vjw0rm | 655334e78aaaedd288a25a2820e93dc43ca0c770848c74e3bab9ff7da2ca0de1

Analysis

max time kernel
146s
max time network
146s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23-12-2024 23:03

Target

7165342_Payment_Receipt.js
Size

81KB
MD5

63920a31085c5e1f40f50b7df48b54f8
SHA1

92955db054abbdd957121479784a552ffd03d857
SHA256

76fc2fbb5f59ddd971dcdb93f11cefb22fc954305b5c99e36f5d42381cb33168
SHA512

6f687653cc20a5d4a4c716f1f2ba9f7bf1a2687e19a972a6537efdf0eee695185c34bcb9f3f32dc3c4f22fb964076dd0de46f2e961aee14c8591b174ddf637fd
SSDEEP

192:/jTKDrSsWruBc3N19eLi1ow9yQ9y9JkLE6+61Wsz+fr+5inP7TvsC+U6OEsO+ghu:rTvPvvmVVR/4K/KtI

Score

10^/10

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm
Vjw0rm family
vjw0rm

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7165342_Payment_Receipt.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7165342_Payment_Receipt.js	wscript.exe

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\CTMJWPB2UR = "'C:\\Users\\Admin\\AppData\\Local\\Temp\\7165342_Payment_Receipt.js'"	wscript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
2640	schtasks.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2640	2256	wscript.exe	32
PID 2256 wrote to memory of 2640	2256	wscript.exe	32
PID 2256 wrote to memory of 2640	2256	wscript.exe	32

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\7165342_Payment_Receipt.js
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr 'C:\Users\Admin\AppData\Local\Temp\7165342_Payment_Receipt.js
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2640