vjw0rm | 71143e6f93736b237f7143f38ceaf4e940fa24e563eb0f6cc0d1d0a8e50d4ddd | Triage

Sharing

General

Target

JaffaCakes118_71143e6f93736b237f7143f38ceaf4e940fa24e563eb0f6cc0d1d0a8e50d4ddd
Size

72KB
Sample

241224-s6pc7a1mdm
MD5

c8f14e2c62a48afa5b8341eccde9fa9f
SHA1

7df4bb276599beeb6b9d203be5341859daf7ef86
SHA256

71143e6f93736b237f7143f38ceaf4e940fa24e563eb0f6cc0d1d0a8e50d4ddd
SHA512

2b191ca984eb24dc5c531461e547640c682b2b416a917cf3d7f0d5a976d6e868e20ea5fdbd023e07693a766e7ccce5562fa127a359ebac591ad367814110baf8
SSDEEP

384:txItdlAq0aDWNGSy0w0Sk9AigFLKKPuvza:txIDlmjRy0weUV

Score

10^/10

vjw0rm execution persistence trojan worm

Malware Config

Targets

- Target
  
  JaffaCakes118_71143e6f93736b237f7143f38ceaf4e940fa24e563eb0f6cc0d1d0a8e50d4ddd
- Size
  
  72KB
- MD5
  
  c8f14e2c62a48afa5b8341eccde9fa9f
- SHA1
  
  7df4bb276599beeb6b9d203be5341859daf7ef86
- SHA256
  
  71143e6f93736b237f7143f38ceaf4e940fa24e563eb0f6cc0d1d0a8e50d4ddd
- SHA512
  
  2b191ca984eb24dc5c531461e547640c682b2b416a917cf3d7f0d5a976d6e868e20ea5fdbd023e07693a766e7ccce5562fa127a359ebac591ad367814110baf8
- SSDEEP
  
  384:txItdlAq0aDWNGSy0w0Sk9AigFLKKPuvza:txIDlmjRy0weUV
Score

3^/10
behavioral1 behavioral2
- Target
  
  V00JM_Invoice_Copy.js
- Size
  
  11KB
- MD5
  
  e39be287d5161038ddeaa6ebbca80151
- SHA1
  
  0ab208083961f5054b4042eb86eb1d195701d89d
- SHA256
  
  b91e92bc3dd5d7eddb8c10f8aee1429f262b4cd033e4d1847c7eaf180a0120eb
- SHA512
  
  f524bc2967f94cf6a56e6461e2b5daf4ceef86dc5bf53b15e0c199626c447a4009d632153bc391e54698960f30645866d62865c0f91d7a3be7cd363d844ff8a0
- SSDEEP
  
  192:fYmQfHbdlbNiTGh0a3VhWNGKXy0w1G75fERC5DfBABEgFLYogETfciuD9JKSzTe3:YdlAq0aDWNGSy0w0Sk9AigFLKKPuvza3
Score

10^/10

vjw0rm execution persistence trojan worm
- Vjw0rm
  Vjw0rm is a remote access trojan written in JavaScript.
  trojan worm vjw0rm
- Vjw0rm family
  vjw0rm
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Adds Run key to start application
  persistence
behavioral3 behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Scheduled Task/Job

Scheduled Task

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Scheduled Task

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

vjw0rmexecutionpersistencetrojanworm

behavioral4

vjw0rmexecutionpersistencetrojanworm