vjw0rm | 81e404c97700d97eb4ed9274f84071f48ab947f297afac6367234995467c0c1b

Analysis

max time kernel
146s
max time network
147s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25-12-2024 05:42

Target

HB00UN_Copy.js
Size

14KB
MD5

4abaff06af02cab33d67aa79028cd546
SHA1

f3831e4dd7f55fea6f093900a50e11cc311bb3df
SHA256

39a2889a8f27f0c875f04ac82ebefb26247e41f88c5b2824f649748901ae3a6a
SHA512

0f8afa70dc5a7838f6d7359f6cdad354fc1a2e9ec1072e47a39c336712e738ca0c6495598d6fdf00c76378b8cc2ae6068b00ece64d3bcdeec94533f017acc66a
SSDEEP

384:mrdNm05MJQo0UtDsIU0dUgpZENMsfyW2vJuxqgeh:mJNm05orVSY3MynJuEgeh

Score

10^/10

Family

vjw0rm

http://dbmne20.duckdns.org:8832

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm
Vjw0rm family
vjw0rm

Blocklisted process makes network request 20 IoCs

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HB00UN_Copy.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HB00UN_Copy.js	wscript.exe

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\SIQECRKOSC = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\HB00UN_Copy.js\""	wscript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
2304	schtasks.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 2304	2888	wscript.exe	32
PID 2888 wrote to memory of 2304	2888	wscript.exe	32
PID 2888 wrote to memory of 2304	2888	wscript.exe	32

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\HB00UN_Copy.js
1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Local\Temp\HB00UN_Copy.js
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2304