vjw0rm | d7613ec37e645975b8269da83418168d8721b00a8b90bf7c15db6095ef25e1dd | Triage

Sharing

General

Target

JaffaCakes118_d7613ec37e645975b8269da83418168d8721b00a8b90bf7c15db6095ef25e1dd
Size

72KB
Sample

241226-tdfe9azlgq
MD5

a888145096f76ce437ab1028a7b9f7ae
SHA1

79349c085866ca9d813d248a429af1362464f547
SHA256

d7613ec37e645975b8269da83418168d8721b00a8b90bf7c15db6095ef25e1dd
SHA512

88f1d153e18a9d7eb3d06566d671d30bcc9e5d5fbba87d765c81e7c7d01420690f39b8c5e7d1f7d6474f5bd3fa55053930ec88a573fdceccdfb4123a347d94c5
SSDEEP

384:aMqNDii6FVg4NEnbt7a3F2/EzswH/JIeXyT:aMqoi6FAaI/GxHhDyT

Score

10^/10

vjw0rm execution persistence trojan worm

Malware Config

Targets

- Target
  
  JaffaCakes118_d7613ec37e645975b8269da83418168d8721b00a8b90bf7c15db6095ef25e1dd
- Size
  
  72KB
- MD5
  
  a888145096f76ce437ab1028a7b9f7ae
- SHA1
  
  79349c085866ca9d813d248a429af1362464f547
- SHA256
  
  d7613ec37e645975b8269da83418168d8721b00a8b90bf7c15db6095ef25e1dd
- SHA512
  
  88f1d153e18a9d7eb3d06566d671d30bcc9e5d5fbba87d765c81e7c7d01420690f39b8c5e7d1f7d6474f5bd3fa55053930ec88a573fdceccdfb4123a347d94c5
- SSDEEP
  
  384:aMqNDii6FVg4NEnbt7a3F2/EzswH/JIeXyT:aMqoi6FAaI/GxHhDyT
Score

3^/10
behavioral1 behavioral2
- Target
  
  HOO8M_Invoice_Copy.js
- Size
  
  11KB
- MD5
  
  4bbeabc7d902f9f654cfe9c4f51d155d
- SHA1
  
  04b90a68e3911bc4edcf355c1db4567ae173c601
- SHA256
  
  e3f46470aa9ef52628f741e07db33a6af854693ae2a761d397bf87fbfbe687c9
- SHA512
  
  ecebe6eeb0848600cc8d4ac6b612ad4f02e5bce7d3f35ed14936508aa987c449a8e8029752bfa0b46ed68661836b99692abedce4175d3a7085aa22e0cb9882e5
- SSDEEP
  
  192:GDiOn6F9bg4NuHmcVP0sntG4a3FRUciE8IswHT9xfD8+pLhZx53fAeT7yTK:GDii6FVg4NEnbt7a3F2/EzswH/JIeXyO
Score

10^/10

vjw0rm execution persistence trojan worm
- Vjw0rm
  Vjw0rm is a remote access trojan written in JavaScript.
  trojan worm vjw0rm
- Vjw0rm family
  vjw0rm
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Adds Run key to start application
  persistence
behavioral3 behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Scheduled Task/Job

Scheduled Task

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Scheduled Task

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

vjw0rmexecutionpersistencetrojanworm

behavioral4

vjw0rmexecutionpersistencetrojanworm