Analysis

  • max time kernel
    148s
  • max time network
    156s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    02-09-2021 03:22

General

  • Target

    2.js

  • Size

    225KB

  • MD5

    7db6d9cd3eb60b8e7296921e4d8d959e

  • SHA1

    b2bbea5b2f903c83758d2bb31399addcab9a32ad

  • SHA256

    05c63cde94e8cf070a1d5fe7e1d14cf4e8f37da01274224dcbe67a136a4f8d77

  • SHA512

    c42bf22429f2f84cede85e6bdf93ac15a7cd6498086df302b8559575b2aa95bc88ad1da8e73096bd3f10549c5fc8f75c5bdd25b2d08862a1b3a144130e4fb44f

Malware Config

Signatures

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

  • Blocklisted process makes network request 17 IoCs
  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\2.js
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:808
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\HjFFOyQEiR.js"
      2⤵
      • Blocklisted process makes network request
      • Drops startup file
      • Adds Run key to start application
      PID:2272
    • C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
      "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\abadfcqfdn.txt"
      2⤵
        PID:3612
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -u -p 3612 -s 352
          3⤵
          • Program crash
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1896

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Defense Evasion

    Modify Registry

    1
    T1112

    Discovery

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\HjFFOyQEiR.js
      MD5

      25308d3faf2814d521f745a11eddb128

      SHA1

      c43b46b320a9712d7d2122c0815b4c89197658ad

      SHA256

      e07beb274f63e2a973e5dd8ba08c7898cfd04a878ed9e582783541ae95c863e5

      SHA512

      4a8cb10e2c453b168f83e5044d893231c245bbb76a9470bed8817d41daabd6c3fb7be8ae704b58850ac1c3e423668579db0faeac4d79ff1473e0adf2c04c7ae4

    • C:\Users\Admin\AppData\Roaming\abadfcqfdn.txt
      MD5

      d30db43fa4de3d1c86d88199fd218672

      SHA1

      f87e903271b69f5dc3dc5b1da84dca781a838247

      SHA256

      e3c140f5c4fa10ef365115cfa71f73b3a503313cf94068365472bb431e91e7e1

      SHA512

      ba7a5fb9a375a5e1edaf9821d3de2d466a2649cfc4a690170c0c295b7b98fdad9577427a45f6938a7c4ecd827e7554e70175a36f4dfbeb2f7d25f8d22de707ca

    • memory/2272-114-0x0000000000000000-mapping.dmp
    • memory/3612-116-0x0000000000000000-mapping.dmp