Analysis

  • max time kernel
    147s
  • max time network
    152s
  • platform
    windows10_x64
  • resource
    win10-en-20211014
  • submitted
    07/12/2021, 14:07

General

  • Target

    SHIPMENTDOCUMENTS PDF.js

  • Size

    531KB

  • MD5

    cf4ec0d22c787775c9f46dd0fe19da33

  • SHA1

    f0379f9363c0c9955d9b71064a2879fd6b1cff5c

  • SHA256

    c399dbe473150a5d2a9d3676d81971de66f2daf5360d2be26e62b5533c4fcbad

  • SHA512

    7248e804832f6eb2fb13e73af73a41a695fa131d239ce2b5aa3495858bd387053569e1d1a0e530a1e4f1a949a7c87e0995ad9443b9e2ec49d9a09889e8ccbb1f

Malware Config

Signatures

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

  • Blocklisted process makes network request 18 IoCs
  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Program Files directory 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe "C:\Users\Admin\AppData\Local\Temp\SHIPMENTDOCUMENTS PDF.js"
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2644
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\IwhBHZSsWd.js"
      2⤵
      • Blocklisted process makes network request
      • Drops startup file
      • Adds Run key to start application
      PID:3504
    • C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
      "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\ftyuljcq.txt"
      2⤵
      • Drops file in Program Files directory
      PID:3664

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/3664-128-0x0000000003040000-0x0000000003050000-memory.dmp

          Filesize

          64KB

        • memory/3664-131-0x00000000030C0000-0x00000000030D0000-memory.dmp

          Filesize

          64KB

        • memory/3664-120-0x0000000002DB0000-0x0000000003020000-memory.dmp

          Filesize

          2.4MB

        • memory/3664-121-0x0000000000D00000-0x0000000000D01000-memory.dmp

          Filesize

          4KB

        • memory/3664-124-0x0000000003020000-0x0000000003030000-memory.dmp

          Filesize

          64KB

        • memory/3664-125-0x0000000003030000-0x0000000003040000-memory.dmp

          Filesize

          64KB

        • memory/3664-126-0x0000000000D00000-0x0000000000D01000-memory.dmp

          Filesize

          4KB

        • memory/3664-129-0x0000000003050000-0x0000000003060000-memory.dmp

          Filesize

          64KB

        • memory/3664-119-0x0000000002DB0000-0x0000000003020000-memory.dmp

          Filesize

          2.4MB

        • memory/3664-130-0x0000000003060000-0x0000000003070000-memory.dmp

          Filesize

          64KB

        • memory/3664-133-0x00000000030D0000-0x00000000030E0000-memory.dmp

          Filesize

          64KB

        • memory/3664-134-0x00000000030E0000-0x00000000030F0000-memory.dmp

          Filesize

          64KB

        • memory/3664-135-0x0000000003070000-0x0000000003080000-memory.dmp

          Filesize

          64KB

        • memory/3664-136-0x0000000003080000-0x0000000003090000-memory.dmp

          Filesize

          64KB

        • memory/3664-137-0x0000000003090000-0x00000000030A0000-memory.dmp

          Filesize

          64KB

        • memory/3664-138-0x00000000030A0000-0x00000000030B0000-memory.dmp

          Filesize

          64KB

        • memory/3664-139-0x00000000030B0000-0x00000000030C0000-memory.dmp

          Filesize

          64KB

        • memory/3664-140-0x00000000030F0000-0x0000000003100000-memory.dmp

          Filesize

          64KB