Analysis

  • max time kernel
    1795s
  • max time network
    1807s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    08/12/2021, 15:49

General

  • Target

    SHIPMENT_DOCUMENTS PDF.js

  • Size

    531KB

  • MD5

    cf4ec0d22c787775c9f46dd0fe19da33

  • SHA1

    f0379f9363c0c9955d9b71064a2879fd6b1cff5c

  • SHA256

    c399dbe473150a5d2a9d3676d81971de66f2daf5360d2be26e62b5533c4fcbad

  • SHA512

    7248e804832f6eb2fb13e73af73a41a695fa131d239ce2b5aa3495858bd387053569e1d1a0e530a1e4f1a949a7c87e0995ad9443b9e2ec49d9a09889e8ccbb1f

Malware Config

Signatures

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

  • Blocklisted process makes network request 64 IoCs
  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Program Files directory 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe "C:\Users\Admin\AppData\Local\Temp\SHIPMENT_DOCUMENTS PDF.js"
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2724
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\IwhBHZSsWd.js"
      2⤵
      • Blocklisted process makes network request
      • Drops startup file
      • Adds Run key to start application
      PID:3424
    • C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
      "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\pysvfcjcxz.txt"
      2⤵
      • Drops file in Program Files directory
      PID:952

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/952-143-0x00000000029A0000-0x00000000029B0000-memory.dmp

          Filesize

          64KB

        • memory/952-151-0x00000000029C0000-0x00000000029D0000-memory.dmp

          Filesize

          64KB

        • memory/952-122-0x00000000026B0000-0x0000000002920000-memory.dmp

          Filesize

          2.4MB

        • memory/952-123-0x00000000026B0000-0x0000000002920000-memory.dmp

          Filesize

          2.4MB

        • memory/952-124-0x00000000006D0000-0x00000000006D1000-memory.dmp

          Filesize

          4KB

        • memory/952-129-0x0000000002920000-0x0000000002930000-memory.dmp

          Filesize

          64KB

        • memory/952-128-0x0000000002930000-0x0000000002940000-memory.dmp

          Filesize

          64KB

        • memory/952-130-0x0000000002940000-0x0000000002950000-memory.dmp

          Filesize

          64KB

        • memory/952-132-0x00000000006D0000-0x00000000006D1000-memory.dmp

          Filesize

          4KB

        • memory/952-135-0x0000000002950000-0x0000000002960000-memory.dmp

          Filesize

          64KB

        • memory/952-137-0x0000000002960000-0x0000000002970000-memory.dmp

          Filesize

          64KB

        • memory/952-139-0x0000000002970000-0x0000000002980000-memory.dmp

          Filesize

          64KB

        • memory/952-140-0x0000000002980000-0x0000000002990000-memory.dmp

          Filesize

          64KB

        • memory/952-142-0x0000000002990000-0x00000000029A0000-memory.dmp

          Filesize

          64KB

        • memory/952-258-0x0000000002A90000-0x0000000002AA0000-memory.dmp

          Filesize

          64KB

        • memory/952-153-0x00000000029E0000-0x00000000029F0000-memory.dmp

          Filesize

          64KB

        • memory/952-152-0x00000000029D0000-0x00000000029E0000-memory.dmp

          Filesize

          64KB

        • memory/952-149-0x00000000029B0000-0x00000000029C0000-memory.dmp

          Filesize

          64KB

        • memory/952-169-0x00000000029F0000-0x0000000002A00000-memory.dmp

          Filesize

          64KB

        • memory/952-171-0x0000000002A00000-0x0000000002A10000-memory.dmp

          Filesize

          64KB

        • memory/952-173-0x0000000002A10000-0x0000000002A20000-memory.dmp

          Filesize

          64KB

        • memory/952-186-0x00000000006D0000-0x00000000006D1000-memory.dmp

          Filesize

          4KB

        • memory/952-189-0x0000000002A20000-0x0000000002A30000-memory.dmp

          Filesize

          64KB

        • memory/952-207-0x0000000002A30000-0x0000000002A40000-memory.dmp

          Filesize

          64KB

        • memory/952-232-0x0000000002A40000-0x0000000002A50000-memory.dmp

          Filesize

          64KB

        • memory/952-246-0x0000000002A50000-0x0000000002A60000-memory.dmp

          Filesize

          64KB

        • memory/952-253-0x0000000002A60000-0x0000000002A70000-memory.dmp

          Filesize

          64KB

        • memory/952-254-0x0000000002A70000-0x0000000002A80000-memory.dmp

          Filesize

          64KB

        • memory/952-255-0x0000000002A80000-0x0000000002A90000-memory.dmp

          Filesize

          64KB