Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    08/12/2021, 16:07

General

  • Target

    js-decoded-1.js

  • Size

    346KB

  • MD5

    241d3041e2bb264cf886eff9fc3de24e

  • SHA1

    7f3fe68b0ef727fca62441cff8eea28c5cd51941

  • SHA256

    e817bd6a89f5bc3ee448e3c39e5c4739cf010bb815d087ecdd1b5e1f30c04959

  • SHA512

    078b8f61b2afeefdf283d6e8f6b33986fc3500788b8d77e7672fc6aae70221ac140d850f91401a3e65a8996f49b4c9babdabac7071d7ea40adc84c62e9bbddc0

Malware Config

Signatures

  • STRRAT

    STRRAT is a remote access tool than can steal credentials and log keystrokes.

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

  • Blocklisted process makes network request 13 IoCs
  • Drops startup file 3 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\js-decoded-1.js
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1520
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\IwhBHZSsWd.js"
      2⤵
      • Blocklisted process makes network request
      • Drops startup file
      • Adds Run key to start application
      PID:428
    • C:\Program Files\Java\jre7\bin\javaw.exe
      "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\tullyas.txt"
      2⤵
        PID:1404
        • C:\Program Files\Java\jre7\bin\java.exe
          "C:\Program Files\Java\jre7\bin\java.exe" -jar "C:\Users\Admin\tullyas.txt"
          3⤵
          • Drops startup file
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:1616
          • C:\Program Files\Java\jre7\bin\java.exe
            "C:\Program Files\Java\jre7\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\tullyas.txt"
            4⤵
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:572
            • C:\Windows\system32\cmd.exe
              cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list"
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:588
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list
                6⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:1192
            • C:\Windows\system32\cmd.exe
              cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list"
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:952
            • C:\Windows\system32\cmd.exe
              cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list"
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:1588
            • C:\Windows\system32\cmd.exe
              cmd.exe /c "wmic /node:localhost /namespace:'\\root\securitycenter' path antivirusproduct get displayname /format:list"
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:1708
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic /node:localhost /namespace:'\\root\securitycenter' path antivirusproduct get displayname /format:list
                6⤵
                  PID:1136
            • C:\Windows\system32\cmd.exe
              cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\tullyas.txt"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:1720
              • C:\Windows\system32\schtasks.exe
                schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\tullyas.txt"
                5⤵
                • Creates scheduled task(s)
                PID:1916
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1684
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list
        1⤵
          PID:576

        Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • memory/572-174-0x0000000002250000-0x00000000024C0000-memory.dmp

                Filesize

                2.4MB

              • memory/1404-61-0x00000000021D0000-0x0000000002440000-memory.dmp

                Filesize

                2.4MB

              • memory/1404-68-0x0000000000210000-0x0000000000211000-memory.dmp

                Filesize

                4KB

              • memory/1404-62-0x00000000021D0000-0x0000000002440000-memory.dmp

                Filesize

                2.4MB

              • memory/1404-83-0x0000000000210000-0x0000000000211000-memory.dmp

                Filesize

                4KB

              • memory/1404-64-0x0000000000210000-0x0000000000211000-memory.dmp

                Filesize

                4KB

              • memory/1404-63-0x0000000000210000-0x0000000000211000-memory.dmp

                Filesize

                4KB

              • memory/1520-55-0x000007FEFBC01000-0x000007FEFBC03000-memory.dmp

                Filesize

                8KB

              • memory/1616-153-0x00000000022A0000-0x0000000002510000-memory.dmp

                Filesize

                2.4MB