Analysis

  • max time kernel
    151s
  • max time network
    155s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    08/12/2021, 16:07

General

  • Target

    js-decoded-1.js

  • Size

    346KB

  • MD5

    241d3041e2bb264cf886eff9fc3de24e

  • SHA1

    7f3fe68b0ef727fca62441cff8eea28c5cd51941

  • SHA256

    e817bd6a89f5bc3ee448e3c39e5c4739cf010bb815d087ecdd1b5e1f30c04959

  • SHA512

    078b8f61b2afeefdf283d6e8f6b33986fc3500788b8d77e7672fc6aae70221ac140d850f91401a3e65a8996f49b4c9babdabac7071d7ea40adc84c62e9bbddc0

Malware Config

Signatures

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

  • Blocklisted process makes network request 18 IoCs
  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Program Files directory 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\js-decoded-1.js
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3692
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\IwhBHZSsWd.js"
      2⤵
      • Blocklisted process makes network request
      • Drops startup file
      • Adds Run key to start application
      PID:3080
    • C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
      "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\vhlxhgn.txt"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2072
      • C:\Program Files\Java\jre1.8.0_66\bin\java.exe
        "C:\Program Files\Java\jre1.8.0_66\bin\java.exe" -jar "C:\Users\Admin\vhlxhgn.txt"
        3⤵
        • Drops file in Program Files directory
        PID:64

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/64-159-0x0000000002D30000-0x0000000002D40000-memory.dmp

          Filesize

          64KB

        • memory/64-158-0x0000000000F40000-0x0000000000F41000-memory.dmp

          Filesize

          4KB

        • memory/64-157-0x0000000002AC0000-0x0000000002D30000-memory.dmp

          Filesize

          2.4MB

        • memory/2072-138-0x0000000002A50000-0x0000000002A60000-memory.dmp

          Filesize

          64KB

        • memory/2072-128-0x00000000029B0000-0x00000000029C0000-memory.dmp

          Filesize

          64KB

        • memory/2072-132-0x00000000029F0000-0x0000000002A00000-memory.dmp

          Filesize

          64KB

        • memory/2072-133-0x0000000002A00000-0x0000000002A10000-memory.dmp

          Filesize

          64KB

        • memory/2072-134-0x0000000002A10000-0x0000000002A20000-memory.dmp

          Filesize

          64KB

        • memory/2072-136-0x0000000002A30000-0x0000000002A40000-memory.dmp

          Filesize

          64KB

        • memory/2072-135-0x0000000002A20000-0x0000000002A30000-memory.dmp

          Filesize

          64KB

        • memory/2072-137-0x0000000002A40000-0x0000000002A50000-memory.dmp

          Filesize

          64KB

        • memory/2072-139-0x0000000002A60000-0x0000000002A70000-memory.dmp

          Filesize

          64KB

        • memory/2072-140-0x0000000002A90000-0x0000000002AA0000-memory.dmp

          Filesize

          64KB

        • memory/2072-141-0x0000000002A70000-0x0000000002A80000-memory.dmp

          Filesize

          64KB

        • memory/2072-142-0x0000000002A80000-0x0000000002A90000-memory.dmp

          Filesize

          64KB

        • memory/2072-144-0x0000000002AB0000-0x0000000002AC0000-memory.dmp

          Filesize

          64KB

        • memory/2072-143-0x0000000002AA0000-0x0000000002AB0000-memory.dmp

          Filesize

          64KB

        • memory/2072-145-0x0000000002AC0000-0x0000000002AD0000-memory.dmp

          Filesize

          64KB

        • memory/2072-147-0x0000000002AE0000-0x0000000002AF0000-memory.dmp

          Filesize

          64KB

        • memory/2072-146-0x0000000002AD0000-0x0000000002AE0000-memory.dmp

          Filesize

          64KB

        • memory/2072-148-0x0000000002AF0000-0x0000000002B00000-memory.dmp

          Filesize

          64KB

        • memory/2072-129-0x00000000029C0000-0x00000000029D0000-memory.dmp

          Filesize

          64KB

        • memory/2072-130-0x00000000029D0000-0x00000000029E0000-memory.dmp

          Filesize

          64KB

        • memory/2072-127-0x00000000029A0000-0x00000000029B0000-memory.dmp

          Filesize

          64KB

        • memory/2072-131-0x00000000029E0000-0x00000000029F0000-memory.dmp

          Filesize

          64KB

        • memory/2072-125-0x0000000002980000-0x0000000002990000-memory.dmp

          Filesize

          64KB

        • memory/2072-126-0x0000000002990000-0x00000000029A0000-memory.dmp

          Filesize

          64KB

        • memory/2072-124-0x0000000000A80000-0x0000000000A81000-memory.dmp

          Filesize

          4KB

        • memory/2072-123-0x0000000002710000-0x0000000002980000-memory.dmp

          Filesize

          2.4MB

        • memory/2072-122-0x0000000002710000-0x0000000002980000-memory.dmp

          Filesize

          2.4MB