Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    21/01/2022, 14:24

General

  • Target

    Order confirmation.jar

  • Size

    187KB

  • MD5

    9b888e0d179f1079bab199bf682c69d2

  • SHA1

    55632e020598c5511d3c361fe2e3c483af39b0ba

  • SHA256

    febb815216146ce5b082e909f7ee36a07f2692201b36671fa0f3c73eb7cd407d

  • SHA512

    684ef507db352bde9942501ef9f8fdb72be541724d10bda4c7f9b6a4c28eace345cd9078e7b27bf09d06c7babd786d04a275fc96b3f54e4d98f70e8f9a1ffbd8

Malware Config

Signatures

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

  • Blocklisted process makes network request 17 IoCs
  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Program Files directory 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\ProgramData\Oracle\Java\javapath\java.exe
    java -jar "C:\Users\Admin\AppData\Local\Temp\Order confirmation.jar"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2480
    • C:\Windows\SYSTEM32\wscript.exe
      wscript C:\Users\Admin\_output.js
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:3852
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\YSCicdEDwo.js"
        3⤵
        • Blocklisted process makes network request
        • Drops startup file
        • Adds Run key to start application
        PID:1072
      • C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
        "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\qzlxoxjgy.txt"
        3⤵
        • Drops file in Program Files directory
        PID:368

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/368-256-0x0000000000EA0000-0x0000000000EA1000-memory.dmp

          Filesize

          4KB

        • memory/368-258-0x0000000002E10000-0x0000000011F10000-memory.dmp

          Filesize

          241.0MB

        • memory/368-266-0x0000000000EA0000-0x0000000000EA1000-memory.dmp

          Filesize

          4KB

        • memory/368-267-0x0000000002E10000-0x0000000011F10000-memory.dmp

          Filesize

          241.0MB

        • memory/2480-116-0x00000000029A0000-0x0000000011AA0000-memory.dmp

          Filesize

          241.0MB

        • memory/2480-117-0x0000000000C40000-0x0000000000C41000-memory.dmp

          Filesize

          4KB