Overview

overview

10

Static

static

pendiente ...22.jar

windows7_x64

10

pendiente ...22.jar

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    pendiente factura 2022.jar

  • Size

    642KB

  • Sample

    220617-pkf8xabhgj

  • MD5

    8653da73c76f1278d597ef1cb0629ec8

  • SHA1

    99c880ec39db27f12394aad675be3e89503ad53c

  • SHA256

    140b8618c7ebfb3c74f6c96ae80bb18f7ad11e3a6af5160195413165bf445346

  • SHA512

    c6e39922fc54516dc5e34ca00cf283dcceccad8198aabf07dae6ba60e1a089ac8c3f3a7d727a32dc90f32df2cec512fd01cf7b9cd687967ab24c934394d8e2f4

Score
10/10
adwindvjw0rmevasionpersistencetrojanworm

Malware Config

Targets

    • Target

      pendiente factura 2022.jar

    • Size

      642KB

    • MD5

      8653da73c76f1278d597ef1cb0629ec8

    • SHA1

      99c880ec39db27f12394aad675be3e89503ad53c

    • SHA256

      140b8618c7ebfb3c74f6c96ae80bb18f7ad11e3a6af5160195413165bf445346

    • SHA512

      c6e39922fc54516dc5e34ca00cf283dcceccad8198aabf07dae6ba60e1a089ac8c3f3a7d727a32dc90f32df2cec512fd01cf7b9cd687967ab24c934394d8e2f4

    Score
    10/10
    vjw0rmpersistencetrojanwormadwindevasion

    • AdWind

      A Java-based RAT family operated as malware-as-a-service.

      trojanadwind

    • UAC bypass

      evasiontrojan

    • Vjw0rm

      Vjw0rm is a remote access trojan written in JavaScript.

      trojanwormvjw0rm

    • Blocklisted process makes network request

    • Disables Task Manager via registry modification

      evasion

    • Disables use of System Restore points

      evasion

    • Executes dropped EXE

    • Sets file execution options in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks