Analysis

  • max time kernel
    41s
  • max time network
    76s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    27-06-2022 08:10

General

  • Target

    RFQ-20222606.js

  • Size

    904KB

  • MD5

    2e374bbdfd996ff9b0a22647f2a06726

  • SHA1

    9d8410f23744dbc340a4a412686634c2fb6e496b

  • SHA256

    7eea26c62d8b952f70d4a84aaec4c33b8a4d44aee6ae2480ad389865e7e033aa

  • SHA512

    aa37b6a665303c68730ff981f06fda696341f3b4eeb59846e3b33609f9196eeca10574ed0217faea7d27f647e8b982775ed9c2956e48a788fa1f6ef160fb178b

Malware Config

Signatures

  • AdWind

    A Java-based RAT family operated as malware-as-a-service.

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

  • Blocklisted process makes network request 3 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\RFQ-20222606.js
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3868
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\oRQQPreZxd.js"
      2⤵
      • Blocklisted process makes network request
      • Drops startup file
      • Adds Run key to start application
      PID:3784
    • C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
      "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\qqdnjcy.txt"
      2⤵
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4772
      • C:\Program Files\Java\jre1.8.0_66\bin\java.exe
        "C:\Program Files\Java\jre1.8.0_66\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\_0.64529390757446917446356467187093415.class
        3⤵
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1744
        • C:\Windows\SYSTEM32\cmd.exe
          cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive6725757014680576802.vbs
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2176
          • C:\Windows\system32\cscript.exe
            cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive6725757014680576802.vbs
            5⤵
              PID:3540
          • C:\Windows\SYSTEM32\cmd.exe
            cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive2887554250066647638.vbs
            4⤵
              PID:4892
              • C:\Windows\system32\cscript.exe
                cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive2887554250066647638.vbs
                5⤵
                  PID:3380
            • C:\Windows\SYSTEM32\cmd.exe
              cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive1496218592790102588.vbs
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:3080
              • C:\Windows\system32\cscript.exe
                cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive1496218592790102588.vbs
                4⤵
                  PID:3492
              • C:\Windows\SYSTEM32\cmd.exe
                cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive7012841106692668034.vbs
                3⤵
                  PID:4240
                  • C:\Windows\system32\cscript.exe
                    cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive7012841106692668034.vbs
                    4⤵
                      PID:4496

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp

                Filesize

                50B

                MD5

                9573a78ff80a931d33c89524caf216f5

                SHA1

                ee7fd94ac5805330f3c30cbefde7472a236d1878

                SHA256

                d3f7b7ff123746d757e7d627801dac6f923133b9600eaf82bf200de827f941b7

                SHA512

                823e6ddf7cec0fa862ef19c224d164209f78526710dfb20ee03079076b3302c20a1da301f6b3d2032c2d8db970e15980e14c17fe505fe37e41044098bb6aecfe

              • C:\Users\Admin\AppData\Local\Temp\Retrive1496218592790102588.vbs

                Filesize

                276B

                MD5

                3bdfd33017806b85949b6faa7d4b98e4

                SHA1

                f92844fee69ef98db6e68931adfaa9a0a0f8ce66

                SHA256

                9da575dd2d5b7c1e9bab8b51a16cde457b3371c6dcdb0537356cf1497fa868f6

                SHA512

                ae5e5686ae71edef53e71cd842cb6799e4383b9c238a5c361b81647efa128d2fedf3bf464997771b5b0c47a058fecae7829aeedcd098c80a11008581e5781429

              • C:\Users\Admin\AppData\Local\Temp\Retrive6725757014680576802.vbs

                Filesize

                276B

                MD5

                3bdfd33017806b85949b6faa7d4b98e4

                SHA1

                f92844fee69ef98db6e68931adfaa9a0a0f8ce66

                SHA256

                9da575dd2d5b7c1e9bab8b51a16cde457b3371c6dcdb0537356cf1497fa868f6

                SHA512

                ae5e5686ae71edef53e71cd842cb6799e4383b9c238a5c361b81647efa128d2fedf3bf464997771b5b0c47a058fecae7829aeedcd098c80a11008581e5781429

              • C:\Users\Admin\AppData\Local\Temp\_0.64529390757446917446356467187093415.class

                Filesize

                241KB

                MD5

                781fb531354d6f291f1ccab48da6d39f

                SHA1

                9ce4518ebcb5be6d1f0b5477fa00c26860fe9a68

                SHA256

                97d585b6aff62fb4e43e7e6a5f816dcd7a14be11a88b109a9ba9e8cd4c456eb9

                SHA512

                3e6630f5feb4a3eb1dac7e9125ce14b1a2a45d7415cf44cea42bc51b2a9aa37169ee4a4c36c888c8f2696e7d6e298e2ad7b2f4c22868aaa5948210eb7db220d8

              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1081944012-3634099177-1681222835-1000\83aa4cc77f591dfc2374580bbd95f6ba_20e30e2f-4677-4eb9-89e6-7dd1fd044635

                Filesize

                45B

                MD5

                c8366ae350e7019aefc9d1e6e6a498c6

                SHA1

                5731d8a3e6568a5f2dfbbc87e3db9637df280b61

                SHA256

                11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238

                SHA512

                33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd

              • C:\Users\Admin\AppData\Roaming\oRQQPreZxd.js

                Filesize

                5KB

                MD5

                ee7c86331e927c3bb54cc0ec2cb2e254

                SHA1

                c2fb27bd598702b19cd48e25df42f8027b55c511

                SHA256

                f476e352ca10a3062a409c491e0d6cb79cf09579ebc561de66d2172358201c17

                SHA512

                f05135c606464b1a79fbf7a053112dd609417c94c0c66c31c98d177fc67068fe6f382e203f24a329d5915ee84d288a368e23c1914dee3c2f48107643a88534a4

              • C:\Users\Admin\AppData\Roaming\qqdnjcy.txt

                Filesize

                479KB

                MD5

                e6e49d6575a99dc7eaf81091e02190b6

                SHA1

                d7abf421d1a9d080d89b2922003a0d869d64ac2c

                SHA256

                3df792e3ab0c1efd66231647b0369e5805d359403d5b534a2562a7ba301b0757

                SHA512

                98743a430ab0490aed350a800d057dbaf7b29d2ce9833ca7cefc3e52a18dc5918c315918f64b193ca6d42f0250f7d93f001606689852de3f56182de42e0a7d3f

              • memory/1744-168-0x0000000002710000-0x0000000003710000-memory.dmp

                Filesize

                16.0MB

              • memory/1744-177-0x0000000002710000-0x0000000003710000-memory.dmp

                Filesize

                16.0MB

              • memory/1744-156-0x0000000002710000-0x0000000003710000-memory.dmp

                Filesize

                16.0MB

              • memory/4772-165-0x0000000002A90000-0x0000000003A90000-memory.dmp

                Filesize

                16.0MB

              • memory/4772-136-0x0000000002A90000-0x0000000003A90000-memory.dmp

                Filesize

                16.0MB

              • memory/4772-170-0x0000000002A90000-0x0000000003A90000-memory.dmp

                Filesize

                16.0MB