Analysis Overview
SHA256
5dfaea003a9b484fad723fc13f79303169e4c8f2f414a4ee0ef187f7ebd0aac9
Threat Level: Known bad
The file TRANSFERENCIA $112987.17.js was found to be: Known bad.
Malicious Activity Summary
Vjw0rm
Blocklisted process makes network request
Drops startup file
Checks computer location settings
Enumerates physical storage devices
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2022-08-17 17:31
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2022-08-17 17:31
Reported
2022-08-17 17:36
Platform
win7-20220812-en
Max time kernel
299s
Max time network
304s
Command Line
Signatures
Vjw0rm
Blocklisted process makes network request
Drops startup file
| Description | Indicator | Process | Target |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jQCWVHjWAA.js | C:\Windows\System32\wscript.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jQCWVHjWAA.js | C:\Windows\System32\wscript.exe | N/A |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bZQEUbJxNj.js | C:\Windows\System32\wscript.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bZQEUbJxNj.js | C:\Windows\System32\wscript.exe | N/A |
Enumerates physical storage devices
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1248 wrote to memory of 1976 | N/A | C:\Windows\system32\wscript.exe | C:\Windows\System32\wscript.exe |
| PID 1248 wrote to memory of 1976 | N/A | C:\Windows\system32\wscript.exe | C:\Windows\System32\wscript.exe |
| PID 1248 wrote to memory of 1976 | N/A | C:\Windows\system32\wscript.exe | C:\Windows\System32\wscript.exe |
| PID 1976 wrote to memory of 1624 | N/A | C:\Windows\System32\wscript.exe | C:\Windows\System32\wscript.exe |
| PID 1976 wrote to memory of 1624 | N/A | C:\Windows\System32\wscript.exe | C:\Windows\System32\wscript.exe |
| PID 1976 wrote to memory of 1624 | N/A | C:\Windows\System32\wscript.exe | C:\Windows\System32\wscript.exe |
Processes
C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\TRANSFERENCIA $112987.17.js"
C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\jQCWVHjWAA.js"
C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\bZQEUbJxNj.js"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | kodencherycollege.ac.in | udp |
| SG | 148.66.137.120:443 | kodencherycollege.ac.in | tcp |
| US | 8.8.8.8:53 | macjoe597.duia.ro | udp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| SG | 148.66.137.120:443 | kodencherycollege.ac.in | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| SG | 148.66.137.120:443 | kodencherycollege.ac.in | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
Files
memory/1976-54-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Roaming\jQCWVHjWAA.js
| MD5 | 1f7855c87513cf8d9f4b5319445865cf |
| SHA1 | a73d48e0da18067c2e943da97c45acb679e18139 |
| SHA256 | b386904566434edecd5319ebe730f8c5ecd05d8003eaf8b695cc771aa17c2579 |
| SHA512 | 41eb3f05e08fa6b878b1a8ffa90cba44756be53ea09d00c63425ba176f1bef31dc677caea99acfb2e6298403efaae1af4e71ea5a7fe29158a9c0510bfee022a9 |
memory/1624-56-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Roaming\bZQEUbJxNj.js
| MD5 | a542a21ecaba36f6ba8c6457b8ab67f9 |
| SHA1 | 3f05ddc6d6e59554cd9870b9e4b17919b81eaa6c |
| SHA256 | bc831f27e6da7b5e82be628a1564c8b6aee02ec9290c5d21f99733dd2d1db47b |
| SHA512 | 78ca13a83bbd029470978b1e465ee6b0c2a9345a1fe8ee3e86d9f1d48bd52b7927a16e607f71084a91706213d8ddc0293ed06a1927e478b9bbc21ab0b47b9a2a |
memory/1624-58-0x000007FEFBCC1000-0x000007FEFBCC3000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2022-08-17 17:31
Reported
2022-08-17 17:36
Platform
win10v2004-20220812-en
Max time kernel
294s
Max time network
300s
Command Line
Signatures
Vjw0rm
Blocklisted process makes network request
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation | C:\Windows\system32\wscript.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation | C:\Windows\System32\wscript.exe | N/A |
Drops startup file
| Description | Indicator | Process | Target |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bZQEUbJxNj.js | C:\Windows\System32\wscript.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bZQEUbJxNj.js | C:\Windows\System32\wscript.exe | N/A |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jQCWVHjWAA.js | C:\Windows\System32\wscript.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jQCWVHjWAA.js | C:\Windows\System32\wscript.exe | N/A |
Enumerates physical storage devices
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2172 wrote to memory of 4944 | N/A | C:\Windows\system32\wscript.exe | C:\Windows\System32\wscript.exe |
| PID 2172 wrote to memory of 4944 | N/A | C:\Windows\system32\wscript.exe | C:\Windows\System32\wscript.exe |
| PID 4944 wrote to memory of 4844 | N/A | C:\Windows\System32\wscript.exe | C:\Windows\System32\wscript.exe |
| PID 4944 wrote to memory of 4844 | N/A | C:\Windows\System32\wscript.exe | C:\Windows\System32\wscript.exe |
Processes
C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\TRANSFERENCIA $112987.17.js"
C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\jQCWVHjWAA.js"
C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\bZQEUbJxNj.js"
Network
| Country | Destination | Domain | Proto |
| NL | 95.101.78.82:80 | tcp | |
| US | 8.8.8.8:53 | kodencherycollege.ac.in | udp |
| SG | 148.66.137.120:443 | kodencherycollege.ac.in | tcp |
| US | 8.8.8.8:53 | macjoe597.duia.ro | udp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| US | 20.189.173.13:443 | tcp | |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| US | 8.8.8.8:53 | 226.101.242.52.in-addr.arpa | udp |
| NL | 104.80.225.205:443 | tcp | |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| NL | 95.101.78.82:80 | tcp | |
| NL | 95.101.78.82:80 | tcp | |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| US | 209.197.3.8:80 | tcp | |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
Files
memory/4944-132-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Roaming\jQCWVHjWAA.js
| MD5 | 1f7855c87513cf8d9f4b5319445865cf |
| SHA1 | a73d48e0da18067c2e943da97c45acb679e18139 |
| SHA256 | b386904566434edecd5319ebe730f8c5ecd05d8003eaf8b695cc771aa17c2579 |
| SHA512 | 41eb3f05e08fa6b878b1a8ffa90cba44756be53ea09d00c63425ba176f1bef31dc677caea99acfb2e6298403efaae1af4e71ea5a7fe29158a9c0510bfee022a9 |
memory/4844-134-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Roaming\bZQEUbJxNj.js
| MD5 | a542a21ecaba36f6ba8c6457b8ab67f9 |
| SHA1 | 3f05ddc6d6e59554cd9870b9e4b17919b81eaa6c |
| SHA256 | bc831f27e6da7b5e82be628a1564c8b6aee02ec9290c5d21f99733dd2d1db47b |
| SHA512 | 78ca13a83bbd029470978b1e465ee6b0c2a9345a1fe8ee3e86d9f1d48bd52b7927a16e607f71084a91706213d8ddc0293ed06a1927e478b9bbc21ab0b47b9a2a |