Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    11/10/2022, 10:06

General

  • Target

    Payment Swift-MT103101122.js

  • Size

    15KB

  • MD5

    1d7e2346c393a498d60d3a43095d3b8e

  • SHA1

    729fe8f9886c020c6a1d61fcf68a6acd02c43515

  • SHA256

    22125214857ca13a8cb91e5c920d2018db792d57356537234487ad47e66ae0e0

  • SHA512

    74f6434c8cc87403504c7d42b5d6811f46a817416e4ce285ad50d2fb842d91636ca68e74d6cff2b23b98578e8016260d47f8d4ec5c8471b23907a7cc4b276d3e

  • SSDEEP

    384:12zXBxnmXyv1X1QuJRVKJbyfMZU8Hyi939s3:16RAyXZRVfMse9s3

Score
10/10

Malware Config

Extracted

Family

vjw0rm

C2

http://185.216.71.62:52054

Signatures

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

  • Blocklisted process makes network request 6 IoCs
  • Drops startup file 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe "C:\Users\Admin\AppData\Local\Temp\Payment Swift-MT103101122.js"
    1⤵
    • Blocklisted process makes network request
    • Suspicious use of WriteProcessMemory
    PID:1324
    • C:\Windows\System32\wscript.exe
      "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\FeyQENosfv.js"
      2⤵
      • Blocklisted process makes network request
      • Drops startup file
      PID:668

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\FeyQENosfv.js

    Filesize

    5KB

    MD5

    f008c6822efc36d36773c28c6648531a

    SHA1

    e2346b75ee7d0ab6106a519f652d1b55f3fd2a28

    SHA256

    2f5f6b4f2a873a414a1541572c41ff23339fd055b46e0edffcf4adf42985ec7e

    SHA512

    cd4464839b668ce3218d803f6b10c5b932b964d951d29689979c673d7e002c727f239600e6f7dc62f6d291f7612531df802660bc23ac415926f3eecefdc5fa80

  • memory/1324-54-0x000007FEFC001000-0x000007FEFC003000-memory.dmp

    Filesize

    8KB