vjw0rm | 2e37d7372a97df9e3955837eeae856489541aab815dffabc00bbc72af6483e9b

Analysis

max time kernel
150s
max time network
148s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
12/10/2022, 13:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9f40a90db5c7da1cc2ced7e23df53ec3.com.exe
Size 1.4MB
Sample221012-ql9saadeh5
SHA256 2e37d7372a97df9e3955837eeae856489541aab815dffabc00bbc72af6483e9b
MD5 6c6d3758452aa4500bd4186d02a54bbd
SHA1 29a36ac35cdd13203b584e4f1176802a8bd999ef
SHA512 f6a1332f36948f2d2f593878a704f8d9de8dcb157c3727bdf21203ddf69512f4498faa1a34a86a2e91d5a4b8fc635fd058636a7b38c1cb2e1841efa44c4a18f2
SSDEEP 24576:0AOcZ2i7sBG5TH4AI8saogP5+OE8YqZWyqTr+Mo5pemHI0Yuyqgm:iQYAIoh+OE8Yq+xo5EmHWqZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

vjw0rm persistence trojan worm

Malware Config

Extracted

Family

vjw0rm

http://129.204.138.203:7974

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm

Blocklisted process makes network request 1 IoCs

flow	pid	Process
3	1332	WScript.exe

Executes dropped EXE 1 IoCs

pid	Process
1372	kkuai.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rfil.js	WScript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rfil.js	WScript.exe

Loads dropped DLL 1 IoCs

pid	Process
1792	WScript.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	kkuai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "0\\4_87\\kkuai.exe 0\\4_87\\fwfinco.apb"	kkuai.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1372 set thread context of 1468	1372	kkuai.exe	41

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 60 IoCs

pid	Process
1372	kkuai.exe
1372	kkuai.exe
1372	kkuai.exe
1372	kkuai.exe
1372	kkuai.exe
1372	kkuai.exe
1372	kkuai.exe
1372	kkuai.exe
1372	kkuai.exe
1372	kkuai.exe
1372	kkuai.exe
1372	kkuai.exe
1372	kkuai.exe
1372	kkuai.exe
1372	kkuai.exe
1372	kkuai.exe
1372	kkuai.exe
1372	kkuai.exe
1372	kkuai.exe
1372	kkuai.exe
1372	kkuai.exe
1372	kkuai.exe
1372	kkuai.exe
1372	kkuai.exe
1372	kkuai.exe
1372	kkuai.exe
1372	kkuai.exe
1372	kkuai.exe
1372	kkuai.exe
1372	kkuai.exe
1372	kkuai.exe
1372	kkuai.exe
1372	kkuai.exe
1372	kkuai.exe
1372	kkuai.exe
1372	kkuai.exe
1372	kkuai.exe
1372	kkuai.exe
1372	kkuai.exe
1372	kkuai.exe
1372	kkuai.exe
1372	kkuai.exe
1372	kkuai.exe
1372	kkuai.exe
1372	kkuai.exe
1372	kkuai.exe
1372	kkuai.exe
1372	kkuai.exe
1372	kkuai.exe
1372	kkuai.exe
1372	kkuai.exe
1372	kkuai.exe
1372	kkuai.exe
1372	kkuai.exe
1372	kkuai.exe
1372	kkuai.exe
1372	kkuai.exe
1372	kkuai.exe
1372	kkuai.exe
1372	kkuai.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1468	RegSvcs.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 1332	1600	9f40a90db5c7da1cc2ced7e23df53ec3.com.exe	27
PID 1600 wrote to memory of 1332	1600	9f40a90db5c7da1cc2ced7e23df53ec3.com.exe	27
PID 1600 wrote to memory of 1332	1600	9f40a90db5c7da1cc2ced7e23df53ec3.com.exe	27
PID 1600 wrote to memory of 1332	1600	9f40a90db5c7da1cc2ced7e23df53ec3.com.exe	27
PID 1600 wrote to memory of 1792	1600	9f40a90db5c7da1cc2ced7e23df53ec3.com.exe	28
PID 1600 wrote to memory of 1792	1600	9f40a90db5c7da1cc2ced7e23df53ec3.com.exe	28
PID 1600 wrote to memory of 1792	1600	9f40a90db5c7da1cc2ced7e23df53ec3.com.exe	28
PID 1600 wrote to memory of 1792	1600	9f40a90db5c7da1cc2ced7e23df53ec3.com.exe	28
PID 1792 wrote to memory of 1372	1792	WScript.exe	30
PID 1792 wrote to memory of 1372	1792	WScript.exe	30
PID 1792 wrote to memory of 1372	1792	WScript.exe	30
PID 1792 wrote to memory of 1372	1792	WScript.exe	30
PID 1372 wrote to memory of 1096	1372	kkuai.exe	33
PID 1372 wrote to memory of 1096	1372	kkuai.exe	33
PID 1372 wrote to memory of 1096	1372	kkuai.exe	33
PID 1372 wrote to memory of 1096	1372	kkuai.exe	33
PID 1372 wrote to memory of 1360	1372	kkuai.exe	34
PID 1372 wrote to memory of 1360	1372	kkuai.exe	34
PID 1372 wrote to memory of 1360	1372	kkuai.exe	34
PID 1372 wrote to memory of 1360	1372	kkuai.exe	34
PID 1372 wrote to memory of 1536	1372	kkuai.exe	35
PID 1372 wrote to memory of 1536	1372	kkuai.exe	35
PID 1372 wrote to memory of 1536	1372	kkuai.exe	35
PID 1372 wrote to memory of 1536	1372	kkuai.exe	35
PID 1372 wrote to memory of 1820	1372	kkuai.exe	36
PID 1372 wrote to memory of 1820	1372	kkuai.exe	36
PID 1372 wrote to memory of 1820	1372	kkuai.exe	36
PID 1372 wrote to memory of 1820	1372	kkuai.exe	36
PID 1372 wrote to memory of 284	1372	kkuai.exe	37
PID 1372 wrote to memory of 284	1372	kkuai.exe	37
PID 1372 wrote to memory of 284	1372	kkuai.exe	37
PID 1372 wrote to memory of 284	1372	kkuai.exe	37
PID 1372 wrote to memory of 796	1372	kkuai.exe	38
PID 1372 wrote to memory of 796	1372	kkuai.exe	38
PID 1372 wrote to memory of 796	1372	kkuai.exe	38
PID 1372 wrote to memory of 796	1372	kkuai.exe	38
PID 1372 wrote to memory of 908	1372	kkuai.exe	39
PID 1372 wrote to memory of 908	1372	kkuai.exe	39
PID 1372 wrote to memory of 908	1372	kkuai.exe	39
PID 1372 wrote to memory of 908	1372	kkuai.exe	39
PID 1372 wrote to memory of 916	1372	kkuai.exe	40
PID 1372 wrote to memory of 916	1372	kkuai.exe	40
PID 1372 wrote to memory of 916	1372	kkuai.exe	40
PID 1372 wrote to memory of 916	1372	kkuai.exe	40
PID 1372 wrote to memory of 916	1372	kkuai.exe	40
PID 1372 wrote to memory of 916	1372	kkuai.exe	40
PID 1372 wrote to memory of 916	1372	kkuai.exe	40
PID 1372 wrote to memory of 1468	1372	kkuai.exe	41
PID 1372 wrote to memory of 1468	1372	kkuai.exe	41
PID 1372 wrote to memory of 1468	1372	kkuai.exe	41
PID 1372 wrote to memory of 1468	1372	kkuai.exe	41
PID 1372 wrote to memory of 1468	1372	kkuai.exe	41
PID 1372 wrote to memory of 1468	1372	kkuai.exe	41
PID 1372 wrote to memory of 1468	1372	kkuai.exe	41
PID 1372 wrote to memory of 1468	1372	kkuai.exe	41
PID 1372 wrote to memory of 1468	1372	kkuai.exe	41
PID 1372 wrote to memory of 1468	1372	kkuai.exe	41
PID 1372 wrote to memory of 1468	1372	kkuai.exe	41
PID 1372 wrote to memory of 1468	1372	kkuai.exe	41

C:\Users\Admin\AppData\Local\Temp\9f40a90db5c7da1cc2ced7e23df53ec3.com.exe
"C:\Users\Admin\AppData\Local\Temp\9f40a90db5c7da1cc2ced7e23df53ec3.com.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\temp\4_87\rfil.js" Paul E. Patton (born May 26, 1937) is an American politician who served as the 59th governor of Kentucky from 1995 to 2003.
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  PID:1332
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\temp\4_87\xrqxkro.vbe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1792
- - C:\Users\Admin\AppData\Local\Temp\4_87\kkuai.exe
    "C:\Users\Admin\AppData\Local\Temp\4_87\kkuai.exe" fwfinco.apb
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1372
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\SysWOW64\mshta.exe"
      4⤵
      PID:1096
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\SysWOW64\mshta.exe"
      4⤵
      PID:1360
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\SysWOW64\mshta.exe"
      4⤵
      PID:1536
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\SysWOW64\mshta.exe"
      4⤵
      PID:1820
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\SysWOW64\mshta.exe"
      4⤵
      PID:284
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\SysWOW64\mshta.exe"
      4⤵
      PID:796
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\SysWOW64\mshta.exe"
      4⤵
      PID:908
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      PID:916
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:1468

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

epueaee.qsa

Path C:\Users\Admin\AppData\Local\Temp\4_87\epueaee.qsa
Size 832KB
SHA256 db326b548a3e1a2a05539881a054b6f9c0ba302d945480564df3cf77fe96ebb1
MD5 097b77b3288ee474492dc94a6cb43a15
SHA1 742d0e529289b837f512055a4e448fb17cad7656
SHA512 e738ca448b7e83e822803b5bd22ae222584ae46ee67e7ac60189a23af36c42515c1122d5e10b7145db6aee97b110d4882794ee6877a43eb502239d68fa076dab
SSDEEP 6144:bT5kHBPYToJvxFdP1XIW4q7VUcLJvJMkVWwDFwxVL1toFCQNhLOGwFEGRmG3TInH:baBPxNDD4qXMGuxVJ6CQNEp+GRm/zs+
MD5 SHA1 SHA512 SSDEEP

Submit Download

fwfinco.apb

Path C:\Users\Admin\AppData\Local\Temp\4_87\fwfinco.apb
Size 124.2MB
SHA256 29808fb1137203fc1b0a840e60876da3d8c3ddf9b21869310b2caa221e64ba24
MD5 87bbebf030409ffb724c09365e4d094c
SHA1 dcec2d7a6ff6de98f1760454b1c1c67abeac0da3
SHA512 1a5005e44bf12b4e83e77ee5479a413643813ac0aef3ee906693d08c1a4439949931270be996beda5052fc5c2d01a22852224e19b00462cb086b361082a08f6a
SSDEEP 24576:cIU5IUtIU2IUqIUIIUmIURIUhIUWIUJIURIUDIUmIUWIUQIUyIUeIUtIUQIUsIUm:l
MD5 SHA1 SHA512 SSDEEP

Submit Download

ieeoonj.ppt

Path C:\Users\Admin\AppData\Local\Temp\4_87\ieeoonj.ppt
Size 61KB
SHA256 907be50f2e3548c8ac9f4945c05ce4e74ea8f246c51378e097e10837d0331b43
MD5 6eab883507b80a10c54c5c90706826c8
SHA1 fd9813bfd24992485b5133d5d68025dd3d0cdf46
SHA512 88bfda7bebe18d4c2faeeedf366c781259e1537f74d7f5d0251f9364807fd945faadff2c56dbeffd5dec8b89723cba736a5538eeaeaee8b511bfd3d5b93ee2c1
SSDEEP 768:iE+Yf5XGSES+3cJ0qagK+5vuhZ4JhLPJhBUXV0PxGQkuojBgcZvft61bfe8nfBMV:iE+Wl+sW+YMhJ5PxZFwibXJMk8uXt0k+
MD5 SHA1 SHA512 SSDEEP

Submit Download

kkuai.exe

Path C:\Users\Admin\AppData\Local\Temp\4_87\kkuai.exe
Size 1.0MB
SHA256 cbcdc1eecb091c7e3418706dd0aafaca9018474150f73d2d4b1cc55595dcf550
MD5 b153044cf36a027e19eb94b06003f09c
SHA1 9c5137654c78d249b318d7612a4d3dd2710c3aea
SHA512 ef301b7c23b5012909e6b2a48d7bffbfc122e6c18180b66bd7ac16c8e9a27f3eff6b7cbab8a997857e6d101f8275ca87ba30d153fecb62e630aad14d923d7b96
SSDEEP 24576:NErOxpVnqgt5ExLh27RQlf7Yfq2WZz2atN69:N86pqeE74aB0Sdiatw9
MD5 SHA1 SHA512 SSDEEP

Submit Download

kkuai.exe

Path C:\Users\Admin\AppData\Local\Temp\4_87\kkuai.exe
Size 1.0MB
SHA256 cbcdc1eecb091c7e3418706dd0aafaca9018474150f73d2d4b1cc55595dcf550
MD5 b153044cf36a027e19eb94b06003f09c
SHA1 9c5137654c78d249b318d7612a4d3dd2710c3aea
SHA512 ef301b7c23b5012909e6b2a48d7bffbfc122e6c18180b66bd7ac16c8e9a27f3eff6b7cbab8a997857e6d101f8275ca87ba30d153fecb62e630aad14d923d7b96
SSDEEP 24576:NErOxpVnqgt5ExLh27RQlf7Yfq2WZz2atN69:N86pqeE74aB0Sdiatw9
MD5 SHA1 SHA512 SSDEEP

Submit Download

rfil.js

Path C:\Users\Admin\AppData\Local\temp\4_87\rfil.js
Size 3KB
SHA256 dbd1b9421d8634cc2af6ae9c4fe72891bd3139527730185d2e28afe0447b4e2e
MD5 6c705c7ee0ce269b3e6eb770b797e808
SHA1 e8c6540e4dbb6a464e1f0c2c59cab161f44a8705
SHA512 0999401d3218986eac63b8e449a572cdd5aec382fac11a6aa86b6a4035107b75343f6f005d506322c0a0e853c7566cf49078991d93cadfab1e80fad8ed1d93e2
MD5 SHA1 SHA512

Submit Download

xrqxkro.vbe

Path C:\Users\Admin\AppData\Local\temp\4_87\xrqxkro.vbe
Size 23KB
SHA256 26a2dee2267cbd8d019524d2045dda3f0cec89e73d56ba3d2cf2fef9187cb55a
MD5 71e60ffa129c1759de7d21cda151dc4e
SHA1 7a727197a54b055d06180b398ce1a196ffd5ffe6
SHA512 bf9ca1b82cbff005357fba82b97c4d0494f4b268b1751639f486a936297e5fa49707d545e3471ef61c4153f6cdd796c344d564f6251de87ac8f499b1002ed3e0
SSDEEP 384:69dd+hXHqlBDM79dd+hXHqlBDMB9dd+hXHqlBDMw9dd+hXHqlBDMY99dd+hXHqls:8L5MBL5MPL5M6L5MYLL5Mb
MD5 SHA1 SHA512 SSDEEP

Submit Download

kkuai.exe

Path \Users\Admin\AppData\Local\Temp\4_87\kkuai.exe
Size 1.0MB
SHA256 cbcdc1eecb091c7e3418706dd0aafaca9018474150f73d2d4b1cc55595dcf550
MD5 b153044cf36a027e19eb94b06003f09c
SHA1 9c5137654c78d249b318d7612a4d3dd2710c3aea
SHA512 ef301b7c23b5012909e6b2a48d7bffbfc122e6c18180b66bd7ac16c8e9a27f3eff6b7cbab8a997857e6d101f8275ca87ba30d153fecb62e630aad14d923d7b96
SSDEEP 24576:NErOxpVnqgt5ExLh27RQlf7Yfq2WZz2atN69:N86pqeE74aB0Sdiatw9
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1468-76-0x0000000000400000-0x0000000000468000-memory.dmp

Download

memory/1468-77-0x0000000000400000-0x0000000000468000-memory.dmp

Download

memory/1468-79-0x0000000000400000-0x0000000000468000-memory.dmp

Download

memory/1468-82-0x0000000000400000-0x0000000000468000-memory.dmp

Download

memory/1468-85-0x0000000000400000-0x0000000000468000-memory.dmp

Download

memory/1468-88-0x0000000000400000-0x0000000000468000-memory.dmp

Download

memory/1468-89-0x0000000000400000-0x0000000000468000-memory.dmp

Download

memory/1600-54-0x00000000752B1000-0x00000000752B3000-memory.dmp

Download