Analysis

  • max time kernel
    184s
  • max time network
    191s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    17-01-2023 19:12

General

  • Target

    98e3648add4ab0724ebeb54eb720e8ad97ad52b0.js

  • Size

    378KB

  • MD5

    484e1f6925d5957e9d486e420dc010b7

  • SHA1

    98e3648add4ab0724ebeb54eb720e8ad97ad52b0

  • SHA256

    9005a39c203e068daa077fe244e2608d36852dbef6f6ce8b28cc5cc015b89b1b

  • SHA512

    5b32912e30b446357ce6fe626b8136ae3262cdf4c60b7bc56b16171156a8979001a1a52168c0fe34b2b7526379b4519b7b04c86e17e18f40a62b7361acb0617c

  • SSDEEP

    6144:6V0EJTElOz43XdvK4tHOh6WfkHi4FjqWkQ2M4MMPpsiscuzAOgied24iD+:cJMW43NsZghqekPpNqAOgBd7iD+

Malware Config

Signatures

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

  • Blocklisted process makes network request 17 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1300
    • C:\Windows\system32\wscript.exe
      wscript.exe C:\Users\Admin\AppData\Local\Temp\98e3648add4ab0724ebeb54eb720e8ad97ad52b0.js
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:520
      • C:\Windows\System32\wscript.exe
        "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\TzTlSUHDie.js"
        3⤵
        • Blocklisted process makes network request
        • Drops startup file
        PID:1056
      • C:\Users\Admin\AppData\Local\Temp\bin.exe
        "C:\Users\Admin\AppData\Local\Temp\bin.exe"
        3⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:1996
    • C:\Windows\SysWOW64\wscript.exe
      "C:\Windows\SysWOW64\wscript.exe"
      2⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1980
      • C:\Program Files\Mozilla Firefox\Firefox.exe
        "C:\Program Files\Mozilla Firefox\Firefox.exe"
        3⤵
          PID:1632

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\bin.exe

      Filesize

      185KB

      MD5

      f9fdfca55156f35ea48a17947d091f4d

      SHA1

      15f10040cf10535deed5ca028150ed847a585d01

      SHA256

      7258963be005d6914901a62c591c56427553f62537f86d70965af16dae57c0d0

      SHA512

      53caa12467706839406c40e8e8a925a67f8c51ddc6abb0bf7db8ca61e03af09714cc954e959c89dae91fb45c07fc113a076e0ab34806933ca7deed520113c302

    • C:\Users\Admin\AppData\Local\Temp\bin.exe

      Filesize

      185KB

      MD5

      f9fdfca55156f35ea48a17947d091f4d

      SHA1

      15f10040cf10535deed5ca028150ed847a585d01

      SHA256

      7258963be005d6914901a62c591c56427553f62537f86d70965af16dae57c0d0

      SHA512

      53caa12467706839406c40e8e8a925a67f8c51ddc6abb0bf7db8ca61e03af09714cc954e959c89dae91fb45c07fc113a076e0ab34806933ca7deed520113c302

    • C:\Users\Admin\AppData\Roaming\TzTlSUHDie.js

      Filesize

      18KB

      MD5

      90c052e2282de1c12470fc54d62681d9

      SHA1

      ea069b254dde1f6cad46afedf55c69d4516a0d7a

      SHA256

      be62476863ca538e76f33e4758a5a5af8609d681026c4e325d8d667470aa9097

      SHA512

      73661062644236fcd76f689a8271f5f2c875468fbfdd4a4431a2b419c8bc093129345ee9b83d4f87eaa389a1ff12e776ba5d0d5845899931e1b72c32d4cb5ea7

    • \Users\Admin\AppData\Local\Temp\sqlite3.dll

      Filesize

      837KB

      MD5

      e1b58e0aa1b377a1d0e940660ad1ace1

      SHA1

      5afc7291b26855b1252b26381ebc85ed3cca218f

      SHA256

      1b98c006231d38524e2278a474c49274fe42e0bb1a31bcfda02e6e32f559b777

      SHA512

      9ce778bcb586638662b090910c4ceab3b64e16dfaf905a7581c1d349fecdf186995b3cc0dc8c6fc6e9761ea2831d7b14ac1619c2bd5ebc6d18015842e5d94aa2

    • memory/1056-59-0x000007FEFBFC1000-0x000007FEFBFC3000-memory.dmp

      Filesize

      8KB

    • memory/1056-54-0x0000000000000000-mapping.dmp

    • memory/1300-72-0x00000000072F0000-0x00000000073EA000-memory.dmp

      Filesize

      1000KB

    • memory/1300-71-0x0000000006CE0000-0x0000000006DFA000-memory.dmp

      Filesize

      1.1MB

    • memory/1300-70-0x00000000072F0000-0x00000000073EA000-memory.dmp

      Filesize

      1000KB

    • memory/1300-62-0x0000000006CE0000-0x0000000006DFA000-memory.dmp

      Filesize

      1.1MB

    • memory/1980-69-0x00000000005C0000-0x000000000064F000-memory.dmp

      Filesize

      572KB

    • memory/1980-66-0x00000000000F0000-0x0000000000116000-memory.dmp

      Filesize

      152KB

    • memory/1980-67-0x0000000001FD0000-0x00000000022D3000-memory.dmp

      Filesize

      3.0MB

    • memory/1980-68-0x0000000000070000-0x000000000009D000-memory.dmp

      Filesize

      180KB

    • memory/1980-63-0x0000000000000000-mapping.dmp

    • memory/1980-73-0x0000000075881000-0x0000000075883000-memory.dmp

      Filesize

      8KB

    • memory/1996-64-0x0000000001390000-0x00000000013BF000-memory.dmp

      Filesize

      188KB

    • memory/1996-61-0x00000000000A0000-0x00000000000B0000-memory.dmp

      Filesize

      64KB

    • memory/1996-60-0x00000000008B0000-0x0000000000BB3000-memory.dmp

      Filesize

      3.0MB

    • memory/1996-58-0x0000000001390000-0x00000000013BF000-memory.dmp

      Filesize

      188KB

    • memory/1996-56-0x0000000000000000-mapping.dmp