Analysis
- max time kernel
146s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
- submitted
11/04/2023, 01:00
General
- Target d72e9e277f3eadd7b9097a7f8d1d00f905d97df92bbf66982e51899a9d6eec60.js
- Size 3.3MB
- Sample230411-bcpnesbb51
- SHA256 d72e9e277f3eadd7b9097a7f8d1d00f905d97df92bbf66982e51899a9d6eec60
Malware Config
Signatures
- Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
- Blocklisted process makes network request 3 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies registry class 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\d72e9e277f3eadd7b9097a7f8d1d00f905d97df92bbf66982e51899a9d6eec60.js1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\FAklApsLii.js"2⤵
- Blocklisted process makes network request
- Drops startup file
-
-
C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\jsfhaxb.txt"2⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
FAklApsLii.js
jsfhaxb.txt
memory/4896-150-0x0000000000FF0000-0x0000000000FF1000-memory.dmp
memory/4896-159-0x0000000000FF0000-0x0000000000FF1000-memory.dmp
memory/4896-166-0x0000000000FF0000-0x0000000000FF1000-memory.dmp
memory/4896-173-0x0000000000FF0000-0x0000000000FF1000-memory.dmp
memory/4896-201-0x0000000000FF0000-0x0000000000FF1000-memory.dmp
memory/4896-204-0x0000000000FF0000-0x0000000000FF1000-memory.dmp
memory/4896-205-0x0000000000FF0000-0x0000000000FF1000-memory.dmp
memory/4896-208-0x0000000000FF0000-0x0000000000FF1000-memory.dmp
memory/4896-209-0x0000000000FF0000-0x0000000000FF1000-memory.dmp
memory/4896-212-0x0000000000FF0000-0x0000000000FF1000-memory.dmp
memory/4896-214-0x0000000000FF0000-0x0000000000FF1000-memory.dmp
memory/4896-215-0x0000000000FF0000-0x0000000000FF1000-memory.dmp
memory/4896-220-0x0000000000FF0000-0x0000000000FF1000-memory.dmp
memory/4896-227-0x0000000000FF0000-0x0000000000FF1000-memory.dmp
memory/4896-229-0x0000000000FF0000-0x0000000000FF1000-memory.dmp
memory/4896-230-0x0000000000FF0000-0x0000000000FF1000-memory.dmp
memory/4896-234-0x0000000000FF0000-0x0000000000FF1000-memory.dmp
memory/4896-235-0x0000000000FF0000-0x0000000000FF1000-memory.dmp
memory/4896-236-0x0000000000FF0000-0x0000000000FF1000-memory.dmp
memory/4896-237-0x0000000000FF0000-0x0000000000FF1000-memory.dmp
memory/4896-239-0x0000000000FF0000-0x0000000000FF1000-memory.dmp
memory/4896-238-0x0000000000FF0000-0x0000000000FF1000-memory.dmp