Analysis
- max time kernel
150s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20230915-en - resource tags
- submitted
09/10/2023, 04:41
General
- Target swift copy.PDF.js
- Size 453KB
- Sample231009-fa4f1sce66
- SHA256 47ac55851c62e30f0553a5d32f2b6a128f532b9904fbf5e100b53895ec8a86ca
Malware Config
Extracted
-
vjw0rm
-
http://jemyy.theworkpc.com:5401
Signatures
- Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
- Blocklisted process makes network request 2 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 2 IoCs
- Executes dropped EXE 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 62 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 7 IoCs
- Suspicious use of AdjustPrivilegeToken 12 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\swift copy.PDF.js"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\ECqEVMhpHV.js"2⤵
- Blocklisted process makes network request
- Drops startup file
-
-
C:\Users\Admin\AppData\Roaming\bin.exe"C:\Users\Admin\AppData\Roaming\bin.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ktmutil.exe"C:\Windows\SysWOW64\ktmutil.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
ECqEVMhpHV.js
bin.exe
bin.exe
bin.exe
memory/968-25-0x0000000000CF0000-0x0000000000D8A000-memory.dmp
memory/968-23-0x0000000000560000-0x000000000059A000-memory.dmp
memory/968-29-0x0000000000CF0000-0x0000000000D8A000-memory.dmp
memory/968-28-0x0000000000560000-0x000000000059A000-memory.dmp
memory/968-18-0x0000000000560000-0x000000000059A000-memory.dmp
memory/968-19-0x0000000000560000-0x000000000059A000-memory.dmp
memory/968-22-0x0000000000F70000-0x00000000012BA000-memory.dmp
memory/3192-31-0x0000000004CA0000-0x0000000004D90000-memory.dmp
memory/3192-27-0x0000000004CA0000-0x0000000004D90000-memory.dmp
memory/3192-17-0x000000000D220000-0x000000000E64A000-memory.dmp
memory/3192-26-0x0000000004CA0000-0x0000000004D90000-memory.dmp
memory/3192-24-0x000000000D220000-0x000000000E64A000-memory.dmp
memory/3484-16-0x0000000000B60000-0x0000000000B7B000-memory.dmp
memory/3484-21-0x0000000000B60000-0x0000000000B7B000-memory.dmp
memory/3484-12-0x00000000008F0000-0x000000000092D000-memory.dmp
memory/3484-20-0x00000000008F0000-0x000000000092D000-memory.dmp
memory/3484-11-0x00000000008F0000-0x000000000092D000-memory.dmp
memory/3484-15-0x00000000008F0000-0x000000000092D000-memory.dmp
memory/3484-14-0x00000000008F0000-0x000000000092D000-memory.dmp
memory/3484-13-0x00000000010E0000-0x000000000142A000-memory.dmp