Analysis
- max time kernel
141s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
30/12/2023, 08:31
General
- Target 137a79bb32e10321f3803bb74e98fd93.js
- Size 332KB
- Sample231230-kevf5adca2
- SHA256 a9b5cf89510cfcc9b8ab7e311395540e1810f69f47ebf735134a04b376960ad0
Malware Config
Signatures
- Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 2 IoCs
- Modifies file permissions 1 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\137a79bb32e10321f3803bb74e98fd93.js1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\SKdxOqJGgU.js"2⤵
- Drops startup file
- Adds Run key to start application
-
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\scooxbax.txt"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M3⤵
- Modifies file permissions
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
SKdxOqJGgU.js
scooxbax.txt
memory/3864-61-0x000001B37FD00000-0x000001B37FD01000-memory.dmp
memory/3864-109-0x000001B300000000-0x000001B301000000-memory.dmp
memory/3864-21-0x000001B37FD00000-0x000001B37FD01000-memory.dmp
memory/3864-26-0x000001B300000000-0x000001B301000000-memory.dmp
memory/3864-37-0x000001B37FD00000-0x000001B37FD01000-memory.dmp
memory/3864-38-0x000001B300000000-0x000001B301000000-memory.dmp
memory/3864-54-0x000001B300000000-0x000001B301000000-memory.dmp
memory/3864-58-0x000001B300000000-0x000001B301000000-memory.dmp
memory/3864-59-0x000001B300000000-0x000001B301000000-memory.dmp
memory/3864-9-0x000001B300000000-0x000001B301000000-memory.dmp
memory/3864-108-0x000001B300000000-0x000001B301000000-memory.dmp
memory/3864-19-0x000001B37FD00000-0x000001B37FD01000-memory.dmp
memory/3864-170-0x000001B300000000-0x000001B301000000-memory.dmp
memory/3864-171-0x000001B300000000-0x000001B301000000-memory.dmp
memory/3864-172-0x000001B300000000-0x000001B301000000-memory.dmp
memory/3864-173-0x000001B300000000-0x000001B301000000-memory.dmp
memory/3864-175-0x000001B300000000-0x000001B301000000-memory.dmp
memory/3864-176-0x000001B300000000-0x000001B301000000-memory.dmp
memory/3864-177-0x000001B300000000-0x000001B301000000-memory.dmp
memory/3864-194-0x000001B300000000-0x000001B301000000-memory.dmp
memory/3864-195-0x000001B300000000-0x000001B301000000-memory.dmp
memory/3864-196-0x000001B300000000-0x000001B301000000-memory.dmp