Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/01/2024, 07:36

General

  • Target

    SKM_C258201001130020005057.js

  • Size

    469KB

  • MD5

    8fed7262f75ec7c978a03e8177dfadab

  • SHA1

    3c95b2b69114082581b28a34533cbcddefd72516

  • SHA256

    7a2fd40a032e726bde8638b079963c499d20c7c197a0f91544f458977fbd3304

  • SHA512

    22a2ca24da0dd5d7a665d84fc58cc36013716d4605518f3c035d0bc5e6944825267e332708eb26623cba4e2d7b57b395caab6c5628b9e88f510fb23a8871e9f2

  • SSDEEP

    6144:Qy6COPsZV2SvRmFgI9smdixnlahHhUgy6COPsZV2SvRmFgI9smdixnlahHhUt:wux5mFg6slxuKAux5mFg6slxuKt

Malware Config

Signatures

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Program Files directory 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\SKM_C258201001130020005057.js
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4080
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\kgjBVaIrAu.js"
      2⤵
      • Drops startup file
      • Adds Run key to start application
      PID:8
    • C:\Program Files\Java\jre-1.8\bin\javaw.exe
      "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\ayznhqes.txt"
      2⤵
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:3224
      • C:\Windows\system32\icacls.exe
        C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
        3⤵
        • Modifies file permissions
        PID:2448

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

    Filesize

    46B

    MD5

    a9ca4bef049cff32a358bdc6129dfedc

    SHA1

    f163cdb4f06bce6ab7d5e2f70bf0f6d2bbd3eb2c

    SHA256

    39a7d30b5e37c24d2d12f17886cf39a185aa2bbd32c6ef35a419721f885a0cf1

    SHA512

    d2e8c44f4dea8f21f2d0b625db18b5c8c3773288ce6d0b1845872803aa6f7bbe6f756f238509a3a2963422a65c17260db75911e3a98596d6b44df9702925a8bc

  • C:\Users\Admin\AppData\Roaming\ayznhqes.txt

    Filesize

    107KB

    MD5

    e38670aa13e73105b5b518779c4983df

    SHA1

    dbed21eea88ad1574999e3db2b6d7eb19b5a2979

    SHA256

    e0141d12da8d9172a5ea7bad725a5f0c4a766473b914d1f6b2b1485a7eeadf8f

    SHA512

    f2fa507968f7c817ca55001215610a39cebd35ab76696593f87efc7f504572e2da3cdf5355c80cb420eb767dee950b5a7b71f83ba898ac08ac11f6be099c397e

  • C:\Users\Admin\AppData\Roaming\kgjBVaIrAu.js

    Filesize

    14KB

    MD5

    f74ee95cc8fbe51c705384a7dcc5a701

    SHA1

    b15a636ca2ce2f45dd466e5ee463f1cfed9fd64b

    SHA256

    a86309235858dbc9f91f1a8405a3599a70f2394b7671889c9f6a1b05831c3407

    SHA512

    e68783102258f983e31d4ffd7f4b532957072207dad9b892f388924d17e8909ac21cb59d823cd3dcedb066f69ac9053c8992cc40204f86798932eef2179d3ad6

  • memory/3224-41-0x0000017A87770000-0x0000017A88770000-memory.dmp

    Filesize

    16.0MB

  • memory/3224-19-0x0000017A85EC0000-0x0000017A85EC1000-memory.dmp

    Filesize

    4KB

  • memory/3224-25-0x0000017A87770000-0x0000017A88770000-memory.dmp

    Filesize

    16.0MB

  • memory/3224-11-0x0000017A87770000-0x0000017A88770000-memory.dmp

    Filesize

    16.0MB

  • memory/3224-47-0x0000017A85EC0000-0x0000017A85EC1000-memory.dmp

    Filesize

    4KB

  • memory/3224-51-0x0000017A87770000-0x0000017A88770000-memory.dmp

    Filesize

    16.0MB

  • memory/3224-56-0x0000017A87770000-0x0000017A88770000-memory.dmp

    Filesize

    16.0MB

  • memory/3224-60-0x0000017A87770000-0x0000017A88770000-memory.dmp

    Filesize

    16.0MB

  • memory/3224-67-0x0000017A87770000-0x0000017A88770000-memory.dmp

    Filesize

    16.0MB

  • memory/3224-68-0x0000017A87770000-0x0000017A88770000-memory.dmp

    Filesize

    16.0MB