Analysis
- max time kernel
147s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
31/01/2024, 03:26
General
- Target 83515551eaa1178801cc99a303160826.js
- Size 199KB
- Sample240131-dzmtfsagc5
- SHA256 744c760018483ee148b61b496f3fce2d3bc7de7aebb72269f914baaf73f34633
Malware Config
Signatures
- Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 2 IoCs
- Modifies file permissions 1 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\83515551eaa1178801cc99a303160826.js1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\QUKoVKgJQp.js"2⤵
- Drops startup file
- Adds Run key to start application
-
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\pdfooablue.txt"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M3⤵
- Modifies file permissions
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
QUKoVKgJQp.js
pdfooablue.txt
memory/1708-46-0x000001B1AD550000-0x000001B1AD560000-memory.dmp
memory/1708-49-0x000001B1AD510000-0x000001B1AD520000-memory.dmp
memory/1708-29-0x000001B1AD230000-0x000001B1AD231000-memory.dmp
memory/1708-35-0x000001B1AD230000-0x000001B1AD231000-memory.dmp
memory/1708-40-0x000001B1AD250000-0x000001B1AE250000-memory.dmp
memory/1708-45-0x000001B1AD4D0000-0x000001B1AD4E0000-memory.dmp
memory/1708-47-0x000001B1AD4F0000-0x000001B1AD500000-memory.dmp
memory/1708-11-0x000001B1AD250000-0x000001B1AE250000-memory.dmp
memory/1708-48-0x000001B1AD500000-0x000001B1AD510000-memory.dmp
memory/1708-25-0x000001B1AD250000-0x000001B1AE250000-memory.dmp
memory/1708-50-0x000001B1AD530000-0x000001B1AD540000-memory.dmp
memory/1708-52-0x000001B1AD560000-0x000001B1AD570000-memory.dmp
memory/1708-51-0x000001B1AD540000-0x000001B1AD550000-memory.dmp
memory/1708-55-0x000001B1AD250000-0x000001B1AE250000-memory.dmp
memory/1708-57-0x000001B1AD5A0000-0x000001B1AD5B0000-memory.dmp
memory/1708-56-0x000001B1AD590000-0x000001B1AD5A0000-memory.dmp
memory/1708-54-0x000001B1AD580000-0x000001B1AD590000-memory.dmp
memory/1708-53-0x000001B1AD570000-0x000001B1AD580000-memory.dmp
memory/1708-58-0x000001B1AD250000-0x000001B1AE250000-memory.dmp