Analysis

  • max time kernel
    145s
  • max time network
    136s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    29-02-2024 21:33

General

  • Target

    af85d8109ff251f1db6191b46ef8c66f.js

  • Size

    191KB

  • MD5

    af85d8109ff251f1db6191b46ef8c66f

  • SHA1

    b1f6c58407bd70c4819db5eecfbc2cdcb5af77e3

  • SHA256

    5ec545f3cccb7dddd12196320fb5144f131818170d87000cdca10fe9fb0353d4

  • SHA512

    1a7bf9da69cd189c15d33c0a7114670c0a0c5b76cf6f8cece60c33cac7b32cb7d22d13a989d19f61eebead584429d3ed9afdd8a222959b24ee31abc62353d48d

  • SSDEEP

    3072:yWt8ruabx2MftvMQDvolUJSKqvCVfKzJme6TB+ZhUzzv9EZAUycwqeHZzL:yWt8ruEjMV3KqsaB+B+MzFpeSzL

Malware Config

Signatures

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\af85d8109ff251f1db6191b46ef8c66f.js
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2348
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\tKaUarDZDG.js"
      2⤵
      • Drops startup file
      • Adds Run key to start application
      PID:2736
    • C:\Program Files\Java\jre7\bin\javaw.exe
      "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\lizzyfox.txt"
      2⤵
        PID:3012

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\lizzyfox.txt

      Filesize

      92KB

      MD5

      e960b9b8954afa303d7989eed1290637

      SHA1

      a42410c56fb024243014c29334152c209ab88873

      SHA256

      4439ce946a74288bc91360bee4b7ef43e7efeced81432ba10728220c323d7c7f

      SHA512

      cdb3f0e2911f1841919847903c6f6bd695e3f15106c1a5b7fa19b70e549967beefa7c32c87a1a2040bbc2b7a75b1a90adc7a7e113f519e15b09f62dc0ea473c8

    • C:\Users\Admin\AppData\Roaming\tKaUarDZDG.js

      Filesize

      5KB

      MD5

      1f7a1f50ddcaacd7c16098f452ae3ea9

      SHA1

      c31e3feb895e9b69db5e014cc42a2b3e03473016

      SHA256

      f14d01dc44ad040b5c3a8b418aa4c27bc476f0c5bd7af5e1554547fe0f6bb2ef

      SHA512

      6835fe9faac663378a6bd96e4dcba1f492d4dc488d410e019a965ca3c989c0d66d39f71b213a579c0e55fa4e52deb542b64c9b68108763af6ffed89414867271

    • memory/3012-34-0x0000000000140000-0x0000000000141000-memory.dmp

      Filesize

      4KB

    • memory/3012-36-0x0000000000140000-0x0000000000141000-memory.dmp

      Filesize

      4KB

    • memory/3012-24-0x0000000000140000-0x0000000000141000-memory.dmp

      Filesize

      4KB

    • memory/3012-29-0x0000000000140000-0x0000000000141000-memory.dmp

      Filesize

      4KB

    • memory/3012-30-0x0000000000140000-0x0000000000141000-memory.dmp

      Filesize

      4KB

    • memory/3012-33-0x0000000000140000-0x0000000000141000-memory.dmp

      Filesize

      4KB

    • memory/3012-15-0x00000000026C0000-0x00000000056C0000-memory.dmp

      Filesize

      48.0MB

    • memory/3012-17-0x0000000000140000-0x0000000000141000-memory.dmp

      Filesize

      4KB

    • memory/3012-40-0x0000000000140000-0x0000000000141000-memory.dmp

      Filesize

      4KB

    • memory/3012-41-0x0000000000140000-0x0000000000141000-memory.dmp

      Filesize

      4KB

    • memory/3012-47-0x0000000000140000-0x0000000000141000-memory.dmp

      Filesize

      4KB

    • memory/3012-50-0x00000000026C0000-0x00000000056C0000-memory.dmp

      Filesize

      48.0MB

    • memory/3012-61-0x0000000000140000-0x0000000000141000-memory.dmp

      Filesize

      4KB

    • memory/3012-64-0x0000000000140000-0x0000000000141000-memory.dmp

      Filesize

      4KB

    • memory/3012-65-0x0000000000140000-0x0000000000141000-memory.dmp

      Filesize

      4KB

    • memory/3012-70-0x0000000000140000-0x0000000000141000-memory.dmp

      Filesize

      4KB