Analysis
- max time kernel
150s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
20/03/2024, 15:44
General
- Target d92e4d601fad56e8750ea73e8b0e53d9.jar
- Size 621KB
- Sample240320-s6xdssca56
- SHA256 56ca8f9b8ac1cb7dab8123ba8b84a067e05527f75ffbe18046b1f12c0ac4db2c
Malware Config
Signatures
- Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 2 IoCs
- Modifies file permissions 1 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Drops file in Program Files directory 24 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\d92e4d601fad56e8750ea73e8b0e53d9.jar1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\wscript.exewscript C:\Users\Admin\gbystgqcic.js2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\HXpBUBTtZF.js"3⤵
- Drops startup file
- Adds Run key to start application
-
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\qboasqjo.txt"3⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\_0.105551579451586221569121857187342560.class4⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
3903daac9bc4a3b7.timestamp
_0.105551579451586221569121857187342560.class
HXpBUBTtZF.js
83aa4cc77f591dfc2374580bbd95f6ba_2d983147-f9f1-498d-be7e-1997eada874a
qboasqjo.txt
gbystgqcic.js
memory/1164-75-0x000002441D8D0000-0x000002441D8E0000-memory.dmp
memory/1164-81-0x000002441D920000-0x000002441D930000-memory.dmp
memory/1164-143-0x000002441D660000-0x000002441E660000-memory.dmp
memory/1164-32-0x000002441D660000-0x000002441E660000-memory.dmp
memory/1164-86-0x000002441D660000-0x000002441E660000-memory.dmp
memory/1164-58-0x000002441BFE0000-0x000002441BFE1000-memory.dmp
memory/1164-82-0x000002441D940000-0x000002441D950000-memory.dmp
memory/1164-66-0x000002441D660000-0x000002441E660000-memory.dmp
memory/1164-34-0x000002441BFE0000-0x000002441BFE1000-memory.dmp
memory/1164-79-0x000002441D910000-0x000002441D920000-memory.dmp
memory/1164-76-0x000002441D900000-0x000002441D910000-memory.dmp
memory/1164-77-0x000002441D8F0000-0x000002441D900000-memory.dmp
memory/1844-98-0x0000018285260000-0x0000018285261000-memory.dmp
memory/1844-142-0x0000018285280000-0x0000018286280000-memory.dmp
memory/1844-59-0x0000018285260000-0x0000018285261000-memory.dmp
memory/1844-54-0x0000018285260000-0x0000018285261000-memory.dmp
memory/1844-91-0x0000018285280000-0x0000018286280000-memory.dmp
memory/1844-94-0x0000018285260000-0x0000018285261000-memory.dmp
memory/1844-103-0x0000018285280000-0x0000018286280000-memory.dmp
memory/1844-49-0x0000018285280000-0x0000018286280000-memory.dmp
memory/1844-99-0x0000018285260000-0x0000018285261000-memory.dmp
memory/1844-115-0x0000018285280000-0x0000018286280000-memory.dmp
memory/1844-123-0x0000018285280000-0x0000018286280000-memory.dmp
memory/1844-141-0x0000018285590000-0x00000182855A0000-memory.dmp
memory/4016-14-0x0000018FC0FB0000-0x0000018FC0FB1000-memory.dmp
memory/4016-7-0x0000018FC2840000-0x0000018FC3840000-memory.dmp