Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    20/04/2024, 10:04

General

  • Target

    fc81b118b986d065514814c62ce2959c_JaffaCakes118.js

  • Size

    199KB

  • MD5

    fc81b118b986d065514814c62ce2959c

  • SHA1

    a8c1ed074cc533c5aa6b71a3a527ffbc0493e225

  • SHA256

    8b89ccf2aeee269572578f39cbe44d8b9eb1e90d6625be8bb005cc5296abc629

  • SHA512

    5bf826d4cfbdd6613e4955d4eee3ef0851ad48f0ab3c8eada4c4d57b0b815af8e854d08a95eaf196316fd91f8c84aa2ec7ed5cfef8913757c19ea077e3c4a6e7

  • SSDEEP

    3072:lritC+1MYgCc1doOgng49ooBP/GmhWi5eTIQ+vZzMd3efZeb9sHts649mPnhXe:4ggnTWq/TH1AsW6Ksle

Malware Config

Signatures

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\fc81b118b986d065514814c62ce2959c_JaffaCakes118.js
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2896
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\QUKoVKgJQp.js"
      2⤵
      • Drops startup file
      • Adds Run key to start application
      PID:2944
    • C:\Program Files\Java\jre7\bin\javaw.exe
      "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\dnituvvj.txt"
      2⤵
        PID:2996

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\QUKoVKgJQp.js

      Filesize

      10KB

      MD5

      20db8f29d1db93e67b8b2ad6196d9e37

      SHA1

      ce499527cae2ea611057d5dc952132b0d948eba4

      SHA256

      349e780cca53f741459e1da002e177b536bf4eb7c69f5d3efaa6c4287bcfa985

      SHA512

      71950c00ace082834e8b13ccc869a5d13c1ee0fe83e170ea3714b0a4279bad2d560f2dd6c2f200bddd4a00b241ff6553db9f6c8156cda7b60f0c08629512bfd3

    • C:\Users\Admin\AppData\Roaming\dnituvvj.txt

      Filesize

      89KB

      MD5

      7873269dd388d4ff3dbe9f020e121e89

      SHA1

      d50b0740bab0ebc4cf6b3cc4c586632f6dc9e13e

      SHA256

      bc12cbf509a1f5bff1dea9896aae44b9bc119115bf38349f6caabbbf99e0e919

      SHA512

      36fdd31209b3448dc32100f733c048b063521bade50a5dd8a3945b7acc5b504115036a6c37bf37ac99b31cf4f94a63b7040224bcf5d8b0c3d2bc93e4bb0fc818

    • memory/2996-46-0x0000000000110000-0x0000000000111000-memory.dmp

      Filesize

      4KB

    • memory/2996-17-0x0000000000110000-0x0000000000111000-memory.dmp

      Filesize

      4KB

    • memory/2996-18-0x0000000000110000-0x0000000000111000-memory.dmp

      Filesize

      4KB

    • memory/2996-41-0x0000000000110000-0x0000000000111000-memory.dmp

      Filesize

      4KB

    • memory/2996-8-0x00000000021B0000-0x00000000051B0000-memory.dmp

      Filesize

      48.0MB

    • memory/2996-47-0x0000000000110000-0x0000000000111000-memory.dmp

      Filesize

      4KB

    • memory/2996-49-0x0000000000110000-0x0000000000111000-memory.dmp

      Filesize

      4KB

    • memory/2996-58-0x0000000000110000-0x0000000000111000-memory.dmp

      Filesize

      4KB

    • memory/2996-72-0x0000000000110000-0x0000000000111000-memory.dmp

      Filesize

      4KB

    • memory/2996-78-0x0000000000110000-0x0000000000111000-memory.dmp

      Filesize

      4KB

    • memory/2996-81-0x0000000000110000-0x0000000000111000-memory.dmp

      Filesize

      4KB