Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
06/01/2025, 03:24
General
-
Target
JaffaCakes118_0b8890e56e80bbdd1502cf079ce7583a.exe
-
Size
1.4MB
-
MD5
0b8890e56e80bbdd1502cf079ce7583a
-
SHA1
dd2898e0e29e621e61f94b09b208daa77d3a916a
-
SHA256
c7f975e39d71c09f26329414e6e790b2df26808e88529845996c889726af65ff
-
SHA512
bd35e0ecddfc7f132f7eccd33d5abe40ff92ab129723110a1c5d11decc291af30857d05786beb16cf03401ae824ca6f5b4be6820fa1291b42cc956e6ef21b793
-
SSDEEP
24576:x2G/nvxW3WQN2mfFT+LCT7c7gapLtf5UjGgBLEA2NGAQ04tgYXltpcCK5sjmRSPu:xbA39/YL87cZ9tf5UjGgBAA2NTcDlD56
Malware Config
Signatures
-
Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
-
Vjw0rm family
-
Blocklisted process makes network request 6 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Drops file in System32 directory 4 IoCs
-
UPX packed file 16 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks SCSI registry key(s) 3 TTPs 13 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies registry class 40 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 9 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0b8890e56e80bbdd1502cf079ce7583a.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0b8890e56e80bbdd1502cf079ce7583a.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\info.js"2⤵
- Blocklisted process makes network request
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn anydesk /tr "C:\Users\Admin\AppData\Roaming\info.js3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1JavaScript
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
MD59fabf10537549747efbbb6281dce1a91
SHA14590a323576f86471b3d6b8b841762fc33c6e4b2
SHA256a8e7fa03686c4354002c14b61047318fc4e7b654ffab72cf2bb814d13c2d2205
SHA51201d41222e055e98841415d4aaa55ef16323e2c443273e9ca8b3e5f02ecdf2b3fd583b0b4e8fa7760404a1a154ca2b55f22441d667e41783a131786d22d995e6f
-
Filesize
41B
MD59a82b0f98c84b2cd4ae869dc9ef5cc55
SHA1a57c4fa7f18c6cfe000acce7570481c38dcfc22d
SHA2565eda49ee6189bb1203837e9bb1499ee92823d494da23cc5069e2e5f786018cc1
SHA512ffdd1c813914ad8640db2498aec9af57880e15c772fcb13e7b2638051c041797aa78637a831072dbbfc6189501e3f48e038300795c2909149ba94e507bb21f44
-
Filesize
70B
MD57e00006683b09439bcb7a94fdb7154d3
SHA17776909d72b2050fa578acb181aa419961961ae8
SHA256a18ea201114d1af87724c7dae73dcd2208fd38c5825af4151d3e12d1aecf4038
SHA512b2dfc2cf10dc3465e99f1deb221a3c29d5acb193bd364efc1bb6171d53fcad7056de471e5baa8ee9e2187b2a99dc87beec2c540c89d95efd95d0fb1067517ede
-
Filesize
1.1MB
MD5c1df434cf15aeb31783e1144b8a30059
SHA11c385ec41d5f20ab411bd20e792ad8e7da7feaf9
SHA256c0ccf4f480545b50169cc1f5bf92b357ce588520cb8534128200ca48fc6ae588
SHA5127dcdd37b831c3e6d54ea5cb74e5308ead0ac3a344a94f40d70b1ad72746a830d0109ed3ddebd4fa6dc8a3cd8352545dd81164a1cff6fdbbcc9ed3312ecbe76f4
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB