Analysis

  • max time kernel
    141s
  • max time network
    145s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    14-01-2021 07:00

General

  • Target

    PaymentReceipt.js

  • Size

    27KB

  • MD5

    4aefdf76b4e1b9e3902b62ff743f060b

  • SHA1

    7cb6f5a6a6e30353cef6694bae2b56db8cdc0ea6

  • SHA256

    7961f9be4bdb030adaa35da45684612421c5affe460729b1eb0af5432638c25f

  • SHA512

    ce7f2bb4f8787d2e2905a3bb35e2bbe21dbfa52a10fa7e09e941ff8e7f78b0005851a23ff1d70bbfef2fffc5d060d70103276094a760d97ddb53567c74912dbb

Malware Config

Signatures

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

  • Blocklisted process makes network request 4 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\PaymentReceipt.js
    1⤵
    • Blocklisted process makes network request
    • Adds Run key to start application
    PID:3940

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Replay Monitor

Loading Replay Monitor...

Downloads