vjw0rm | 2432c50fa8569fb4e19d7fe0630b9a4e2657465e9fe30dc9248b04a62af02c9f

Analysis

max time kernel
146s
max time network
147s
platform
windows7_x64
resource
win7v20201028
submitted
17-01-2021 13:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PaymentReceipt.js
Size

28KB
MD5

b199269852088f41919025ee636a8f6d
SHA1

3b0262420bf7a33d4265415e9245c4fa21f5398f
SHA256

2432c50fa8569fb4e19d7fe0630b9a4e2657465e9fe30dc9248b04a62af02c9f
SHA512

477f79c85277576ecf87153fe86fe8eb31c81a2982e84b68f5dd4d190446b20961cebca6dbd082661c8c50d14e157ec44acfab60efe3556d0691ec1e2faa7da0

Score

10^/10

vjw0rm trojan worm

Malware Config

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm

Blocklisted process makes network request 30 IoCs

flow	pid	Process
5	240	wscript.exe
7	240	wscript.exe
8	240	wscript.exe
9	240	wscript.exe
10	240	wscript.exe
11	240	wscript.exe
12	240	wscript.exe
13	240	wscript.exe
15	240	wscript.exe
16	240	wscript.exe
17	240	wscript.exe
18	240	wscript.exe
19	240	wscript.exe
20	240	wscript.exe
22	240	wscript.exe
23	240	wscript.exe
24	240	wscript.exe
25	240	wscript.exe
26	240	wscript.exe
27	240	wscript.exe
29	240	wscript.exe
30	240	wscript.exe
31	240	wscript.exe
32	240	wscript.exe
33	240	wscript.exe
34	240	wscript.exe
36	240	wscript.exe
37	240	wscript.exe
38	240	wscript.exe
39	240	wscript.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PaymentReceipt.js	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\PaymentReceipt.js
1⤵
- Blocklisted process makes network request
- Drops startup file
PID:240

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2000-2-0x000007FEF7D30000-0x000007FEF7FAA000-memory.dmp

Filesize
2.5MB

Download