Analysis
-
max time kernel
143s -
max time network
146s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
17-01-2021 13:57
General
-
Target
PaymentReceipt.js
-
Size
28KB
-
MD5
b199269852088f41919025ee636a8f6d
-
SHA1
3b0262420bf7a33d4265415e9245c4fa21f5398f
-
SHA256
2432c50fa8569fb4e19d7fe0630b9a4e2657465e9fe30dc9248b04a62af02c9f
-
SHA512
477f79c85277576ecf87153fe86fe8eb31c81a2982e84b68f5dd4d190446b20961cebca6dbd082661c8c50d14e157ec44acfab60efe3556d0691ec1e2faa7da0
Score
10/10
Malware Config
Signatures
-
Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
-
Blocklisted process makes network request 21 IoCs
-
Drops startup file 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\PaymentReceipt.js1⤵
- Blocklisted process makes network request
- Drops startup file