Analysis

  • max time kernel
    144s
  • max time network
    147s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    18-01-2021 08:30

General

  • Target

    PaymentReceipt_345.js

  • Size

    27KB

  • MD5

    498ecc30f8856e7c6a509fbc73b86df6

  • SHA1

    4b4fe0f6aeb00eb63ff12953bececc7eb66a78f8

  • SHA256

    b96dc64b8a8f309058d5a311527a5eddb286f0e0c9b4771a5e52449b45d1c704

  • SHA512

    e4aa5cc9a27f7835457218189d360aa1076db51c4de3ccf9979a569175a6ed76d36dfb54c666d9ce9fdb0ffe51759ab053df30f2c5f7674522cda7a78ad137e4

Score
10/10

Malware Config

Signatures

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

  • Blocklisted process makes network request 9 IoCs
  • Drops startup file 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\PaymentReceipt_345.js
    1⤵
    • Blocklisted process makes network request
    • Drops startup file
    PID:744

Network

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads