vjw0rm | 5bc2b0c80deeed2b330b57fc9324fd773e86cfc04bb793f8ba34e165e8165bcf

Analysis

Target

Receipt.js
Size

25KB
MD5

84f3f222c717a35af83fef144ed95736
SHA1

3dac370ffdcd4978abf35181cfd8472b8f472a9e
SHA256

2f222cf2393537683a329ee33618b7a0cda47cad19e28f4f39e15e6757e9c2d3
SHA512

64aa583b0e982bdb6a4e4e7bfe91c7118787a3cd71998b1f7ce656d43cc816d3b07f6cbc0eeaecec3ba13a0a0e1709f5b271ba1e9e5ba308be878a22591a65b8

Score

10^/10

vjw0rm trojan worm

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm
Blocklisted process makes network request 4 IoCs

Processes:

wscript.exe

flow pid process

7 4012 wscript.exe
9 4012 wscript.exe
11 4012 wscript.exe
14 4012 wscript.exe

Drops startup file 2 IoCs

Processes:

wscript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Receipt.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Receipt.js	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact