vjw0rm | 69c51cafad5ae7fa8b0eb17d6a8cdb521356e1cffec1bd772989bba874f3b352 | Triage

Analysis

max time kernel
147s
max time network
149s
platform
windows7_x64
resource
win7v20201028
submitted
01-04-2021 16:33

Sharing

Report Analysis Logs

General

Target

kfjforderreceipt.js
Size

92KB
MD5

1b35f717f4fb2916d4f2a8df50e5313b
SHA1

078f27b1024c5287408339fc760e5aec6674856e
SHA256

69c51cafad5ae7fa8b0eb17d6a8cdb521356e1cffec1bd772989bba874f3b352
SHA512

d6930aca7e64b0683c68a900221f9ec52c8f6317d08a47a72217687adb8b5d89e3909e00bac71dd3a0d7bbf5244ceeb578b69f380f272ceea6977e192300f076

Score

10^/10

vjw0rm trojan worm

Malware Config

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm
Blocklisted process makes network request 1 IoCs

Processes:

wscript.exe

flow pid process

5 1636 wscript.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\kfjforderreceipt.js
1⤵
- Blocklisted process makes network request
PID:1636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1216-2-0x000007FEF6380000-0x000007FEF65FA000-memory.dmp

Filesize
2.5MB

Download