vjw0rm | 7209b5eaae21d79e72ea7fad3fdf9430e4f6fa4c4011c29fdedb71035f35e0b9

Analysis

Target

NOTIFICACION DE TRANSFERENCIA VIRTUAL EXITOSA.js
Size

2.4MB
MD5

d720234b5136a9aab99e6bb59b6f45c5
SHA1

9833e954338d45830ab5603486319f4a46ceca01
SHA256

7209b5eaae21d79e72ea7fad3fdf9430e4f6fa4c4011c29fdedb71035f35e0b9
SHA512

131009b183d9c73bb2456e4834da4e8f1c72ac6c67201915754d4b899eefffd1de67eeb0fbc56bc3a359f8310516e7a9e12f892c376e317a53af89f183c1019c

Score

10^/10

vjw0rm trojan worm

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm
Blocklisted process makes network request 5 IoCs

Processes:

wscript.exe

flow pid process

19 3656 wscript.exe
25 3656 wscript.exe
28 3656 wscript.exe
29 3656 wscript.exe
30 3656 wscript.exe

Drops startup file 2 IoCs

Processes:

wscript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NOTIFICACION DE TRANSFERENCIA VIRTUAL EXITOSA.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NOTIFICACION DE TRANSFERENCIA VIRTUAL EXITOSA.js	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact