Overview

overview

10

Static

static

receipt.js

windows7_x64

10

receipt.js

windows10-2004_x64

10

Analysis

  • max time kernel
    157s
  • max time network
    173s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    11-02-2022 07:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    receipt.js

  • Size

    21KB

  • MD5

    fb34a8b0c4fb9221726c41f66ad5a604

  • SHA1

    957ace13d02b3ff42d1d34037e7f348e00c8de94

  • SHA256

    d659d288e3b316568f0ef98b2f8a14b57b2f620818fa01fba1741d5f0f0f0925

  • SHA512

    53cd70534f7fdf52ef57981694761325076dff190cd1911966c29dab0cd1b1b6417bde0dbe65780f0b0ccc89649e4f776441c577717d4e0169c4fd84a5f061dc

Score
10/10
vjw0rmpersistencetrojanworm

Malware Config

Signatures

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

    trojanwormvjw0rm
  • Blocklisted process makes network request 26 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 3 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\receipt.js
    1⤵
    • Blocklisted process makes network request
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:5060
    • C:\Windows\System32\wscript.exe
      "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\tOiJLeONJD.js"
      2⤵
      • Blocklisted process makes network request
      • Drops startup file
      • Adds Run key to start application
      PID:5080
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\receipt.js
      2⤵
      • Creates scheduled task(s)
      PID:4932
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2844
  • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
    C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2772

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\tOiJLeONJD.js
    MD5

    e2b3a0b7a66b20f08bf748baed1eec41

    SHA1

    a94dd7e0819aa43080574f80da8195bd84e86a0e

    SHA256

    ba188f267eb3aff4ee8dee77e77389b97d9298a020bd369ad078836c31436dfd

    SHA512

    ac524fd11905c5d5a3ab8d13d95be4b3fbc6edf44a14844b80ccdf868f39b95a710dac26607adde77fdb02ed4ce081bfc28c52148692ddb76d83c60ee1b92f66

    Download Submit

  • memory/2844-131-0x0000024463960000-0x0000024463970000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2844-132-0x0000024463F20000-0x0000024463F30000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2844-133-0x00000244665E0000-0x00000244665E4000-memory.dmp

    Filesize

    16KB

    Download