vjw0rm | cffb071d85ac7db9a68460e0128f0b14544c8186a7edc5da07de1e82068049ba

Analysis

Target

cffb071d85ac7db9a68460e0128f0b14544c8186a7edc5da07de1e82068049ba.js
Size

67KB
MD5

0ada3a5e5a1c79b8c5f62097063f39ed
SHA1

806fcb782e7129ebd60aca7f40d3d5ec0d55e9e3
SHA256

cffb071d85ac7db9a68460e0128f0b14544c8186a7edc5da07de1e82068049ba
SHA512

d53d88215729bbb5cd4f7f3415a1564046f232820baf8b3aba0ed29345cb6ca13c1b23e9c75c874ee2f4738e77aaba9c133d3f17db0a0bd44fb7986be09b3950

Score

10^/10

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm
Blocklisted process makes network request 6 IoCs

Processes:

wscript.exe

flow pid process

3 644 wscript.exe
4 644 wscript.exe
6 644 wscript.exe
7 644 wscript.exe
8 644 wscript.exe
9 644 wscript.exe

Adds Run key to start application 2 TTPs 2 IoCs

Registry Run Keys / Startup Folder

Modify Registry

Processes:

wscript.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\4JUOQRM7HR = "'C:\\Users\\Admin\\AppData\\Local\\Temp\\cffb071d85ac7db9a68460e0128f0b14544c8186a7edc5da07de1e82068049ba.js'"	wscript.exe

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

memory/644-54-0x000007FEFC521000-0x000007FEFC523000-memory.dmp

Filesize
8KB

Download