vjw0rm | 91a70ece7662934450a1fa1567311523cec2656d2b1865f20abfad5557362a06 | Triage

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
17-06-2022 11:52

Sharing

Report Analysis Logs

General

Target

List_Of_Transfers_and_Managers_promotions_dtd_details_pdf.js
Size

403KB
MD5

863c56001819a39a8b63da22f03920ef
SHA1

b9dd426309b1d26b667f748dc35aba3c1d741bb9
SHA256

91a70ece7662934450a1fa1567311523cec2656d2b1865f20abfad5557362a06
SHA512

4d4779b8c2a6d1b71826adff55545d9ad7aea0b10bf023c1941bc774425cc3a186d44d23813a1c25f5bbca5de615d700c84df798f0826173dc2c13e1f0437bab

Score

10^/10

vjw0rm trojan worm

Malware Config

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm

Blocklisted process makes network request 16 IoCs

Processes:

wscript.exe

flow	pid	process
6	2532	wscript.exe
12	2532	wscript.exe
18	2532	wscript.exe
20	2532	wscript.exe
27	2532	wscript.exe
29	2532	wscript.exe
32	2532	wscript.exe
36	2532	wscript.exe
39	2532	wscript.exe
40	2532	wscript.exe
41	2532	wscript.exe
42	2532	wscript.exe
43	2532	wscript.exe
44	2532	wscript.exe
45	2532	wscript.exe
46	2532	wscript.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\List_Of_Transfers_and_Managers_promotions_dtd_details_pdf.js
1⤵
- Blocklisted process makes network request
PID:2532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...