vjw0rm | fe310b776855f95612a6f8633c73df693a8b940bc10b2109e2c51f54be398b85

Analysis

max time kernel
0s
max time network
148s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
04-01-2024 06:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

40226ee8e5ccd983ec7446b068819477.js
Size

19KB
MD5

40226ee8e5ccd983ec7446b068819477
SHA1

9417c77384776b685a98293d0416646b18dddf01
SHA256

fe310b776855f95612a6f8633c73df693a8b940bc10b2109e2c51f54be398b85
SHA512

c09bdd3943bd724ac4e13fe6d32061cf54b0af7b726b6f777ba5621c57d6876db683a95ef2d7da95052a7284072f48dc8f5fbf0422d00e275c6026c097ab8cd1
SSDEEP

384:P9XmuVESfBOSNSkykjG4KrIXsaxmlItkCmNXBe1KMym/mukFqsnMPcDl4F9:P9X32SZOSI35qXCqsnMPcCF9

Score

10^/10

vjw0rm trojan worm

Malware Config

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2012	schtasks.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\40226ee8e5ccd983ec7446b068819477.js
1⤵
PID:2380
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\40226ee8e5ccd983ec7446b068819477.js
  2⤵
  - Creates scheduled task(s)
  PID:2012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads