vjw0rm | f16c66e9093e8357697dee345f91ae04cb930c14bdb416c688cbbbaa957f61b9

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
24-01-2025 18:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

run.vbs
Size

2KB
MD5

fe141a7870cdfc98d359c8f0f9bf160f
SHA1

d32577b8ba6d761c4ca0c03ebeb0e46799d92090
SHA256

f16c66e9093e8357697dee345f91ae04cb930c14bdb416c688cbbbaa957f61b9
SHA512

7f13c9ceeaa368bacbe9e91cfd848bfda1811a24a05533d45bea5cf8165c0ce4e9fc47107c1fe4d876ba0c8fe187b9c7b97419d0adbe9a2a4caaae49eb79b65b

Score

10^/10

vjw0rm trojan worm

Malware Config

Extracted

Family

vjw0rm

http://185.208.156.153:6656

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm
Vjw0rm family
vjw0rm

Blocklisted process makes network request 1 IoCs

flow	pid	Process
4	2020	WScript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Install32.vbs	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Install32.vbs	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\run.vbs"
1⤵
- Blocklisted process makes network request
- Drops startup file
PID:2020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads