Analysis
- user interaction
yes - max time kernel
600s - max time network
597s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-es - resource tags
- submitted
06/07/2026, 21:08
General
- Target agent_1780445774.ps1
- Size 38KB
- Sample260706-zza1jsgy2k
- SHA256 026a8d90fae2f2e256bbb9f095fed3296dff7b3f031d1178147d5e7f331beaf5
Malware Config
Extracted
-
vjw0rm
-
http://duck12.dynuddns.net:1234
Signatures
- Family: Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
- Badlisted process makes network request 6 IoCs
Network request originating from process or tool commonly abused by malware.
- Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\agent_1780445774.ps11⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gg21jdlg\gg21jdlg.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEF14.tmp" "c:\Users\Admin\AppData\Local\Temp\gg21jdlg\CSC5D5590E377C74EEDBE52D4EAADED1E6D.TMP"3⤵
-
-
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RESEF14.tmp
gg21jdlg.dll
CSC5D5590E377C74EEDBE52D4EAADED1E6D.TMP
gg21jdlg.0.cs
gg21jdlg.cmdline
memory/4092-30-0x00007FFAD8D30000-0x00007FFAD96D4000-memory.dmp
memory/4092-29-0x000001D146350000-0x000001D146402000-memory.dmp
memory/4092-9-0x00007FFAD8D30000-0x00007FFAD96D4000-memory.dmp
memory/4092-10-0x00007FFAD8D30000-0x00007FFAD96D4000-memory.dmp
memory/4092-11-0x00007FFAD8D30000-0x00007FFAD96D4000-memory.dmp
memory/4092-12-0x00007FFAD8D30000-0x00007FFAD96D4000-memory.dmp
memory/4092-8-0x00007FFAD8D30000-0x00007FFAD96D4000-memory.dmp
memory/4092-6-0x000001D1460A0000-0x000001D1460B0000-memory.dmp
memory/4092-5-0x000001D1461D0000-0x000001D1461F2000-memory.dmp
memory/4092-25-0x000001D1460B0000-0x000001D1460B8000-memory.dmp
memory/4092-1-0x00007FFAD8D30000-0x00007FFAD96D4000-memory.dmp
memory/4092-2-0x000001D146260000-0x000001D1462E2000-memory.dmp
memory/4092-28-0x000001D146330000-0x000001D14634E000-memory.dmp
memory/4092-0-0x00007FFAD8EBF000-0x00007FFAD8EC0000-memory.dmp
memory/4092-31-0x000001D146410000-0x000001D14641A000-memory.dmp
memory/4092-7-0x000001D146440000-0x000001D146542000-memory.dmp
memory/4092-34-0x000001D1468D0000-0x000001D1468E4000-memory.dmp
memory/4092-35-0x000001D146330000-0x000001D146338000-memory.dmp
memory/4092-33-0x000001D146900000-0x000001D146924000-memory.dmp
memory/4092-32-0x000001D146900000-0x000001D14692A000-memory.dmp
memory/4092-36-0x000001D146A40000-0x000001D146A8A000-memory.dmp
memory/4092-38-0x00007FFAD8D30000-0x00007FFAD96D4000-memory.dmp
memory/4092-39-0x00007FFAD8D30000-0x00007FFAD96D4000-memory.dmp
memory/4092-37-0x00007FFAD8D30000-0x00007FFAD96D4000-memory.dmp
memory/4092-40-0x00007FFAD8D30000-0x00007FFAD96D4000-memory.dmp
memory/4092-41-0x00007FFAD8D30000-0x00007FFAD96D4000-memory.dmp
memory/4092-42-0x00007FFAD8D30000-0x00007FFAD96D4000-memory.dmp
memory/4092-44-0x00007FFAD8D30000-0x00007FFAD96D4000-memory.dmp
memory/4092-45-0x00007FFAD8D30000-0x00007FFAD96D4000-memory.dmp
memory/4092-46-0x00007FFAD8D30000-0x00007FFAD96D4000-memory.dmp
memory/4092-47-0x000001D146E90000-0x000001D146ED0000-memory.dmp