Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
22/09/2026, 00:10
General
- Target Sell Out - Daily Tracker.xlsx.js
- Size 2.0MB
- Sample260922-af3tsabf37
- SHA256 388cd4e1cd008e17b3fa205053e0e260eb70bcc15afb52d603dfa5d501393098
Malware Config
Signatures
- Family: Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
- Badlisted process makes network request 6 IoCs
Network request originating from process or tool commonly abused by malware.
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Sell Out - Daily Tracker.xlsx.js"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\KEgHNfIkNt.js"2⤵
- Badlisted process makes network request
- Creates a file in the Startup directory
-
-
C:\Users\Admin\AppData\Roaming\ESCO SERVER.exe"C:\Users\Admin\AppData\Roaming\ESCO SERVER.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Roaming\server\server.exeC:\Users\Admin\AppData\Roaming\server\server.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ESCO SERVER.exe
KEgHNfIkNt.js
memory/2948-10-0x00007FF88E82A000-0x00007FF88E82B000-memory.dmp
memory/2948-12-0x00007FF88E530000-0x00007FF88EF68000-memory.dmp
memory/2948-11-0x000000001C2A0000-0x000000001C76E000-memory.dmp
memory/2948-13-0x000000001BCC0000-0x000000001BD5C000-memory.dmp
memory/2948-14-0x00007FF88E530000-0x00007FF88EF68000-memory.dmp
memory/2948-15-0x0000000001660000-0x0000000001668000-memory.dmp
memory/2948-16-0x000000001C880000-0x000000001C926000-memory.dmp
memory/2948-17-0x00007FF88E530000-0x00007FF88EF68000-memory.dmp
memory/2948-18-0x00007FF88E530000-0x00007FF88EF68000-memory.dmp
memory/2948-19-0x00007FF88E530000-0x00007FF88EF68000-memory.dmp
memory/2948-20-0x00007FF88E530000-0x00007FF88EF68000-memory.dmp
memory/2948-21-0x00007FF88E530000-0x00007FF88EF68000-memory.dmp
memory/2948-22-0x00007FF88E530000-0x00007FF88EF68000-memory.dmp
memory/2948-23-0x00007FF88E530000-0x00007FF88EF68000-memory.dmp
memory/2948-24-0x00007FF88E530000-0x00007FF88EF68000-memory.dmp
memory/2948-25-0x00007FF88E530000-0x00007FF88EF68000-memory.dmp
memory/2948-27-0x000000001D7F0000-0x000000001D852000-memory.dmp
memory/2948-28-0x000000001DB20000-0x000000001DB39000-memory.dmp
memory/2948-32-0x00007FF88E82A000-0x00007FF88E82B000-memory.dmp
memory/2948-33-0x00007FF88E530000-0x00007FF88EF68000-memory.dmp
memory/2948-36-0x00007FF88E530000-0x00007FF88EF68000-memory.dmp
memory/2948-38-0x00007FF88E530000-0x00007FF88EF68000-memory.dmp
memory/2948-37-0x00007FF88E530000-0x00007FF88EF68000-memory.dmp
memory/2948-39-0x00007FF88E530000-0x00007FF88EF68000-memory.dmp