analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

PO MISSING.js

Full analysis: https://app.any.run/tasks/441dfc04-bdfe-4d90-a535-549e6086f3bb
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Analysis date: January 30, 2019, 20:37:24
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
vjworm
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines
MD5:

B9998D859C04AA680E0C6F8D2AE2960F

SHA1:

D93B98E8080B27E791F6F3CD0C2012C043A6EAE9

SHA256:

E9F7DCDDD2EE27234473A9B7DFEF2518D35A32B43789E45C4883027C63846013

SSDEEP:

384:rkqKVB+trVc7fpWP/7xxZL+/3Bbom0xtwAAuLtNknqIYSwFLczwoquEwucN+Rldx:oqxce7XZL+/35aAQtq8K7uFl0bkAVqZp

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Writes to a start menu file

      • WScript.exe (PID: 2956)
      • wscript.exe (PID: 180)
    • VJWORM was detected

      • WScript.exe (PID: 2956)
    • Connects to CnC server

      • WScript.exe (PID: 2956)
    • Changes the autorun value in the registry

      • wscript.exe (PID: 180)
  • SUSPICIOUS

    • Creates files in the user directory

      • wscript.exe (PID: 180)
      • WScript.exe (PID: 2956)
    • Connects to unusual port

      • WScript.exe (PID: 2956)
    • Executes scripts

      • WScript.exe (PID: 2956)
    • Application launched itself

      • WScript.exe (PID: 2956)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
32
Monitored processes
2
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #VJWORM wscript.exe wscript.exe

Process information

PID
CMD
Path
Indicators
Parent process
2956"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\PO MISSING.js"C:\Windows\System32\WScript.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Version:
5.8.7600.16385
180"C:\Windows\System32\wscript.exe" //B "C:\Users\admin\AppData\Roaming\LedYQPXzhk.js"C:\Windows\System32\wscript.exe
WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Version:
5.8.7600.16385
Total events
222
Read events
187
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
0
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
2956WScript.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PO MISSING.jstext
MD5:B9998D859C04AA680E0C6F8D2AE2960F
SHA256:E9F7DCDDD2EE27234473A9B7DFEF2518D35A32B43789E45C4883027C63846013
2956WScript.exeC:\Users\admin\AppData\Roaming\LedYQPXzhk.jstext
MD5:CAD4BC9051CF3804EDDDABE9F0190F29
SHA256:683F2E7F9A7A5C9E4468A50E42A59B60CC8CBC22873B5D980CDDA579A32DAAA2
180wscript.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LedYQPXzhk.jstext
MD5:CAD4BC9051CF3804EDDDABE9F0190F29
SHA256:683F2E7F9A7A5C9E4468A50E42A59B60CC8CBC22873B5D980CDDA579A32DAAA2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
2
DNS requests
0
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2956
WScript.exe
POST
200
176.32.194.244:2019
http://176.32.194.244:2019/Vre
AM
malicious
2956
WScript.exe
POST
176.32.194.244:2019
http://176.32.194.244:2019/Vre
AM
malicious
2956
WScript.exe
POST
200
176.32.194.244:2019
http://176.32.194.244:2019/Vre
AM
malicious
2956
WScript.exe
POST
200
176.32.194.244:2019
http://176.32.194.244:2019/Vre
AM
malicious
2956
WScript.exe
POST
200
176.32.194.244:2019
http://176.32.194.244:2019/Vre
AM
malicious
2956
WScript.exe
POST
200
176.32.194.244:2019
http://176.32.194.244:2019/Vre
AM
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2956
WScript.exe
176.32.194.244:2019
Interactive TV LLC
AM
malicious

DNS requests

No data

Threats

PID
Process
Class
Message
2956
WScript.exe
A Network Trojan was detected
MALWARE [PTsecurity] VJworm activity
2956
WScript.exe
A Network Trojan was detected
MALWARE [PTsecurity] vjw0rm
2956
WScript.exe
A Network Trojan was detected
MALWARE [PTsecurity] VJworm activity
2956
WScript.exe
A Network Trojan was detected
MALWARE [PTsecurity] vjw0rm
2956
WScript.exe
A Network Trojan was detected
MALWARE [PTsecurity] VJworm activity
2956
WScript.exe
A Network Trojan was detected
MALWARE [PTsecurity] vjw0rm
2956
WScript.exe
A Network Trojan was detected
MALWARE [PTsecurity] VJworm activity
2956
WScript.exe
A Network Trojan was detected
MALWARE [PTsecurity] vjw0rm
2956
WScript.exe
A Network Trojan was detected
MALWARE [PTsecurity] VJworm activity
2956
WScript.exe
A Network Trojan was detected
MALWARE [PTsecurity] vjw0rm
10 ETPRO signatures available at the full report
No debug info