analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

«ПАО «НГК «Славнефть» подробности заказа.js

Full analysis: https://app.any.run/tasks/436ef94a-8caa-447a-a7d5-bfb380849d62
Verdict: Malicious activity
Analysis date: February 18, 2019, 11:37:09
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: text/plain
File info: ASCII text, with CRLF, LF line terminators
MD5:

1FC1C936DA1B3DFAF031CF634460C0CC

SHA1:

0319C7F581DCD5BF1E48002D183F71BB36A62E1B

SHA256:

22B1EA0639F1AB25E4050363266D219C17AAFBEC8F42F2E0CD119D6322810024

SSDEEP:

96:tMgFFHTUcsmshD3PUZT1OmTws34cKnEQW5cv3mITZoKLdPN:DPaFUZhOmTwfcK2vGomX

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    No malicious indicators.
  • SUSPICIOUS

    • Creates files in the user directory

      • WScript.exe (PID: 2972)
  • INFO

    • Reads settings of System Certificates

      • WScript.exe (PID: 2972)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
30
Monitored processes
1
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start wscript.exe

Process information

PID
CMD
Path
Indicators
Parent process
2972"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\«ПАО «НГК «Славнефть» подробности заказа.js"C:\Windows\System32\WScript.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Total events
74
Read events
46
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
0
Text files
0
Unknown types
1

Dropped files

PID
Process
Filename
Type
2972WScript.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\IETldCache\index.datdat
MD5:D7A950FEFD60DBAA01DF2D85FEFB3862
SHA256:75D0B1743F61B76A35B1FEDD32378837805DE58D79FA950CB6E8164BFA72073A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
2
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2972
WScript.exe
GET
404
217.160.94.110:80
http://www.katharinen-apotheke-braunschweig.de/wp-content/themes/zerif-lite/css/messg.jpg
DE
xml
345 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2972
WScript.exe
217.160.94.110:80
www.katharinen-apotheke-braunschweig.de
1&1 Internet SE
DE
suspicious
2972
WScript.exe
66.147.244.243:443
texassweetiesdogrescue.org
Unified Layer
US
unknown

DNS requests

Domain
IP
Reputation
texassweetiesdogrescue.org
  • 66.147.244.243
unknown
www.katharinen-apotheke-braunschweig.de
  • 217.160.94.110
malicious

Threats

No threats detected
No debug info