Analysis date (UTC): 21 November 2019, 16:41Analysis environment: Windows 7 Pro, build 7601, x86

bmd7i29.JS

MD5:12E8BA05EFFEA4B55613C16B1439986F
SHA1:BA1B7B7BB7C4E028C0F392C1EF19B58569DBAC7B
SHA256:2C7FA3A8BCC108185DA9F9CB9C4218578FA30CF03CA9A8FEA3379CB89374FB77

Analysis result

Behavior activities

MALICIOUS

Changes settings of System certificates

  • WScript.exe (PID: 1412)

Uses BITADMIN.EXE for downloading application

  • WScript.exe (PID: 1412)

SUSPICIOUS

Adds / modifies Windows certificates

  • WScript.exe (PID: 1412)

Creates files in the user directory

  • WScript.exe (PID: 1412)

Starts CMD.EXE for commands execution

  • WScript.exe (PID: 1412)

INFO

No info indicators.

Threats

PIDProcessClassMessage
1080svchost.exePotentially Bad TrafficET INFO DNS Query for Suspicious .ml Domain
1412WScript.exePotentially Bad TrafficET INFO Suspicious Domain (*.ml) in TLS SNI
1080svchost.exePotentially Bad TrafficET INFO DNS Query for Suspicious .gq Domain
——Potentially Bad TrafficET INFO Suspicious Domain (*.gq) in TLS SNI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Interactive malware hunting service ANY.RUN