File name:

Payment-proof-270966-867AS.js

Full analysis: https://app.any.run/tasks/f7d38077-fc62-4371-a58d-303a95fb1694
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Malware Trends Tracker     >>>
Analysis date: May 21, 2025, 07:56:29
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
wshrat
remote
rat
auto-startup
asyncrat
auto-reg
netreactor
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines (64342), with CRLF line terminators
MD5:

593A0880D28A1EF789797DE643A6D8A1

SHA1:

032897DCA15C145D7DC7D61B25DCA3B0A4C33080

SHA256:

4E70248F724F506EAE27284720B02F5DBA15FBBA54074C11AC32790DCC85C2A1

SSDEEP:

24576:8EL6Cpnun5uawwM3jpgod99DOnsOHxecBI:V6vn5EwK99ShXS

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Gets path to any of the special folders (SCRIPT)

      • wscript.exe (PID: 7424)
      • wscript.exe (PID: 7504)
      • wscript.exe (PID: 7476)
      • wscript.exe (PID: 7592)
      • wscript.exe (PID: 7944)
      • wscript.exe (PID: 8008)

    • Uses base64 encoding (SCRIPT)

      • wscript.exe (PID: 7424)
      • wscript.exe (PID: 7504)

    • Gets %appdata% folder path (SCRIPT)

      • wscript.exe (PID: 7476)
      • wscript.exe (PID: 7592)
      • wscript.exe (PID: 7944)
      • wscript.exe (PID: 8008)

    • Checks whether a specified folder exists (SCRIPT)

      • wscript.exe (PID: 7476)
      • wscript.exe (PID: 7592)
      • wscript.exe (PID: 7944)
      • wscript.exe (PID: 8008)

    • Accesses environment variables (SCRIPT)

      • wscript.exe (PID: 7476)
      • wscript.exe (PID: 7592)
      • wscript.exe (PID: 7944)
      • wscript.exe (PID: 8008)

    • Reads the value of a key from the registry (SCRIPT)

      • wscript.exe (PID: 7476)
      • wscript.exe (PID: 7592)
      • wscript.exe (PID: 7944)
      • wscript.exe (PID: 8008)

    • Creates a new registry key or changes the value of an existing one (SCRIPT)

      • wscript.exe (PID: 7476)
      • wscript.exe (PID: 7592)
      • wscript.exe (PID: 7944)
      • wscript.exe (PID: 8008)

    • Gets startup folder path (SCRIPT)

      • wscript.exe (PID: 7476)
      • wscript.exe (PID: 7592)
      • wscript.exe (PID: 7944)
      • wscript.exe (PID: 8008)

    • Detects the decoding of a binary file from Base64 (SCRIPT)

      • wscript.exe (PID: 7504)

    • Modifies registry startup key (SCRIPT)

      • wscript.exe (PID: 7476)
      • wscript.exe (PID: 7592)
      • wscript.exe (PID: 7944)
      • wscript.exe (PID: 8008)

    • Create files in the Startup directory

      • wscript.exe (PID: 7476)

    • Gets a file object corresponding to the file in a specified path (SCRIPT)

      • wscript.exe (PID: 7476)
      • wscript.exe (PID: 7592)
      • wscript.exe (PID: 7944)
      • wscript.exe (PID: 8008)

    • Executing a file with an untrusted certificate

      • audiodg.exe (PID: 7620)
      • audiodg.exe (PID: 7864)
      • audiodg.exe (PID: 7872)
      • svchost.exe (PID: 1660)
      • svchost.exe (PID: 6272)
      • svchost.exe (PID: 672)
      • svchost.exe (PID: 5800)

    • Copies file to a new location (SCRIPT)

      • wscript.exe (PID: 7476)
      • wscript.exe (PID: 7592)
      • wscript.exe (PID: 7944)
      • wscript.exe (PID: 8008)

    • Creates internet connection object (SCRIPT)

      • wscript.exe (PID: 7592)
      • wscript.exe (PID: 7476)
      • wscript.exe (PID: 7944)
      • wscript.exe (PID: 8008)

    • Opens a text file (SCRIPT)

      • wscript.exe (PID: 7592)
      • wscript.exe (PID: 8008)

    • Opens an HTTP connection (SCRIPT)

      • wscript.exe (PID: 7592)
      • wscript.exe (PID: 8008)

    • Gets username (SCRIPT)

      • wscript.exe (PID: 7592)
      • wscript.exe (PID: 8008)

    • Accesses information about the status of the installed antivirus(Win32_AntivirusProduct) via WMI (SCRIPT)

      • wscript.exe (PID: 7592)
      • wscript.exe (PID: 8008)

    • Sends HTTP request (SCRIPT)

      • wscript.exe (PID: 7592)
      • wscript.exe (PID: 8008)

    • Connects to the CnC server

      • wscript.exe (PID: 7592)
      • wscript.exe (PID: 8008)

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 7592)
      • wscript.exe (PID: 8008)

    • WSHRAT has been detected (SURICATA)

      • wscript.exe (PID: 7592)
      • wscript.exe (PID: 8008)

    • ASYNCRAT has been detected (MUTEX)

      • audiodg.exe (PID: 7872)
      • svchost.exe (PID: 672)
      • svchost.exe (PID: 5800)

    • Changes the autorun value in the registry

      • audiodg.exe (PID: 7872)

    • ASYNCRAT has been detected (YARA)

      • svchost.exe (PID: 672)

  • SUSPICIOUS

    • The process executes JS scripts

      • wscript.exe (PID: 7424)
      • wscript.exe (PID: 7476)
      • wscript.exe (PID: 7944)

    • Writes binary data to a Stream object (SCRIPT)

      • wscript.exe (PID: 7424)
      • wscript.exe (PID: 7504)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • wscript.exe (PID: 7476)
      • wscript.exe (PID: 7424)
      • wscript.exe (PID: 7592)
      • wscript.exe (PID: 7504)
      • wscript.exe (PID: 7944)
      • wscript.exe (PID: 8008)

    • Creates a Stream, which may work with files, input/output devices, pipes, or TCP/IP sockets (SCRIPT)

      • wscript.exe (PID: 7424)
      • wscript.exe (PID: 7504)

    • Creates XML DOM element (SCRIPT)

      • wscript.exe (PID: 7424)
      • wscript.exe (PID: 7504)

    • Script creates XML DOM node (SCRIPT)

      • wscript.exe (PID: 7424)
      • wscript.exe (PID: 7504)

    • Sets XML DOM element text (SCRIPT)

      • wscript.exe (PID: 7424)
      • wscript.exe (PID: 7504)

    • Application launched itself

      • wscript.exe (PID: 7424)
      • wscript.exe (PID: 7476)
      • audiodg.exe (PID: 7620)
      • wscript.exe (PID: 7944)
      • svchost.exe (PID: 6272)
      • svchost.exe (PID: 1660)

    • Saves data to a binary file (SCRIPT)

      • wscript.exe (PID: 7424)
      • wscript.exe (PID: 7504)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 7424)
      • wscript.exe (PID: 7476)
      • wscript.exe (PID: 7504)
      • wscript.exe (PID: 7944)

    • Gets name of the script (SCRIPT)

      • wscript.exe (PID: 7476)
      • wscript.exe (PID: 7592)
      • wscript.exe (PID: 7944)
      • wscript.exe (PID: 8008)

    • Gets full path of the running script (SCRIPT)

      • wscript.exe (PID: 7476)
      • wscript.exe (PID: 7592)
      • wscript.exe (PID: 7944)
      • wscript.exe (PID: 8008)

    • Executable content was dropped or overwritten

      • wscript.exe (PID: 7504)
      • audiodg.exe (PID: 7872)

    • Gets a collection of all available drive names (SCRIPT)

      • wscript.exe (PID: 7592)
      • wscript.exe (PID: 8008)

    • Checks whether the drive is ready (SCRIPT)

      • wscript.exe (PID: 7592)
      • wscript.exe (PID: 8008)

    • Gets the drive type (SCRIPT)

      • wscript.exe (PID: 7592)
      • wscript.exe (PID: 8008)

    • Gets disk free space (SCRIPT)

      • wscript.exe (PID: 7592)
      • wscript.exe (PID: 8008)

    • Accesses WMI object, sets custom ImpersonationLevel (SCRIPT)

      • wscript.exe (PID: 7592)
      • wscript.exe (PID: 8008)

    • Gets computer name (SCRIPT)

      • wscript.exe (PID: 7592)
      • wscript.exe (PID: 8008)

    • Executes WMI query (SCRIPT)

      • wscript.exe (PID: 7592)
      • wscript.exe (PID: 8008)

    • Accesses local storage devices (Win32_LogicalDisk) via WMI (SCRIPT)

      • wscript.exe (PID: 7592)
      • wscript.exe (PID: 8008)

    • Accesses current user name via WMI (SCRIPT)

      • wscript.exe (PID: 7592)
      • wscript.exe (PID: 8008)

    • Accesses OperatingSystem(Win32_OperatingSystem) via WMI (SCRIPT)

      • wscript.exe (PID: 7592)
      • wscript.exe (PID: 8008)

    • Accesses computer name via WMI (SCRIPT)

      • wscript.exe (PID: 7592)
      • wscript.exe (PID: 8008)

    • Accesses operating system name via WMI (SCRIPT)

      • wscript.exe (PID: 7592)
      • wscript.exe (PID: 8008)

    • Accesses WMI object caption (SCRIPT)

      • wscript.exe (PID: 7592)
      • wscript.exe (PID: 8008)

    • Accesses WMI object display name (SCRIPT)

      • wscript.exe (PID: 7592)
      • wscript.exe (PID: 8008)

    • Accesses antivirus product name via WMI (SCRIPT)

      • wscript.exe (PID: 7592)
      • wscript.exe (PID: 8008)

    • Adds, changes, or deletes HTTP request header (SCRIPT)

      • wscript.exe (PID: 7592)
      • wscript.exe (PID: 8008)

    • Connects to unusual port

      • wscript.exe (PID: 7592)
      • wscript.exe (PID: 8008)
      • svchost.exe (PID: 672)

    • Contacting a server suspected of hosting an CnC

      • wscript.exe (PID: 7592)
      • wscript.exe (PID: 8008)

    • The process creates files with name similar to system file names

      • audiodg.exe (PID: 7872)

    • Executing commands from a ".bat" file

      • audiodg.exe (PID: 7872)

    • Starts CMD.EXE for commands execution

      • audiodg.exe (PID: 7872)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 8164)

    • The executable file from the user directory is run by the CMD process

      • svchost.exe (PID: 1660)

  • INFO

    • Auto-launch of the file from Startup directory

      • wscript.exe (PID: 7476)

    • Self-termination (SCRIPT)

      • wscript.exe (PID: 7476)
      • wscript.exe (PID: 7944)

    • Checks supported languages

      • audiodg.exe (PID: 7620)
      • audiodg.exe (PID: 7872)
      • svchost.exe (PID: 6272)
      • svchost.exe (PID: 1660)
      • svchost.exe (PID: 672)
      • svchost.exe (PID: 5800)

    • Reads the computer name

      • audiodg.exe (PID: 7620)
      • audiodg.exe (PID: 7872)
      • svchost.exe (PID: 6272)
      • svchost.exe (PID: 1660)
      • svchost.exe (PID: 672)
      • svchost.exe (PID: 5800)

    • Reads the machine GUID from the registry

      • audiodg.exe (PID: 7620)
      • audiodg.exe (PID: 7872)
      • svchost.exe (PID: 6272)
      • svchost.exe (PID: 1660)
      • svchost.exe (PID: 672)
      • svchost.exe (PID: 5800)

    • Checks proxy server information

      • wscript.exe (PID: 7592)
      • wscript.exe (PID: 8008)
      • slui.exe (PID: 6944)

    • Manual execution by a user

      • wscript.exe (PID: 7800)
      • wscript.exe (PID: 7944)
      • svchost.exe (PID: 6272)

    • .NET Reactor protector has been detected

      • audiodg.exe (PID: 7620)
      • svchost.exe (PID: 6272)

    • Create files in a temporary directory

      • audiodg.exe (PID: 7872)

    • Creates files or folders in the user directory

      • audiodg.exe (PID: 7872)

    • Auto-launch of the file from Registry key

      • audiodg.exe (PID: 7872)

    • Reads the software policy settings

      • slui.exe (PID: 6944)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

AsyncRat

(PID) Process(672) svchost.exe
C2 (1)riches20.kozow.com
Ports (2)7016
50161
Version0.5.7B
BotnetAPRIL
Options
AutoRuntrue
MutexAsyncMutex_6SI8OkPnk
InstallFolder%AppData%
BSoDfalse
AntiVMfalse
Certificates
Cert1MIIE8jCCAtqgAwIBAgIQAK1iGMS9gWYqLrMppp102zANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjUwNTAyMDA1NjU1WhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAOHKtfV4aL31K42CDGFem3U+XxcXVo8nALruNYZt9r8zrzdA6jTOv0m278ynFY0Zam3Y5eeGwcJq...
Server_SignatureGnsLa3Q00V8Xn+k2KNkcPGsbYzNV9jpNg+29cLhwnnTsihW4K6F9sunRo/Oc38DYXO881XBHaaRd+PuESPQyxtpX8byynIbm2sfismxFWReE8807cbIE/t2/e8GHrKbXGLtV4mvUU8H0Wgmdc9iEr9wqqLev3vGw4cJJJmSOtxtPm3rjsboPPPq6ZR0dsWv0Ljysy+Nz8DWIkR5u68hRB1Kb47CwYRHzVFANVfZs43NhNzniTIo4mQ2NrByPguROVDz6sIFvhKsIrIXUTs/0L0OmW8pJatgrm5ujaUhWDvDm...
Keys
AESef401961cfcc8b89b0768d5affdf5c862e9a8c25458283dc2364b368d33cadd5
Saltbfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
No Malware configuration.
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
140
Monitored processes
19
Malicious processes
13
Suspicious processes
1

Behavior graph

Click at the process to see the details
start wscript.exe no specs wscript.exe wscript.exe #WSHRAT wscript.exe audiodg.exe no specs svchost.exe wscript.exe no specs audiodg.exe no specs #ASYNCRAT audiodg.exe wscript.exe no specs #WSHRAT wscript.exe cmd.exe no specs conhost.exe no specs timeout.exe no specs svchost.exe no specs svchost.exe no specs #ASYNCRAT svchost.exe #ASYNCRAT svchost.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
672"C:\Users\admin\AppData\Roaming\svchost.exe"C:\Users\admin\AppData\Roaming\svchost.exe
svchost.exe
User:
admin
Company:
博典创新科技
Integrity Level:
MEDIUM
Description:
亚历山大学者版
Version:
3.5.2240.18
Modules
Images
c:\users\admin\appdata\roaming\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
AsyncRat
(PID) Process(672) svchost.exe
C2 (1)riches20.kozow.com
Ports (2)7016
50161
Version0.5.7B
BotnetAPRIL
Options
AutoRuntrue
MutexAsyncMutex_6SI8OkPnk
InstallFolder%AppData%
BSoDfalse
AntiVMfalse
Certificates
Cert1MIIE8jCCAtqgAwIBAgIQAK1iGMS9gWYqLrMppp102zANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjUwNTAyMDA1NjU1WhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAOHKtfV4aL31K42CDGFem3U+XxcXVo8nALruNYZt9r8zrzdA6jTOv0m278ynFY0Zam3Y5eeGwcJq...
Server_SignatureGnsLa3Q00V8Xn+k2KNkcPGsbYzNV9jpNg+29cLhwnnTsihW4K6F9sunRo/Oc38DYXO881XBHaaRd+PuESPQyxtpX8byynIbm2sfismxFWReE8807cbIE/t2/e8GHrKbXGLtV4mvUU8H0Wgmdc9iEr9wqqLev3vGw4cJJJmSOtxtPm3rjsboPPPq6ZR0dsWv0Ljysy+Nz8DWIkR5u68hRB1Kb47CwYRHzVFANVfZs43NhNzniTIo4mQ2NrByPguROVDz6sIFvhKsIrIXUTs/0L0OmW8pJatgrm5ujaUhWDvDm...
Keys
AESef401961cfcc8b89b0768d5affdf5c862e9a8c25458283dc2364b368d33cadd5
Saltbfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
1660"C:\Users\admin\AppData\Roaming\svchost.exe" C:\Users\admin\AppData\Roaming\svchost.exe—cmd.exe
User:
admin
Company:
博典创新科技
Integrity Level:
MEDIUM
Description:
亚历山大学者版
Exit code:
0
Version:
3.5.2240.18
Modules
Images
c:\users\admin\appdata\roaming\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3176timeout 3 C:\Windows\SysWOW64\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
5800"C:\Users\admin\AppData\Roaming\svchost.exe"C:\Users\admin\AppData\Roaming\svchost.exe
svchost.exe
User:
admin
Company:
博典创新科技
Integrity Level:
MEDIUM
Description:
亚历山大学者版
Exit code:
0
Version:
3.5.2240.18
Modules
Images
c:\users\admin\appdata\roaming\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
6272"C:\Users\admin\AppData\Roaming\svchost.exe"C:\Users\admin\AppData\Roaming\svchost.exe—explorer.exe
User:
admin
Company:
博典创新科技
Integrity Level:
MEDIUM
Description:
亚历山大学者版
Exit code:
0
Version:
3.5.2240.18
Modules
Images
c:\users\admin\appdata\roaming\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
6944C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7424"C:\Windows\System32\WScript.exe" C:\Users\admin\Desktop\Payment-proof-270966-867AS.jsC:\Windows\System32\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7476"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\adobe.js" C:\Windows\System32\wscript.exe
wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7504"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\svchost.js" C:\Windows\System32\wscript.exe
wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
9 839
Read events
9 778
Write events
61
Delete events
0

Modification events

(PID) Process:(7424) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.js\OpenWithProgids
Operation:writeName:JSFile
Value:
(PID) Process:(7424) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Script\Settings\Telemetry\wscript.exe
Operation:writeName:JScriptSetScriptStateStarted
Value:
90C3100000000000
(PID) Process:(7476) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:adobe
Value:
wscript.exe //B "C:\Users\admin\AppData\Roaming\adobe.js"
(PID) Process:(7592) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:adobe
Value:
wscript.exe //B "C:\Users\admin\AppData\Roaming\adobe.js"
(PID) Process:(7944) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:adobe
Value:
wscript.exe //B "C:\Users\admin\AppData\Roaming\adobe.js"
(PID) Process:(8008) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:adobe
Value:
wscript.exe //B "C:\Users\admin\AppData\Roaming\adobe.js"
(PID) Process:(7872) audiodg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:svchost
Value:
"C:\Users\admin\AppData\Roaming\svchost.exe"
Executable files
2
Suspicious files
0
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
7476wscript.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\adobe.jstext
MD5:C3903DFF6A72D119EB6C6B9F451625E5
SHA256:4451E476918C8B6D02F2F4CB00548B55EB184256A3D96A3E243484273FDF65E0
7424wscript.exeC:\Users\admin\AppData\Local\Temp\svchost.jstext
MD5:E75942EDB244EF2D3423911739A267E1
SHA256:A61962F133FB658836523727124031A73A2D11A3ED20E67E39017E208EC04A9D
7424wscript.exeC:\Users\admin\AppData\Local\Temp\adobe.jstext
MD5:C3903DFF6A72D119EB6C6B9F451625E5
SHA256:4451E476918C8B6D02F2F4CB00548B55EB184256A3D96A3E243484273FDF65E0
7476wscript.exeC:\Users\admin\AppData\Roaming\adobe.jstext
MD5:C3903DFF6A72D119EB6C6B9F451625E5
SHA256:4451E476918C8B6D02F2F4CB00548B55EB184256A3D96A3E243484273FDF65E0
7504wscript.exeC:\Users\admin\AppData\Local\Temp\audiodg.exeexecutable
MD5:58CE634EAD9737C3F90990F27D7B46A1
SHA256:56E94A95C329C4961505F0AD7EA8567502DB6F9611ECD268E33951A2FC56CB81
7872audiodg.exeC:\Users\admin\AppData\Local\Temp\tmp1922.tmp.battext
MD5:6794EB37FBD715BC9B8EE37A1EC44960
SHA256:AC8EBE5028E186208EA0E081E30F0D7340CD61E90CF1937AFC08C504D1CC669A
7872audiodg.exeC:\Users\admin\AppData\Roaming\svchost.exeexecutable
MD5:58CE634EAD9737C3F90990F27D7B46A1
SHA256:56E94A95C329C4961505F0AD7EA8567502DB6F9611ECD268E33951A2FC56CB81
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
61
TCP/UDP connections
117
DNS requests
15
Threats
161

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7592
wscript.exe
POST
502
172.94.13.184:6144
http://riches20.freeddns.org:6144/is-ready
unknown
—
—
unknown
7592
wscript.exe
POST
502
172.94.13.184:6144
http://riches20.freeddns.org:6144/is-ready
unknown
—
—
unknown
7592
wscript.exe
POST
502
172.94.13.184:6144
http://riches20.freeddns.org:6144/is-ready
unknown
—
—
unknown
8008
wscript.exe
POST
502
172.94.13.184:6144
http://riches20.freeddns.org:6144/is-ready
unknown
—
—
unknown
4980
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
4980
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7592
wscript.exe
POST
502
172.94.13.184:6144
http://riches20.freeddns.org:6144/is-ready
unknown
—
—
unknown
4980
SIHClient.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
8008
wscript.exe
POST
502
172.94.13.184:6144
http://riches20.freeddns.org:6144/is-ready
unknown
—
—
unknown
4980
SIHClient.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
7592
wscript.exe
172.94.13.184:6144
riches20.freeddns.org
Voxility LLP
DE
malicious
8008
wscript.exe
172.94.13.184:6144
riches20.freeddns.org
Voxility LLP
DE
malicious
4980
SIHClient.exe
20.109.210.53:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4980
SIHClient.exe
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4980
SIHClient.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4980
SIHClient.exe
13.85.23.206:443
fe3cr.delivery.mp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
google.com
  • 142.250.181.238
whitelisted
client.wns.windows.com
  • 172.211.123.249
  • 172.211.123.248
whitelisted
riches20.freeddns.org
  • 172.94.13.184
malicious
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted
riches20.kozow.com
  • 172.94.13.184
malicious
activation-v2.sls.microsoft.com
  • 52.161.91.37
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DYNAMIC_DNS Query to a *.freeddns .org Domain
7592
wscript.exe
Potentially Bad Traffic
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.freeddns .org Domain
7592
wscript.exe
Malware Command and Control Activity Detected
ET MALWARE WSHRAT CnC Checkin
7592
wscript.exe
Malware Command and Control Activity Detected
ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1
7592
wscript.exe
Potentially Bad Traffic
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.freeddns .org Domain
7592
wscript.exe
Malware Command and Control Activity Detected
ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1
7592
wscript.exe
Malware Command and Control Activity Detected
ET MALWARE WSHRAT CnC Checkin
7592
wscript.exe
Potentially Bad Traffic
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.freeddns .org Domain
7592
wscript.exe
Malware Command and Control Activity Detected
ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1
7592
wscript.exe
Malware Command and Control Activity Detected
ET MALWARE WSHRAT CnC Checkin
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Payment-proof-270966-867AS.js