File name:

JJscript Roblox.exe1

Full analysis: https://app.any.run/tasks/20591e35-3459-4820-8964-ac9fde462835
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Analysis date: December 26, 2024, 19:15:17
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
rat
asyncrat
remote
orcus
stealer
quasar
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

2712ACDF39E043F075409FDB0C49E0C3

SHA1:

32E026D0B4BF6D09ED8C02E4C62EF5A6B17F6D94

SHA256:

87A4295CC92793F2223358BD899872CDDC5CD0F0919E4462C5604EE038D70E00

SSDEEP:

98304:lfwOd+hhh3H6aSIJaxkGEWemniR1z2ScRcDkO9z+XtBclOZj1kTvRvHZ41u0nrEF:o2Q

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Orcus is detected

      • JJscript Roblox.exe1.exe (PID: 6696)
      • JJscript Roblox.exe1.exe (PID: 6976)
      • pipedatalife.exe (PID: 7056)
      • pipedatalife.exe (PID: 7128)
      • InstallUtil.exe (PID: 7152)
      • pipedatalife.exe (PID: 968)
    • ASYNCRAT has been detected (SURICATA)

      • InstallUtil.exe (PID: 7152)
    • Steals credentials from Web Browsers

      • InstallUtil.exe (PID: 7152)
    • Actions looks like stealing of personal data

      • InstallUtil.exe (PID: 7152)
    • ORCUS has been detected (YARA)

      • InstallUtil.exe (PID: 7152)
    • QUASAR has been detected (YARA)

      • InstallUtil.exe (PID: 7152)
  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • JJscript Roblox.exe1.exe (PID: 6696)
      • JJscript Roblox.exe1.exe (PID: 6976)
      • InstallUtil.exe (PID: 7152)
    • Application launched itself

      • JJscript Roblox.exe1.exe (PID: 6696)
    • Executable content was dropped or overwritten

      • JJscript Roblox.exe1.exe (PID: 6976)
    • Starts itself from another location

      • JJscript Roblox.exe1.exe (PID: 6976)
    • The process executes via Task Scheduler

      • pipedatalife.exe (PID: 7128)
      • pipedatalife.exe (PID: 968)
    • Connects to unusual port

      • InstallUtil.exe (PID: 7152)
    • Contacting a server suspected of hosting an CnC

      • InstallUtil.exe (PID: 7152)
    • There is functionality for taking screenshot (YARA)

      • InstallUtil.exe (PID: 7152)
  • INFO

    • Reads the computer name

      • JJscript Roblox.exe1.exe (PID: 6696)
      • JJscript Roblox.exe1.exe (PID: 6976)
      • pipedatalife.exe (PID: 7056)
      • InstallUtil.exe (PID: 7152)
      • pipedatalife.exe (PID: 7128)
      • pipedatalife.exe (PID: 968)
    • Checks supported languages

      • JJscript Roblox.exe1.exe (PID: 6696)
      • JJscript Roblox.exe1.exe (PID: 6976)
      • pipedatalife.exe (PID: 7056)
      • pipedatalife.exe (PID: 7128)
      • InstallUtil.exe (PID: 7152)
      • pipedatalife.exe (PID: 968)
    • Reads the machine GUID from the registry

      • JJscript Roblox.exe1.exe (PID: 6696)
      • JJscript Roblox.exe1.exe (PID: 6976)
      • pipedatalife.exe (PID: 7056)
      • pipedatalife.exe (PID: 7128)
      • InstallUtil.exe (PID: 7152)
      • pipedatalife.exe (PID: 968)
    • Process checks computer location settings

      • JJscript Roblox.exe1.exe (PID: 6696)
      • JJscript Roblox.exe1.exe (PID: 6976)
    • The process uses the downloaded file

      • JJscript Roblox.exe1.exe (PID: 6696)
      • JJscript Roblox.exe1.exe (PID: 6976)
    • Creates files or folders in the user directory

      • JJscript Roblox.exe1.exe (PID: 6976)
    • Reads the software policy settings

      • InstallUtil.exe (PID: 7152)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (42.5)
.exe | InstallShield setup (25)
.exe | Win64 Executable (generic) (16)
.scr | Windows screen saver (7.6)
.dll | Win32 Dynamic Link Library (generic) (3.8)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:07:07 14:52:02+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 3108864
InitializedDataSize: 4608
UninitializedDataSize: -
EntryPoint: 0x2f8f4e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: -
FileVersion: 1.0.0.0
InternalName: -
LegalCopyright: -
LegalTrademarks: -
OriginalFileName: -
ProductName: -
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
130
Monitored processes
7
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #ORCUS jjscript roblox.exe1.exe no specs #ORCUS jjscript roblox.exe1.exe #ORCUS pipedatalife.exe no specs #ORCUS pipedatalife.exe no specs #ASYNCRAT installutil.exe svchost.exe #ORCUS pipedatalife.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
968"C:\Users\admin\AppData\Roaming\geocdnlow\pipedatalife.exe"C:\Users\admin\AppData\Roaming\geocdnlow\pipedatalife.exe
svchost.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\geocdnlow\pipedatalife.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
2192C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
6696"C:\Users\admin\AppData\Local\Temp\JJscript Roblox.exe1.exe" C:\Users\admin\AppData\Local\Temp\JJscript Roblox.exe1.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\jjscript roblox.exe1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
6976"C:\Users\admin\AppData\Local\Temp\JJscript Roblox.exe1.exe" /waitC:\Users\admin\AppData\Local\Temp\JJscript Roblox.exe1.exe
JJscript Roblox.exe1.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\jjscript roblox.exe1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
7056"C:\Users\admin\AppData\Roaming\geocdnlow\pipedatalife.exe" C:\Users\admin\AppData\Roaming\geocdnlow\pipedatalife.exe
JJscript Roblox.exe1.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\geocdnlow\pipedatalife.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
7128"C:\Users\admin\AppData\Roaming\geocdnlow\pipedatalife.exe"C:\Users\admin\AppData\Roaming\geocdnlow\pipedatalife.exe
svchost.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\geocdnlow\pipedatalife.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
7152"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
pipedatalife.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
.NET Framework installation utility
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\installutil.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
Total events
6 995
Read events
6 991
Write events
4
Delete events
0

Modification events

(PID) Process:(6976) JJscript Roblox.exe1.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
(PID) Process:(7152) InstallUtil.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7152) InstallUtil.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7152) InstallUtil.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
1
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
6976JJscript Roblox.exe1.exeC:\Users\admin\AppData\Roaming\geocdnlow\pipedatalife.exeexecutable
MD5:2712ACDF39E043F075409FDB0C49E0C3
SHA256:87A4295CC92793F2223358BD899872CDDC5CD0F0919E4462C5604EE038D70E00
6976JJscript Roblox.exe1.exeC:\Users\admin\AppData\Roaming\geocdnlow\pipedatalife.exe.configxml
MD5:A2B76CEA3A59FA9AF5EA21FF68139C98
SHA256:F99EF5BF79A7C43701877F0BB0B890591885BB0A3D605762647CC8FFBF10C839
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
33
DNS requests
19
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
1488
svchost.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
1488
svchost.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
whitelisted
6520
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
5728
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
5728
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
192.168.100.255:137
whitelisted
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1488
svchost.exe
2.16.164.49:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
4712
MoUsoCoreWorker.exe
2.16.164.49:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
4712
MoUsoCoreWorker.exe
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
1488
svchost.exe
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
whitelisted
5064
SearchApp.exe
2.23.209.149:443
www.bing.com
Akamai International B.V.
GB
whitelisted
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1176
svchost.exe
40.126.31.73:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 2.16.164.49
  • 2.16.164.120
whitelisted
www.microsoft.com
  • 88.221.169.152
whitelisted
google.com
  • 142.250.186.78
whitelisted
www.bing.com
  • 2.23.209.149
  • 2.23.209.179
  • 2.23.209.133
  • 2.23.209.185
  • 2.23.209.187
  • 2.23.209.176
  • 2.23.209.189
  • 2.23.209.130
  • 2.23.209.182
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.31.73
  • 20.190.159.75
  • 20.190.159.4
  • 20.190.159.64
  • 20.190.159.73
  • 20.190.159.2
  • 40.126.31.71
  • 20.190.159.71
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
15288.client.sudorat.top
  • 185.37.62.158
malicious
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted

Threats

PID
Process
Class
Message
2192
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
1 ETPRO signatures available at the full report
No debug info