File name:

obamka.js

Full analysis: https://app.any.run/tasks/27eb2089-5df2-4b56-ab86-b0150ec382cb
Verdict: Malicious activity
Analysis date: September 18, 2021, 21:40:02
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines, with no line terminators
MD5:

EEF977108C7A7AEF512532CC6E2F49CC

SHA1:

7273BF0DB30A12428F7046EF99EBE3E7472CDFBE

SHA256:

884E96A75DC568075E845CCAC2D4B4CCEC68017E6EF258C7C03DA8C88A597534

SSDEEP:

6144:9ifWwIb7L3vMTk69b9wwU5oyISUiuH4CgzO/NAgpD8TAVL3QGGv14nzUmviNu:cWwIb7ATki9wwyoVSUQCgwNdwML3K2

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • csc.exe (PID: 1940)

    • Starts Visual C# compiler

      • cscript.exe (PID: 2908)

    • Uses Task Scheduler to run other applications

      • cscript.exe (PID: 2908)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 2128)

  • SUSPICIOUS

    • Checks supported languages

      • wscript.exe (PID: 796)
      • wscript.exe (PID: 2516)
      • wscript.exe (PID: 2208)
      • cscript.exe (PID: 2908)
      • cvtres.exe (PID: 1656)
      • csc.exe (PID: 1940)
      • cmd.exe (PID: 1032)
      • cmd.exe (PID: 3360)
      • powershell.exe (PID: 1076)
      • powershell.exe (PID: 760)

    • Reads the computer name

      • wscript.exe (PID: 796)
      • wscript.exe (PID: 2516)
      • wscript.exe (PID: 2208)
      • cscript.exe (PID: 2908)
      • powershell.exe (PID: 1076)
      • powershell.exe (PID: 760)

    • Application launched itself

      • wscript.exe (PID: 796)
      • wscript.exe (PID: 2516)

    • Executes scripts

      • wscript.exe (PID: 796)
      • wscript.exe (PID: 2516)
      • wscript.exe (PID: 2208)

    • Creates files in the user directory

      • wscript.exe (PID: 2516)
      • cscript.exe (PID: 2908)
      • powershell.exe (PID: 1076)
      • powershell.exe (PID: 760)

    • Executable content was dropped or overwritten

      • csc.exe (PID: 1940)

    • Uses TASKKILL.EXE to kill process

      • cscript.exe (PID: 2908)

    • Drops a file with a compile date too recent

      • csc.exe (PID: 1940)

    • Starts SC.EXE for service management

      • cscript.exe (PID: 2908)

    • Executes PowerShell scripts

      • cscript.exe (PID: 2908)

    • Executed as Windows Service

      • vssvc.exe (PID: 1164)

    • Starts CMD.EXE for commands execution

      • cscript.exe (PID: 2908)

    • Executed via COM

      • DllHost.exe (PID: 1928)

    • Reads the date of Windows installation

      • powershell.exe (PID: 1076)
      • powershell.exe (PID: 760)

    • Uses NETSH.EXE for network configuration

      • cscript.exe (PID: 2908)

    • Reads Environment values

      • netsh.exe (PID: 3984)
      • netsh.exe (PID: 3184)
      • cscript.exe (PID: 2908)

    • Uses ICACLS.EXE to modify access control list

      • cscript.exe (PID: 2908)

  • INFO

    • Reads the computer name

      • net1.exe (PID: 3468)
      • net1.exe (PID: 724)
      • net1.exe (PID: 3844)
      • net1.exe (PID: 2420)
      • taskkill.exe (PID: 3792)
      • schtasks.exe (PID: 2128)
      • taskkill.exe (PID: 3912)
      • sc.exe (PID: 2956)
      • sc.exe (PID: 2224)
      • sc.exe (PID: 2680)
      • sc.exe (PID: 996)
      • sc.exe (PID: 1796)
      • DllHost.exe (PID: 1928)
      • sc.exe (PID: 3152)
      • vssvc.exe (PID: 1164)
      • sc.exe (PID: 2204)
      • sc.exe (PID: 1224)
      • sc.exe (PID: 3832)
      • sc.exe (PID: 2248)
      • sc.exe (PID: 892)
      • sc.exe (PID: 2456)
      • netsh.exe (PID: 3184)
      • netsh.exe (PID: 3984)
      • icacls.exe (PID: 2192)
      • icacls.exe (PID: 2644)
      • icacls.exe (PID: 2312)

    • Checks supported languages

      • net1.exe (PID: 3468)
      • net.exe (PID: 3108)
      • net.exe (PID: 2900)
      • net1.exe (PID: 724)
      • net.exe (PID: 3720)
      • net1.exe (PID: 3844)
      • net.exe (PID: 3320)
      • net1.exe (PID: 2420)
      • taskkill.exe (PID: 3792)
      • sc.exe (PID: 2956)
      • taskkill.exe (PID: 3912)
      • schtasks.exe (PID: 2128)
      • sc.exe (PID: 2224)
      • sc.exe (PID: 996)
      • sc.exe (PID: 1796)
      • sc.exe (PID: 2680)
      • sc.exe (PID: 3152)
      • vssvc.exe (PID: 1164)
      • sc.exe (PID: 2204)
      • sc.exe (PID: 1224)
      • DllHost.exe (PID: 1928)
      • sc.exe (PID: 2248)
      • sc.exe (PID: 892)
      • sc.exe (PID: 2456)
      • netsh.exe (PID: 3184)
      • sc.exe (PID: 3832)
      • netsh.exe (PID: 3984)
      • icacls.exe (PID: 2192)
      • mountvol.exe (PID: 1448)
      • mountvol.exe (PID: 1688)
      • mountvol.exe (PID: 3912)
      • icacls.exe (PID: 2644)
      • icacls.exe (PID: 2312)

    • Checks Windows Trust Settings

      • wscript.exe (PID: 796)
      • wscript.exe (PID: 2516)
      • wscript.exe (PID: 2208)
      • cscript.exe (PID: 2908)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
115
Monitored processes
43
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start wscript.exe no specs net.exe no specs net1.exe no specs wscript.exe net.exe no specs net1.exe no specs wscript.exe no specs net.exe no specs net1.exe no specs cscript.exe net.exe no specs net1.exe no specs csc.exe cvtres.exe no specs taskkill.exe no specs taskkill.exe no specs schtasks.exe no specs powershell.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs DllHost.exe no specs vssvc.exe no specs cmd.exe no specs cmd.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs netsh.exe no specs netsh.exe no specs powershell.exe no specs mountvol.exe no specs mountvol.exe no specs mountvol.exe no specs icacls.exe no specs icacls.exe no specs icacls.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
724C:\Windows\system32\net1 sessionC:\Windows\system32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dsrole.dll
c:\windows\system32\netutils.dll
760"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Enable-WindowsOptionalFeature -Online -FeatureName SMB1ProtocolC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
6.2.9200.16398 (win8_gdr_oobssr.120820-1900)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
796"C:\Windows\System32\wscript.exe" C:\Users\admin\AppData\Local\Temp\obamka.jsC:\Windows\System32\wscript.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft � Windows Based Script Host
Exit code:
1
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
892"C:\Windows\System32\sc.exe" config upnphost start= autoC:\Windows\System32\sc.exe—cscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
996"C:\Windows\System32\sc.exe" config SstpSvc start= disabledC:\Windows\System32\sc.exe—cscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1032"C:\Windows\System32\cmd.exe" /c rd /s /q %SYSTEMDRIVE%\\$Recycle.binC:\Windows\System32\cmd.exe—cscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\gdi32.dll
1076"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-CimInstance Win32_ShadowCopy | Remove-CimInstanceC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
6.2.9200.16398 (win8_gdr_oobssr.120820-1900)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\atl.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1164C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft� Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\vssvc.exe
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1224"C:\Windows\System32\sc.exe" config fdPHost start= autoC:\Windows\System32\sc.exe—cscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1448"mountvol.exe"C:\Windows\System32\mountvol.exe—cscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Mount Volume Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\mountvol.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
Total events
6 126
Read events
5 760
Write events
366
Delete events
0

Modification events

(PID) Process:(796) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(796) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(796) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(796) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2516) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2516) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2516) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2516) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2516) wscript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework
Operation:writeName:ETWEnabled
Value:
0
(PID) Process:(2208) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
1
Suspicious files
6
Text files
5
Unknown types
3

Dropped files

PID
Process
Filename
Type
1656cvtres.exeC:\Users\admin\AppData\Local\Temp\RESF1D9.tmpo
MD5:—
SHA256:—
1940csc.exeC:\Users\admin\AppData\Local\Temp\CSC3B5622821D547FBA98D8E54AB4DA0C.TMPres
MD5:—
SHA256:—
2908cscript.exeC:\Users\admin\AppData\Local\Temp\svfuyzqv.cmdlinetext
MD5:—
SHA256:—
1940csc.exeC:\Users\admin\AppData\Local\Temp\svfuyzqv.dllexecutable
MD5:—
SHA256:—
1940csc.exeC:\Users\admin\AppData\Local\Temp\svfuyzqv.outtext
MD5:—
SHA256:—
1076powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\YWKLCTJIK70V019MD6WV.tempbinary
MD5:—
SHA256:—
2908cscript.exeC:\Users\admin\AppData\Local\Temp\svfuyzqv.0.cstext
MD5:42BE26B2C8233637DA81DE8E467FDEA3
SHA256:45DC235FED868D5710F0B37D699A2D35E22F727EA8EEB3175B5092D77AEB8FFD
2516wscript.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\Google.urltext
MD5:1E7E5E93C2A5AADAF932F93D25C57F3E
SHA256:8B94D04FECE582E4182E8E73F46FB86EB8E965C69C526C42805ABB9E43641E35
1076powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFff63e.TMPbinary
MD5:—
SHA256:—
1076powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
0
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2908
cscript.exe
GET
—
45.9.148.114:80
http://45.9.148.114/forest.png
unknown
—
—
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2908
cscript.exe
45.9.148.114:80
—
—
—
suspicious

DNS requests

No data

Threats

PID
Process
Class
Message
2908
cscript.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 2
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
obamka.js