analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Proof of payment.js

Full analysis: https://app.any.run/tasks/beeba4f7-115e-4a2a-8de1-6f0458a5f58b
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: October 03, 2021, 11:03:11
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
trojan
strrat
rat
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines, with CRLF line terminators
MD5:

34A653C2523056E055C378285398F72D

SHA1:

D9813CDA6DA576F77D09AE3665F2C0C5DD37FEF1

SHA256:

93B8B4B95575FBAEADF2548F59BFE6E9F7A540EB02A75CE575EE7662BFB6CA52

SSDEEP:

3072:o9pZV7cIa1MmOQe+rABEBj+6fXB+Tcu01xI8xE9Ye+eLvLusOTi1N253:o9PVD+OyrABEBjFBpRjeJKEN253

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Writes to a start menu file

      • java.exe (PID: 128)

    • Loads dropped or rewritten executable

      • java.exe (PID: 128)
      • java.exe (PID: 1932)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 996)

    • Changes the autorun value in the registry

      • java.exe (PID: 128)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 3244)
      • mmc.exe (PID: 2628)

    • STRRAT was detected

      • java.exe (PID: 1932)

    • Connects to CnC server

      • java.exe (PID: 1932)

  • SUSPICIOUS

    • Reads the computer name

      • javaw.exe (PID: 2152)
      • WScript.exe (PID: 3224)
      • java.exe (PID: 128)
      • java.exe (PID: 1932)
      • WMIC.exe (PID: 2392)
      • WMIC.exe (PID: 3092)
      • WMIC.exe (PID: 4000)
      • WMIC.exe (PID: 1072)

    • Checks supported languages

      • java.exe (PID: 128)
      • javaw.exe (PID: 2152)
      • WScript.exe (PID: 3224)
      • cmd.exe (PID: 996)
      • java.exe (PID: 1932)
      • cmd.exe (PID: 1588)
      • WMIC.exe (PID: 2392)
      • WMIC.exe (PID: 3092)
      • cmd.exe (PID: 1608)
      • WMIC.exe (PID: 4000)
      • cmd.exe (PID: 2424)
      • cmd.exe (PID: 3968)
      • WMIC.exe (PID: 1072)

    • Check for Java to be installed

      • WScript.exe (PID: 3224)

    • Creates files in the program directory

      • javaw.exe (PID: 2152)

    • Executes JAVA applets

      • javaw.exe (PID: 2152)
      • WScript.exe (PID: 3224)
      • java.exe (PID: 128)

    • Uses ICACLS.EXE to modify access control list

      • javaw.exe (PID: 2152)

    • Creates files in the user directory

      • WScript.exe (PID: 3224)
      • java.exe (PID: 128)

    • Executable content was dropped or overwritten

      • java.exe (PID: 128)
      • java.exe (PID: 1932)

    • Application launched itself

      • java.exe (PID: 128)

    • Starts CMD.EXE for commands execution

      • java.exe (PID: 128)
      • java.exe (PID: 1932)

    • Uses WMIC.EXE to obtain a system information

      • cmd.exe (PID: 2424)
      • cmd.exe (PID: 1608)
      • cmd.exe (PID: 1588)
      • cmd.exe (PID: 3968)

    • Checks for external IP

      • java.exe (PID: 1932)

    • Uses WMIC.EXE to obtain a list of AntiViruses

      • cmd.exe (PID: 3968)

    • Executed via Task Scheduler

      • NOTEPAD.EXE (PID: 2388)

  • INFO

    • Reads the computer name

      • icacls.exe (PID: 3800)
      • schtasks.exe (PID: 3244)
      • mmc.exe (PID: 2628)

    • Checks supported languages

      • icacls.exe (PID: 3800)
      • schtasks.exe (PID: 3244)
      • mmc.exe (PID: 2628)
      • NOTEPAD.EXE (PID: 2388)

    • Checks Windows Trust Settings

      • WScript.exe (PID: 3224)

    • Manual execution by user

      • mmc.exe (PID: 2628)
      • mmc.exe (PID: 3524)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
62
Monitored processes
18
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
start wscript.exe no specs javaw.exe icacls.exe no specs java.exe cmd.exe no specs #STRRAT java.exe schtasks.exe no specs cmd.exe no specs wmic.exe no specs cmd.exe no specs wmic.exe no specs cmd.exe no specs wmic.exe no specs cmd.exe no specs wmic.exe no specs mmc.exe no specs mmc.exe notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3224"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\Proof of payment.js"C:\Windows\System32\WScript.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft � Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\lpk.dll
c:\windows\system32\sechost.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2152"C:\Program Files\Java\jre1.8.0_271\bin\javaw.exe" -jar "C:\Users\admin\AppData\Roaming\ypjljobfz.txt"C:\Program Files\Java\jre1.8.0_271\bin\javaw.exe
WScript.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.2710.9
Modules
Images
c:\program files\java\jre1.8.0_271\bin\javaw.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3800C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)MC:\Windows\system32\icacls.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
128"C:\Program Files\Java\jre1.8.0_271\bin\java.exe" -jar "C:\Users\admin\ypjljobfz.txt"C:\Program Files\Java\jre1.8.0_271\bin\java.exe
javaw.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.2710.9
Modules
Images
c:\program files\java\jre1.8.0_271\bin\java.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
996cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\admin\AppData\Roaming\ypjljobfz.txt"C:\Windows\system32\cmd.exe—java.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
1932"C:\Program Files\Java\jre1.8.0_271\bin\java.exe" -jar "C:\Users\admin\AppData\Roaming\ypjljobfz.txt"C:\Program Files\Java\jre1.8.0_271\bin\java.exe
java.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Version:
8.0.2710.9
Modules
Images
c:\program files\java\jre1.8.0_271\bin\java.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3244schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\admin\AppData\Roaming\ypjljobfz.txt"C:\Windows\system32\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1588cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list"C:\Windows\system32\cmd.exe—java.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2392wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:listC:\Windows\System32\Wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
2424cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list"C:\Windows\system32\cmd.exe—java.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
3 319
Read events
3 306
Write events
12
Delete events
1

Modification events

(PID) Process:(3224) WScript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3224) WScript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3224) WScript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3224) WScript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(128) java.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:ypjljobfz
Value:
"C:\Users\admin\AppData\Roaming\ypjljobfz.txt"
(PID) Process:(2628) mmc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MMC\SnapIns\FX:{c7b8fb06-bfe1-4c2e-9217-7a69a95bbac4}
Operation:writeName:HelpTopic
Value:
C:\Windows\Help\taskscheduler.chm
(PID) Process:(2628) mmc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MMC\SnapIns\FX:{c7b8fb06-bfe1-4c2e-9217-7a69a95bbac4}
Operation:writeName:LinkedHelpTopics
Value:
C:\Windows\Help\taskscheduler.chm
(PID) Process:(2628) mmc.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Microsoft Management Console\Recent File List
Operation:delete keyName:(default)
Value:
(PID) Process:(2628) mmc.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Microsoft Management Console\Recent File List
Operation:writeName:File1
Value:
C:\Windows\system32\taskschd.msc
Executable files
8
Suspicious files
9
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
2152javaw.exeC:\Users\admin\ypjljobfz.txtcompressed
MD5:5155453D759E49880D32CAA54962ACB0
SHA256:28DACCDADFD5999B6463F6D1ED0D4DA8F369F9D84D9046DD453B1AC78C5B6AF5
128java.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ypjljobfz.txtcompressed
MD5:5155453D759E49880D32CAA54962ACB0
SHA256:28DACCDADFD5999B6463F6D1ED0D4DA8F369F9D84D9046DD453B1AC78C5B6AF5
2152javaw.exeC:\ProgramData\Oracle\Java\.oracle_jre_usage\17dfc292991c8061.timestamptext
MD5:6E6F3E0D1FCBA99EAD9A7606BA0AC151
SHA256:2ACF3B3A9BA99EB34CA4FBFEC8E9FF7BE8DE79DA9CD06365EAA97A90DF5EECBA
3224WScript.exeC:\Users\admin\AppData\Roaming\ypjljobfz.txtcompressed
MD5:5155453D759E49880D32CAA54962ACB0
SHA256:28DACCDADFD5999B6463F6D1ED0D4DA8F369F9D84D9046DD453B1AC78C5B6AF5
2628mmc.exeC:\Users\admin\AppData\Roaming\Microsoft\MMC\taskschdxml
MD5:0F848F7D92E16855403E4FCF94AE13C2
SHA256:2C8500789E6B5F9BB79D148BC3019A8446EF0A88BC8745A1B69036AEDE2150C5
2152javaw.exeC:\Users\admin\lib\jna-5.5.0.jardjava
MD5:ACFB5B5FD9EE10BF69497792FD469F85
SHA256:B308FAEBFE4ED409DE8410E0A632D164B2126B035F6EACFF968D3908CAFB4D9E
2152javaw.exeC:\Users\admin\lib\jna-platform-5.5.0.jardjava
MD5:2F4A99C2758E72EE2B59A73586A2322F
SHA256:24D81621F82AC29FCDD9A74116031F5907A2343158E616F4573BBFA2434AE0D5
128java.exeC:\Users\admin\AppData\Roaming\lib\jna-platform-5.5.0.jarjava
MD5:2F4A99C2758E72EE2B59A73586A2322F
SHA256:24D81621F82AC29FCDD9A74116031F5907A2343158E616F4573BBFA2434AE0D5
128java.exeC:\Users\admin\AppData\Roaming\lib\jna-5.5.0.jarjava
MD5:ACFB5B5FD9EE10BF69497792FD469F85
SHA256:B308FAEBFE4ED409DE8410E0A632D164B2126B035F6EACFF968D3908CAFB4D9E
2152javaw.exeC:\Users\admin\lib\sqlite-jdbc-3.14.2.1.jardcompressed
MD5:B33387E15AB150A7BF560ABDC73C3BEC
SHA256:2EAE3DEA1C3DDE6104C49F9601074B6038FF6ABCF3BE23F4B56F6720A4F6A491
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
7
DNS requests
6
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1932
java.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/
unknown
text
299 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2152
javaw.exe
185.199.108.154:443
github-releases.githubusercontent.com
GitHub, Inc.
NL
suspicious
1932
java.exe
31.210.20.226:3608
harold.ns01.info
—
—
malicious
1932
java.exe
208.95.112.1:80
ip-api.com
IBURST
—
malicious
2152
javaw.exe
199.232.192.209:443
repo1.maven.org
—
US
suspicious
2152
javaw.exe
140.82.121.3:443
github.com
—
US
suspicious

DNS requests

Domain
IP
Reputation
repo1.maven.org
  • 199.232.192.209
  • 199.232.196.209
whitelisted
github.com
  • 140.82.121.3
shared
github-releases.githubusercontent.com
  • 185.199.108.154
  • 185.199.109.154
  • 185.199.110.154
  • 185.199.111.154
whitelisted
str-master.pw
  • —
malicious
harold.ns01.info
  • 31.210.20.226
malicious
ip-api.com
  • 208.95.112.1
shared

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET DNS Query to a *.pw domain - Likely Hostile
1932
java.exe
Potential Corporate Privacy Violation
ET POLICY External IP Lookup ip-api.com
1932
java.exe
Potential Corporate Privacy Violation
AV POLICY Internal Host Retrieving External IP Address (ip-api. com)
1932
java.exe
A Network Trojan was detected
ET TROJAN STRRAT CnC Checkin
1932
java.exe
A Network Trojan was detected
ET TROJAN STRRAT CnC Checkin
1932
java.exe
A Network Trojan was detected
ET TROJAN STRRAT CnC Checkin
1932
java.exe
A Network Trojan was detected
ET TROJAN STRRAT CnC Checkin
1932
java.exe
A Network Trojan was detected
ET TROJAN STRRAT CnC Checkin
1932
java.exe
A Network Trojan was detected
ET TROJAN STRRAT CnC Checkin
1932
java.exe
A Network Trojan was detected
ET TROJAN STRRAT CnC Checkin
1 ETPRO signatures available at the full report
Process
Message
mmc.exe
Constructor: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
mmc.exe
OnInitialize: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
mmc.exe
AddIcons: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
mmc.exe
ProcessCommandLineArguments: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Proof of payment.js