analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

hmskerx.js

Full analysis: https://app.any.run/tasks/25b89b46-74e1-435e-ba9a-c4ebc4cafb24
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Analysis date: October 14, 2019, 19:14:22
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
sinkhole
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines
MD5:

1C767D9D6391C9C0AC9E68FFB9FF914E

SHA1:

952499F7E7EEE4D57A238145632B5F368C42DA92

SHA256:

96693B64926B884229CD09025C220E36432B3346B609F59EE8534B2854ACD979

SSDEEP:

768:vlvyVeKBlKrCamQLfxIxTzeU75klr4CEn7jDQoQ9ld+fs6HiAGc2YTjpoMVo/zqd:9v6eu0CuCx+U9kloRpDVo/zqiRqOy1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • WScript.exe (PID: 1800)
      • ydqrb64.exe (PID: 2840)
      • wscript.exe (PID: 3172)
      • ydqrb64.exe (PID: 748)
    • Writes to a start menu file

      • wscript.exe (PID: 3172)
    • Connects to CnC server

      • wscript.exe (PID: 3172)
  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • WScript.exe (PID: 1800)
      • wscript.exe (PID: 3172)
      • ydqrb64.exe (PID: 748)
      • ydqrb64.exe (PID: 2840)
    • Executes scripts

      • WScript.exe (PID: 1800)
    • Creates files in the user directory

      • WScript.exe (PID: 1800)
      • wscript.exe (PID: 3172)
    • Starts itself from another location

      • wscript.exe (PID: 3172)
    • Executable content was dropped or overwritten

      • wscript.exe (PID: 3172)
    • Application launched itself

      • WScript.exe (PID: 1800)
    • Connects to server without host name

      • wscript.exe (PID: 3172)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
90
Monitored processes
39
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start wscript.exe no specs cmd.exe no specs cacls.exe no specs cmd.exe no specs cacls.exe no specs wscript.exe cmd.exe no specs cacls.exe no specs cmd.exe no specs cacls.exe no specs cmd.exe no specs cmd.exe no specs cacls.exe no specs cmd.exe no specs cacls.exe no specs cmd.exe no specs cacls.exe no specs cmd.exe no specs cacls.exe no specs cmd.exe no specs cacls.exe no specs cmd.exe no specs cacls.exe no specs cmd.exe no specs cacls.exe no specs ydqrb64.exe no specs cmd.exe no specs cacls.exe no specs ydqrb64.exe no specs cmd.exe no specs cacls.exe no specs cmd.exe no specs cmd.exe no specs cacls.exe no specs cacls.exe no specs cmd.exe no specs cacls.exe no specs cmd.exe no specs cacls.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1800"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\hmskerx.js"C:\Windows\System32\WScript.exeexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
960"C:\Windows\system32\cmd.exe" /c cacls "C:\Users\admin\AppData\Roaming\skujmyc" /T /E /G Users:F /CC:\Windows\system32\cmd.exeWScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3736cacls "C:\Users\admin\AppData\Roaming\skujmyc" /T /E /G Users:F /CC:\Windows\system32\cacls.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Control ACLs Program
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2896"C:\Windows\system32\cmd.exe" /c cacls "C:\Users\admin\AppData\Roaming\skujmyc\qslqm.js" /T /E /G Users:F /CC:\Windows\system32\cmd.exeWScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2440cacls "C:\Users\admin\AppData\Roaming\skujmyc\qslqm.js" /T /E /G Users:F /CC:\Windows\system32\cacls.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Control ACLs Program
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3172"C:\Windows\System32\wscript.exe" "C:\Users\admin\AppData\Local\Temp\hmskerx.js" weympyrrgC:\Windows\System32\wscript.exe
WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Version:
5.8.7600.16385
2176"C:\Windows\system32\cmd.exe" /c cacls "C:\Users\admin\AppData\Roaming\skujmyc\*" /T /E /G Users:F /CC:\Windows\system32\cmd.exewscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3624cacls "C:\Users\admin\AppData\Roaming\skujmyc\*" /T /E /G Users:F /CC:\Windows\system32\cacls.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Control ACLs Program
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
688"C:\Windows\system32\cmd.exe" /c cacls "C:\Users\admin\AppData\Roaming\skujmyc\uxpyolkee" /T /E /G Users:F /CC:\Windows\system32\cmd.exewscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
1976cacls "C:\Users\admin\AppData\Roaming\skujmyc\uxpyolkee" /T /E /G Users:F /CC:\Windows\system32\cacls.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Control ACLs Program
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
775
Read events
757
Write events
18
Delete events
0

Modification events

(PID) Process:(1800) WScript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(1800) WScript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3172) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3172) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3172) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Operation:writeName:Hidden
Value:
2
(PID) Process:(3172) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Operation:writeName:ShowSuperHidden
Value:
0
(PID) Process:(2840) ydqrb64.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2840) ydqrb64.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(748) ydqrb64.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(748) ydqrb64.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
1
Suspicious files
0
Text files
5
Unknown types
3

Dropped files

PID
Process
Filename
Type
3172wscript.exeC:\Users\admin\AppData\Roaming\skujmyc\rotvlitext
MD5:690806002A8F2DAFAEC79DF4C88D7F8E
SHA256:E44DC56044C44B70A6BAB25A48F7FCF411E1ED051342F7F066D47E50AC086E37
3172wscript.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Start.lnklnk
MD5:00682089E1F735734BAD2036F982B799
SHA256:CD1B102BFFBF0F51EFEFE18EAC0FA9914CDAD0BD72B475C9C6DBF52706F724C8
1800WScript.exeC:\Users\admin\AppData\Roaming\skujmyc\qslqm.jstext
MD5:1C767D9D6391C9C0AC9E68FFB9FF914E
SHA256:96693B64926B884229CD09025C220E36432B3346B609F59EE8534B2854ACD979
748ydqrb64.exeC:\Users\admin\AppData\Roaming\skujmyc\qslqm.jstext
MD5:1C767D9D6391C9C0AC9E68FFB9FF914E
SHA256:96693B64926B884229CD09025C220E36432B3346B609F59EE8534B2854ACD979
2840ydqrb64.exeC:\Users\admin\AppData\Roaming\skujmyc\qslqm.jstext
MD5:1C767D9D6391C9C0AC9E68FFB9FF914E
SHA256:96693B64926B884229CD09025C220E36432B3346B609F59EE8534B2854ACD979
3172wscript.exeC:\Users\admin\AppData\Roaming\skujmyc\qslqm.jstext
MD5:1C767D9D6391C9C0AC9E68FFB9FF914E
SHA256:96693B64926B884229CD09025C220E36432B3346B609F59EE8534B2854ACD979
3172wscript.exeC:\Users\admin\AppData\Roaming\skujmyc\ydqrb64.exeexecutable
MD5:D1AB72DB2BEDD2F255D35DA3DA0D4B16
SHA256:047F3C5A7AB0EA05F35B2CA8037BF62DD4228786D07707064DBD0D46569305D0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
4
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3172
wscript.exe
POST
200
72.5.161.14:80
http://bellsyscdn.com/
US
malicious
3172
wscript.exe
POST
95.153.31.18:80
http://95.153.31.18/
EE
malicious
3172
wscript.exe
POST
95.153.31.22:80
http://95.153.31.22/
EE
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3172
wscript.exe
2.21.38.54:80
www.microsoft.com
GTT Communications Inc.
FR
malicious
3172
wscript.exe
72.5.161.14:80
bellsyscdn.com
Voxel Dot Net, Inc.
US
malicious
3172
wscript.exe
95.153.31.18:80
TELE2
EE
malicious
3172
wscript.exe
95.153.31.22:80
TELE2
EE
malicious

DNS requests

Domain
IP
Reputation
www.microsoft.com
  • 2.21.38.54
whitelisted
bellsyscdn.com
  • 72.5.161.14
malicious

Threats

PID
Process
Class
Message
3172
wscript.exe
A Network Trojan was detected
MALWARE [PTsecurity] Worm:JS/Bondat.D
3172
wscript.exe
A Network Trojan was detected
ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
3172
wscript.exe
Exploitation attributes have been detected
SINKHOLE [PTsecurity] snkz HTTP cookie set
3172
wscript.exe
A Network Trojan was detected
MALWARE [PTsecurity] Worm:JS/Bondat.D
3172
wscript.exe
A Network Trojan was detected
MALWARE [PTsecurity] Worm:JS/Bondat.D
2 ETPRO signatures available at the full report
No debug info