File name:

a.js

Full analysis: https://app.any.run/tasks/db515371-8722-44dd-ab4a-a220dd26c388
Verdict: Malicious activity
Analysis date: February 15, 2024, 14:30:00
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines (686)
MD5:

6FF2BE8B35431FCB8E9EB92204551BE8

SHA1:

C7FD27CCD6DDDD3E4E0A645652AC10F2B658D963

SHA256:

A605C7C51329E972E0679D77DA112EA6D6D358A441C7E2DBB7425885F578F0F5

SSDEEP:

768:+QGgD0cgUYHNAflFWX7vPNo20TTXyMz5rVU+ugcebE7MwG5WzsFLLG/6f:vGEeUQAflMXrYTXLVpU9nuj

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Gets %windir% folder path (SCRIPT)

      • wscript.exe (PID: 4052)
      • wscript.exe (PID: 2792)
      • wscript.exe (PID: 2788)

    • Gets username (SCRIPT)

      • wscript.exe (PID: 4052)
      • wscript.exe (PID: 2792)
      • wscript.exe (PID: 2788)

    • Accesses environment variables (SCRIPT)

      • wscript.exe (PID: 4052)
      • wscript.exe (PID: 2792)
      • wscript.exe (PID: 2788)

    • Copies file to a new location (SCRIPT)

      • wscript.exe (PID: 4052)

    • Create files in the Startup directory

      • wscript.exe (PID: 4052)

    • Gets a file object corresponding to the file in a specified path (SCRIPT)

      • wscript.exe (PID: 4052)
      • wscript.exe (PID: 2792)
      • wscript.exe (PID: 2788)

    • Creates a new registry key or changes the value of an existing one (SCRIPT)

      • wscript.exe (PID: 4052)
      • wscript.exe (PID: 2792)
      • wscript.exe (PID: 2788)

    • Changes appearance of the Explorer extensions

      • wscript.exe (PID: 4052)
      • wscript.exe (PID: 2792)
      • wscript.exe (PID: 2788)

    • Opens an HTTP connection (SCRIPT)

      • wscript.exe (PID: 4052)
      • wscript.exe (PID: 2792)
      • wscript.exe (PID: 2788)

    • Creates internet connection object (SCRIPT)

      • wscript.exe (PID: 4052)
      • wscript.exe (PID: 2792)
      • wscript.exe (PID: 2788)

    • Unusual connection from system programs

      • wscript.exe (PID: 4052)
      • wscript.exe (PID: 2792)
      • wscript.exe (PID: 2788)

    • Accesses physical disk drive(Win32_DiskDrive) via WMI (SCRIPT)

      • wscript.exe (PID: 4052)
      • wscript.exe (PID: 2792)
      • wscript.exe (PID: 2788)

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 4052)
      • wscript.exe (PID: 2792)
      • wscript.exe (PID: 2788)

    • Sends HTTP request (SCRIPT)

      • wscript.exe (PID: 4052)
      • wscript.exe (PID: 2792)
      • wscript.exe (PID: 2788)

  • SUSPICIOUS

    • Gets computer name (SCRIPT)

      • wscript.exe (PID: 4052)
      • wscript.exe (PID: 2792)
      • wscript.exe (PID: 2788)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • wscript.exe (PID: 4052)
      • wscript.exe (PID: 2792)
      • wscript.exe (PID: 2788)

    • Accesses current user name via WMI (SCRIPT)

      • wscript.exe (PID: 4052)
      • wscript.exe (PID: 2792)
      • wscript.exe (PID: 2788)

    • Checks whether a specific file exists (SCRIPT)

      • wscript.exe (PID: 4052)
      • wscript.exe (PID: 2792)
      • wscript.exe (PID: 2788)

    • Accesses computer name via WMI (SCRIPT)

      • wscript.exe (PID: 4052)
      • wscript.exe (PID: 2792)
      • wscript.exe (PID: 2788)

    • Gets full path of the running script (SCRIPT)

      • wscript.exe (PID: 4052)
      • wscript.exe (PID: 2792)
      • wscript.exe (PID: 2788)

    • Accesses OperatingSystem(Win32_OperatingSystem) via WMI (SCRIPT)

      • wscript.exe (PID: 4052)
      • wscript.exe (PID: 2792)
      • wscript.exe (PID: 2788)

    • Uses WMI to retrieve WMI-managed resources (SCRIPT)

      • wscript.exe (PID: 4052)
      • wscript.exe (PID: 2792)
      • wscript.exe (PID: 2788)

    • Executes WMI query (SCRIPT)

      • wscript.exe (PID: 4052)
      • wscript.exe (PID: 2792)
      • wscript.exe (PID: 2788)

    • Adds, changes, or deletes HTTP request header (SCRIPT)

      • wscript.exe (PID: 4052)
      • wscript.exe (PID: 2792)
      • wscript.exe (PID: 2788)

    • Reads the Internet Settings

      • wscript.exe (PID: 4052)
      • wscript.exe (PID: 2792)
      • wscript.exe (PID: 2788)

    • Access Product Name via WMI (SCRIPT)

      • wscript.exe (PID: 4052)
      • wscript.exe (PID: 2792)
      • wscript.exe (PID: 2788)

    • The process executes JS scripts

      • cmd.exe (PID: 2860)

  • INFO

    • Checks proxy server information

      • wscript.exe (PID: 4052)
      • wscript.exe (PID: 2792)
      • wscript.exe (PID: 2788)

    • Manual execution by a user

      • explorer.exe (PID: 1040)
      • cmd.exe (PID: 2860)
      • explorer.exe (PID: 2000)
      • wscript.exe (PID: 2788)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
47
Monitored processes
6
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start wscript.exe explorer.exe no specs cmd.exe no specs wscript.exe explorer.exe no specs wscript.exe

Process information

PID
CMD
Path
Indicators
Parent process
1040"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2000"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2788"C:\Windows\System32\WScript.exe" "C:\a.js" C:\Windows\System32\wscript.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2792wscript.exe C:\a.jsC:\Windows\System32\wscript.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2860"C:\Windows\system32\cmd.exe" C:\Windows\System32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
4052"C:\Windows\system32\wscript.exe" "C:\a.js"C:\Windows\System32\wscript.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
4 017
Read events
3 904
Write events
90
Delete events
23

Modification events

(PID) Process:(4052) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Operation:writeName:Hidden
Value:
2
(PID) Process:(4052) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Operation:writeName:ShowSuperHidden
Value:
0
(PID) Process:(4052) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(4052) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(4052) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(4052) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(4052) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(4052) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:ProxyServer
Value:
(PID) Process:(4052) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:ProxyOverride
Value:
(PID) Process:(4052) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:AutoConfigURL
Value:
Executable files
0
Suspicious files
1
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
4052wscript.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Send to.lnkbinary
MD5:82EB8EEB2EC479EC10F8E0D304E0E74C
SHA256:F96ADC882681D17945D425127BAF18DB03DFDD8AFD7FEB488F97EA9D7C1E8125
4052wscript.exeC:\Users\Public\a.jstext
MD5:6FF2BE8B35431FCB8E9EB92204551BE8
SHA256:A605C7C51329E972E0679D77DA112EA6D6D358A441C7E2DBB7425885F578F0F5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
7
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4052
wscript.exe
POST
—
204.11.56.48:80
http://apprecords.com/
unknown
—
—
unknown
2792
wscript.exe
POST
—
204.11.56.48:80
http://apprecords.com/
unknown
—
—
unknown
2788
wscript.exe
POST
—
204.11.56.48:80
http://apprecords.com/
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4052
wscript.exe
204.11.56.48:80
apprecords.com
ULTRADDOS
VG
unknown
2792
wscript.exe
204.11.56.48:80
apprecords.com
ULTRADDOS
VG
unknown
2788
wscript.exe
204.11.56.48:80
apprecords.com
ULTRADDOS
VG
unknown

DNS requests

Domain
IP
Reputation
apprecords.com
  • 204.11.56.48
unknown

Threats

No threats detected
No debug info