AquariumScreening.exe| Category | Machine | Started | Completed |
|---|---|---|---|
| FILE | s1_win7_x6403_us | Feb. 2, 2024, 9:16 a.m. | Feb. 2, 2024, 9:24 a.m. |
-
-
TapiUnattend.exe TapiUnattend.exe
2120 -
-
findstr.exe findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
2300 -
tasklist.exe tasklist
2264 -
tasklist.exe tasklist
2408 -
findstr.exe findstr /I "wrsa.exe"
2444 -
cmd.exe cmd /c md 15012
2524 -
cmd.exe cmd /c copy /b Firefox + Jerusalem + Scales + Penny + Refund 15012\Carpet.pif
2572 -
cmd.exe cmd /c copy /b Boring + Campus 15012\u
2620 -
Carpet.pif 15012\Carpet.pif 15012\u
2664 -
PING.EXE ping -n 5 localhost
2828
-
-
-
cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VitaFit.url" & echo URL="C:\Users\test22\AppData\Local\VitalNourish Technologies Inc\VitaFit.js" >> "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VitaFit.url" & exit
2756 -
-
cmd.exe "C:\Windows\System32\cmd.exe" /C chcp 65001 && timeout /t 3 > NUL && schtasks /create /tn "jsc" /sc MINUTE /tr "C:\Users\test22\AppData\Local\RobloxSecurity\jsc.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\test22\AppData\Local\Temp\IXP000.TMP\15012\jsc.exe" &&START "" "C:\Users\test22\AppData\Local\RobloxSecurity\jsc.exe"
2412-
chcp.com chcp 65001
2612 -
timeout.exe timeout /t 3
2684 -
schtasks.exe schtasks /create /tn "jsc" /sc MINUTE /tr "C:\Users\test22\AppData\Local\RobloxSecurity\jsc.exe" /rl HIGHEST /f
2784 -
jsc.exe "C:\Users\test22\AppData\Local\RobloxSecurity\jsc.exe"
2856
-
-
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| hFvEGlMbCNxHoTQhmD.hFvEGlMbCNxHoTQhmD |
| IP Address | Status | Action |
|---|---|---|
| 164.124.101.2 | Active | Moloch |
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
| resource name | AVI |
| file | C:\Users\test22\AppData\Local\Temp\IXP000.TMP\15012\Carpet.pif |
| file | C:\Users\test22\AppData\Local\VitalNourish Technologies Inc\VitaFit.pif |
| file | C:\Users\test22\AppData\Local\VitalNourish Technologies Inc\VitaFit.js |
| cmdline | schtasks /create /tn "jsc" /sc MINUTE /tr "C:\Users\test22\AppData\Local\RobloxSecurity\jsc.exe" /rl HIGHEST /f |
| cmdline | cmd.exe /C chcp 65001 && timeout /t 3 > NUL && schtasks /create /tn "jsc" /sc MINUTE /tr "C:\Users\test22\AppData\Local\RobloxSecurity\jsc.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\test22\AppData\Local\Temp\IXP000.TMP\15012\jsc.exe" &&START "" "C:\Users\test22\AppData\Local\RobloxSecurity\jsc.exe" |
| cmdline | "C:\Windows\System32\cmd.exe" /C chcp 65001 && timeout /t 3 > NUL && schtasks /create /tn "jsc" /sc MINUTE /tr "C:\Users\test22\AppData\Local\RobloxSecurity\jsc.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\test22\AppData\Local\Temp\IXP000.TMP\15012\jsc.exe" &&START "" "C:\Users\test22\AppData\Local\RobloxSecurity\jsc.exe" |
| file | C:\Users\test22\AppData\Local\Temp\IXP000.TMP\15012\Carpet.pif |
| file | C:\Users\test22\AppData\Local\Temp\IXP000.TMP\15012\jsc.exe |
| file | C:\Users\test22\AppData\Local\Temp\AquariumScreening.exe |
| file | C:\Users\test22\AppData\Local\Temp\IXP000.TMP\Firefox |
| file | C:\Users\test22\AppData\Local\Temp\IXP000.TMP\15012\Carpet.pif |
| wmi | SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process |
| section | {u'size_of_data': u'0x000a5a00', u'virtual_address': u'0x0000f000', u'entropy': 7.935795182724924, u'name': u'.rsrc', u'virtual_size': u'0x000a5828'} | entropy | 7.93579518272 | description | A section with a high entropy has been found | |||||||||
| entropy | 0.932441942294 | description | Overall entropy of this PE file is high | |||||||||||
| url | http://www.microsoft.com/schemas/ie8tldlistdescription/1.0 |
| url | http://purl.org/rss/1.0/ |
| url | http://www.passport.com |
| description | Communications use DNS | rule | Network_DNS | ||||||
| description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
| description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
| description | (no description) | rule | DebuggerHiding__Thread | ||||||
| description | (no description) | rule | DebuggerHiding__Active | ||||||
| description | (no description) | rule | ThreadControl__Context | ||||||
| description | (no description) | rule | SEH__vectored | ||||||
| description | Checks if being debugged | rule | anti_dbg | ||||||
| description | Bypass DEP | rule | disable_dep | ||||||
| description | Create a windows service | rule | Create_Service | ||||||
| description | Communications over RAW Socket | rule | Network_TCP_Socket | ||||||
| description | Communication using DGA | rule | Network_DGA | ||||||
| description | Match Windows Http API call | rule | Str_Win32_Http_API | ||||||
| description | Take ScreenShot | rule | ScreenShot | ||||||
| description | Escalate priviledges | rule | Escalate_priviledges | ||||||
| description | Steal credential | rule | local_credential_Steal | ||||||
| description | PWS Memory | rule | Generic_PWS_Memory_Zero | ||||||
| description | Hijack network configuration | rule | Hijack_Network | ||||||
| description | Record Audio | rule | Sniff_Audio | ||||||
| description | Communications over HTTP | rule | Network_HTTP | ||||||
| description | Communications use DNS | rule | Network_DNS | ||||||
| description | Code injection with CreateRemoteThread in a remote process | rule | Code_injection | ||||||
| description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
| description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
| description | (no description) | rule | DebuggerCheck__RemoteAPI | ||||||
| description | (no description) | rule | DebuggerHiding__Thread | ||||||
| description | (no description) | rule | DebuggerHiding__Active | ||||||
| description | (no description) | rule | DebuggerException__ConsoleCtrl | ||||||
| description | (no description) | rule | DebuggerException__SetConsoleCtrl | ||||||
| description | (no description) | rule | ThreadControl__Context | ||||||
| description | (no description) | rule | SEH__vectored | ||||||
| description | (no description) | rule | Check_Dlls | ||||||
| description | Checks if being debugged | rule | anti_dbg | ||||||
| description | Anti-Sandbox checks for ThreatExpert | rule | antisb_threatExpert | ||||||
| description | Bypass DEP | rule | disable_dep | ||||||
| description | Affect hook table | rule | win_hook | ||||||
| description | File Downloader | rule | Network_Downloader | ||||||
| description | Match Windows Inet API call | rule | Str_Win32_Internet_API | ||||||
| description | Install itself for autorun at Windows startup | rule | Persistence | ||||||
| description | Communications over FTP | rule | Network_FTP | ||||||
| description | Run a KeyLogger | rule | KeyLogger | ||||||
| description | Communications over P2P network | rule | Network_P2P_Win | ||||||
| description | Create a windows service | rule | Create_Service | ||||||
| description | Communications over RAW Socket | rule | Network_TCP_Socket | ||||||
| description | Communication using DGA | rule | Network_DGA | ||||||
| description | Match Windows Http API call | rule | Str_Win32_Http_API | ||||||
| description | Take ScreenShot | rule | ScreenShot | ||||||
| description | Escalate priviledges | rule | Escalate_priviledges | ||||||
| description | Steal credential | rule | local_credential_Steal | ||||||
| description | PWS Memory | rule | Generic_PWS_Memory_Zero | ||||||
| cmdline | cmd /k move Ko Ko.bat & Ko.bat & exit |
| cmdline | chcp 65001 |
| cmdline | tasklist |
| cmdline | ping -n 5 localhost |
| cmdline | schtasks /create /tn "jsc" /sc MINUTE /tr "C:\Users\test22\AppData\Local\RobloxSecurity\jsc.exe" /rl HIGHEST /f |
| cmdline | cmd /k echo [InternetShortcut] > "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VitaFit.url" & echo URL="C:\Users\test22\AppData\Local\VitalNourish Technologies Inc\VitaFit.js" >> "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VitaFit.url" & exit |
| cmdline | C:\Users\test22\AppData\Local\Temp\IXP000.TMP\15012\jsc.exe |
| cmdline | "C:\Users\test22\AppData\Local\RobloxSecurity\jsc.exe" |
| cmdline | cmd.exe /C chcp 65001 && timeout /t 3 > NUL && schtasks /create /tn "jsc" /sc MINUTE /tr "C:\Users\test22\AppData\Local\RobloxSecurity\jsc.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\test22\AppData\Local\Temp\IXP000.TMP\15012\jsc.exe" &&START "" "C:\Users\test22\AppData\Local\RobloxSecurity\jsc.exe" |
| cmdline | "C:\Windows\System32\cmd.exe" /C chcp 65001 && timeout /t 3 > NUL && schtasks /create /tn "jsc" /sc MINUTE /tr "C:\Users\test22\AppData\Local\RobloxSecurity\jsc.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\test22\AppData\Local\Temp\IXP000.TMP\15012\jsc.exe" &&START "" "C:\Users\test22\AppData\Local\RobloxSecurity\jsc.exe" |
| buffer | Buffer with sha1: 7442b95da3fe5cae89aac61c7c609105294037c7 |
| buffer | Buffer with sha1: 1ffa9b0e0acd704a0fcb405505ec6a9c205f1497 |
| description | jsc.exe tried to sleep 2728173 seconds, actually delayed analysis time by 2728173 seconds | |||
| reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 | reg_value | rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP000.TMP\" | ||||||
| file | C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VitaFit.url | ||||||||
| cmdline | schtasks /create /tn "jsc" /sc MINUTE /tr "C:\Users\test22\AppData\Local\RobloxSecurity\jsc.exe" /rl HIGHEST /f | ||||||||
| cmdline | cmd.exe /C chcp 65001 && timeout /t 3 > NUL && schtasks /create /tn "jsc" /sc MINUTE /tr "C:\Users\test22\AppData\Local\RobloxSecurity\jsc.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\test22\AppData\Local\Temp\IXP000.TMP\15012\jsc.exe" &&START "" "C:\Users\test22\AppData\Local\RobloxSecurity\jsc.exe" | ||||||||
| cmdline | "C:\Windows\System32\cmd.exe" /C chcp 65001 && timeout /t 3 > NUL && schtasks /create /tn "jsc" /sc MINUTE /tr "C:\Users\test22\AppData\Local\RobloxSecurity\jsc.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\test22\AppData\Local\Temp\IXP000.TMP\15012\jsc.exe" &&START "" "C:\Users\test22\AppData\Local\RobloxSecurity\jsc.exe" | ||||||||
| process | carpet.pif |
| process | aquariumscreening.exe |
| process | cmd.exe |
| process: potential process injection target | explorer.exe |
| Bkav | W32.AIDetectMalware |
| Lionic | Trojan.Win32.Agent.Y!c |
| Cynet | Malicious (score: 100) |
| Skyhigh | Artemis!Trojan |
| Symantec | ML.Attribute.HighConfidence |
| Elastic | malicious (high confidence) |
| APEX | Malicious |
| Kaspersky | UDS:DangerousObject.Multi.Generic |
| Rising | Trojan.Generic@AI.100 (RDML:61S+Ee5ZWdOgp846yXUJXw) |
| Trapmine | malicious.high.ml.score |
| Ikarus | Win32.Outbreak |
| Webroot | W32.Trojan.Gen |
| Detected | |
| Antiy-AVL | Trojan[Backdoor]/Win32.Agent |
| Kingsoft | Win32.Hack.Agent.a |
| Gridinsoft | Ransom.Win32.Sabsik.oa!s1 |
| Microsoft | Trojan:Win32/Znyonm |
| ZoneAlarm | UDS:DangerousObject.Multi.Generic |
| McAfee | Artemis!B74AF6F8231C |
| DeepInstinct | MALICIOUS |
| VBA32 | TrojanDownloader.Lgoog |
| Malwarebytes | Generic.Malware/Suspicious |
| CrowdStrike | win/malicious_confidence_90% (W) |