Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

Summary | ZeroBOX

Update.js

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Aug. 6, 2024, 2:58 p.m.	Aug. 6, 2024, 3:01 p.m.

Size	6.1KB
Type	ASCII text, with very long lines
MD5	`866b0c5274ee3ddae55d782644816251`
SHA256	`52506744f616790f7e6e25f2324d5dcd02d73530549aff6e3d8d2754f4c3672d`
CRC32	`CA4E8D4A`
ssdeep	`192:305lxI7lPOm1oDWu1M1cGETJM3sF9PRi+dpA:Mq1SWu6aGpsF98qA`
Yara	None matched

wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\Update.js
3048

Name	Response	Post-Analysis Lookup
jbwf.donors.eucharisticjesus.net	A 50.114.37.59	50.114.37.59

IP Address	Status	Action
164.124.101.2	Active	Moloch
50.114.37.59	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49162 -> 50.114.37.59:443	2054867	ET MALWARE SocGholish CnC Domain in TLS SNI (* .donors .eucharisticjesus .net)	Domain Observed Used for C2 Detected
TCP 192.168.56.102:49162 -> 50.114.37.59:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49162 -> 50.114.37.59:443	2054867	ET MALWARE SocGholish CnC Domain in TLS SNI (* .donors .eucharisticjesus .net)	Domain Observed Used for C2 Detected
TCP 50.114.37.59:443 -> 192.168.56.102:49164	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
UDP 192.168.56.102:63709 -> 164.124.101.2:53	2054866	ET MALWARE SocGholish CnC Domain in DNS (* .donors .eucharisticjesus .net)	Domain Observed Used for C2 Detected
TCP 192.168.56.102:49163 -> 50.114.37.59:443	2054867	ET MALWARE SocGholish CnC Domain in TLS SNI (* .donors .eucharisticjesus .net)	Domain Observed Used for C2 Detected
TCP 192.168.56.102:49163 -> 50.114.37.59:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49163 -> 50.114.37.59:443	2054867	ET MALWARE SocGholish CnC Domain in TLS SNI (* .donors .eucharisticjesus .net)	Domain Observed Used for C2 Detected
TCP 192.168.56.102:49163 -> 50.114.37.59:443	2054867	ET MALWARE SocGholish CnC Domain in TLS SNI (* .donors .eucharisticjesus .net)	Domain Observed Used for C2 Detected
TCP 192.168.56.102:49162 -> 50.114.37.59:443	2054867	ET MALWARE SocGholish CnC Domain in TLS SNI (* .donors .eucharisticjesus .net)	Domain Observed Used for C2 Detected

Suricata TLS

No Suricata TLS

Wscript.exe initiated network communications indicative of a script based payload download (2 events)

Time & API	Arguments	Status	Return	Repeated
InternetCrackUrlW Aug. 6, 2024, 2:58 p.m.	url: https://jbwf.donors.eucharisticjesus.net/orderReview flags: 0	1	1	0
HttpOpenRequestW Aug. 6, 2024, 2:58 p.m.	connect_handle: 0x00cc0008 http_version: flags: 81788928 http_method: POST referer: path: /orderReview	1	13369356	0

wscript.exe-based dropper (JScript, VBS) (1 event)

Network communications indicative of a potential document or script payload download was initiated by the process wscript.exe (12 events)

Time & API	Arguments	Status	Return	Repeated
InternetCrackUrlW Aug. 6, 2024, 2:58 p.m.	url: https://jbwf.donors.eucharisticjesus.net/orderReview flags: 0	1	1	0
HttpOpenRequestW Aug. 6, 2024, 2:58 p.m.	connect_handle: 0x00cc0008 http_version: flags: 81788928 http_method: POST referer: path: /orderReview	1	13369356	0
send Aug. 6, 2024, 2:58 p.m.	buffer: ! socket: 844 sent: 1	1	1	0
send Aug. 6, 2024, 2:58 p.m.	buffer: f±»¢û ÀüÓüJìünÉ¶<ý¨(Hm£/5 ÀÀÀ À 28>ÿ%# jbwf.donors.eucharisticjesus.net socket: 976 sent: 136	1	136	0
send Aug. 6, 2024, 2:58 p.m.	buffer: ! socket: 844 sent: 1	1	1	0
send Aug. 6, 2024, 2:58 p.m.	buffer: ! socket: 844 sent: 1	1	1	0
send Aug. 6, 2024, 2:58 p.m.	buffer: f±»¢({ì2¡8tÖ\|é¸Ç+C«ëºt¼G/5 ÀÀÀ À 28>ÿ%# jbwf.donors.eucharisticjesus.net socket: 976 sent: 136	1	136	0
send Aug. 6, 2024, 2:58 p.m.	buffer: ! socket: 844 sent: 1	1	1	0
send Aug. 6, 2024, 2:58 p.m.	buffer: ! socket: 844 sent: 1	1	1	0
send Aug. 6, 2024, 2:58 p.m.	buffer: 51f±»¢öB´Ielë¸[L/Xc¥½c±rôY ÿ socket: 976 sent: 58	1	58	0
send Aug. 6, 2024, 2:58 p.m.	buffer: ! socket: 844 sent: 1	1	1	0
send Aug. 6, 2024, 2:58 p.m.	buffer: ! socket: 844 sent: 1	1	1	0