Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Sept. 7, 2024, 5:01 p.m.	Sept. 7, 2024, 5:10 p.m.

Size	365.7KB
Type	ASCII text, with very long lines, with CRLF line terminators
MD5	`c78d4d6ec350000ceba0d488df6239ab`
SHA256	`8606c7f5ba9a32a577f5abc67fc95e432efe44a17c20c5cf628fd89f05681d5f`
CRC32	`A1273A4A`
ssdeep	`6144:6zdCKaqZLkV/n8aYvP38RfUjGmsqsRjJ+h/njiKyuxh9/7C73ATh/UOjgqBkAF:6gKdefUSmPsdEnWmB7CzAF/7VCAF`
Yara	Suspicious_Obfuscation_Script_2 - Suspicious obfuscation script (e.g. executable files)

wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\sky.js
1804
- javaw.exe "C:\Program Files (x86)\Java\jre1.8.0_131\bin\javaw.exe" -jar "C:\Users\test22\AppData\Local\Temp\vfOQS.jar"
  2192
  - java.exe "C:\Program Files (x86)\Java\jre1.8.0_131\bin\java.exe" -jar "C:\Users\test22\vfOQS.jar"
    2680
    - cmd.exe cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\test22\AppData\Roaming\vfOQS.jar"
      2792
      - schtasks.exe schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\test22\AppData\Roaming\vfOQS.jar"
        2904
    - java.exe "C:\Program Files (x86)\Java\jre1.8.0_131\bin\java.exe" -jar "C:\Users\test22\AppData\Roaming\vfOQS.jar"
      2828

Name	Response	Post-Analysis Lookup
objects.githubusercontent.com	A 185.199.109.133 A 185.199.111.133 A 185.199.110.133 A 185.199.108.133	185.199.111.133
repo1.maven.org	A 151.101.196.209 CNAME dualstack.sonatype.map.fastly.net	199.232.196.209
papacy.ddns.net	A 146.70.54.98	146.70.54.98
papacy.line.pm	A 146.70.54.98
github.com	A 20.200.245.247	20.200.245.247

IP Address	Status	Action
146.70.54.98	Active	Moloch
151.101.196.209	Active	Moloch
164.124.101.2	Active	Moloch
185.199.110.133	Active	Moloch
20.200.245.247	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.103:62576 -> 164.124.101.2:53	2042824	ET INFO DYNAMIC_DNS Query to a *.line .pm Domain	Potentially Bad Traffic
UDP 192.168.56.103:62576 -> 8.8.8.8:53	2042824	ET INFO DYNAMIC_DNS Query to a *.line .pm Domain	Potentially Bad Traffic
UDP 192.168.56.103:56613 -> 8.8.8.8:53	2028675	ET POLICY DNS Query to DynDNS Domain *.ddns .net	Potentially Bad Traffic

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLS 1.2 192.168.56.103:49163 20.200.245.247:443	C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo ECC Domain Validation Secure Server CA	CN=github.com	e7:03:5b:cc:1c:18:77:1f:79:2f:90:86:6b:6c:1d:f8:df:aa:bd:c0
TLS 1.2 192.168.56.103:49167 185.199.110.133:443	C=US, O=DigiCert Inc, CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1	C=US, ST=California, L=San Francisco, O=GitHub, Inc., CN=*.github.io	97:d8:c5:70:0f:12:24:6c:88:bc:fa:06:7e:8c:a7:4d:a8:62:67:28
TLS 1.2 192.168.56.103:49165 151.101.196.209:443	C=BE, O=GlobalSign nv-sa, CN=GlobalSign Atlas R3 DV TLS CA 2023 Q4	CN=repo1.maven.org	e3:6c:c5:6f:f7:76:7f:47:da:4d:26:4b:ef:ed:8b:23:b0:78:01:f8
TLS 1.2 192.168.56.103:49166 151.101.196.209:443	C=BE, O=GlobalSign nv-sa, CN=GlobalSign Atlas R3 DV TLS CA 2023 Q4	CN=repo1.maven.org	e3:6c:c5:6f:f7:76:7f:47:da:4d:26:4b:ef:ed:8b:23:b0:78:01:f8
TLS 1.2 192.168.56.103:49164 151.101.196.209:443	C=BE, O=GlobalSign nv-sa, CN=GlobalSign Atlas R3 DV TLS CA 2023 Q4	CN=repo1.maven.org	e3:6c:c5:6f:f7:76:7f:47:da:4d:26:4b:ef:ed:8b:23:b0:78:01:f8

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Sept. 7, 2024, 5:08 p.m.	computer_name: TEST22-PC	1	1	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 7, 2024, 5:01 p.m.		1	1	0

One or more processes crashed (3 events)

Time & API	Arguments	Status
__exception__ Sept. 7, 2024, 5:01 p.m.	stacktrace: exception.instruction_r: 8b 06 8d b5 f8 00 00 00 c5 fe 7f 06 c5 fe 7f 7e exception.instruction: mov eax, dword ptr [esi] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x2440202 registers.esp: 35060088 registers.edi: 1 registers.eax: 6 registers.ebp: 1950340288 registers.edx: 0 registers.ebx: 133120 registers.esi: 0 registers.ecx: 3405691582	1
__exception__ Sept. 7, 2024, 5:01 p.m.	stacktrace: exception.instruction_r: 8b 06 8d b5 f8 00 00 00 c5 fe 7f 06 c5 fe 7f 7e exception.instruction: mov eax, dword ptr [esi] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x23a0202 registers.esp: 32962048 registers.edi: 1 registers.eax: 6 registers.ebp: 1949422784 registers.edx: 0 registers.ebx: 16910336 registers.esi: 0 registers.ecx: 3405691582	1
__exception__ Sept. 7, 2024, 5:08 p.m.	stacktrace: exception.instruction_r: 8b 06 8d b5 f8 00 00 00 c5 fe 7f 06 c5 fe 7f 7e exception.instruction: mov eax, dword ptr [esi] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x23e0202 registers.esp: 34010660 registers.edi: 1 registers.eax: 6 registers.ebp: 1949684928 registers.edx: 0 registers.ebx: 133120 registers.esi: 0 registers.ecx: 3405691582	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Connects to a Dynamic DNS Domain (1 event)

domain

papacy.ddns.net

Allocates read-write-execute memory (usually to unpack itself) (50 out of 101 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 163840 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02440000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02468000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02470000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02478000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02480000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02488000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02490000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02498000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024a0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024a8000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024b0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024b8000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024c0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024c8000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024d0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024d8000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024e0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024e8000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024f0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024f8000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02500000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02508000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02510000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02518000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02520000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02528000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02530000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02538000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02540000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02548000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02550000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02558000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02560000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02568000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02570000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02578000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02580000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02588000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02590000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02598000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 163840 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023a0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023c8000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023d0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023d8000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023e0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023e8000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023f0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023f8000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02400000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02408000 process_handle: 0xffffffff	1

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\jna--877171118\jna8358950823561032753.dll

Creates a suspicious process (2 events)

cmdline	cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\test22\AppData\Roaming\vfOQS.jar"
cmdline	schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\test22\AppData\Roaming\vfOQS.jar"

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\jna--877171118\jna8358950823561032753.dll

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 65536 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x16200000 process_handle: 0xffffffff	1	0	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Sept. 7, 2024, 5:01 p.m.	flags: 28 family: 0	1	0	0

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\test22\AppData\Roaming\vfOQS.jar"
cmdline	schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\test22\AppData\Roaming\vfOQS.jar"

Installs itself for autorun at Windows startup (6 events)

reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\vfOQS	reg_value	"C:\Program Files (x86)\Java\jre1.8.0_131\bin\javaw.exe" -jar "C:\Users\test22\AppData\Roaming\vfOQS.jar"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vfOQS	reg_value	"C:\Program Files (x86)\Java\jre1.8.0_131\bin\javaw.exe" -jar "C:\Users\test22\AppData\Roaming\vfOQS.jar"
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vfOQS.jar
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\vfOQS.jar
cmdline	cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\test22\AppData\Roaming\vfOQS.jar"
cmdline	schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\test22\AppData\Roaming\vfOQS.jar"

One or more non-whitelisted processes were created (2 events)

parent_process	wscript.exe				martian_process	"C:\Program Files (x86)\Java\jre1.8.0_131\bin\javaw.exe" -jar "C:\Users\test22\AppData\Local\Temp\vfOQS.jar"
parent_process	wscript.exe				martian_process	C:\Users\test22\AppData\Local\Temp\vfOQS.jar

Generates some ICMP traffic

File has been identified by 24 AntiVirus engines on VirusTotal as malicious (24 events)

Cynet	Malicious (score: 99)
Skyhigh	BehavesLike.JS.Exploit.fm
ALYac	Trojan.GenericKD.73837375
VIPRE	JS:Trojan.Cryxos.5674
Arcabit	JS:Trojan.Cryxos.D162A [many]
Symantec	Trojan.Appjar!gen1
ESET-NOD32	JS/TrojanDropper.Agent.OEY
Avast	JS:Dropper-AADL [Drp]
Kaspersky	HEUR:Trojan-Dropper.Script.Generic
BitDefender	JS:Trojan.Cryxos.5674
NANO-Antivirus	Trojan.Script.Dropper.jpdkao
MicroWorld-eScan	JS:Trojan.Cryxos.5674
Emsisoft	JS:Trojan.Cryxos.5674 (B)
F-Secure	Malware.JS/Dldr.G8
TrendMicro	HEUR_JS.O.ELBP
FireEye	JS:Trojan.Cryxos.5674
Ikarus	Trojan.Java.Agent
Google	Detected
Avira	JS/Dldr.G8
MAX	malware (ai score=82)
GData	Trojan.GenericKD.73837375
Varist	JS/Agent.AXL!Eldorado
huorong	TrojanDropper/JS.Agent.bi
AVG	JS:Dropper-AADL [Drp]

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

146.70.54.98:24002

The processes wscript.exe, java.exe wrote an executable file to disk which it then attempted to execute (2 events)

file	C:\Program Files (x86)\Java\jre1.8.0_131\bin\javaw.exe
file	C:\Users\test22\AppData\Local\Temp\jna--877171118\jna8358950823561032753.dll

sky.js

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All