Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	March 13, 2021, 10:11 a.m.	March 13, 2021, 10:14 a.m.

Size	179.3KB
Type	ASCII text, with very long lines, with CRLF line terminators
MD5	`dab72fabc42d262d099b12ce1f78e2cc`
SHA256	`30a6bf923f8559730ffd943722f0027e1a97c6bc8bbce81f88bfa417d19a97d1`
CRC32	`1E263081`
ssdeep	`3072:lp1gHeX3reXPf6ZKOBRY+7Q0bamKZtvEzKbURCqeGK/6SbIpklgVDSxGfmuZyas:lp1gHeX3reXPf6ZKwRY+cM24RCqeGKZR`
Yara	rat_vnc - Remote Administration toolkit VNC

wscript.exe "C:\Windows\System32\wscript.exe" "C:\Users\test22\AppData\Local\Temp\Deutsche Telekom GMBH.js"
900
- wscript.exe "C:\Windows\System32\wscript.exe" //B "C:\Users\test22\AppData\Roaming\Deutsche Telekom GMBH.js"
  5720

Name	Response	Post-Analysis Lookup
ip-api.com	A 208.95.112.1	208.95.112.1

IP Address	Status	Action
164.124.101.2	Active	Moloch
172.217.25.14	Active	Moloch
194.5.98.104	Active	Moloch
208.95.112.1	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49807 -> 208.95.112.1:80	2022082	ET POLICY External IP Lookup ip-api.com	Device Retrieving External IP Address Detected

Suricata TLS

No Suricata TLS

Queries for the computername (7 events)

Time & API	Arguments	Status	Return
GetComputerNameW March 13, 2021, 10:11 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 13, 2021, 10:11 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 13, 2021, 10:11 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 13, 2021, 10:11 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 13, 2021, 10:11 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 13, 2021, 10:11 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 13, 2021, 10:11 a.m.	computer_name: TEST22-PC	1	1

Performs some HTTP requests (1 event)

request

GET http://ip-api.com/json/

Allocates read-write-execute memory (usually to unpack itself) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory March 13, 2021, 10:11 a.m.	process_identifier: 5720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1	0	0

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (18 events)

Time & API	Arguments	Status	Return
GetDiskFreeSpaceW March 13, 2021, 10:11 a.m.	number_of_free_clusters: 3246148 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW March 13, 2021, 10:12 a.m.	number_of_free_clusters: 3246016 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW March 13, 2021, 10:12 a.m.	number_of_free_clusters: 3246014 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW March 13, 2021, 10:12 a.m.	number_of_free_clusters: 3246014 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW March 13, 2021, 10:12 a.m.	number_of_free_clusters: 3246014 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW March 13, 2021, 10:12 a.m.	number_of_free_clusters: 3246014 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW March 13, 2021, 10:12 a.m.	number_of_free_clusters: 3246014 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW March 13, 2021, 10:12 a.m.	number_of_free_clusters: 3246014 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW March 13, 2021, 10:12 a.m.	number_of_free_clusters: 3246014 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW March 13, 2021, 10:12 a.m.	number_of_free_clusters: 3246014 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW March 13, 2021, 10:13 a.m.	number_of_free_clusters: 3246014 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW March 13, 2021, 10:13 a.m.	number_of_free_clusters: 3246014 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW March 13, 2021, 10:13 a.m.	number_of_free_clusters: 3246014 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW March 13, 2021, 10:13 a.m.	number_of_free_clusters: 3246014 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW March 13, 2021, 10:13 a.m.	number_of_free_clusters: 3246014 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW March 13, 2021, 10:13 a.m.	number_of_free_clusters: 3246014 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW March 13, 2021, 10:13 a.m.	number_of_free_clusters: 3246012 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW March 13, 2021, 10:13 a.m.	number_of_free_clusters: 3246012 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1

Looks up the external IP address (1 event)

domain

ip-api.com

Potentially malicious URLs were found in the process memory dump (50 out of 1324 events)

url	http://www.expedia.com/favicon.ico
url	http://uk.ask.com/favicon.ico
url	http://www.priceminister.com/
url	http://ru.wikipedia.org/
url	http://ocsp.infonotary.com/responder.cgi0V
url	http://www.merlin.com.pl/favicon.ico
url	http://www.cnet.com/favicon.ico
url	http://www.certificadodigital.com.br/repositorio/serasaca/crl/SerasaCAII.crl0
url	http://search.nifty.com/
url	http://ns.adobe.com/exif/1.0/
url	http://www.etmall.com.tw/
url	http://crl.chambersign.org/publicnotaryroot.crl0
url	http://search.goo.ne.jp/
url	http://fr.wikipedia.org/favicon.ico
url	http://busca.estadao.com.br/favicon.ico
url	http://search.hanafos.com/favicon.ico
url	http://search.chol.com/favicon.ico
url	http://purl.org/rss/1.0/
url	http://amazon.fr/
url	http://www.amazon.co.jp/
url	http://www.mtv.com/favicon.ico
url	http://busqueda.aol.com.mx/
url	http://search.live.com/results.aspx?FORM=SOLTDF
url	http://msdn.microsoft.com/
url	http://msdn.microsoft.com/workshop/security/privacy/overview/privacyimportxml.asp)
url	http://www.sify.com/favicon.ico
url	http://yellowpages.superpages.com/
url	http://suche.freenet.de/
url	http://search.yahooapis.jp/AssistSearchService/V2/webassistSearch?output=iejson
url	http://crl.chambersign.org/chambersroot.crl0
url	http://search.aol.com/
url	http://browse.guardian.co.uk/
url	http://www.mercadolibre.com.mx/
url	http://www.asharqalawsat.com/
url	http://www.facebook.com/
url	http://si.wikipedia.org/favicon.ico
url	http://www.rtl.de/favicon.ico
url	http://search.msn.com/results.aspx?q=
url	http://www.microsoft.com/pki/certs/MicrosoftWinPCA.crt0
url	http://search.naver.com/favicon.ico
url	http://fedir.comsign.co.il/cacert/ComSignAdvancedSecurityCA.crt0
url	http://crl.usertrust.com/UTN-USERFirst-NetworkApplications.crl0
url	https://www.netlock.net/docs
url	http://en.wikipedia.org/favicon.ico
url	http://si.wikipedia.org/w/api.php?action=opensearch
url	http://www.signatur.rtr.at/de/directory/cps.html0
url	http://udn.com/favicon.ico
url	http://rover.ebay.com
url	http://search.ebay.fr/
url	http://www.univision.com/

Yara rule detected in process memory (50 out of 89 events)

description	Code injection with CreateRemoteThread in a remote process	rule	inject_thread
description	Hijack network configuration	rule	hijack_network
description	Create a windows service	rule	create_service
description	Create a COM server	rule	create_com_service
description	Communications over UDP network	rule	network_udp_sock
description	Listen for incoming communication	rule	network_tcp_listen
description	Communications over P2P network	rule	network_p2p_win
description	Communications over HTTP	rule	network_http
description	File downloader/dropper	rule	network_dropper
description	Communications over FTP	rule	network_ftp
description	Communications over RAW socket	rule	network_tcp_socket
description	Communications use DNS	rule	network_dns
description	Communication using dga	rule	network_dga
description	Escalade priviledges	rule	escalate_priv
description	Take screenshot	rule	screenshot
description	Run a keylogger	rule	keylogger
description	Steal credential	rule	cred_local
description	Record Audio	rule	sniff_audio
description	APC queue tasks migration	rule	migrate_apc
description	Malware can spread east-west file	rule	spreading_file
description	Malware can spread east-west using share drive	rule	spreading_share
description	Create or check mutex	rule	win_mutex
description	Affect system registries	rule	win_registry
description	Affect system token	rule	win_token
description	Affect private profile	rule	win_private_profile
description	Affect private profile	rule	win_files_operation
description	Match Winsock 2 API library declaration	rule	Str_Win32_Winsock2_Library
description	Match Windows Inet API library declaration	rule	Str_Win32_Wininet_Library
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Code injection with CreateRemoteThread in a remote process	rule	inject_thread
description	Hijack network configuration	rule	hijack_network
description	Create a windows service	rule	create_service
description	Create a COM server	rule	create_com_service
description	Communications over UDP network	rule	network_udp_sock
description	Listen for incoming communication	rule	network_tcp_listen

Executes one or more WMI queries which can be used to identify virtual machines (1 event)

wmi	select * from win32_logicaldisk

Communicates with host for which no DNS query was performed (2 events)

host	172.217.25.14
host	194.5.98.104

Wscript.exe initiated network communications indicative of a script based payload download (40 events)

Time & API	Arguments	Status	Return
InternetCrackUrlW March 13, 2021, 10:11 a.m.	url: http://194.5.98.104:5200/is-ready flags: 0	1	1
InternetCrackUrlW March 13, 2021, 10:11 a.m.	url: http://ip-api.com/json/ flags: 0	1	1
HttpOpenRequestW March 13, 2021, 10:11 a.m.	connect_handle: 0x00cc0008 http_version: flags: 4194304 http_method: GET referer: path: /json/	1	13369356
InternetCrackUrlA March 13, 2021, 10:11 a.m.	url: http://ip-api.com/json/ flags: 0	1	1
InternetReadFile March 13, 2021, 10:11 a.m.	buffer: {"status":"success","country":"South Korea","countryCode":"KR","region":"11","regionName":"Seoul","city":"Songpa-dong","zip":"05670","lat":37.5079,"lon":127.1177,"timezone":"Asia/Seoul","isp":"Korea Telecom","org":"Kornet","as":"AS4766 Korea Telecom","query":"175.208.134.150"} request_handle: 0x00cc000c	1	1
HttpOpenRequestW March 13, 2021, 10:11 a.m.	connect_handle: 0x00cc0008 http_version: flags: 71303168 http_method: POST referer: path: /is-ready	1	13369356
InternetCrackUrlW March 13, 2021, 10:12 a.m.	url: http://194.5.98.104:5200/is-ready flags: 0	1	1
HttpOpenRequestW March 13, 2021, 10:12 a.m.	connect_handle: 0x00cc0008 http_version: flags: 71303168 http_method: POST referer: path: /is-ready	1	13369356
InternetCrackUrlW March 13, 2021, 10:12 a.m.	url: http://194.5.98.104:5200/is-ready flags: 0	1	1
HttpOpenRequestW March 13, 2021, 10:12 a.m.	connect_handle: 0x00cc0008 http_version: flags: 71303168 http_method: POST referer: path: /is-ready	1	13369356
InternetCrackUrlW March 13, 2021, 10:12 a.m.	url: http://194.5.98.104:5200/is-ready flags: 0	1	1
HttpOpenRequestW March 13, 2021, 10:12 a.m.	connect_handle: 0x00cc0008 http_version: flags: 71303168 http_method: POST referer: path: /is-ready	1	13369356
InternetCrackUrlW March 13, 2021, 10:12 a.m.	url: http://194.5.98.104:5200/is-ready flags: 0	1	1
HttpOpenRequestW March 13, 2021, 10:12 a.m.	connect_handle: 0x00cc0008 http_version: flags: 71303168 http_method: POST referer: path: /is-ready	1	13369356
InternetCrackUrlW March 13, 2021, 10:12 a.m.	url: http://194.5.98.104:5200/is-ready flags: 0	1	1
HttpOpenRequestW March 13, 2021, 10:12 a.m.	connect_handle: 0x00cc0008 http_version: flags: 71303168 http_method: POST referer: path: /is-ready	1	13369356
InternetCrackUrlW March 13, 2021, 10:12 a.m.	url: http://194.5.98.104:5200/is-ready flags: 0	1	1
HttpOpenRequestW March 13, 2021, 10:12 a.m.	connect_handle: 0x00cc0008 http_version: flags: 71303168 http_method: POST referer: path: /is-ready	1	13369356
InternetCrackUrlW March 13, 2021, 10:12 a.m.	url: http://194.5.98.104:5200/is-ready flags: 0	1	1
HttpOpenRequestW March 13, 2021, 10:12 a.m.	connect_handle: 0x00cc0008 http_version: flags: 71303168 http_method: POST referer: path: /is-ready	1	13369356
InternetCrackUrlW March 13, 2021, 10:12 a.m.	url: http://194.5.98.104:5200/is-ready flags: 0	1	1
HttpOpenRequestW March 13, 2021, 10:12 a.m.	connect_handle: 0x00cc0008 http_version: flags: 71303168 http_method: POST referer: path: /is-ready	1	13369356
InternetCrackUrlW March 13, 2021, 10:12 a.m.	url: http://194.5.98.104:5200/is-ready flags: 0	1	1
HttpOpenRequestW March 13, 2021, 10:12 a.m.	connect_handle: 0x00cc0008 http_version: flags: 71303168 http_method: POST referer: path: /is-ready	1	13369356
InternetCrackUrlW March 13, 2021, 10:13 a.m.	url: http://194.5.98.104:5200/is-ready flags: 0	1	1
HttpOpenRequestW March 13, 2021, 10:13 a.m.	connect_handle: 0x00cc0008 http_version: flags: 71303168 http_method: POST referer: path: /is-ready	1	13369356
InternetCrackUrlW March 13, 2021, 10:13 a.m.	url: http://194.5.98.104:5200/is-ready flags: 0	1	1
HttpOpenRequestW March 13, 2021, 10:13 a.m.	connect_handle: 0x00cc0008 http_version: flags: 71303168 http_method: POST referer: path: /is-ready	1	13369356
InternetCrackUrlW March 13, 2021, 10:13 a.m.	url: http://194.5.98.104:5200/is-ready flags: 0	1	1
HttpOpenRequestW March 13, 2021, 10:13 a.m.	connect_handle: 0x00cc0008 http_version: flags: 71303168 http_method: POST referer: path: /is-ready	1	13369356
InternetCrackUrlW March 13, 2021, 10:13 a.m.	url: http://194.5.98.104:5200/is-ready flags: 0	1	1
HttpOpenRequestW March 13, 2021, 10:13 a.m.	connect_handle: 0x00cc0008 http_version: flags: 71303168 http_method: POST referer: path: /is-ready	1	13369356
InternetCrackUrlW March 13, 2021, 10:13 a.m.	url: http://194.5.98.104:5200/is-ready flags: 0	1	1
HttpOpenRequestW March 13, 2021, 10:13 a.m.	connect_handle: 0x00cc0008 http_version: flags: 71303168 http_method: POST referer: path: /is-ready	1	13369356
InternetCrackUrlW March 13, 2021, 10:13 a.m.	url: http://194.5.98.104:5200/is-ready flags: 0	1	1
HttpOpenRequestW March 13, 2021, 10:13 a.m.	connect_handle: 0x00cc0008 http_version: flags: 71303168 http_method: POST referer: path: /is-ready	1	13369356
InternetCrackUrlW March 13, 2021, 10:13 a.m.	url: http://194.5.98.104:5200/is-ready flags: 0	1	1
HttpOpenRequestW March 13, 2021, 10:13 a.m.	connect_handle: 0x00cc0008 http_version: flags: 71303168 http_method: POST referer: path: /is-ready	1	13369356
InternetCrackUrlW March 13, 2021, 10:13 a.m.	url: http://194.5.98.104:5200/is-ready flags: 0	1	1
HttpOpenRequestW March 13, 2021, 10:13 a.m.	connect_handle: 0x00cc0008 http_version: flags: 71303168 http_method: POST referer: path: /is-ready	1	13369356

Installs itself for autorun at Windows startup (40 events)

reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Deutsche Telekom GMBH	reg_value	wscript.exe //B "C:\Users\test22\AppData\Roaming\Deutsche Telekom GMBH.js"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Deutsche Telekom GMBH	reg_value	wscript.exe //B "C:\Users\test22\AppData\Roaming\Deutsche Telekom GMBH.js"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Deutsche Telekom GMBH	reg_value	wscript.exe //B "C:\Users\test22\AppData\Roaming\Deutsche Telekom GMBH.js"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Deutsche Telekom GMBH	reg_value	wscript.exe //B "C:\Users\test22\AppData\Roaming\Deutsche Telekom GMBH.js"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Deutsche Telekom GMBH	reg_value	wscript.exe //B "C:\Users\test22\AppData\Roaming\Deutsche Telekom GMBH.js"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Deutsche Telekom GMBH	reg_value	wscript.exe //B "C:\Users\test22\AppData\Roaming\Deutsche Telekom GMBH.js"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Deutsche Telekom GMBH	reg_value	wscript.exe //B "C:\Users\test22\AppData\Roaming\Deutsche Telekom GMBH.js"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Deutsche Telekom GMBH	reg_value	wscript.exe //B "C:\Users\test22\AppData\Roaming\Deutsche Telekom GMBH.js"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Deutsche Telekom GMBH	reg_value	wscript.exe //B "C:\Users\test22\AppData\Roaming\Deutsche Telekom GMBH.js"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Deutsche Telekom GMBH	reg_value	wscript.exe //B "C:\Users\test22\AppData\Roaming\Deutsche Telekom GMBH.js"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Deutsche Telekom GMBH	reg_value	wscript.exe //B "C:\Users\test22\AppData\Roaming\Deutsche Telekom GMBH.js"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Deutsche Telekom GMBH	reg_value	wscript.exe //B "C:\Users\test22\AppData\Roaming\Deutsche Telekom GMBH.js"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Deutsche Telekom GMBH	reg_value	wscript.exe //B "C:\Users\test22\AppData\Roaming\Deutsche Telekom GMBH.js"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Deutsche Telekom GMBH	reg_value	wscript.exe //B "C:\Users\test22\AppData\Roaming\Deutsche Telekom GMBH.js"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Deutsche Telekom GMBH	reg_value	wscript.exe //B "C:\Users\test22\AppData\Roaming\Deutsche Telekom GMBH.js"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Deutsche Telekom GMBH	reg_value	wscript.exe //B "C:\Users\test22\AppData\Roaming\Deutsche Telekom GMBH.js"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Deutsche Telekom GMBH	reg_value	wscript.exe //B "C:\Users\test22\AppData\Roaming\Deutsche Telekom GMBH.js"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Deutsche Telekom GMBH	reg_value	wscript.exe //B "C:\Users\test22\AppData\Roaming\Deutsche Telekom GMBH.js"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Deutsche Telekom GMBH	reg_value	wscript.exe //B "C:\Users\test22\AppData\Roaming\Deutsche Telekom GMBH.js"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Deutsche Telekom GMBH	reg_value	wscript.exe //B "C:\Users\test22\AppData\Roaming\Deutsche Telekom GMBH.js"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Deutsche Telekom GMBH	reg_value	wscript.exe //B "C:\Users\test22\AppData\Roaming\Deutsche Telekom GMBH.js"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Deutsche Telekom GMBH	reg_value	wscript.exe //B "C:\Users\test22\AppData\Roaming\Deutsche Telekom GMBH.js"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Deutsche Telekom GMBH	reg_value	wscript.exe //B "C:\Users\test22\AppData\Roaming\Deutsche Telekom GMBH.js"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Deutsche Telekom GMBH	reg_value	wscript.exe //B "C:\Users\test22\AppData\Roaming\Deutsche Telekom GMBH.js"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Deutsche Telekom GMBH	reg_value	wscript.exe //B "C:\Users\test22\AppData\Roaming\Deutsche Telekom GMBH.js"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Deutsche Telekom GMBH	reg_value	wscript.exe //B "C:\Users\test22\AppData\Roaming\Deutsche Telekom GMBH.js"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Deutsche Telekom GMBH	reg_value	wscript.exe //B "C:\Users\test22\AppData\Roaming\Deutsche Telekom GMBH.js"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Deutsche Telekom GMBH	reg_value	wscript.exe //B "C:\Users\test22\AppData\Roaming\Deutsche Telekom GMBH.js"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Deutsche Telekom GMBH	reg_value	wscript.exe //B "C:\Users\test22\AppData\Roaming\Deutsche Telekom GMBH.js"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Deutsche Telekom GMBH	reg_value	wscript.exe //B "C:\Users\test22\AppData\Roaming\Deutsche Telekom GMBH.js"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Deutsche Telekom GMBH	reg_value	wscript.exe //B "C:\Users\test22\AppData\Roaming\Deutsche Telekom GMBH.js"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Deutsche Telekom GMBH	reg_value	wscript.exe //B "C:\Users\test22\AppData\Roaming\Deutsche Telekom GMBH.js"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Deutsche Telekom GMBH	reg_value	wscript.exe //B "C:\Users\test22\AppData\Roaming\Deutsche Telekom GMBH.js"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Deutsche Telekom GMBH	reg_value	wscript.exe //B "C:\Users\test22\AppData\Roaming\Deutsche Telekom GMBH.js"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Deutsche Telekom GMBH	reg_value	wscript.exe //B "C:\Users\test22\AppData\Roaming\Deutsche Telekom GMBH.js"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Deutsche Telekom GMBH	reg_value	wscript.exe //B "C:\Users\test22\AppData\Roaming\Deutsche Telekom GMBH.js"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Deutsche Telekom GMBH	reg_value	wscript.exe //B "C:\Users\test22\AppData\Roaming\Deutsche Telekom GMBH.js"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Deutsche Telekom GMBH	reg_value	wscript.exe //B "C:\Users\test22\AppData\Roaming\Deutsche Telekom GMBH.js"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Deutsche Telekom GMBH	reg_value	wscript.exe //B "C:\Users\test22\AppData\Roaming\Deutsche Telekom GMBH.js"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Deutsche Telekom GMBH	reg_value	wscript.exe //B "C:\Users\test22\AppData\Roaming\Deutsche Telekom GMBH.js"

Executes one or more WMI queries (3 events)

wmi	select * from antivirusproduct
wmi	select * from win32_operatingsystem
wmi	select * from win32_logicaldisk

wscript.exe-based dropper (JScript, VBS) (19 events)

Network communications indicative of a potential document or script payload download was initiated by the process wscript.exe (50 out of 60 events)

Time & API	Arguments	Status	Return
InternetCrackUrlW March 13, 2021, 10:11 a.m.	url: http://194.5.98.104:5200/is-ready flags: 0	1	1
InternetCrackUrlW March 13, 2021, 10:11 a.m.	url: http://ip-api.com/json/ flags: 0	1	1
HttpOpenRequestW March 13, 2021, 10:11 a.m.	connect_handle: 0x00cc0008 http_version: flags: 4194304 http_method: GET referer: path: /json/	1	13369356
send March 13, 2021, 10:11 a.m.	buffer: ! socket: 988 sent: 1	1	1
send March 13, 2021, 10:11 a.m.	buffer: GET /json/ HTTP/1.1 Accept: / Accept-Language: ko User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.86 Safari/537.36 Accept-Encoding: gzip, deflate Host: ip-api.com Connection: Keep-Alive socket: 1092 sent: 259	1	259
send March 13, 2021, 10:11 a.m.	buffer: ! socket: 988 sent: 1	1	1
InternetCrackUrlA March 13, 2021, 10:11 a.m.	url: http://ip-api.com/json/ flags: 0	1	1
HttpOpenRequestW March 13, 2021, 10:11 a.m.	connect_handle: 0x00cc0008 http_version: flags: 71303168 http_method: POST referer: path: /is-ready	1	13369356
send March 13, 2021, 10:11 a.m.	buffer: ! socket: 988 sent: 1	1	1
InternetCrackUrlW March 13, 2021, 10:12 a.m.	url: http://194.5.98.104:5200/is-ready flags: 0	1	1
HttpOpenRequestW March 13, 2021, 10:12 a.m.	connect_handle: 0x00cc0008 http_version: flags: 71303168 http_method: POST referer: path: /is-ready	1	13369356
send March 13, 2021, 10:12 a.m.	buffer: ! socket: 988 sent: 1	1	1
InternetCrackUrlW March 13, 2021, 10:12 a.m.	url: http://194.5.98.104:5200/is-ready flags: 0	1	1
HttpOpenRequestW March 13, 2021, 10:12 a.m.	connect_handle: 0x00cc0008 http_version: flags: 71303168 http_method: POST referer: path: /is-ready	1	13369356
send March 13, 2021, 10:12 a.m.	buffer: ! socket: 988 sent: 1	1	1
InternetCrackUrlW March 13, 2021, 10:12 a.m.	url: http://194.5.98.104:5200/is-ready flags: 0	1	1
HttpOpenRequestW March 13, 2021, 10:12 a.m.	connect_handle: 0x00cc0008 http_version: flags: 71303168 http_method: POST referer: path: /is-ready	1	13369356
send March 13, 2021, 10:12 a.m.	buffer: ! socket: 988 sent: 1	1	1
InternetCrackUrlW March 13, 2021, 10:12 a.m.	url: http://194.5.98.104:5200/is-ready flags: 0	1	1
HttpOpenRequestW March 13, 2021, 10:12 a.m.	connect_handle: 0x00cc0008 http_version: flags: 71303168 http_method: POST referer: path: /is-ready	1	13369356
send March 13, 2021, 10:12 a.m.	buffer: ! socket: 988 sent: 1	1	1
InternetCrackUrlW March 13, 2021, 10:12 a.m.	url: http://194.5.98.104:5200/is-ready flags: 0	1	1
HttpOpenRequestW March 13, 2021, 10:12 a.m.	connect_handle: 0x00cc0008 http_version: flags: 71303168 http_method: POST referer: path: /is-ready	1	13369356
send March 13, 2021, 10:12 a.m.	buffer: ! socket: 988 sent: 1	1	1
InternetCrackUrlW March 13, 2021, 10:12 a.m.	url: http://194.5.98.104:5200/is-ready flags: 0	1	1
HttpOpenRequestW March 13, 2021, 10:12 a.m.	connect_handle: 0x00cc0008 http_version: flags: 71303168 http_method: POST referer: path: /is-ready	1	13369356
send March 13, 2021, 10:12 a.m.	buffer: ! socket: 988 sent: 1	1	1
InternetCrackUrlW March 13, 2021, 10:12 a.m.	url: http://194.5.98.104:5200/is-ready flags: 0	1	1
HttpOpenRequestW March 13, 2021, 10:12 a.m.	connect_handle: 0x00cc0008 http_version: flags: 71303168 http_method: POST referer: path: /is-ready	1	13369356
send March 13, 2021, 10:12 a.m.	buffer: ! socket: 988 sent: 1	1	1
InternetCrackUrlW March 13, 2021, 10:12 a.m.	url: http://194.5.98.104:5200/is-ready flags: 0	1	1
HttpOpenRequestW March 13, 2021, 10:12 a.m.	connect_handle: 0x00cc0008 http_version: flags: 71303168 http_method: POST referer: path: /is-ready	1	13369356
send March 13, 2021, 10:12 a.m.	buffer: ! socket: 988 sent: 1	1	1
InternetCrackUrlW March 13, 2021, 10:12 a.m.	url: http://194.5.98.104:5200/is-ready flags: 0	1	1
HttpOpenRequestW March 13, 2021, 10:12 a.m.	connect_handle: 0x00cc0008 http_version: flags: 71303168 http_method: POST referer: path: /is-ready	1	13369356
send March 13, 2021, 10:12 a.m.	buffer: ! socket: 988 sent: 1	1	1
InternetCrackUrlW March 13, 2021, 10:13 a.m.	url: http://194.5.98.104:5200/is-ready flags: 0	1	1
HttpOpenRequestW March 13, 2021, 10:13 a.m.	connect_handle: 0x00cc0008 http_version: flags: 71303168 http_method: POST referer: path: /is-ready	1	13369356
send March 13, 2021, 10:13 a.m.	buffer: ! socket: 988 sent: 1	1	1
InternetCrackUrlW March 13, 2021, 10:13 a.m.	url: http://194.5.98.104:5200/is-ready flags: 0	1	1
HttpOpenRequestW March 13, 2021, 10:13 a.m.	connect_handle: 0x00cc0008 http_version: flags: 71303168 http_method: POST referer: path: /is-ready	1	13369356
send March 13, 2021, 10:13 a.m.	buffer: ! socket: 988 sent: 1	1	1
InternetCrackUrlW March 13, 2021, 10:13 a.m.	url: http://194.5.98.104:5200/is-ready flags: 0	1	1
HttpOpenRequestW March 13, 2021, 10:13 a.m.	connect_handle: 0x00cc0008 http_version: flags: 71303168 http_method: POST referer: path: /is-ready	1	13369356
send March 13, 2021, 10:13 a.m.	buffer: ! socket: 988 sent: 1	1	1
InternetCrackUrlW March 13, 2021, 10:13 a.m.	url: http://194.5.98.104:5200/is-ready flags: 0	1	1
HttpOpenRequestW March 13, 2021, 10:13 a.m.	connect_handle: 0x00cc0008 http_version: flags: 71303168 http_method: POST referer: path: /is-ready	1	13369356
send March 13, 2021, 10:13 a.m.	buffer: ! socket: 988 sent: 1	1	1
InternetCrackUrlW March 13, 2021, 10:13 a.m.	url: http://194.5.98.104:5200/is-ready flags: 0	1	1
HttpOpenRequestW March 13, 2021, 10:13 a.m.	connect_handle: 0x00cc0008 http_version: flags: 71303168 http_method: POST referer: path: /is-ready	1	13369356

One or more non-whitelisted processes were created (2 events)

parent_process	wscript.exe				martian_process	"C:\Windows\System32\wscript.exe" //B "C:\Users\test22\AppData\Roaming\Deutsche Telekom GMBH.js"
parent_process	wscript.exe				martian_process	wscript.exe //B "C:\Users\test22\AppData\Roaming\Deutsche Telekom GMBH.js"

Found URLs in memory pointing to an IP address rather than a domain (potentially indicative of Command & Control traffic) (4 events)

url	http://175.208.134.150:8282/test/test.eml
url	http://175.208.134.150:8282/favicon.ico
url	http://194.5.98.104:5200/is-ready
url	http://175.208.134.150:8282/test/exe1.zip

The process wscript.exe wrote an executable file to disk (1 event)

file	C:\Windows\SysWOW64\wscript.exe

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (18 events)

dead_host	192.168.56.102:49812
dead_host	192.168.56.102:49813
dead_host	192.168.56.102:49824
dead_host	192.168.56.102:49818
dead_host	192.168.56.102:49825
dead_host	192.168.56.102:49819
dead_host	192.168.56.102:49816
dead_host	192.168.56.102:49817
dead_host	192.168.56.102:49811
dead_host	192.168.56.102:49822
dead_host	192.168.56.102:49823
dead_host	194.5.98.104:5200
dead_host	192.168.56.102:49809
dead_host	192.168.56.102:49820
dead_host	192.168.56.102:49814
dead_host	192.168.56.102:49821
dead_host	192.168.56.102:49815
dead_host	192.168.56.102:49826

Deutsche Telekom GMBH.js

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All