Analysis

Category Package Started Completed Duration Options Log
FILE js 2019-12-03 05:48:47 2019-12-03 05:50:28 101 seconds Show Options Show Log
procmemdump = 1
procdump = 1
route = internet
2019-12-03 05:49:01,015 [root] INFO: Date set to: 12-03-19, time set to: 05:49:01, timeout set to: 200
2019-12-03 05:49:01,140 [root] DEBUG: Starting analyzer from: C:\pmzgkzy
2019-12-03 05:49:01,140 [root] DEBUG: Storing results at: C:\EGprIo
2019-12-03 05:49:01,140 [root] DEBUG: Pipe server name: \\.\PIPE\tpZBWrmni
2019-12-03 05:49:01,140 [root] DEBUG: No analysis package specified, trying to detect it automagically.
2019-12-03 05:49:01,140 [root] INFO: Automatically selected analysis package "js"
2019-12-03 05:49:15,960 [root] DEBUG: Started auxiliary module Browser
2019-12-03 05:49:15,976 [root] DEBUG: Started auxiliary module Curtain
2019-12-03 05:49:15,976 [modules.auxiliary.digisig] DEBUG: Checking for a digitial signature.
2019-12-03 05:49:24,180 [modules.auxiliary.digisig] DEBUG: File is not signed.
2019-12-03 05:49:24,180 [modules.auxiliary.digisig] INFO: Uploading signature results to aux/DigiSig.json
2019-12-03 05:49:24,180 [root] DEBUG: Started auxiliary module DigiSig
2019-12-03 05:49:24,180 [root] DEBUG: Started auxiliary module Disguise
2019-12-03 05:49:24,180 [root] DEBUG: Started auxiliary module Human
2019-12-03 05:49:24,197 [root] DEBUG: Started auxiliary module Screenshots
2019-12-03 05:49:24,197 [root] DEBUG: Started auxiliary module Sysmon
2019-12-03 05:49:24,197 [root] DEBUG: Started auxiliary module Usage
2019-12-03 05:49:24,197 [root] INFO: Analyzer: Package modules.packages.js does not specify a DLL option
2019-12-03 05:49:24,197 [root] INFO: Analyzer: Package modules.packages.js does not specify a DLL_64 option
2019-12-03 05:49:26,099 [lib.api.process] INFO: Successfully executed process from path "C:\Windows\system32\wscript.exe" with arguments ""C:\Users\user\AppData\Local\Temp\scan.js"" with pid 1140
2019-12-03 05:49:28,081 [lib.api.process] INFO: Option 'procmemdump' with value '1' sent to monitor
2019-12-03 05:49:28,081 [lib.api.process] INFO: Option 'procdump' with value '1' sent to monitor
2019-12-03 05:49:28,081 [lib.api.process] INFO: 32-bit DLL to inject is C:\pmzgkzy\dll\neXzzz.dll, loader C:\pmzgkzy\bin\XqOycEM.exe
2019-12-03 05:49:28,111 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\tpZBWrmni.
2019-12-03 05:49:28,111 [root] DEBUG: Loader: Injecting process 1140 (thread 844) with C:\pmzgkzy\dll\neXzzz.dll.
2019-12-03 05:49:28,111 [root] DEBUG: Process image base: 0x00220000
2019-12-03 05:49:28,111 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\pmzgkzy\dll\neXzzz.dll.
2019-12-03 05:49:28,111 [root] DEBUG: InjectDllViaIAT: Found a free region from 0x00246000 - 0x00300000
2019-12-03 05:49:28,111 [root] DEBUG: InjectDllViaIAT: Allocated 0x1d8 bytes for new import table at 0x00250000.
2019-12-03 05:49:28,111 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2019-12-03 05:49:28,111 [root] DEBUG: Successfully injected DLL C:\pmzgkzy\dll\neXzzz.dll.
2019-12-03 05:49:28,111 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 1140
2019-12-03 05:49:30,125 [lib.api.process] INFO: Successfully resumed process with pid 1140
2019-12-03 05:49:30,125 [root] INFO: Added new process to list with pid: 1140
2019-12-03 05:49:30,342 [root] DEBUG: Terminate processes on terminate_event enabled.
2019-12-03 05:49:30,342 [root] DEBUG: Full process memory dumps enabled.
2019-12-03 05:49:30,342 [root] DEBUG: Process dumps enabled.
2019-12-03 05:49:30,997 [root] INFO: Disabling sleep skipping.
2019-12-03 05:49:30,997 [root] INFO: Disabling sleep skipping.
2019-12-03 05:49:30,997 [root] INFO: Disabling sleep skipping.
2019-12-03 05:49:30,997 [root] DEBUG: RestoreHeaders: Restored original import table.
2019-12-03 05:49:30,997 [root] INFO: Disabling sleep skipping.
2019-12-03 05:49:30,997 [root] DEBUG: CAPE initialised: 32-bit base package loaded in process 1140 at 0x74b50000, image base 0x220000, stack from 0x3f6000-0x400000
2019-12-03 05:49:30,997 [root] DEBUG: Commandline: C:\Users\user\AppData\Local\Temp\"C:\Windows\system32\wscript.exe" "C:\Users\user\AppData\Local\Temp\scan.js".
2019-12-03 05:49:30,997 [root] INFO: Monitor successfully loaded in process with pid 1140.
2019-12-03 05:49:31,061 [root] DEBUG: DLL unloaded from 0x77230000.
2019-12-03 05:49:31,061 [root] DEBUG: DLL unloaded from 0x00220000.
2019-12-03 05:49:31,075 [root] DEBUG: DLL loaded at 0x74AF0000: C:\Windows\SysWOW64\SXS (0x5f000 bytes).
2019-12-03 05:49:31,372 [root] DEBUG: DLL loaded at 0x75B30000: C:\Windows\syswow64\CLBCatQ (0x83000 bytes).
2019-12-03 05:49:33,042 [root] DEBUG: DLL loaded at 0x74A30000: C:\Windows\SysWOW64\jscript (0xb2000 bytes).
2019-12-03 05:49:33,369 [root] DEBUG: DLL loaded at 0x75CF0000: C:\Windows\syswow64\WINTRUST (0x2d000 bytes).
2019-12-03 05:49:33,384 [root] DEBUG: DLL loaded at 0x75D80000: C:\Windows\syswow64\CRYPT32 (0x11d000 bytes).
2019-12-03 05:49:33,384 [root] DEBUG: DLL loaded at 0x758C0000: C:\Windows\syswow64\MSASN1 (0xc000 bytes).
2019-12-03 05:49:33,384 [root] DEBUG: DLL loaded at 0x751D0000: C:\Windows\SysWOW64\CRYPTSP (0x16000 bytes).
2019-12-03 05:49:33,401 [root] DEBUG: DLL loaded at 0x75190000: C:\Windows\system32\rsaenh (0x3b000 bytes).
2019-12-03 05:49:33,401 [root] DEBUG: DLL loaded at 0x74A10000: C:\Windows\SysWOW64\MSISIP (0x8000 bytes).
2019-12-03 05:49:33,401 [root] DEBUG: DLL unloaded from 0x758D0000.
2019-12-03 05:49:33,401 [root] DEBUG: DLL loaded at 0x749F0000: C:\Windows\SysWOW64\wshext (0x16000 bytes).
2019-12-03 05:49:33,401 [root] DEBUG: DLL loaded at 0x74C40000: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\COMCTL32 (0x84000 bytes).
2019-12-03 05:49:33,431 [root] DEBUG: DLL loaded at 0x76430000: C:\Windows\syswow64\SHELL32 (0xc4a000 bytes).
2019-12-03 05:49:33,431 [root] DEBUG: DLL loaded at 0x749C0000: C:\Windows\SysWOW64\scrobj (0x2d000 bytes).
2019-12-03 05:49:33,431 [root] DEBUG: DLL unloaded from 0x75C50000.
2019-12-03 05:49:33,447 [root] DEBUG: DLL loaded at 0x749B0000: C:\Windows\SysWOW64\RpcRtRemote (0xe000 bytes).
2019-12-03 05:49:33,447 [root] DEBUG: DLL unloaded from 0x749C0000.
2019-12-03 05:49:33,447 [root] DEBUG: DLL unloaded from 0x74A30000.
2019-12-03 05:49:33,463 [root] DEBUG: NtTerminateProcess hook: Attempting to dump process 1140
2019-12-03 05:49:33,463 [root] DEBUG: GetHookCallerBase: thread 844 (handle 0x0), return address 0x00222FBD, allocation base 0x00220000.
2019-12-03 05:49:33,463 [root] DEBUG: DoProcessDump: Created dump file for full process memory dump: C:\EGprIo\memory\1140.dmp.
2019-12-03 05:49:33,681 [root] DEBUG: DumpInterestingRegions: Dumping Imagebase at 0x00220000.
2019-12-03 05:49:33,681 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image.
2019-12-03 05:49:33,681 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x00220000.
2019-12-03 05:49:33,681 [root] DEBUG: DumpProcess: Module entry point VA is 0x00002F3B.
2019-12-03 05:49:33,697 [root] INFO: Added new CAPE file to list with path: C:\EGprIo\CAPE\1140_193160983243501432122019
2019-12-03 05:49:33,697 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x21600.
2019-12-03 05:49:40,374 [root] DEBUG: DoProcessDump: Full process memory dump saved to file: C:\EGprIo\memory\1140.dmp.
2019-12-03 05:49:40,374 [root] DEBUG: DLL unloaded from 0x75D20000.
2019-12-03 05:49:40,374 [root] INFO: Notified of termination of process with pid 1140.
2019-12-03 05:49:46,769 [root] INFO: Process list is empty, terminating analysis.
2019-12-03 05:49:47,783 [root] INFO: Created shutdown mutex.
2019-12-03 05:49:48,798 [root] INFO: Shutting down package.
2019-12-03 05:49:48,798 [root] INFO: Stopping auxiliary modules.
2019-12-03 05:49:48,798 [root] INFO: Finishing auxiliary modules.
2019-12-03 05:49:48,798 [root] INFO: Shutting down pipe server and dumping dropped files.
2019-12-03 05:49:48,798 [root] WARNING: File at path "C:\EGprIo\debugger" does not exist, skip.
2019-12-03 05:49:48,798 [root] INFO: Analysis completed.

MalScore

1.0

Benign

Machine

Name Label Manager Started On Shutdown On
target-03 target-03 ESX 2019-12-03 05:48:47 2019-12-03 05:50:28

File Details

File Name scan.js
File Size 352 bytes
File Type ASCII text, with CRLF line terminators
MD5 d9942ce8b4643d49d12e286c8a75ad44
SHA1 85bb9b4e12ca9fb00bf5f7a2c317929fb0d906c7
SHA256 52e585a9b25892e395f58f77c67d1f0490fb8fa8696ef8fb4f90c06746cfe80b
SHA512 fdcb095e010d018919b40f4a0733c2d2d6f429b7d270ac32994e01184783c62972523d7b10ccfe1feb52d45d4d3468e5512ec498560e87880452d2061dd04fe8
CRC32 E8C849C5
Ssdeep 6:qvcAX4nNwmCjODo0nyj7kOJ5NotsssovsEgqXyHSq6XSAVF2QaVa:gc/mXKDoPTatNso0DqXyyq6XhVQQF
TrID
  • Unknown!
ClamAV None matched
Yara None matched
CAPE Yara None matched
Resubmit sample

Signatures

Dynamic (imported) function loading detected
DynamicLoader: ADVAPI32.dll/SaferIdentifyLevel
DynamicLoader: ADVAPI32.dll/SaferComputeTokenFromLevel
DynamicLoader: ADVAPI32.dll/SaferCloseLevel
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptGenRandom
DynamicLoader: RpcRtRemote.dll/I_RpcExtInitializeExtensionPoint
DynamicLoader: ADVAPI32.dll/UnregisterTraceGuids
DynamicLoader: ADVAPI32.dll/UnregisterTraceGuids
DynamicLoader: OLEAUT32.dll/
DynamicLoader: CRYPTSP.dll/CryptReleaseContext
Possible date expiration check, exits too soon after checking local time
process: wscript.exe, PID 1140

Screenshots


Hosts

No hosts contacted.

DNS

No domains contacted.


Summary

C:\Users\user\AppData\Local\Temp\scan.js
C:\Users\user\AppData\Local\Temp\scan.js
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot\Option
HKEY_CURRENT_USER\Software\Classes
HKEY_CURRENT_USER\Software\Classes\Interface\{00000134-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc\Extensions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\RemoteRpcDll
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BFE
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows\DisabledProcesses\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\DA0C75D6
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows\DisabledSessions\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\RemoteRpcDll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\DA0C75D6
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
advapi32.dll.SaferIdentifyLevel
advapi32.dll.SaferComputeTokenFromLevel
advapi32.dll.SaferCloseLevel
cryptsp.dll.CryptAcquireContextW
cryptsp.dll.CryptGenRandom
rpcrtremote.dll.I_RpcExtInitializeExtensionPoint
advapi32.dll.UnregisterTraceGuids
oleaut32.dll.#500
cryptsp.dll.CryptReleaseContext

Process Tree

  • wscript.exe 1140 "C:\Windows\system32\wscript.exe" "C:\Users\user\AppData\Local\Temp\scan.js"

wscript.exe, PID: 1140, Parent PID: 588
Full Path: C:\Windows\SysWOW64\wscript.exe
Command Line: "C:\Windows\system32\wscript.exe" "C:\Users\user\AppData\Local\Temp\scan.js"

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

No UDP connections recorded.

DNS

No domains contacted.

HTTP Requests

No HTTP requests performed.

SMTP traffic

No SMTP traffic performed.

IRC traffic

No IRC requests performed.

ICMP traffic

No ICMP traffic performed.

CIF Results

No CIF Results

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Suricata HTTP

No Suricata HTTP

Sorry! No dropped Suricata Extracted files.

JA3

No JA3 hashes found.

Sorry! No dropped files.
Sorry! No CAPE files.
Process Name wscript.exe
PID 1140
Dump Size 136704 bytes
Module Path C:\Windows\SysWOW64\wscript.exe
Type PE image: 32-bit executable
MD5 0fa0a3bbbc04480153e331d547c31ba6
SHA1 7da7cde3a3bf1af82838c01bbea9b4bef471354e
SHA256 c1d490fe25701f0a9d480cf2eca7b2a8b27115a011bf5bd582dccad2f1a4c6c2
CRC32 9AAE0D7E
Ssdeep 3072:QbXWo4QcY1TUAtHLKkT6uyQ+Cqr0MCVcz3r7pbCsm/CDkusr5Txt:QbWo4QxLum1fM8EGsmFNT
ClamAV None
Yara None matched
CAPE Yara None matched
Dump Filename c1d490fe25701f0a9d480cf2eca7b2a8b27115a011bf5bd582dccad2f1a4c6c2

Comments



No comments posted

Processing ( 0.47 seconds )

  • 0.165 CAPE
  • 0.151 ProcDump
  • 0.084 TrID
  • 0.032 Deduplicate
  • 0.012 BehaviorAnalysis
  • 0.012 TargetInfo
  • 0.007 NetworkAnalysis
  • 0.005 AnalysisInfo
  • 0.001 Debug
  • 0.001 Static

Signatures ( 0.049 seconds )

  • 0.008 antiav_detectreg
  • 0.008 ransomware_files
  • 0.007 ransomware_extensions
  • 0.003 persistence_autorun
  • 0.003 antiav_detectfile
  • 0.003 infostealer_ftp
  • 0.002 browser_security
  • 0.002 infostealer_bitcoin
  • 0.002 infostealer_im
  • 0.001 tinba_behavior
  • 0.001 rat_nanocore
  • 0.001 cerber_behavior
  • 0.001 antianalysis_detectfile
  • 0.001 antianalysis_detectreg
  • 0.001 antivm_vbox_files
  • 0.001 antivm_vbox_keys
  • 0.001 geodo_banking_trojan
  • 0.001 disables_browser_warn
  • 0.001 infostealer_mail
  • 0.001 masquerade_process_name

Reporting ( 0.0 seconds )

Task ID 115343
Mongo ID 5de5f7aaa04cefe70a3b08de
Cuckoo release 1.3-CAPE
Delete