Analysis

Category Package Started Completed Duration Options Log
FILE js 2019-12-03 05:48:50 2019-12-03 05:50:28 98 seconds Show Options Show Log
procmemdump = 1
procdump = 1
route = internet
2019-12-03 05:49:18,000 [root] INFO: Date set to: 12-03-19, time set to: 05:49:18, timeout set to: 200
2019-12-03 05:49:18,155 [root] DEBUG: Starting analyzer from: C:\czhprqnxum
2019-12-03 05:49:18,155 [root] DEBUG: Storing results at: C:\NHVJEb
2019-12-03 05:49:18,171 [root] DEBUG: Pipe server name: \\.\PIPE\hdJxHBmqfr
2019-12-03 05:49:18,171 [root] DEBUG: No analysis package specified, trying to detect it automagically.
2019-12-03 05:49:18,171 [root] INFO: Automatically selected analysis package "js"
2019-12-03 05:49:23,038 [root] DEBUG: Started auxiliary module Browser
2019-12-03 05:49:23,053 [root] DEBUG: Started auxiliary module Curtain
2019-12-03 05:49:23,053 [modules.auxiliary.digisig] DEBUG: Checking for a digitial signature.
2019-12-03 05:49:26,516 [modules.auxiliary.digisig] DEBUG: File is not signed.
2019-12-03 05:49:26,516 [modules.auxiliary.digisig] INFO: Uploading signature results to aux/DigiSig.json
2019-12-03 05:49:26,516 [root] DEBUG: Started auxiliary module DigiSig
2019-12-03 05:49:26,532 [root] DEBUG: Started auxiliary module Disguise
2019-12-03 05:49:26,532 [root] DEBUG: Started auxiliary module Human
2019-12-03 05:49:26,532 [root] DEBUG: Started auxiliary module Screenshots
2019-12-03 05:49:26,532 [root] DEBUG: Started auxiliary module Sysmon
2019-12-03 05:49:26,548 [root] DEBUG: Started auxiliary module Usage
2019-12-03 05:49:26,548 [root] INFO: Analyzer: Package modules.packages.js does not specify a DLL option
2019-12-03 05:49:26,548 [root] INFO: Analyzer: Package modules.packages.js does not specify a DLL_64 option
2019-12-03 05:49:27,048 [lib.api.process] INFO: Successfully executed process from path "C:\Windows\system32\wscript.exe" with arguments ""C:\Users\user\AppData\Local\Temp\scan.js"" with pid 1044
2019-12-03 05:49:27,078 [lib.api.process] INFO: Option 'procmemdump' with value '1' sent to monitor
2019-12-03 05:49:27,078 [lib.api.process] INFO: Option 'procdump' with value '1' sent to monitor
2019-12-03 05:49:27,078 [lib.api.process] INFO: 32-bit DLL to inject is C:\czhprqnxum\dll\UPcYKD.dll, loader C:\czhprqnxum\bin\oXAHpkT.exe
2019-12-03 05:49:27,094 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\hdJxHBmqfr.
2019-12-03 05:49:27,094 [root] DEBUG: Loader: Injecting process 1044 (thread 1472) with C:\czhprqnxum\dll\UPcYKD.dll.
2019-12-03 05:49:27,094 [root] DEBUG: Process image base: 0x008A0000
2019-12-03 05:49:27,094 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\czhprqnxum\dll\UPcYKD.dll.
2019-12-03 05:49:27,109 [root] DEBUG: InjectDllViaIAT: Found a free region from 0x008C6000 - 0x77A00000
2019-12-03 05:49:27,109 [root] DEBUG: InjectDllViaIAT: Allocated 0x1dc bytes for new import table at 0x008D0000.
2019-12-03 05:49:27,109 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2019-12-03 05:49:27,109 [root] DEBUG: Successfully injected DLL C:\czhprqnxum\dll\UPcYKD.dll.
2019-12-03 05:49:27,109 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 1044
2019-12-03 05:49:29,121 [lib.api.process] INFO: Successfully resumed process with pid 1044
2019-12-03 05:49:29,121 [root] INFO: Added new process to list with pid: 1044
2019-12-03 05:49:29,371 [root] DEBUG: Terminate processes on terminate_event enabled.
2019-12-03 05:49:29,371 [root] DEBUG: Full process memory dumps enabled.
2019-12-03 05:49:29,371 [root] DEBUG: Process dumps enabled.
2019-12-03 05:49:29,621 [root] INFO: Disabling sleep skipping.
2019-12-03 05:49:29,621 [root] DEBUG: RestoreHeaders: Restored original import table.
2019-12-03 05:49:29,621 [root] INFO: Disabling sleep skipping.
2019-12-03 05:49:29,621 [root] INFO: Disabling sleep skipping.
2019-12-03 05:49:29,621 [root] INFO: Disabling sleep skipping.
2019-12-03 05:49:29,637 [root] DEBUG: CAPE initialised: 32-bit base package loaded in process 1044 at 0x74ed0000, image base 0x8a0000, stack from 0x426000-0x430000
2019-12-03 05:49:29,637 [root] DEBUG: Commandline: C:\Users\user\AppData\Local\Temp\"C:\Windows\system32\wscript.exe" "C:\Users\user\AppData\Local\Temp\scan.js".
2019-12-03 05:49:29,637 [root] INFO: Monitor successfully loaded in process with pid 1044.
2019-12-03 05:49:29,684 [root] DEBUG: DLL unloaded from 0x76C90000.
2019-12-03 05:49:29,684 [root] DEBUG: DLL unloaded from 0x008A0000.
2019-12-03 05:49:29,948 [root] DEBUG: DLL loaded at 0x74E60000: C:\Windows\SysWOW64\SXS (0x5f000 bytes).
2019-12-03 05:49:30,073 [root] DEBUG: DLL loaded at 0x77090000: C:\Windows\syswow64\CLBCatQ (0x83000 bytes).
2019-12-03 05:49:30,198 [root] DEBUG: DLL loaded at 0x74DA0000: C:\Windows\SysWOW64\jscript (0xb2000 bytes).
2019-12-03 05:49:30,385 [root] DEBUG: DLL loaded at 0x77220000: C:\Windows\syswow64\WINTRUST (0x2d000 bytes).
2019-12-03 05:49:30,385 [root] DEBUG: DLL loaded at 0x75820000: C:\Windows\syswow64\CRYPT32 (0x11d000 bytes).
2019-12-03 05:49:30,385 [root] DEBUG: DLL loaded at 0x76C80000: C:\Windows\syswow64\MSASN1 (0xc000 bytes).
2019-12-03 05:49:30,401 [root] DEBUG: DLL loaded at 0x755F0000: C:\Windows\SysWOW64\CRYPTSP (0x16000 bytes).
2019-12-03 05:49:30,401 [root] DEBUG: DLL loaded at 0x755B0000: C:\Windows\system32\rsaenh (0x3b000 bytes).
2019-12-03 05:49:30,417 [root] DEBUG: DLL loaded at 0x74D80000: C:\Windows\SysWOW64\MSISIP (0x8000 bytes).
2019-12-03 05:49:30,417 [root] DEBUG: DLL unloaded from 0x76EC0000.
2019-12-03 05:49:30,417 [root] DEBUG: DLL loaded at 0x74D60000: C:\Windows\SysWOW64\wshext (0x16000 bytes).
2019-12-03 05:49:30,417 [root] DEBUG: DLL loaded at 0x74FC0000: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\COMCTL32 (0x84000 bytes).
2019-12-03 05:49:30,433 [root] DEBUG: DLL loaded at 0x759C0000: C:\Windows\syswow64\SHELL32 (0xc4a000 bytes).
2019-12-03 05:49:30,447 [root] DEBUG: DLL loaded at 0x74D30000: C:\Windows\SysWOW64\scrobj (0x2d000 bytes).
2019-12-03 05:49:30,447 [root] DEBUG: DLL unloaded from 0x77570000.
2019-12-03 05:49:30,447 [root] DEBUG: DLL loaded at 0x74D20000: C:\Windows\SysWOW64\RpcRtRemote (0xe000 bytes).
2019-12-03 05:49:30,463 [root] DEBUG: DLL unloaded from 0x74D30000.
2019-12-03 05:49:30,463 [root] DEBUG: DLL unloaded from 0x74DA0000.
2019-12-03 05:49:30,463 [root] DEBUG: NtTerminateProcess hook: Attempting to dump process 1044
2019-12-03 05:49:30,480 [root] DEBUG: GetHookCallerBase: thread 1472 (handle 0x0), return address 0x008A2FBD, allocation base 0x008A0000.
2019-12-03 05:49:30,480 [root] DEBUG: DoProcessDump: Created dump file for full process memory dump: C:\NHVJEb\memory\1044.dmp.
2019-12-03 05:49:30,558 [root] DEBUG: DumpInterestingRegions: Dumping Imagebase at 0x008A0000.
2019-12-03 05:49:30,572 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image.
2019-12-03 05:49:30,572 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x008A0000.
2019-12-03 05:49:30,572 [root] DEBUG: DumpProcess: Module entry point VA is 0x00002F3B.
2019-12-03 05:49:30,588 [root] INFO: Added new CAPE file to list with path: C:\NHVJEb\CAPE\1044_180802849240101432122019
2019-12-03 05:49:30,588 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x21600.
2019-12-03 05:49:35,315 [root] DEBUG: DoProcessDump: Full process memory dump saved to file: C:\NHVJEb\memory\1044.dmp.
2019-12-03 05:49:35,315 [root] DEBUG: DLL unloaded from 0x77780000.
2019-12-03 05:49:35,315 [root] INFO: Notified of termination of process with pid 1044.
2019-12-03 05:49:41,289 [root] INFO: Process list is empty, terminating analysis.
2019-12-03 05:49:42,303 [root] INFO: Created shutdown mutex.
2019-12-03 05:49:43,318 [root] INFO: Shutting down package.
2019-12-03 05:49:43,318 [root] INFO: Stopping auxiliary modules.
2019-12-03 05:49:43,318 [root] INFO: Finishing auxiliary modules.
2019-12-03 05:49:43,318 [root] INFO: Shutting down pipe server and dumping dropped files.
2019-12-03 05:49:43,318 [root] WARNING: File at path "C:\NHVJEb\debugger" does not exist, skip.
2019-12-03 05:49:43,318 [root] INFO: Analysis completed.

MalScore

1.0

Benign

Machine

Name Label Manager Started On Shutdown On
target-04 target-04 ESX 2019-12-03 05:48:50 2019-12-03 05:50:28

File Details

File Name scan.js
File Size 352 bytes
File Type ASCII text, with CRLF line terminators
MD5 d9942ce8b4643d49d12e286c8a75ad44
SHA1 85bb9b4e12ca9fb00bf5f7a2c317929fb0d906c7
SHA256 52e585a9b25892e395f58f77c67d1f0490fb8fa8696ef8fb4f90c06746cfe80b
SHA512 fdcb095e010d018919b40f4a0733c2d2d6f429b7d270ac32994e01184783c62972523d7b10ccfe1feb52d45d4d3468e5512ec498560e87880452d2061dd04fe8
CRC32 E8C849C5
Ssdeep 6:qvcAX4nNwmCjODo0nyj7kOJ5NotsssovsEgqXyHSq6XSAVF2QaVa:gc/mXKDoPTatNso0DqXyyq6XhVQQF
TrID
  • Unknown!
ClamAV None matched
Yara None matched
CAPE Yara None matched
Resubmit sample

Signatures

Dynamic (imported) function loading detected
DynamicLoader: ADVAPI32.dll/SaferIdentifyLevel
DynamicLoader: ADVAPI32.dll/SaferComputeTokenFromLevel
DynamicLoader: ADVAPI32.dll/SaferCloseLevel
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptGenRandom
DynamicLoader: RpcRtRemote.dll/I_RpcExtInitializeExtensionPoint
DynamicLoader: ADVAPI32.dll/UnregisterTraceGuids
DynamicLoader: ADVAPI32.dll/UnregisterTraceGuids
DynamicLoader: OLEAUT32.dll/
DynamicLoader: CRYPTSP.dll/CryptReleaseContext
Possible date expiration check, exits too soon after checking local time
process: wscript.exe, PID 1044

Screenshots


Hosts

No hosts contacted.

DNS

No domains contacted.


Summary

C:\Users\user\AppData\Local\Temp\scan.js
C:\Users\user\AppData\Local\Temp\scan.js
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot\Option
HKEY_CURRENT_USER\Software\Classes
HKEY_CURRENT_USER\Software\Classes\Interface\{00000134-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc\Extensions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\RemoteRpcDll
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BFE
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows\DisabledProcesses\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\DA0C75D6
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows\DisabledSessions\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\RemoteRpcDll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\DA0C75D6
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
advapi32.dll.SaferIdentifyLevel
advapi32.dll.SaferComputeTokenFromLevel
advapi32.dll.SaferCloseLevel
cryptsp.dll.CryptAcquireContextW
cryptsp.dll.CryptGenRandom
rpcrtremote.dll.I_RpcExtInitializeExtensionPoint
advapi32.dll.UnregisterTraceGuids
oleaut32.dll.#500
cryptsp.dll.CryptReleaseContext

Process Tree

  • wscript.exe 1044 "C:\Windows\system32\wscript.exe" "C:\Users\user\AppData\Local\Temp\scan.js"

wscript.exe, PID: 1044, Parent PID: 732
Full Path: C:\Windows\SysWOW64\wscript.exe
Command Line: "C:\Windows\system32\wscript.exe" "C:\Users\user\AppData\Local\Temp\scan.js"

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

No UDP connections recorded.

DNS

No domains contacted.

HTTP Requests

No HTTP requests performed.

SMTP traffic

No SMTP traffic performed.

IRC traffic

No IRC requests performed.

ICMP traffic

No ICMP traffic performed.

CIF Results

No CIF Results

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Suricata HTTP

No Suricata HTTP

Sorry! No dropped Suricata Extracted files.

JA3

No JA3 hashes found.

Sorry! No dropped files.
Sorry! No CAPE files.
Process Name wscript.exe
PID 1044
Dump Size 136704 bytes
Module Path C:\Windows\SysWOW64\wscript.exe
Type PE image: 32-bit executable
MD5 1195ff783ce4f27e011cc9b499ed9f78
SHA1 ccc8b10120383fe422b61ed7774b8ca198b24591
SHA256 a27942f0cff522da57c15c27a98b1d865a93f2f2f0e700ec379afd8515177496
CRC32 16645EE7
Ssdeep 3072:Q37P24I700oFTUQNb/rSGCYmKijkca9ZuLCsm/CDkugr5Txt:Q3j24I705rXVXcc8msm5NT
ClamAV None
Yara None matched
CAPE Yara None matched
Dump Filename a27942f0cff522da57c15c27a98b1d865a93f2f2f0e700ec379afd8515177496

Comments



No comments posted

Processing ( 0.467 seconds )

  • 0.165 CAPE
  • 0.15 ProcDump
  • 0.083 TrID
  • 0.031 Deduplicate
  • 0.013 TargetInfo
  • 0.011 BehaviorAnalysis
  • 0.007 NetworkAnalysis
  • 0.005 AnalysisInfo
  • 0.001 Debug
  • 0.001 Static

Signatures ( 0.045 seconds )

  • 0.008 antiav_detectreg
  • 0.008 ransomware_files
  • 0.003 persistence_autorun
  • 0.003 antiav_detectfile
  • 0.003 infostealer_ftp
  • 0.003 ransomware_extensions
  • 0.002 browser_security
  • 0.002 infostealer_bitcoin
  • 0.002 infostealer_im
  • 0.001 tinba_behavior
  • 0.001 rat_nanocore
  • 0.001 cerber_behavior
  • 0.001 antianalysis_detectfile
  • 0.001 antianalysis_detectreg
  • 0.001 antivm_vbox_files
  • 0.001 antivm_vbox_keys
  • 0.001 geodo_banking_trojan
  • 0.001 disables_browser_warn
  • 0.001 infostealer_mail
  • 0.001 masquerade_process_name

Reporting ( 0.0 seconds )

Task ID 115344
Mongo ID 5de5f7af38b1e1182f3b1530
Cuckoo release 1.3-CAPE
Delete