Joe Sandbox Cloud Basic

Want to search on specific fields?


Try our:

Advanced Search

Want to search in depth on all Cloud Basic reports?

Try: Joe Sandbox View

Register Login
sloganpng
top title background image
flash

SCAN COPY CV 310123.js

Status: finished
Submission Time: 2023-02-01 16:24:39 +01:00
Malicious
Trojan
Evader
Nanocore

Comments

Tags

  • js
  • NanoCore
  • RAT

Details

  • Analysis ID:
    796104
  • API (Web) ID:
    1163338
  • Analysis Started:
    2023-02-01 16:38:30 +01:00
  • Analysis Finished:
    2023-02-01 16:51:42 +01:00
  • MD5:
    c1e6f89b24d1304d31dc64015d9bda62
  • SHA1:
    27f825c528d3011316720bd8011edfed129b3289
  • SHA256:
    06b5465e33770e469fcd576f34f55021df7f348b6b262e8721e23e801629e29e
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
Full Report Management Report IOC Report
malicious
Score: 100
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

Third Party Analysis Engines

malicious
Score: 18/39
malicious
malicious

URLs

Name Detection
bition.duckdns.org
http://upx.sf.net
http://nsis.sf.net/NSIS_ErrorError
Click to see the 1 hidden entries
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Roaming\vtvt.exe
 PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
 #
C:\Users\user\AppData\Roaming\jrwodjjaoqgx\vktp.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat
 data
 #
Click to see the 19 hidden entries
C:\Users\user\AppData\Local\Temp\czkdqe.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\czkdqe.exe.log
 ASCII text, with CRLF line terminators
 #
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_czkdqe.exe_edecdbe330d62627812ca3de941673a21cf89d_81d3edbc_120f58ca\Report.wer
 Unicode text, UTF-16, little-endian text, with CRLF line terminators
 #
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6501.tmp.xml
 XML 1.0 document, ASCII text, with CRLF line terminators
 #
C:\Windows\appcompat\Programs\Amcache.hve.LOG1
 MS Windows registry file, NT/2000 or above
 #
C:\Windows\appcompat\Programs\Amcache.hve
 MS Windows registry file, NT/2000 or above
 #
C:\Users\user\AppData\Local\Temp\nsg14BD.tmp
 data
 #
C:\Users\user\AppData\Local\Temp\chwzpb.c
 data
 #
C:\Users\user\AppData\Local\Temp\bqehhpdje.pyv
 data
 #
C:\ProgramData\Microsoft\Windows\WER\Temp\WER64A3.tmp.WERInternalMetadata.xml
 XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
 #
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6369.tmp.dmp
 Mini DuMP crash report, 14 streams, Wed Feb 1 15:39:51 2023, 0x1205a4 type
 #
C:\ProgramData\Microsoft\Windows\WER\Temp\WER52F0.tmp.xml
 XML 1.0 document, ASCII text, with CRLF line terminators
 #
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5282.tmp.WERInternalMetadata.xml
 XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
 #
C:\ProgramData\Microsoft\Windows\WER\Temp\WER51C7.tmp.xml
 XML 1.0 document, ASCII text, with CRLF line terminators
 #
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5169.tmp.WERInternalMetadata.xml
 XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
 #
C:\ProgramData\Microsoft\Windows\WER\Temp\WER50BC.tmp.dmp
 Mini DuMP crash report, 14 streams, Wed Feb 1 15:39:47 2023, 0x1205a4 type
 #
C:\ProgramData\Microsoft\Windows\WER\Temp\WER485F.tmp.dmp
 Mini DuMP crash report, 14 streams, Wed Feb 1 15:39:46 2023, 0x1205a4 type
 #
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_vktp.exe_f220d68fa7f9ede2a0543dab2aa8d083101aed6_c24664e9_154359f3\Report.wer
 Unicode text, UTF-16, little-endian text, with CRLF line terminators
 #
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_vktp.exe_f220d68fa7f9ede2a0543dab2aa8d083101aed6_c24664e9_075f69e1\Report.wer
 Unicode text, UTF-16, little-endian text, with CRLF line terminators
 #