top title background image
flash

curriculum_vitae-copie.vbs

Status: finished
Submission Time: 2023-06-06 17:18:08 +02:00
Malicious
Trojan
Evader
Miner
Xmrig

Comments

Tags

  • vbs

Details

  • Analysis ID:
    882715
  • API (Web) ID:
    1249693
  • Analysis Started:
    2023-06-06 17:24:56 +02:00
  • Analysis Finished:
    2023-06-06 17:40:02 +02:00
  • MD5:
    f72b1d9e4780f7b1b63fc2e2e88f1593
  • SHA1:
    95f3a182de433dac071eb353f1abd50b8643aabe
  • SHA256:
    4a346ad97d3b8093e61c3a0ab67a1a6611fb5c399725eea10becbdd0f331ee13
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
malicious
Score: 100
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

Third Party Analysis Engines

malicious
Score: 6/59
malicious
Score: 20/24
malicious

IPs

IP Country Detection
141.94.96.144
Germany
172.65.251.78
United States
49.12.202.237
Germany

Domains

Name IP Detection
www.7-zip.org
49.12.202.237
gitlab.com
172.65.251.78

URLs

Name Detection
https://sourcegraph.com
https://gitlab.com/-/sandbox/
https://gitlab.com/admin/
Click to see the 30 hidden entries
https://gitlab.com/assets/
https://customers.gitlab.com
https://gitlab.com/-/speedscope/index.html
https://www.google.com/recaptcha/
https://www.7-zip.org/a/7zr.exe
https://xmrig.com/docs/algorithms
https://gitlab.com/cv4345521/cv/-/raw/main/gmail.7z?inline=false
https://gitlab.com/cv4345521/cv/-/raw/main/gmail.7z?inline=falsex
https://apis.google.com
https://snowplow.tgitlab.c%%.
http://www.nirsoft.net/
https://sentry.gitlab.net
https://gitlab.com/cv4345521/cv/-/raw/main/gmail.7z?inline=falsem
https://www.recaptcha.net/
https://www.7-zip.org/w
https://gitlab.com/cv6535510/cv/-/raw/main/curriculum_vitae-usb.vbs?inline=falseMsg
https://www.7-zip.org/a/7zr.exel
https://gitlab.com/cv6535510/cv/-/raw/main/curriculum_vitae-usb.vbs?inline=false
https://gitlab.com/cwIf
https://gitlab.com
https://snowplow.tgitlab.c%
https://www.7-zip.org/O
https://gitlab.com/
https://xmrig.com/wizard
https://sentry.gitlab.net/api/105/security/?sentry_key=a42ea3adc19140d9a6424906e12fba86;
https://snowplow.trx.gitlab.net
https://new-sentry.gitlab.net
https://xmrig.com/wizard%s
https://gitlab.com/cv4345521/cv/-/raw/main/gmail.7z?inline=falseA
https://gitlab.com/cv6535510/cv/-/raw/main/curriculum_vitae-usb.vbs?inline=falsee

Dropped files

Name File Type Hashes Detection
C:\Users\Public\WindowsUpdate\Update.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
#
C:\Users\Public\WindowsUpdate\WinRing0x64.sys
PE32+ executable (native) x86-64, for MS Windows
#
C:\Users\Public\WindowsUpdate\go.exe
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
#
Click to see the 14 hidden entries
C:\Users\Public\WindowsUpdate\mozilla.vbs
ASCII text, with CRLF line terminators
#
C:\Users\Public\WindowsUpdate\mservice.exe
PE32+ executable (console) x86-64, for MS Windows
#
C:\Users\Public\WindowsUpdate\mservice.vbs
ASCII text, with CRLF line terminators
#
C:\Users\Public\WindowsUpdate\ps.exe
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Users\Public\7g.exe
PE32 executable (console) Intel 80386, for MS Windows
#
C:\Users\Public\gmail.7z
7-zip archive data, version 0.4
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\7zr[1].exe
PE32 executable (console) Intel 80386, for MS Windows
#
\Device\ConDrv
ASCII text, with CRLF, CR line terminators
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uwlcfquj.2yb.psm1
very short file (no magic)
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5fhh2tk2.a5a.ps1
very short file (no magic)
#
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\gmail[1].7z
7-zip archive data, version 0.4
#
C:\Users\Public\log.dat
ASCII text, with no line terminators
#
C:\Users\Public\WindowsUpdate\sarmat.vbs
assembler source, ASCII text
#