Windows Analysis Report
1239840531439025921.js

Overview

General Information

Sample name: 1239840531439025921.js
Analysis ID: 1417023
MD5: f06bb1a7df51df32d783b34f92d9b66a
SHA1: b687119329ce2407964f5230baf368d76073a8e1
SHA256: 84e1edd28a73544499787540829363608648e12c3f3f2955ab2fb3b1af1d1e05
Infos:

Detection

Strela Stealer
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Found malware configuration
JScript performs obfuscated calls to suspicious functions
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Sigma detected: Powershell launch regsvr32
Yara detected Strela Stealer
C2 URLs / IPs found in malware configuration
Drops PE files to the user root directory
Sigma detected: Potentially Suspicious PowerShell Child Processes
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Wscript starts Powershell (via cmd or directly)
Yara detected EXE embedded in BAT file
Contains functionality to dynamically determine API calls
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Drops PE files to the user directory
Drops files with a non-matching file extension (content does not match file extension)
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found large amount of non-executed APIs
Java / VBScript file with very long strings (likely obfuscated code)
May sleep (evasive loops) to hinder dynamic analysis
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Scripting/CommandLine Process Spawned Regsvr32
Sigma detected: Suspicious Copy From or To System Directory
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Tries to load missing DLLs
Uses code obfuscation techniques (call, push, ret)

Classification

AV Detection
barindex
Antivirus detection for URL or domain
Source: 45.9.74.12/server.php Avira URL Cloud: Label: malware
Found malware configuration
Source: 8.2.regsvr32.exe.7ffe10230000.0.unpack Malware Configuration Extractor: Strela Stealer {"C2 url": "45.9.74.12/server.php"}
Multi AV Scanner detection for domain / URL
Source: 45.9.74.12/server.php Virustotal: Detection: 11% Perma Link
Multi AV Scanner detection for submitted file
Source: 1239840531439025921.js Virustotal: Detection: 35% Perma Link

Software Vulnerabilities
barindex
Suspicious execution chain found
Source: C:\Windows\System32\wscript.exe Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking
barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: 45.9.74.12/server.php

System Summary
barindex
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Source: C:\Windows\System32\wscript.exe COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8} Jump to behavior
Wscript starts Powershell (via cmd or directly)
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /k copy "C:\Users\user\Desktop\1239840531439025921.js" "C:\Users\user\\mindtrembleopen.bat" && "C:\Users\user\\mindtrembleopen.bat"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell regsvr32 muddledfreedesert.ico
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /k copy "C:\Users\user\Desktop\1239840531439025921.js" "C:\Users\user\\mindtrembleopen.bat" && "C:\Users\user\\mindtrembleopen.bat" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell regsvr32 muddledfreedesert.ico Jump to behavior
Detected potential crypto function
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_02481240 8_2_02481240
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0248EE88 8_2_0248EE88
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_02481740 8_2_02481740
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_02486C5C 8_2_02486C5C
Java / VBScript file with very long strings (likely obfuscated code)
Source: 1239840531439025921.js Initial sample: Strings found which are bigger than 50
PE file contains more sections than normal
Source: muddledfreedesert.ico.6.dr Static PE information: Number of sections : 19 > 10
Tries to load missing DLLs
Source: C:\Windows\System32\wscript.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: jscript.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: scrobj.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: slc.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: cmdext.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: framedynos.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: msxml6.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: vbscript.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\System32\find.exe Section loaded: ulib.dll Jump to behavior
Source: C:\Windows\System32\find.exe Section loaded: fsutilext.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: certcli.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: cabinet.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: cryptui.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: ntdsapi.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: certca.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: dsrole.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: wininet.dll Jump to behavior
Source: classification engine Classification label: mal100.troj.expl.evad.winJS@16/7@0/0
Source: C:\Windows\System32\cmd.exe File created: C:\Users\user\mindtrembleopen.bat Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6712:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qjllnkuc.i0s.ps1 Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /k copy "C:\Users\user\Desktop\1239840531439025921.js" "C:\Users\user\\mindtrembleopen.bat" && "C:\Users\user\\mindtrembleopen.bat"
Source: C:\Windows\System32\wscript.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Windows\System32\wscript.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: 1239840531439025921.js Virustotal: Detection: 35%
Source: unknown Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1239840531439025921.js"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /k copy "C:\Users\user\Desktop\1239840531439025921.js" "C:\Users\user\\mindtrembleopen.bat" && "C:\Users\user\\mindtrembleopen.bat"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_operatingsystem get oslanguage
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\find.exe find /i "1033"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\findstr.exe findstr /V flyutopianobedient ""C:\Users\user\\mindtrembleopen.bat""
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\certutil.exe certutil -f -decode astonishinglewdselective muddledfreedesert.ico
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell regsvr32 muddledfreedesert.ico
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\regsvr32.exe "C:\Windows\system32\regsvr32.exe" muddledfreedesert.ico
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /k copy "C:\Users\user\Desktop\1239840531439025921.js" "C:\Users\user\\mindtrembleopen.bat" && "C:\Users\user\\mindtrembleopen.bat" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_operatingsystem get oslanguage Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\find.exe find /i "1033" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\findstr.exe findstr /V flyutopianobedient ""C:\Users\user\\mindtrembleopen.bat"" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\certutil.exe certutil -f -decode astonishinglewdselective muddledfreedesert.ico Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell regsvr32 muddledfreedesert.ico Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\regsvr32.exe "C:\Windows\system32\regsvr32.exe" muddledfreedesert.ico Jump to behavior
Source: C:\Windows\System32\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll Jump to behavior

Data Obfuscation
barindex
JScript performs obfuscated calls to suspicious functions
Source: C:\Windows\System32\wscript.exe Anti Malware Scan Interface: WScript.Shell");IHost.ScriptFullName();IWshShell3.Run("cmd /k copy "C:\Users\user\Desktop\1239840531439025921.js" "%userprofile%", "0", "false")
Yara detected EXE embedded in BAT file
Source: Yara match File source: 1239840531439025921.js, type: SAMPLE
Source: Yara match File source: C:\Users\user\mindtrembleopen.bat, type: DROPPED
Contains functionality to dynamically determine API calls
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_00007FFE102314B0 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress, 8_2_00007FFE102314B0
PE file contains sections with non-standard names
Source: muddledfreedesert.ico.6.dr Static PE information: section name: /4
Source: muddledfreedesert.ico.6.dr Static PE information: section name: .xdata
Source: muddledfreedesert.ico.6.dr Static PE information: section name: /14
Source: muddledfreedesert.ico.6.dr Static PE information: section name: /29
Source: muddledfreedesert.ico.6.dr Static PE information: section name: /41
Source: muddledfreedesert.ico.6.dr Static PE information: section name: /55
Source: muddledfreedesert.ico.6.dr Static PE information: section name: /67
Source: muddledfreedesert.ico.6.dr Static PE information: section name: /80
Source: muddledfreedesert.ico.6.dr Static PE information: section name: /91
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0248B542 push esp; ret 8_2_0248B545
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0248C5CC push cs; ret 8_2_0248C5CD
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0248C5EF push esp; ret 8_2_0248C5F5
Drops PE files
Source: C:\Windows\System32\certutil.exe File created: C:\Users\user\muddledfreedesert.ico Jump to dropped file
Drops PE files to the user directory
Source: C:\Windows\System32\certutil.exe File created: C:\Users\user\muddledfreedesert.ico Jump to dropped file
Drops files with a non-matching file extension (content does not match file extension)
Source: C:\Windows\System32\certutil.exe File created: C:\Users\user\muddledfreedesert.ico Jump to dropped file

Boot Survival
barindex
Drops PE files to the user root directory
Source: C:\Windows\System32\certutil.exe File created: C:\Users\user\muddledfreedesert.ico Jump to dropped file
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found WSH timer for Javascript or VBS script (likely evasive script)
Source: C:\Windows\System32\wscript.exe Window found: window name: WSH-Timer Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1396 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1932 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Windows\System32\regsvr32.exe API coverage: 4.5 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6500 Thread sleep count: 1396 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6500 Thread sleep count: 1932 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5040 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: astonishinglewdselective.1.dr Binary or memory string: GWlRoxN5vY29mS0J0b01v0PtGaWtsbUUCbm9M4f1JdRlZbWp+XHhWyM1EVXFNaGELemZ1+8BgYTFGVUztYUxP4vVmZvxZdWOfWUFC5P9DSI91QWZhe1VYxuRSak5UZE0yQWV1kMBzcxdfQnDoSmJk/OVkSO1ed1KTfm5JwMNvWIlrQnJ8fmhw7edodmZnU0opQVpNMNtyS9F6YkG5ekdm8PlzZYdaclheWUt0bM1yQkxSbFnvYHpnvfl2VupmRkGxXWtjxfRHd7peemN6d0Nr8fltRkFwUVCrXEtzlflxRLt6bkNua013D+RpREV7R3NmXm9YaO54eFBkeGotZFZL+/JgaQlCa3CPfEpaMeZzTLBbR1i+bEtXwf9JRq5fUGGeZlFT1/NDc6BgRUZrZUdJ/dlzWXd0dmhaeEhlzvtYY1FEelTtc2FkStNGZuh6RGSxTHVr8u9rRJ5cT1dgUkVByddsUEJSWXcZcWNYAOJ1VgNVSWnUX2pP2/hmUf95dWrWXUVkX+N3RdNrd3g+aVdMHNN2aRVJbHQjeE9shs5VVzxNYlh8anpK/vVQUHJIakvhOFNViNFRR9MsSHePAUNpbtFUWogIQkFSF2J18cxxY0UHdlEIN1pSyPlHZjkiR3TJBHVl28ZWdPYddGavB0JiMMZHTY0mZFKvFlNLiNxbSawEa3ofC09L1PJAYic6cmKKPU1UPshXZqMgYUHpBWVsiO9wUNQlbGIrH3pGqv9MehQoQ0dNBGRpoONiSdMPZGyhCmpS6tpLc6Qib0cFB1lZS+tGVDMramgXB3Rm3f1qQRQlY1N6CUh0TelqbmAcUkIgBHhp8vNEbBA2T2UhL3Rh4ORoVfswS1BkD3lz9ttwVgQ1eHqiA21p/f52TJI5aml2E2RSA8hLV0krTW60GGNR9eNVSlUeS3BJDXVaHdpuQWM4bXSYDVlp0/17YmwEcGfMNXRwivlOZRQEZ2VCJnpMkfpFY1kGRHgTGGhE7vR5bgsJY3KgDm16Y/B4aIYPUVovMHBLId9OVDsGeUouCWRKIfxzYg4pamfaDEljFO1yZc8LZUKvPXN57fJpd4wBUWKaN0RZycNsZ7UCUmR0KnN1AsN2ZDUXcHr2D29sDfZjdN0lYUaFFmttFcBgbow8TFN3K1FGK99tbG8mUE8wMklBjPlsbAwjem5TOENj9P5gWS8RYQBTAXdHzu5HVE0tWHJbJlJP+dF3c2U4dmwXBmVC4OxJWCUYSmuJJkVP4eBoSEkdbHgBA1ht6dxXRiYFVE/KIWdIzeRgbtsZQXKuK2xkU9FSdEcCSEh4KmpEidxzVUodb2T0JlV63MBnRNUybFWfB1JR/u5TT409U09yKkdDMMhXdFUvd0k2FVhS1vFVSCs6SVRqA3Z1J9R2bE8tQ3ppNW5nG/BWZVcjQlAaOmJTVfRMefEFYVeEKHduVNNiZF4ydGh2NU9J+/Fsdms/SmVcOFRV+u5wUHcgZ2ISFklH6MRvRu81QVa5HnFCyPVCZYkxa25xNkx60v1MQnsVaEskEG9C9dRwUx4JWFLeIXJm+PlTeNg9TUmkEnRk3/NTU7kgS24YGkNH29poTQ8XWloLN0pstfVjeSwYQVDJPmtquvVqeP8bSFqzAHZGuuxESb4DaGkAOnJq4NxDaQ8SdneSMW9Fc9NMTGkfQWP0JlJIGs92auYnRkaPIk1hU89MVao1VWFFEUNrx85KY0o8REEpN2p6avRWSygbb3fFHUVW8u5VU+McQVWzA2VTOshRdpU6dmkIIlp4IsRKdToZQ1lUJ1dESdhmUEU+SEdxO2ZGZ95jRnkYSFZDDFpqed9RRXcsSVrwF0RjHsFQUc4cUXYIIXNC2tJ0TDE+WHZhEUhV58ZkbX4RSHKKHHJp2vJQa7sLZFjpIXVo//VQQf8CZ2GkImVQ6NlQdrctdXC9IUd5999vT5gZVHgyOGpvgN5wTyIdV3XEDElH/d1CSdUkek1VFXVq3c9vQlMJRW/KJEFZoNBRbMwYWFjMBlF6jd1KSsMscWz0CWd02fhZd9QJRWORNUtp/cFDUEHDdlYD701a1dtSTRPNaGHt4kFi4MVnWuzkSkLm2nZR88VqUPvMbleGymRY1dlJYpjKYWcG7m1z+8ZjdjD0b2aExk1WLctZdaPOQ1I31kdoSd9ZZyPCUlPQxFlMdu11WeDCRHFR8G5RX/hKbUr4bEjt5HJuJvBwSP/uR21i4Wtp8+JEWGPNaWoqxlRTycRmcz7ZY2grzFFGB9xiQh7hUGZ/xGZhcM9UaHXbS0nJ03BNgspMRtb9Q0Ut02ZCIuZUbh/mcENu1W1TccdUYVvcbnDM+khXodVZQ+DyZVkd5FJqjO1vWhXRSGSH93JB8/hoRYXubmeTwUFk9+NLVoffaHro6Fd6x95sRuPaWUpf3XNRHNR5Q3zXV20d9mFu+t9ZdYvfa0jO+k1XK9hiU7TMcGuNy0R5TtdYboPbWm1z+kFJwsFQcGDZY3kO7Uxn+N5kQ9HMcVWG7mZXwMBbVY/xb0r5z3ZpsOdoUf/EZVqSz1lQN/VvaY3Sd2X1xU1mEPVwVZvpY0zE6ExGfPZjS9XtcFZo51R60PlralrCd0Z06HFukddEdU3mZUVBzFZ4cM1mV1HSQ1Ux1UtsyOlCVybsZ3fCyXZyHu1pY9rEWGnY5WZ6ps5Da8nGYlBCyGJXb+ZqQ2zJSkMh7npzIOBOZgvSQ1ICzllniOhwYxHKSFCi80t0uexjdADMcnqpzXRVlsV3a0PFVmcI/lJPVshoZBj4VW51x1VayuZEeE3uaFjL3E1hT9NRY97MQU2f2WdFIOZIZYDbanTbyEt2psV1Y8f+cWpo/3Vk4OV2d2DvYkIuxkRS3NxJcyXGc2KA5W5R+/95baH2WmmT41NNAN5sVqznUURb+npFMdRwZEvpc2cP5UpROM1pRyLgQ1Ht9WND39BrWMPEa2VO5EF0tM9mbVD1SEIt4HNI8dBnSy79ZUeV3Wlry+B
Source: C:\Windows\System32\wbem\WMIC.exe Process information queried: ProcessInformation Jump to behavior
Contains functionality to dynamically determine API calls
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_00007FFE102314B0 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress, 8_2_00007FFE102314B0
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /k copy "C:\Users\user\Desktop\1239840531439025921.js" "C:\Users\user\\mindtrembleopen.bat" && "C:\Users\user\\mindtrembleopen.bat" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_operatingsystem get oslanguage Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\find.exe find /i "1033" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\findstr.exe findstr /V flyutopianobedient ""C:\Users\user\\mindtrembleopen.bat"" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\certutil.exe certutil -f -decode astonishinglewdselective muddledfreedesert.ico Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell regsvr32 muddledfreedesert.ico Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\regsvr32.exe "C:\Windows\system32\regsvr32.exe" muddledfreedesert.ico Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\cmd.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected Strela Stealer
Source: Yara match File source: 8.2.regsvr32.exe.7ffe1023e734.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.regsvr32.exe.7ffe1023e734.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.regsvr32.exe.7ffe10230000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.1707250298.00007FFE1023E000.00000004.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1707173156.0000000002481000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: regsvr32.exe PID: 6372, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Strela Stealer
Source: Yara match File source: 8.2.regsvr32.exe.7ffe1023e734.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.regsvr32.exe.7ffe1023e734.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.regsvr32.exe.7ffe10230000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.1707250298.00007FFE1023E000.00000004.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1707173156.0000000002481000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: regsvr32.exe PID: 6372, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1417023 Sample: 1239840531439025921.js Startdate: 28/03/2024 Architecture: WINDOWS Score: 100 33 Multi AV Scanner detection for domain / URL 2->33 35 Found malware configuration 2->35 37 Antivirus detection for URL or domain 2->37 39 7 other signatures 2->39 8 wscript.exe 1 1 2->8         started        process3 signatures4 41 JScript performs obfuscated calls to suspicious functions 8->41 43 Wscript starts Powershell (via cmd or directly) 8->43 45 Windows Scripting host queries suspicious COM object (likely to drop second stage) 8->45 47 Suspicious execution chain found 8->47 11 cmd.exe 4 8->11         started        process5 file6 27 C:\Users\user\mindtrembleopen.bat, ASCII 11->27 dropped 49 Wscript starts Powershell (via cmd or directly) 11->49 15 certutil.exe 2 11->15         started        19 powershell.exe 7 11->19         started        21 WMIC.exe 1 11->21         started        23 3 other processes 11->23 signatures7 process8 file9 29 C:\Users\user\muddledfreedesert.ico, PE32+ 15->29 dropped 31 Drops PE files to the user root directory 15->31 25 regsvr32.exe 19->25         started        signatures10 process11
⊘No contacted IP infos

Contacted URLs

Name Malicious Antivirus Detection Reputation
45.9.74.12/server.php true
  • 12%, Virustotal, Browse
  • Avira URL Cloud: malware
 low