Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
1239840531439025921.js
|
ASCII text, with very long lines (3027), with CRLF line terminators
|
initial sample
|
 |
|
|
C:\Users\user\mindtrembleopen.bat
|
ASCII text, with very long lines (3027), with CRLF line terminators
|
dropped
|
|
|
|
C:\Users\user\muddledfreedesert.ico
|
PE32+ executable (DLL) (console) x86-64, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lnffw4rs.104.psm1
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qjllnkuc.i0s.ps1
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Users\user\astonishinglewdselective
|
ASCII text, with very long lines (3027), with CRLF line terminators
|
modified
|
||
|
C:\Users\user\mindtrembleopen.bat:Zone.Identifier
|
ASCII text, with CRLF line terminators
|
modified
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Windows\System32\wscript.exe
|
C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1239840531439025921.js"
|
|
|
|
C:\Windows\System32\cmd.exe
|
"C:\Windows\System32\cmd.exe" /k copy "C:\Users\user\Desktop\1239840531439025921.js" "C:\Users\user\\mindtrembleopen.bat"
&& "C:\Users\user\\mindtrembleopen.bat"
|
|
|
|
C:\Windows\System32\certutil.exe
|
certutil -f -decode astonishinglewdselective muddledfreedesert.ico
|
|
|
|
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
|
powershell regsvr32 muddledfreedesert.ico
|
|
|
|
C:\Windows\System32\regsvr32.exe
|
"C:\Windows\system32\regsvr32.exe" muddledfreedesert.ico
|
|
|
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\wbem\WMIC.exe
|
wmic path win32_operatingsystem get oslanguage
|
||
|
C:\Windows\System32\find.exe
|
find /i "1033"
|
||
|
C:\Windows\System32\findstr.exe
|
findstr /V flyutopianobedient ""C:\Users\user\\mindtrembleopen.bat""
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
45.9.74.12/server.php
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Script\Settings\Telemetry\wscript.exe
|
JScriptSetScriptStateStarted
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
7FFE1023E000
|
unkown
|
page read and write
|
|
|
|
2481000
|
direct allocation
|
page execute and read and write
|
|
|
|
15975565000
|
heap
|
page read and write
|
||
|
159736F8000
|
heap
|
page read and write
|
||
|
28FE2920000
|
heap
|
page read and write
|
||
|
15973B64000
|
heap
|
page read and write
|
||
|
15973CE1000
|
heap
|
page read and write
|
||
|
1B4DD950000
|
heap
|
page read and write
|
||
|
28FE48D4000
|
heap
|
page read and write
|
||
|
94D000
|
heap
|
page read and write
|
||
|
28FE4722000
|
heap
|
page read and write
|
||
|
6D13FF000
|
stack
|
page read and write
|
||
|
1597367C000
|
heap
|
page read and write
|
||
|
159735C0000
|
heap
|
page read and write
|
||
|
159736FD000
|
heap
|
page read and write
|
||
|
28FE294B000
|
heap
|
page read and write
|
||
|
159736FF000
|
heap
|
page read and write
|
||
|
1597371D000
|
heap
|
page read and write
|
||
|
1D24E9E0000
|
heap
|
page read and write
|
||
|
28FE48C3000
|
heap
|
page read and write
|
||
|
28FE4745000
|
heap
|
page read and write
|
||
|
7FFE1025D000
|
unkown
|
page readonly
|
||
|
28FE4724000
|
heap
|
page read and write
|
||
|
92C000
|
heap
|
page read and write
|
||
|
28FE4820000
|
heap
|
page read and write
|
||
|
28FE4725000
|
heap
|
page read and write
|
||
|
159736DA000
|
heap
|
page read and write
|
||
|
15975550000
|
heap
|
page read and write
|
||
|
15973600000
|
trusted library allocation
|
page read and write
|
||
|
C1A8CFE000
|
stack
|
page read and write
|
||
|
C1A86FE000
|
stack
|
page read and write
|
||
|
7FFE10230000
|
unkown
|
page readonly
|
||
|
159736B9000
|
heap
|
page read and write
|
||
|
28FE4A0C000
|
heap
|
page read and write
|
||
|
28FE2890000
|
heap
|
page read and write
|
||
|
15973CBC000
|
heap
|
page read and write
|
||
|
15973704000
|
heap
|
page read and write
|
||
|
7FFE1026A000
|
unkown
|
page readonly
|
||
|
15973B67000
|
heap
|
page read and write
|
||
|
15973CE1000
|
heap
|
page read and write
|
||
|
15973B50000
|
heap
|
page read and write
|
||
|
28FE4720000
|
heap
|
page read and write
|
||
|
1B4DD9A0000
|
heap
|
page read and write
|
||
|
1D24EA0C000
|
heap
|
page read and write
|
||
|
15973707000
|
heap
|
page read and write
|
||
|
15973704000
|
heap
|
page read and write
|
||
|
900000
|
heap
|
page read and write
|
||
|
28FE475E000
|
heap
|
page read and write
|
||
|
1B4DDAF3000
|
heap
|
page read and write
|
||
|
1D24EA00000
|
heap
|
page read and write
|
||
|
15973CBE000
|
heap
|
page read and write
|
||
|
C1A8AFE000
|
stack
|
page read and write
|
||
|
15973CC4000
|
heap
|
page read and write
|
||
|
15973701000
|
heap
|
page read and write
|
||
|
28FE4745000
|
heap
|
page read and write
|
||
|
7FFE1023D000
|
unkown
|
page write copy
|
||
|
C1A8BFE000
|
stack
|
page read and write
|
||
|
28FE48BB000
|
heap
|
page read and write
|
||
|
7FFE1025B000
|
unkown
|
page readonly
|
||
|
95C000
|
heap
|
page read and write
|
||
|
956000
|
heap
|
page read and write
|
||
|
96F000
|
heap
|
page read and write
|
||
|
15973630000
|
heap
|
page read and write
|
||
|
1597555F000
|
heap
|
page read and write
|
||
|
1597555E000
|
heap
|
page read and write
|
||
|
159736F4000
|
heap
|
page read and write
|
||
|
15973CDB000
|
heap
|
page read and write
|
||
|
28FE4821000
|
heap
|
page read and write
|
||
|
15973CDD000
|
heap
|
page read and write
|
||
|
28FE4736000
|
heap
|
page read and write
|
||
|
159736A9000
|
heap
|
page read and write
|
||
|
28FE4804000
|
heap
|
page read and write
|
||
|
6D1277000
|
stack
|
page read and write
|
||
|
28FE4742000
|
heap
|
page read and write
|
||
|
28FE4729000
|
heap
|
page read and write
|
||
|
28FE2CC0000
|
heap
|
page read and write
|
||
|
28FE2962000
|
heap
|
page read and write
|
||
|
15975565000
|
heap
|
page read and write
|
||
|
22BE000
|
stack
|
page read and write
|
||
|
15973B67000
|
heap
|
page read and write
|
||
|
1B4DD7E0000
|
heap
|
page read and write
|
||
|
28FE28B0000
|
heap
|
page read and write
|
||
|
15973CB8000
|
heap
|
page read and write
|
||
|
28FE472D000
|
heap
|
page read and write
|
||
|
1597371D000
|
heap
|
page read and write
|
||
|
6D137F000
|
stack
|
page read and write
|
||
|
28FE4723000
|
heap
|
page read and write
|
||
|
1B4DD9A9000
|
heap
|
page read and write
|
||
|
15973704000
|
heap
|
page read and write
|
||
|
1597370A000
|
heap
|
page read and write
|
||
|
159736B9000
|
heap
|
page read and write
|
||
|
28FE48FA000
|
heap
|
page read and write
|
||
|
904000
|
heap
|
page read and write
|
||
|
15973CC0000
|
heap
|
page read and write
|
||
|
28FE4724000
|
heap
|
page read and write
|
||
|
159736F8000
|
heap
|
page read and write
|
||
|
1597370A000
|
heap
|
page read and write
|
||
|
28FE475E000
|
heap
|
page read and write
|
||
|
1D24EA07000
|
heap
|
page read and write
|
||
|
8D0000
|
heap
|
page read and write
|
||
|
15973704000
|
heap
|
page read and write
|
||
|
28FE475E000
|
heap
|
page read and write
|
||
|
28FE2CC5000
|
heap
|
page read and write
|
||
|
15973670000
|
heap
|
page read and write
|
||
|
2360000
|
heap
|
page read and write
|
||
|
28FE48FB000
|
heap
|
page read and write
|
||
|
C1A8FFB000
|
stack
|
page read and write
|
||
|
15973CE4000
|
heap
|
page read and write
|
||
|
28FE294C000
|
heap
|
page read and write
|
||
|
15973674000
|
heap
|
page read and write
|
||
|
159736F0000
|
heap
|
page read and write
|
||
|
2320000
|
heap
|
page read and write
|
||
|
15973CD8000
|
heap
|
page read and write
|
||
|
1597555F000
|
heap
|
page read and write
|
||
|
28FE4722000
|
heap
|
page read and write
|
||
|
15973704000
|
heap
|
page read and write
|
||
|
28FE4726000
|
heap
|
page read and write
|
||
|
28FE2A16000
|
heap
|
page read and write
|
||
|
96D000
|
heap
|
page read and write
|
||
|
1D24EC94000
|
heap
|
page read and write
|
||
|
15973712000
|
heap
|
page read and write
|
||
|
95C000
|
heap
|
page read and write
|
||
|
30C067C000
|
stack
|
page read and write
|
||
|
28FE48D4000
|
heap
|
page read and write
|
||
|
579000
|
stack
|
page read and write
|
||
|
28FE4921000
|
heap
|
page read and write
|
||
|
28FE2A0C000
|
heap
|
page read and write
|
||
|
28FE43D0000
|
heap
|
page read and write
|
||
|
15973707000
|
heap
|
page read and write
|
||
|
28FE29FD000
|
heap
|
page read and write
|
||
|
28FE474A000
|
heap
|
page read and write
|
||
|
7FD1D2F000
|
stack
|
page read and write
|
||
|
15973B60000
|
heap
|
page read and write
|
||
|
249F000
|
direct allocation
|
page execute and read and write
|
||
|
15973B6A000
|
heap
|
page read and write
|
||
|
159736F4000
|
heap
|
page read and write
|
||
|
15973600000
|
trusted library allocation
|
page read and write
|
||
|
1597555F000
|
heap
|
page read and write
|
||
|
7FD1CAC000
|
stack
|
page read and write
|
||
|
15973CD8000
|
heap
|
page read and write
|
||
|
15973B63000
|
heap
|
page read and write
|
||
|
15973600000
|
trusted library allocation
|
page read and write
|
||
|
28FE2A1A000
|
heap
|
page read and write
|
||
|
28FE4A0C000
|
heap
|
page read and write
|
||
|
28FE4745000
|
heap
|
page read and write
|
||
|
28FE29FD000
|
heap
|
page read and write
|
||
|
15973CC1000
|
heap
|
page read and write
|
||
|
15973715000
|
heap
|
page read and write
|
||
|
15973707000
|
heap
|
page read and write
|
||
|
7FFE10266000
|
unkown
|
page readonly
|
||
|
30C06FF000
|
stack
|
page read and write
|
||
|
2363000
|
heap
|
page read and write
|
||
|
15973B6A000
|
heap
|
page read and write
|
||
|
15975565000
|
heap
|
page read and write
|
||
|
96D000
|
heap
|
page read and write
|
||
|
15973B6E000
|
heap
|
page read and write
|
||
|
159735E0000
|
heap
|
page read and write
|
||
|
15973718000
|
heap
|
page read and write
|
||
|
15973CC7000
|
heap
|
page read and write
|
||
|
5C0000
|
heap
|
page read and write
|
||
|
28FE4731000
|
heap
|
page read and write
|
||
|
15975555000
|
heap
|
page read and write
|
||
|
5D0000
|
heap
|
page read and write
|
||
|
1597370A000
|
heap
|
page read and write
|
||
|
1B4DDB70000
|
heap
|
page read and write
|
||
|
15973B6B000
|
heap
|
page read and write
|
||
|
15975553000
|
heap
|
page read and write
|
||
|
1D24EC90000
|
heap
|
page read and write
|
||
|
1D24E900000
|
heap
|
page read and write
|
||
|
15973B6A000
|
heap
|
page read and write
|
||
|
15973CB7000
|
heap
|
page read and write
|
||
|
6D14FF000
|
stack
|
page read and write
|
||
|
1B4DDB74000
|
heap
|
page read and write
|
||
|
956000
|
heap
|
page read and write
|
||
|
159736F8000
|
heap
|
page read and write
|
||
|
1B4DF710000
|
heap
|
page read and write
|
||
|
C1A87FD000
|
stack
|
page read and write
|
||
|
15973CD8000
|
heap
|
page read and write
|
||
|
28FE4729000
|
heap
|
page read and write
|
||
|
15973712000
|
heap
|
page read and write
|
||
|
15973CBC000
|
heap
|
page read and write
|
||
|
15973CE1000
|
heap
|
page read and write
|
||
|
28FE2A14000
|
heap
|
page read and write
|
||
|
15973CB0000
|
heap
|
page read and write
|
||
|
15973716000
|
heap
|
page read and write
|
||
|
C1A84FA000
|
stack
|
page read and write
|
||
|
7FFE10261000
|
unkown
|
page read and write
|
||
|
15975554000
|
heap
|
page read and write
|
||
|
C1A8DFE000
|
stack
|
page read and write
|
||
|
159736F4000
|
heap
|
page read and write
|
||
|
28FE2880000
|
heap
|
page read and write
|
||
|
28FE4920000
|
heap
|
page read and write
|
||
|
7FFE10264000
|
unkown
|
page readonly
|
||
|
28FE2A1B000
|
heap
|
page read and write
|
||
|
28FE475A000
|
heap
|
page read and write
|
||
|
28FE2A0C000
|
heap
|
page read and write
|
||
|
1597555F000
|
heap
|
page read and write
|
||
|
15973705000
|
heap
|
page read and write
|
||
|
972000
|
heap
|
page read and write
|
||
|
28FE475E000
|
heap
|
page read and write
|
||
|
C1A89FF000
|
stack
|
page read and write
|
||
|
159736A0000
|
heap
|
page read and write
|
||
|
15975557000
|
heap
|
page read and write
|
||
|
159736D7000
|
heap
|
page read and write
|
||
|
1597370C000
|
heap
|
page read and write
|
||
|
15973CD9000
|
heap
|
page read and write
|
||
|
159736B4000
|
heap
|
page read and write
|
||
|
920000
|
heap
|
page read and write
|
||
|
7FFE10231000
|
unkown
|
page execute read
|
||
|
94D000
|
heap
|
page read and write
|
||
|
15975551000
|
heap
|
page read and write
|
||
|
159736F8000
|
heap
|
page read and write
|
||
|
15975565000
|
heap
|
page read and write
|
||
|
1597370F000
|
heap
|
page read and write
|
||
|
1B4DDAF0000
|
heap
|
page read and write
|
||
|
6D147F000
|
stack
|
page read and write
|
||
|
1B4DD8F0000
|
heap
|
page read and write
|
||
|
952000
|
heap
|
page read and write
|
||
|
28FE48C4000
|
heap
|
page read and write
|
||
|
159736D6000
|
heap
|
page read and write
|
||
|
15975566000
|
heap
|
page read and write
|
||
|
6D12FF000
|
stack
|
page read and write
|
||
|
1D24EB00000
|
heap
|
page read and write
|
||
|
15973600000
|
trusted library allocation
|
page read and write
|
||
|
159736F8000
|
heap
|
page read and write
|
||
|
15973709000
|
heap
|
page read and write
|
||
|
95D000
|
heap
|
page read and write
|
||
|
15973B6E000
|
heap
|
page read and write
|
||
|
28FE48D4000
|
heap
|
page read and write
|
||
|
15973B65000
|
heap
|
page read and write
|
||
|
C1A85FE000
|
stack
|
page read and write
|
||
|
159734E0000
|
heap
|
page read and write
|
||
|
28FE4803000
|
heap
|
page read and write
|
||
|
28FE475E000
|
heap
|
page read and write
|
||
|
28FE4724000
|
heap
|
page read and write
|
||
|
1B4DD8C0000
|
heap
|
page read and write
|
||
|
223E000
|
stack
|
page read and write
|
||
|
15973B62000
|
heap
|
page read and write
|
||
|
28FE4805000
|
heap
|
page read and write
|
||
|
28FE4724000
|
heap
|
page read and write
|
||
|
15973CE9000
|
heap
|
page read and write
|
||
|
30C077D000
|
stack
|
page read and write
|
||
|
97A000
|
heap
|
page read and write
|
||
|
28FE2A0C000
|
heap
|
page read and write
|
||
|
159736F4000
|
heap
|
page read and write
|
||
|
15973712000
|
heap
|
page read and write
|
||
|
7FD1DAF000
|
stack
|
page read and write
|
||
|
15973CD8000
|
heap
|
page read and write
|
||
|
7FFE1023C000
|
unkown
|
page read and write
|
||
|
15973704000
|
heap
|
page read and write
|
||
|
159736D8000
|
heap
|
page read and write
|
||
|
15973CC4000
|
heap
|
page read and write
|
There are 242 hidden memdumps, click here to show them.