Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
file.js
|
ASCII text, with very long lines (3189), with CRLF line terminators
|
initial sample
|
 |
|
|
C:\Users\user\childlikeclearintroduce.ico
|
PE32+ executable (DLL) (console) x86-64, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\stiffrelievedawesome.bat
|
ASCII text, with very long lines (3189), with CRLF line terminators
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gw4xkmxd.b3h.ps1
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jyezsyz1.ev4.psm1
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Users\user\deepdidacticfour
|
ASCII text, with very long lines (3189), with CRLF line terminators
|
modified
|
||
|
C:\Users\user\stiffrelievedawesome.bat:Zone.Identifier
|
ASCII text, with CRLF line terminators
|
modified
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Windows\System32\wscript.exe
|
C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\file.js"
|
|
|
|
C:\Windows\System32\cmd.exe
|
"C:\Windows\System32\cmd.exe" /k copy "C:\Users\user\Desktop\file.js" "C:\Users\user\\stiffrelievedawesome.bat" && "C:\Users\user\\stiffrelievedawesome.bat"
|
|
|
|
C:\Windows\System32\certutil.exe
|
certutil -f -decode deepdidacticfour childlikeclearintroduce.ico
|
|
|
|
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
|
powershell regsvr32 childlikeclearintroduce.ico
|
|
|
|
C:\Windows\System32\regsvr32.exe
|
"C:\Windows\system32\regsvr32.exe" childlikeclearintroduce.ico
|
|
|
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\wbem\WMIC.exe
|
wmic path win32_operatingsystem get oslanguage
|
||
|
C:\Windows\System32\find.exe
|
find /i "1033"
|
||
|
C:\Windows\System32\findstr.exe
|
findstr /V joyousintroducebreezy ""C:\Users\user\\stiffrelievedawesome.bat""
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
45.9.74.12/server.php
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Script\Settings\Telemetry\wscript.exe
|
JScriptSetScriptStateStarted
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
7FFE1023E000
|
unkown
|
page read and write
|
|
|
|
2B81000
|
direct allocation
|
page execute and read and write
|
|
|
|
1AC17110000
|
heap
|
page read and write
|
||
|
20D2AA6A000
|
heap
|
page read and write
|
||
|
81E517E000
|
stack
|
page read and write
|
||
|
2360B934000
|
heap
|
page read and write
|
||
|
20D2AA76000
|
heap
|
page read and write
|
||
|
20D2A2E5000
|
heap
|
page read and write
|
||
|
7A283FF000
|
stack
|
page read and write
|
||
|
116C000
|
heap
|
page read and write
|
||
|
20D2A328000
|
heap
|
page read and write
|
||
|
23609B30000
|
heap
|
page read and write
|
||
|
2360B932000
|
heap
|
page read and write
|
||
|
7AAE6FE000
|
stack
|
page read and write
|
||
|
B46A97E000
|
stack
|
page read and write
|
||
|
20D2C2EE000
|
heap
|
page read and write
|
||
|
20D2A280000
|
heap
|
page read and write
|
||
|
10D0000
|
heap
|
page read and write
|
||
|
2360B95A000
|
heap
|
page read and write
|
||
|
20D2AA3A000
|
heap
|
page read and write
|
||
|
B46A87D000
|
stack
|
page read and write
|
||
|
7AAE9FE000
|
stack
|
page read and write
|
||
|
D79000
|
stack
|
page read and write
|
||
|
20D2C2F5000
|
heap
|
page read and write
|
||
|
7AAECFF000
|
stack
|
page read and write
|
||
|
7FFE10266000
|
unkown
|
page readonly
|
||
|
2360B96E000
|
heap
|
page read and write
|
||
|
20D2AA5D000
|
heap
|
page read and write
|
||
|
20D2A260000
|
heap
|
page read and write
|
||
|
20D2AA54000
|
heap
|
page read and write
|
||
|
2360B946000
|
heap
|
page read and write
|
||
|
2B9F000
|
direct allocation
|
page execute and read and write
|
||
|
20D2C2EE000
|
heap
|
page read and write
|
||
|
20D2AA69000
|
heap
|
page read and write
|
||
|
20D2AA3E000
|
heap
|
page read and write
|
||
|
1F228617000
|
heap
|
page read and write
|
||
|
20D2A34C000
|
heap
|
page read and write
|
||
|
2360BA31000
|
heap
|
page read and write
|
||
|
1F22861D000
|
heap
|
page read and write
|
||
|
20D2A2D0000
|
heap
|
page read and write
|
||
|
7AAEBFE000
|
stack
|
page read and write
|
||
|
20D2AA79000
|
heap
|
page read and write
|
||
|
20D2AA6C000
|
heap
|
page read and write
|
||
|
2360B952000
|
heap
|
page read and write
|
||
|
7AAE36A000
|
stack
|
page read and write
|
||
|
20D2AA4E000
|
heap
|
page read and write
|
||
|
20D2C2EE000
|
heap
|
page read and write
|
||
|
20D2A34B000
|
heap
|
page read and write
|
||
|
20D2A328000
|
heap
|
page read and write
|
||
|
1AC170F0000
|
heap
|
page read and write
|
||
|
1F22A340000
|
heap
|
page read and write
|
||
|
7FFE10231000
|
unkown
|
page execute read
|
||
|
1F228648000
|
heap
|
page read and write
|
||
|
81E50FE000
|
stack
|
page read and write
|
||
|
20D2A308000
|
heap
|
page read and write
|
||
|
23609C92000
|
heap
|
page read and write
|
||
|
1AC170E0000
|
heap
|
page read and write
|
||
|
1AC1717C000
|
heap
|
page read and write
|
||
|
B46A9FF000
|
stack
|
page read and write
|
||
|
1F22A680000
|
heap
|
page read and write
|
||
|
20D2AA72000
|
heap
|
page read and write
|
||
|
20D2AA30000
|
heap
|
page read and write
|
||
|
B46A5C7000
|
stack
|
page read and write
|
||
|
23609C7D000
|
heap
|
page read and write
|
||
|
1F22A4F0000
|
heap
|
page read and write
|
||
|
1160000
|
heap
|
page read and write
|
||
|
20D2A510000
|
heap
|
page read and write
|
||
|
11BB000
|
heap
|
page read and write
|
||
|
20D2A33B000
|
heap
|
page read and write
|
||
|
2360BADD000
|
heap
|
page read and write
|
||
|
12F0000
|
heap
|
page read and write
|
||
|
20D2A2EA000
|
heap
|
page read and write
|
||
|
7AAEAFE000
|
stack
|
page read and write
|
||
|
20D2A33D000
|
heap
|
page read and write
|
||
|
2360B955000
|
heap
|
page read and write
|
||
|
20D2AA48000
|
heap
|
page read and write
|
||
|
20D2A306000
|
heap
|
page read and write
|
||
|
20D2AA4C000
|
heap
|
page read and write
|
||
|
7FFE1026A000
|
unkown
|
page readonly
|
||
|
20D2A347000
|
heap
|
page read and write
|
||
|
20D2A33F000
|
heap
|
page read and write
|
||
|
81E507C000
|
stack
|
page read and write
|
||
|
20D2AA3E000
|
heap
|
page read and write
|
||
|
20D2A2A0000
|
trusted library allocation
|
page read and write
|
||
|
20D2A328000
|
heap
|
page read and write
|
||
|
20D2A328000
|
heap
|
page read and write
|
||
|
23609D50000
|
heap
|
page read and write
|
||
|
20D2A51C000
|
heap
|
page read and write
|
||
|
20D2C2EE000
|
heap
|
page read and write
|
||
|
1AC17170000
|
heap
|
page read and write
|
||
|
2360BAE5000
|
heap
|
page read and write
|
||
|
20D2A2EA000
|
heap
|
page read and write
|
||
|
1F228820000
|
heap
|
page read and write
|
||
|
20D2AA73000
|
heap
|
page read and write
|
||
|
119E000
|
heap
|
page read and write
|
||
|
20D2AA5D000
|
heap
|
page read and write
|
||
|
23609CE0000
|
heap
|
page read and write
|
||
|
20D2AA58000
|
heap
|
page read and write
|
||
|
20D2A314000
|
heap
|
page read and write
|
||
|
2360BC1E000
|
heap
|
page read and write
|
||
|
B46AA7F000
|
stack
|
page read and write
|
||
|
20D2A32F000
|
heap
|
page read and write
|
||
|
2B73000
|
heap
|
page read and write
|
||
|
1AC173D0000
|
heap
|
page read and write
|
||
|
20D2C2E7000
|
heap
|
page read and write
|
||
|
11AC000
|
heap
|
page read and write
|
||
|
119C000
|
heap
|
page read and write
|
||
|
20D2A325000
|
heap
|
page read and write
|
||
|
20D2A328000
|
heap
|
page read and write
|
||
|
20D2A4A0000
|
heap
|
page read and write
|
||
|
20D2AA69000
|
heap
|
page read and write
|
||
|
23609C98000
|
heap
|
page read and write
|
||
|
20D2A328000
|
heap
|
page read and write
|
||
|
20D2A347000
|
heap
|
page read and write
|
||
|
20D2A347000
|
heap
|
page read and write
|
||
|
DC0000
|
heap
|
page read and write
|
||
|
2360BADD000
|
heap
|
page read and write
|
||
|
20D2AA37000
|
heap
|
page read and write
|
||
|
118E000
|
heap
|
page read and write
|
||
|
1AC17178000
|
heap
|
page read and write
|
||
|
23609BC9000
|
heap
|
page read and write
|
||
|
119C000
|
heap
|
page read and write
|
||
|
2360BADF000
|
heap
|
page read and write
|
||
|
2360BACC000
|
heap
|
page read and write
|
||
|
2360B934000
|
heap
|
page read and write
|
||
|
20D2C2E0000
|
heap
|
page read and write
|
||
|
20D2A4A0000
|
trusted library allocation
|
page read and write
|
||
|
20D2A514000
|
heap
|
page read and write
|
||
|
7AAF0FB000
|
stack
|
page read and write
|
||
|
81E51FD000
|
stack
|
page read and write
|
||
|
20D2A323000
|
heap
|
page read and write
|
||
|
20D2A346000
|
heap
|
page read and write
|
||
|
23609BC8000
|
heap
|
page read and write
|
||
|
2360BB30000
|
heap
|
page read and write
|
||
|
20D2AA5D000
|
heap
|
page read and write
|
||
|
11AC000
|
heap
|
page read and write
|
||
|
7FFE1023D000
|
unkown
|
page write copy
|
||
|
20D2A321000
|
heap
|
page read and write
|
||
|
7FFE10261000
|
unkown
|
page read and write
|
||
|
20D2A343000
|
heap
|
page read and write
|
||
|
20D2AA69000
|
heap
|
page read and write
|
||
|
DD0000
|
heap
|
page read and write
|
||
|
20D2AA40000
|
heap
|
page read and write
|
||
|
20D2C2F5000
|
heap
|
page read and write
|
||
|
23609C7D000
|
heap
|
page read and write
|
||
|
20D2AA3B000
|
heap
|
page read and write
|
||
|
20D2A33B000
|
heap
|
page read and write
|
||
|
2360B939000
|
heap
|
page read and write
|
||
|
23609A50000
|
heap
|
page read and write
|
||
|
20D2A34A000
|
heap
|
page read and write
|
||
|
2360BA30000
|
heap
|
page read and write
|
||
|
20D2AA47000
|
heap
|
page read and write
|
||
|
23609BA0000
|
heap
|
page read and write
|
||
|
2B70000
|
heap
|
page read and write
|
||
|
20D2A325000
|
heap
|
page read and write
|
||
|
7FFE1025D000
|
unkown
|
page readonly
|
||
|
2360B939000
|
heap
|
page read and write
|
||
|
20D2A325000
|
heap
|
page read and write
|
||
|
20D2A351000
|
heap
|
page read and write
|
||
|
2360B96A000
|
heap
|
page read and write
|
||
|
20D2AA32000
|
heap
|
page read and write
|
||
|
7A286FF000
|
stack
|
page read and write
|
||
|
20D2A330000
|
heap
|
page read and write
|
||
|
20D2AA69000
|
heap
|
page read and write
|
||
|
2360B93D000
|
heap
|
page read and write
|
||
|
2360B941000
|
heap
|
page read and write
|
||
|
20D2A325000
|
heap
|
page read and write
|
||
|
1196000
|
heap
|
page read and write
|
||
|
20D2A2E1000
|
heap
|
page read and write
|
||
|
7A2867F000
|
stack
|
page read and write
|
||
|
20D2C2E1000
|
heap
|
page read and write
|
||
|
7AAE7FF000
|
stack
|
page read and write
|
||
|
1314000
|
heap
|
page read and write
|
||
|
20D2AA5D000
|
heap
|
page read and write
|
||
|
20D2AA35000
|
heap
|
page read and write
|
||
|
20D2A4A0000
|
trusted library allocation
|
page read and write
|
||
|
20D2A33E000
|
heap
|
page read and write
|
||
|
20D2AA3A000
|
heap
|
page read and write
|
||
|
1310000
|
heap
|
page read and write
|
||
|
1F22868E000
|
heap
|
page read and write
|
||
|
20D2AA69000
|
heap
|
page read and write
|
||
|
20D2A33E000
|
heap
|
page read and write
|
||
|
11BB000
|
heap
|
page read and write
|
||
|
20D2AA76000
|
heap
|
page read and write
|
||
|
20D2AA33000
|
heap
|
page read and write
|
||
|
2360B933000
|
heap
|
page read and write
|
||
|
20D2A347000
|
heap
|
page read and write
|
||
|
20D2AA51000
|
heap
|
page read and write
|
||
|
20D2A343000
|
heap
|
page read and write
|
||
|
2360B96E000
|
heap
|
page read and write
|
||
|
20D2AA5D000
|
heap
|
page read and write
|
||
|
7A2837C000
|
stack
|
page read and write
|
||
|
1F22A4F3000
|
heap
|
page read and write
|
||
|
20D2A351000
|
heap
|
page read and write
|
||
|
1F228610000
|
heap
|
page read and write
|
||
|
20D2A2D8000
|
heap
|
page read and write
|
||
|
1196000
|
heap
|
page read and write
|
||
|
2360BB31000
|
heap
|
page read and write
|
||
|
1AC173D4000
|
heap
|
page read and write
|
||
|
7FFE1023C000
|
unkown
|
page read and write
|
||
|
20D2AA5D000
|
heap
|
page read and write
|
||
|
11AE000
|
heap
|
page read and write
|
||
|
1F2287E0000
|
heap
|
page read and write
|
||
|
2360B96E000
|
heap
|
page read and write
|
||
|
23609B50000
|
heap
|
page read and write
|
||
|
20D2C2F5000
|
heap
|
page read and write
|
||
|
23609BE1000
|
heap
|
page read and write
|
||
|
2360BB0C000
|
heap
|
page read and write
|
||
|
12DE000
|
stack
|
page read and write
|
||
|
20D2A250000
|
heap
|
page read and write
|
||
|
20D2A343000
|
heap
|
page read and write
|
||
|
20D2A320000
|
heap
|
page read and write
|
||
|
7AAEEFD000
|
stack
|
page read and write
|
||
|
2360B96E000
|
heap
|
page read and write
|
||
|
2360BADF000
|
heap
|
page read and write
|
||
|
11BB000
|
heap
|
page read and write
|
||
|
20D2AA37000
|
heap
|
page read and write
|
||
|
1F2285D0000
|
heap
|
page read and write
|
||
|
20D2AA10000
|
heap
|
page read and write
|
||
|
2360B930000
|
heap
|
page read and write
|
||
|
20D2AA50000
|
heap
|
page read and write
|
||
|
20D2AA73000
|
heap
|
page read and write
|
||
|
2360BB0D000
|
heap
|
page read and write
|
||
|
7FFE1025B000
|
unkown
|
page readonly
|
||
|
20D2AA55000
|
heap
|
page read and write
|
||
|
2360BAE5000
|
heap
|
page read and write
|
||
|
20D2AA69000
|
heap
|
page read and write
|
||
|
2360B96E000
|
heap
|
page read and write
|
||
|
20D2C2E5000
|
heap
|
page read and write
|
||
|
20D2AA4C000
|
heap
|
page read and write
|
||
|
23609C95000
|
heap
|
page read and write
|
||
|
23609C99000
|
heap
|
page read and write
|
||
|
2360B955000
|
heap
|
page read and write
|
||
|
1F228824000
|
heap
|
page read and write
|
||
|
20D2A30A000
|
heap
|
page read and write
|
||
|
118E000
|
heap
|
page read and write
|
||
|
20D2A307000
|
heap
|
page read and write
|
||
|
20D2AA52000
|
heap
|
page read and write
|
||
|
B46A8FE000
|
stack
|
page read and write
|
||
|
20D2AA54000
|
heap
|
page read and write
|
||
|
20D2AA34000
|
heap
|
page read and write
|
||
|
23609BA8000
|
heap
|
page read and write
|
||
|
7AAEDFE000
|
stack
|
page read and write
|
||
|
20D2A325000
|
heap
|
page read and write
|
||
|
7FFE10264000
|
unkown
|
page readonly
|
||
|
23609D55000
|
heap
|
page read and write
|
||
|
20D2A325000
|
heap
|
page read and write
|
||
|
11BA000
|
heap
|
page read and write
|
||
|
20D2AA3A000
|
heap
|
page read and write
|
||
|
7FFE10230000
|
unkown
|
page readonly
|
||
|
2B3F000
|
stack
|
page read and write
|
||
|
20D2AA72000
|
heap
|
page read and write
|
||
|
20D2C2E3000
|
heap
|
page read and write
|
||
|
20D2A2A0000
|
trusted library allocation
|
page read and write
|
||
|
2360BC1E000
|
heap
|
page read and write
|
||
|
11B3000
|
heap
|
page read and write
|
||
|
20D2A313000
|
heap
|
page read and write
|
||
|
1F2285E0000
|
heap
|
page read and write
|
||
|
2360B955000
|
heap
|
page read and write
|
There are 249 hidden memdumps, click here to show them.