Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

file.exe

PE32 executable (GUI) Intel 80386, for MS Windows

initial sample

C:\Users\user\AppData\Local\Temp\182349\Beginners.pif

PE32 executable (GUI) Intel 80386, for MS Windows

modified

C:\Users\user\AppData\Local\TradeOptimize Dynamics\TradeHub.js

ASCII text, with no line terminators

dropped

C:\Users\user\AppData\Local\TradeOptimize Dynamics\TradeHub.scr

PE32 executable (GUI) Intel 80386, for MS Windows

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TradeHub.url

MS Windows 95 Internet shortcut text (URL=<"C:\Users\user\AppData\Local\TradeOptimize Dynamics\TradeHub.js" >), ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\182349\l

SysEx File - Harmony

dropped

C:\Users\user\AppData\Local\Temp\Cause

SysEx File - Harmony

dropped

C:\Users\user\AppData\Local\Temp\Coral

data

dropped

C:\Users\user\AppData\Local\Temp\Correlation

data

dropped

C:\Users\user\AppData\Local\Temp\Edges

data

dropped

C:\Users\user\AppData\Local\Temp\Provision

data

dropped

C:\Users\user\AppData\Local\Temp\Res

data

dropped

C:\Users\user\AppData\Local\Temp\Shopper

data

dropped

C:\Users\user\AppData\Local\Temp\Sp

data

dropped

C:\Users\user\AppData\Local\Temp\Sunset

ASCII text, with very long lines (409), with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\Sunset.bat (copy)

ASCII text, with very long lines (409), with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\Wearing

data

dropped

C:\Users\user\AppData\Local\Temp\Zinc

data

dropped

C:\Users\user\AppData\Local\TradeOptimize Dynamics\z

SysEx File - Harmony

dropped

There are 9 hidden files, click here to show them.

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\file.exe

"C:\Users\user\Desktop\file.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c move Sunset Sunset.bat & Sunset.bat

C:\Windows\SysWOW64\findstr.exe

findstr /I "wrsa opssvc"

C:\Windows\SysWOW64\findstr.exe

findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"

C:\Windows\SysWOW64\cmd.exe

cmd /c md 182349

C:\Windows\SysWOW64\findstr.exe

findstr /V "RefundAlienConservativeChapters" Coral

C:\Windows\SysWOW64\cmd.exe

cmd /c copy /b ..\Cause + ..\Shopper + ..\Edges + ..\Zinc + ..\Correlation + ..\Wearing + ..\Provision + ..\Res l

C:\Users\user\AppData\Local\Temp\182349\Beginners.pif

Beginners.pif l

C:\Windows\SysWOW64\cmd.exe

cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TradeHub.url" & echo URL="C:\Users\user\AppData\Local\TradeOptimize Dynamics\TradeHub.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TradeHub.url" & exit

C:\Windows\System32\wscript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\TradeOptimize Dynamics\TradeHub.js"

C:\Users\user\AppData\Local\TradeOptimize Dynamics\TradeHub.scr

"C:\Users\user\AppData\Local\TradeOptimize Dynamics\TradeHub.scr" "C:\Users\user\AppData\Local\TradeOptimize Dynamics\z"

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\choice.exe

choice /d y /t 5

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

There are 6 hidden processes, click here to show them.

URLs

Name

Malicious

http://www.autoitscript.com/autoit3/J

unknown

Details

Name:	http://www.autoitscript.com/autoit3/J
TargetID:	-1
From Memory:	true
Source:	file.exe, 00000000.00000003.1665758727.0000000002B81000.00000004.00000020.00020000.00000000.sdmp, Beginners.pif, 0000000A.00000000.1687736473.0000000000179000.00000002.00000001.01000000.00000006.sdmp, Beginners.pif, 0000000A.00000003.1695763329.0000000003763000.00000004.00000800.00020000.00000000.sdmp, TradeHub.scr, 0000000F.00000002.3506982744.0000000000E29000.00000002.00000001.01000000.00000008.sdmp, TradeHub.scr.10.dr, Beginners.pif.1.dr, Sp.0.dr

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://nsis.sf.net/NSIS_ErrorError

unknown

https://www.autoitscript.com/autoit3/

unknown

Details

Name:	https://www.autoitscript.com/autoit3/
TargetID:	-1
From Memory:	true
Source:	file.exe, 00000000.00000003.1665758727.0000000002B81000.00000004.00000020.00020000.00000000.sdmp, Beginners.pif, 0000000A.00000002.3507516822.0000000002E27000.00000004.00000020.00020000.00000000.sdmp, Beginners.pif, 0000000A.00000003.1695763329.0000000003763000.00000004.00000800.00020000.00000000.sdmp, TradeHub.scr.10.dr, Beginners.pif.1.dr, Sp.0.dr

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Domains

Name

Malicious

bsQfWYzSEObgoEYPHvZYAafhPH.bsQfWYzSEObgoEYPHvZYAafhPH

unknown

Registry

Path

Value

Malicious

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Script\Settings\Telemetry\wscript.exe

JScriptSetScriptStateStarted

Memdumps

Base Address

Regiontype

Protect

Malicious

33F1000

heap

page read and write

93E000

stack

page read and write

86E000

heap

page read and write

86E000

heap

page read and write

2AC6000

heap

page read and write

84E000

heap

page read and write

87D000

heap

page read and write

4AE000

heap

page read and write

235111E0000

heap

page read and write

E0C000

heap

page read and write

E98000

heap

page read and write

3B11000

heap

page read and write

2410000

heap

page read and write

2DE6000

heap

page read and write

881000

heap

page read and write

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
file.exe

Files

Processes

URLs

Domains

Registry

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reportfile.exe

Files

Processes

URLs

Domains

Registry

Memdumps

IOC Report
file.exe