Summary

6a6eb56914be39291dc03d66e09efd2a5f4e93e83f73d85d38ead3be402bde01

File 6a6eb56914be39291dc03d66e09efd2a5f4e93e83f73d85d38ead3be402bde01

Summary
Download Resubmit sample

Size 18.0KB
Type HTML document, Unicode text, UTF-8 text, with very long lines (7320)
MD5 97d78291a987fefed6054324a432a8dc
SHA1 93cba78d7c4c7f9fbc7a11f74a9c3594764e272d
SHA256 6a6eb56914be39291dc03d66e09efd2a5f4e93e83f73d85d38ead3be402bde01
SHA512
0570e9d5200cc698dcd24c955102c4e9f2cee74990e08cf52dc83b882c4276c095ad449a34cb00acdb15c434ca0cf799ff7c0476e669398812a635e6d0d7c709
CRC32 BF57D071
ssdeep None
Yara
  • dropper_generic_wscript3 - Generic WScript dropper 3

Score

This file is very suspicious, with a score of 10 out of 10!

Please notice: The scoring system is currently still in development and should be considered an alpha feature.

Feedback

Expecting different results? Send us this analysis and we will inspect it. Click here

Information on Execution

Analysis
Category Started Completed Duration Routing Logs
FILE July 13, 2025, 7:01 a.m. July 13, 2025, 7:07 a.m. 336 seconds internet Show Analyzer Log
Show Cuckoo Log

Analyzer Log

2025-07-08 23:00:26,015 [analyzer] DEBUG: Starting analyzer from: C:\tmpk4d6bl
2025-07-08 23:00:26,046 [analyzer] DEBUG: Pipe server name: \??\PIPE\FzmLMXAYesBoOpJyCbzfEEwNMtBeCl
2025-07-08 23:00:26,046 [analyzer] DEBUG: Log pipe server name: \??\PIPE\JrUGGDbiXbHinanrvwSQLaDFXBJILkX
2025-07-08 23:00:26,046 [analyzer] DEBUG: No analysis package specified, trying to detect it automagically.
2025-07-08 23:00:26,046 [analyzer] INFO: Automatically selected analysis package "ie"
2025-07-08 23:00:26,342 [analyzer] DEBUG: Started auxiliary module Curtain
2025-07-08 23:00:26,342 [analyzer] DEBUG: Started auxiliary module DbgView
2025-07-08 23:00:26,905 [analyzer] DEBUG: Started auxiliary module Disguise
2025-07-08 23:00:27,140 [analyzer] DEBUG: Loaded monitor into process with pid 512
2025-07-08 23:00:27,140 [analyzer] DEBUG: Started auxiliary module DumpTLSMasterSecrets
2025-07-08 23:00:27,140 [analyzer] DEBUG: Started auxiliary module Human
2025-07-08 23:00:27,140 [analyzer] DEBUG: Started auxiliary module InstallCertificate
2025-07-08 23:00:27,140 [analyzer] DEBUG: Started auxiliary module Reboot
2025-07-08 23:00:27,217 [analyzer] DEBUG: Started auxiliary module RecentFiles
2025-07-08 23:00:27,217 [analyzer] DEBUG: Started auxiliary module Screenshots
2025-07-08 23:00:27,233 [analyzer] DEBUG: Started auxiliary module Sysmon
2025-07-08 23:00:27,233 [analyzer] DEBUG: Started auxiliary module LoadZer0m0n
2025-07-08 23:00:27,233 [modules.packages.ie] INFO: Submitted file is missing extension, adding .html
2025-07-08 23:00:27,358 [lib.api.process] INFO: Successfully executed process from path 'C:\\Program Files\\Internet Explorer\\iexplore.exe' with arguments [u'C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\6a6eb56914be39291dc03d66e09efd2a5f4e93e83f73d85d38ead3be402bde01.html'] and pid 1456
2025-07-08 23:00:27,515 [analyzer] DEBUG: Loaded monitor into process with pid 1456
2025-07-08 23:00:29,125 [analyzer] DEBUG: Following legitimate IE11 process: "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1456 CREDAT:275457 /prefetch:2!
2025-07-08 23:00:29,203 [analyzer] INFO: Injected into process with pid 2064 and name u'iexplore.exe'
2025-07-08 23:00:29,265 [lib.api.process] ERROR: Failed to dump memory of 32-bit process with pid 2064.
2025-07-08 23:00:29,390 [analyzer] INFO: Added new file to list with pid 1456 and path C:\Users\Administrator\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{92A5F3C5-5C3E-11F0-8B03-6A4C24D117AF}.dat
2025-07-08 23:00:29,437 [analyzer] DEBUG: Loaded monitor into process with pid 2064
2025-07-08 23:00:29,437 [analyzer] INFO: Added new file to list with pid 1456 and path C:\Users\Administrator\AppData\Local\Temp\~DF28B1136DAE03A7E1.TMP
2025-07-08 23:00:29,671 [analyzer] DEBUG: Error resolving function mshtml!CDocument_write through our custom callback.
2025-07-08 23:00:29,671 [analyzer] DEBUG: Error resolving function mshtml!CElement_put_innerHTML through our custom callback.
2025-07-08 23:00:29,671 [analyzer] DEBUG: Error resolving function mshtml!CHyperlink_SetUrlComponent through our custom callback.
2025-07-08 23:00:29,671 [analyzer] DEBUG: Error resolving function mshtml!CIFrameElement_CreateElement through our custom callback.
2025-07-08 23:00:29,671 [analyzer] DEBUG: Error resolving function mshtml!CImgElement_put_src through our custom callback.
2025-07-08 23:00:29,671 [analyzer] DEBUG: Error resolving function mshtml!CScriptElement_put_src through our custom callback.
2025-07-08 23:00:29,671 [analyzer] DEBUG: Error resolving function mshtml!CWindow_AddTimeoutCode through our custom callback.
2025-07-08 23:00:29,687 [analyzer] DEBUG: Error resolving function mshtml!CDocument_write through our custom callback.
2025-07-08 23:00:29,687 [analyzer] DEBUG: Error resolving function mshtml!CElement_put_innerHTML through our custom callback.
2025-07-08 23:00:29,687 [analyzer] DEBUG: Error resolving function mshtml!CHyperlink_SetUrlComponent through our custom callback.
2025-07-08 23:00:29,687 [analyzer] DEBUG: Error resolving function mshtml!CIFrameElement_CreateElement through our custom callback.
2025-07-08 23:00:29,687 [analyzer] DEBUG: Error resolving function mshtml!CImgElement_put_src through our custom callback.
2025-07-08 23:00:29,687 [analyzer] DEBUG: Error resolving function mshtml!CScriptElement_put_src through our custom callback.
2025-07-08 23:00:29,687 [analyzer] DEBUG: Error resolving function mshtml!CWindow_AddTimeoutCode through our custom callback.
2025-07-08 23:00:29,953 [analyzer] INFO: Added new file to list with pid 1456 and path C:\Users\Administrator\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{92A5F3C7-5C3E-11F0-8B03-6A4C24D117AF}.dat
2025-07-08 23:00:29,967 [analyzer] INFO: Added new file to list with pid 1456 and path C:\Users\Administrator\AppData\Local\Temp\~DF3D02BE9B30CBF551.TMP
2025-07-08 23:00:30,015 [analyzer] DEBUG: Error resolving function mshtml!CDocument_write through our custom callback.
2025-07-08 23:00:30,015 [analyzer] DEBUG: Error resolving function mshtml!CElement_put_innerHTML through our custom callback.
2025-07-08 23:00:30,015 [analyzer] DEBUG: Error resolving function mshtml!CHyperlink_SetUrlComponent through our custom callback.
2025-07-08 23:00:30,015 [analyzer] DEBUG: Error resolving function mshtml!CIFrameElement_CreateElement through our custom callback.
2025-07-08 23:00:30,015 [analyzer] DEBUG: Error resolving function mshtml!CImgElement_put_src through our custom callback.
2025-07-08 23:00:30,015 [analyzer] DEBUG: Error resolving function mshtml!CScriptElement_put_src through our custom callback.
2025-07-08 23:00:30,015 [analyzer] DEBUG: Error resolving function mshtml!CWindow_AddTimeoutCode through our custom callback.
2025-07-08 23:00:30,203 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QZWG09X8\avatar[1].htm
2025-07-08 23:00:30,500 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PZWRF9A3\comment-reply.min[1].js
2025-07-08 23:00:30,500 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PZWRF9A3\style[1].css
2025-07-08 23:00:30,500 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PZWRF9A3\wp-embed.min[1].js
2025-07-08 23:00:30,500 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PZWRF9A3\style.min[1].css
2025-07-08 23:00:30,671 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EDCVLMVQ\neILzCirqoswsqX9zoKmNQ[1].woff
2025-07-08 23:00:30,717 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QZWG09X8\wp-emoji-release.min[1].js
2025-07-08 23:00:30,750 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EDCVLMVQ\bg-paper[1].jpg
2025-07-08 23:00:30,780 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WYZU3NA0\header-design[1].jpg
2025-07-08 23:00:30,780 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WYZU3NA0\socialMediaIcons[1].gif
2025-07-08 23:00:30,875 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QZWG09X8\title-stroke[1].gif
2025-07-08 23:00:30,905 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EDCVLMVQ\nav-bg[1].gif
2025-07-08 23:00:30,937 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QZWG09X8\border[1].gif
2025-07-08 23:00:30,937 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QZWG09X8\title-bg[1].gif
2025-07-08 23:00:30,937 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QZWG09X8\pagination-right[1].jpg
2025-07-08 23:00:35,515 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D
2025-07-08 23:00:35,515 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D
2025-07-08 23:00:35,530 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Temp\Cab6123.tmp
2025-07-08 23:00:35,530 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Temp\Tar6124.tmp
2025-07-08 23:00:35,655 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
2025-07-08 23:00:35,671 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
2025-07-08 23:00:35,687 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Temp\Cab61C1.tmp
2025-07-08 23:00:35,687 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Temp\Tar61D2.tmp
2025-07-08 23:00:35,717 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Temp\Cab61F2.tmp
2025-07-08 23:00:35,733 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Temp\Tar61F3.tmp
2025-07-08 23:00:35,812 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Temp\Cab6242.tmp
2025-07-08 23:00:35,812 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Temp\Tar6253.tmp
2025-07-08 23:00:35,875 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Temp\Cab6283.tmp
2025-07-08 23:00:35,875 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Temp\Tar6284.tmp
2025-07-08 23:00:35,953 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Temp\Cab62D3.tmp
2025-07-08 23:00:35,953 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Temp\Tar62D4.tmp
2025-07-08 23:00:36,000 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Temp\Cab6314.tmp
2025-07-08 23:00:36,000 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Temp\Tar6315.tmp
2025-07-08 23:00:36,078 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Temp\Cab6364.tmp
2025-07-08 23:00:36,078 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Temp\Tar6365.tmp
2025-07-08 23:00:36,125 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Temp\Cab6385.tmp
2025-07-08 23:00:36,125 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Temp\Tar6396.tmp
2025-07-08 23:00:36,203 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Temp\Cab63D5.tmp
2025-07-08 23:00:36,203 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Temp\Tar63D6.tmp
2025-07-08 23:00:36,250 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Temp\Cab6416.tmp
2025-07-08 23:00:36,265 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Temp\Tar6417.tmp
2025-07-08 23:00:36,342 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Temp\Cab6466.tmp
2025-07-08 23:00:36,342 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Temp\Tar6467.tmp
2025-07-08 23:00:36,390 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Temp\Cab64A6.tmp
2025-07-08 23:00:36,390 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Temp\Tar64A7.tmp
2025-07-08 23:00:36,467 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Temp\Cab64F6.tmp
2025-07-08 23:00:36,467 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Temp\Tar64F7.tmp
2025-07-08 23:00:36,515 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Temp\Cab6527.tmp
2025-07-08 23:00:36,530 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Temp\Tar6528.tmp
2025-07-08 23:00:36,592 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Temp\Cab6577.tmp
2025-07-08 23:00:36,608 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Temp\Tar6578.tmp
2025-07-08 23:00:36,655 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Temp\Cab65B8.tmp
2025-07-08 23:00:36,671 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Temp\Tar65B9.tmp
2025-07-08 23:00:36,765 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Temp\Cab6627.tmp
2025-07-08 23:00:36,780 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Temp\Tar6628.tmp
2025-07-08 23:00:36,875 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Temp\Cab6697.tmp
2025-07-08 23:00:36,890 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Temp\Tar6698.tmp
2025-07-08 23:00:36,967 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Temp\Cab66E7.tmp
2025-07-08 23:00:36,967 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Temp\Tar66E8.tmp
2025-07-08 23:00:37,015 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Temp\Cab6727.tmp
2025-07-08 23:00:37,030 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Temp\Tar6728.tmp
2025-07-08 23:00:37,125 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Temp\Cab6787.tmp
2025-07-08 23:00:37,125 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Temp\Tar6788.tmp
2025-07-08 23:00:37,203 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Temp\Cab67D7.tmp
2025-07-08 23:00:37,203 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Temp\Tar67E8.tmp
2025-07-08 23:00:37,312 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Temp\Cab6846.tmp
2025-07-08 23:00:37,312 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Temp\Tar6847.tmp
2025-07-08 23:00:37,390 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Temp\Cab6897.tmp
2025-07-08 23:00:37,390 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Temp\Tar6898.tmp
2025-07-08 23:00:37,500 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Temp\Cab6906.tmp
2025-07-08 23:00:37,500 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Temp\Tar6907.tmp
2025-07-08 23:00:37,562 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Temp\Cab6956.tmp
2025-07-08 23:00:37,578 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Temp\Tar6957.tmp
2025-07-08 23:00:37,671 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Temp\Cab69C5.tmp
2025-07-08 23:00:37,671 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Temp\Tar69C6.tmp
2025-07-08 23:00:37,750 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Temp\Cab6A06.tmp
2025-07-08 23:00:37,750 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Temp\Tar6A07.tmp
2025-07-08 23:00:37,842 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Temp\Cab6A66.tmp
2025-07-08 23:00:37,842 [analyzer] INFO: Added new file to list with pid 2064 and path C:\Users\Administrator\AppData\Local\Temp\Tar6A67.tmp
2025-07-08 23:00:56,390 [analyzer] INFO: Analysis timeout hit, terminating analysis.
2025-07-08 23:00:56,875 [analyzer] INFO: Terminating remaining processes before shutdown.
2025-07-08 23:00:56,875 [lib.api.process] INFO: Successfully terminated process with pid 1456.
2025-07-08 23:00:56,875 [lib.api.process] INFO: Successfully terminated process with pid 2064.
2025-07-08 23:00:56,905 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab61c1.tmp' does not exist, skip.
2025-07-08 23:00:56,905 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar6907.tmp' does not exist, skip.
2025-07-08 23:00:56,905 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar6396.tmp' does not exist, skip.
2025-07-08 23:00:56,905 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar64f7.tmp' does not exist, skip.
2025-07-08 23:00:56,905 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab64a6.tmp' does not exist, skip.
2025-07-08 23:00:56,921 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar62d4.tmp' does not exist, skip.
2025-07-08 23:00:56,921 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar6578.tmp' does not exist, skip.
2025-07-08 23:00:56,921 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar6788.tmp' does not exist, skip.
2025-07-08 23:00:56,921 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar6284.tmp' does not exist, skip.
2025-07-08 23:00:56,921 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar6528.tmp' does not exist, skip.
2025-07-08 23:00:56,921 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar6365.tmp' does not exist, skip.
2025-07-08 23:00:56,921 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar66e8.tmp' does not exist, skip.
2025-07-08 23:00:56,921 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar67e8.tmp' does not exist, skip.
2025-07-08 23:00:56,921 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab62d3.tmp' does not exist, skip.
2025-07-08 23:00:56,921 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab66e7.tmp' does not exist, skip.
2025-07-08 23:00:56,921 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab69c5.tmp' does not exist, skip.
2025-07-08 23:00:56,921 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab6627.tmp' does not exist, skip.
2025-07-08 23:00:56,921 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab63d5.tmp' does not exist, skip.
2025-07-08 23:00:56,937 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab6416.tmp' does not exist, skip.
2025-07-08 23:00:56,937 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab6956.tmp' does not exist, skip.
2025-07-08 23:00:56,937 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab6787.tmp' does not exist, skip.
2025-07-08 23:00:56,937 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\~df28b1136dae03a7e1.tmp' does not exist, skip.
2025-07-08 23:00:56,937 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab6a66.tmp' does not exist, skip.
2025-07-08 23:00:56,953 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab67d7.tmp' does not exist, skip.
2025-07-08 23:00:56,953 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar6728.tmp' does not exist, skip.
2025-07-08 23:00:56,953 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab6577.tmp' does not exist, skip.
2025-07-08 23:00:56,953 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\~df3d02be9b30cbf551.tmp' does not exist, skip.
2025-07-08 23:00:56,953 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar6417.tmp' does not exist, skip.
2025-07-08 23:00:56,953 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab6897.tmp' does not exist, skip.
2025-07-08 23:00:56,953 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab61f2.tmp' does not exist, skip.
2025-07-08 23:00:56,953 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar6898.tmp' does not exist, skip.
2025-07-08 23:00:56,953 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab6123.tmp' does not exist, skip.
2025-07-08 23:00:56,953 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab65b8.tmp' does not exist, skip.
2025-07-08 23:00:56,953 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar6315.tmp' does not exist, skip.
2025-07-08 23:00:56,953 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab6727.tmp' does not exist, skip.
2025-07-08 23:00:56,953 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab6906.tmp' does not exist, skip.
2025-07-08 23:00:56,967 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab64f6.tmp' does not exist, skip.
2025-07-08 23:00:56,967 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab6283.tmp' does not exist, skip.
2025-07-08 23:00:56,967 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab6697.tmp' does not exist, skip.
2025-07-08 23:00:56,967 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar61f3.tmp' does not exist, skip.
2025-07-08 23:00:56,967 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab6242.tmp' does not exist, skip.
2025-07-08 23:00:56,967 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab6364.tmp' does not exist, skip.
2025-07-08 23:00:56,967 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar6a67.tmp' does not exist, skip.
2025-07-08 23:00:56,967 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar6124.tmp' does not exist, skip.
2025-07-08 23:00:56,967 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar69c6.tmp' does not exist, skip.
2025-07-08 23:00:56,967 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab6466.tmp' does not exist, skip.
2025-07-08 23:00:56,967 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar6628.tmp' does not exist, skip.
2025-07-08 23:00:56,967 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar65b9.tmp' does not exist, skip.
2025-07-08 23:00:56,983 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar6698.tmp' does not exist, skip.
2025-07-08 23:00:56,983 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab6314.tmp' does not exist, skip.
2025-07-08 23:00:56,983 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar64a7.tmp' does not exist, skip.
2025-07-08 23:00:56,983 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar63d6.tmp' does not exist, skip.
2025-07-08 23:00:56,983 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar6a07.tmp' does not exist, skip.
2025-07-08 23:00:56,983 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar6847.tmp' does not exist, skip.
2025-07-08 23:00:56,983 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab6846.tmp' does not exist, skip.
2025-07-08 23:00:57,000 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar6467.tmp' does not exist, skip.
2025-07-08 23:00:57,015 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar6253.tmp' does not exist, skip.
2025-07-08 23:00:57,015 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab6385.tmp' does not exist, skip.
2025-07-08 23:00:57,030 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar6957.tmp' does not exist, skip.
2025-07-08 23:00:57,030 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab6a06.tmp' does not exist, skip.
2025-07-08 23:00:57,030 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar61d2.tmp' does not exist, skip.
2025-07-08 23:00:57,030 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab6527.tmp' does not exist, skip.
2025-07-08 23:00:57,030 [analyzer] INFO: Analysis completed.

Cuckoo Log

2025-07-13 07:01:25,410 [cuckoo.core.scheduler] INFO: Task #6697078: acquired machine win7x6422 (label=win7x6422)
2025-07-13 07:01:25,410 [cuckoo.core.resultserver] DEBUG: Now tracking machine 192.168.168.222 for task #6697078
2025-07-13 07:01:25,671 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 3025628 (interface=vboxnet0, host=192.168.168.222)
2025-07-13 07:01:25,711 [cuckoo.machinery.virtualbox] DEBUG: Starting vm win7x6422
2025-07-13 07:01:26,524 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine win7x6422 to vmcloak
2025-07-13 07:03:31,856 [cuckoo.core.guest] INFO: Starting analysis #6697078 on guest (id=win7x6422, ip=192.168.168.222)
2025-07-13 07:03:32,861 [cuckoo.core.guest] DEBUG: win7x6422: not ready yet
2025-07-13 07:03:37,884 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.10 (id=win7x6422, ip=192.168.168.222)
2025-07-13 07:03:37,965 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=win7x6422, ip=192.168.168.222, monitor=latest, size=6660546)
2025-07-13 07:03:39,281 [cuckoo.core.resultserver] DEBUG: Task #6697078: live log analysis.log initialized.
2025-07-13 07:03:40,373 [cuckoo.core.resultserver] DEBUG: Task #6697078 is sending a BSON stream
2025-07-13 07:03:40,749 [cuckoo.core.resultserver] DEBUG: Task #6697078 is sending a BSON stream
2025-07-13 07:03:41,634 [cuckoo.core.resultserver] DEBUG: Task #6697078: File upload for 'shots/0001.jpg'
2025-07-13 07:03:41,652 [cuckoo.core.resultserver] DEBUG: Task #6697078 uploaded file length: 133464
2025-07-13 07:03:42,690 [cuckoo.core.resultserver] DEBUG: Task #6697078 is sending a BSON stream
2025-07-13 07:03:43,757 [cuckoo.core.resultserver] DEBUG: Task #6697078: File upload for 'shots/0002.jpg'
2025-07-13 07:03:43,760 [cuckoo.core.resultserver] DEBUG: Task #6697078 uploaded file length: 24441
2025-07-13 07:03:44,863 [cuckoo.core.resultserver] DEBUG: Task #6697078: File upload for 'shots/0003.jpg'
2025-07-13 07:03:44,876 [cuckoo.core.resultserver] DEBUG: Task #6697078 uploaded file length: 113529
2025-07-13 07:03:53,933 [cuckoo.core.guest] DEBUG: win7x6422: analysis #6697078 still processing
2025-07-13 07:04:09,064 [cuckoo.core.guest] DEBUG: win7x6422: analysis #6697078 still processing
2025-07-13 07:04:09,903 [cuckoo.core.resultserver] DEBUG: Task #6697078: File upload for 'curtain/1752008456.59.curtain.log'
2025-07-13 07:04:09,906 [cuckoo.core.resultserver] DEBUG: Task #6697078 uploaded file length: 36
2025-07-13 07:04:10,140 [cuckoo.core.resultserver] DEBUG: Task #6697078: File upload for 'sysmon/1752008456.84.sysmon.xml'
2025-07-13 07:04:10,172 [cuckoo.core.resultserver] DEBUG: Task #6697078 uploaded file length: 1683348
2025-07-13 07:04:10,180 [cuckoo.core.resultserver] DEBUG: Task #6697078: File upload for 'files/136fdfbe16064de5_nav-bg[1].gif'
2025-07-13 07:04:10,182 [cuckoo.core.resultserver] DEBUG: Task #6697078 uploaded file length: 54
2025-07-13 07:04:10,198 [cuckoo.core.resultserver] DEBUG: Task #6697078: File upload for 'files/aeb40c559d97e7bb_comment-reply.min[1].js'
2025-07-13 07:04:10,200 [cuckoo.core.resultserver] DEBUG: Task #6697078 uploaded file length: 2160
2025-07-13 07:04:10,207 [cuckoo.core.resultserver] DEBUG: Task #6697078: File upload for 'files/f21ab8b0b8ecd308_socialmediaicons[1].gif'
2025-07-13 07:04:10,209 [cuckoo.core.resultserver] DEBUG: Task #6697078 uploaded file length: 6609
2025-07-13 07:04:10,216 [cuckoo.core.resultserver] DEBUG: Task #6697078: File upload for 'files/94f80c87390a84a3_style.min[1].css'
2025-07-13 07:04:10,219 [cuckoo.core.resultserver] DEBUG: Task #6697078 uploaded file length: 25245
2025-07-13 07:04:10,223 [cuckoo.core.resultserver] DEBUG: Task #6697078: File upload for 'files/9a5b215dd80908fd_header-design[1].jpg'
2025-07-13 07:04:10,226 [cuckoo.core.resultserver] DEBUG: Task #6697078 uploaded file length: 16445
2025-07-13 07:04:10,230 [cuckoo.core.resultserver] DEBUG: Task #6697078: File upload for 'files/9e17cb15dd75bbbd_avatar[1].htm'
2025-07-13 07:04:10,232 [cuckoo.core.resultserver] DEBUG: Task #6697078 uploaded file length: 162
2025-07-13 07:04:10,236 [cuckoo.core.resultserver] DEBUG: Task #6697078: File upload for 'files/07d3256f864b4d31_title-stroke[1].gif'
2025-07-13 07:04:10,245 [cuckoo.core.resultserver] DEBUG: Task #6697078 uploaded file length: 68
2025-07-13 07:04:10,248 [cuckoo.core.resultserver] DEBUG: Task #6697078: File upload for 'files/96bcec06264976f3_2d85f72862b55c4eadd9e66e06947f3d'
2025-07-13 07:04:10,250 [cuckoo.core.resultserver] DEBUG: Task #6697078 uploaded file length: 1391
2025-07-13 07:04:10,253 [cuckoo.core.resultserver] DEBUG: Task #6697078: File upload for 'files/37c5f58f12814dd0_wp-embed.min[1].js'
2025-07-13 07:04:10,256 [cuckoo.core.resultserver] DEBUG: Task #6697078 uploaded file length: 1443
2025-07-13 07:04:10,259 [cuckoo.core.resultserver] DEBUG: Task #6697078: File upload for 'files/7fb927590c378ac0_neilzcirqoswsqx9zokmnq[1].woff'
2025-07-13 07:04:10,262 [cuckoo.core.resultserver] DEBUG: Task #6697078 uploaded file length: 42056
2025-07-13 07:04:10,268 [cuckoo.core.resultserver] DEBUG: Task #6697078: File upload for 'files/8114d5105305efe0_bg-paper[1].jpg'
2025-07-13 07:04:10,270 [cuckoo.core.resultserver] DEBUG: Task #6697078 uploaded file length: 5257
2025-07-13 07:04:10,273 [cuckoo.core.resultserver] DEBUG: Task #6697078: File upload for 'files/2b14536d83d1f3d1_2d85f72862b55c4eadd9e66e06947f3d'
2025-07-13 07:04:10,275 [cuckoo.core.resultserver] DEBUG: Task #6697078 uploaded file length: 192
2025-07-13 07:04:10,278 [cuckoo.core.resultserver] DEBUG: Task #6697078: File upload for 'files/de757ecd04da709e_pagination-right[1].jpg'
2025-07-13 07:04:10,280 [cuckoo.core.resultserver] DEBUG: Task #6697078 uploaded file length: 954
2025-07-13 07:04:10,283 [cuckoo.core.resultserver] DEBUG: Task #6697078: File upload for 'files/d9160bf5ee2c9435_wp-emoji-release.min[1].js'
2025-07-13 07:04:10,285 [cuckoo.core.resultserver] DEBUG: Task #6697078 uploaded file length: 11951
2025-07-13 07:04:10,288 [cuckoo.core.resultserver] DEBUG: Task #6697078: File upload for 'files/4c847e0c28733ed3_94308059b57b3142e455b38a6eb92015'
2025-07-13 07:04:10,291 [cuckoo.core.resultserver] DEBUG: Task #6697078 uploaded file length: 73513
2025-07-13 07:04:10,298 [cuckoo.core.resultserver] DEBUG: Task #6697078: File upload for 'files/2b616c46714678ce_{92a5f3c7-5c3e-11f0-8b03-6a4c24d117af}.dat'
2025-07-13 07:04:10,301 [cuckoo.core.resultserver] DEBUG: Task #6697078 uploaded file length: 5120
2025-07-13 07:04:10,306 [cuckoo.core.resultserver] DEBUG: Task #6697078: File upload for 'files/5ceb71a6af5a43f5_recoverystore.{92a5f3c5-5c3e-11f0-8b03-6a4c24d117af}.dat'
2025-07-13 07:04:10,308 [cuckoo.core.resultserver] DEBUG: Task #6697078 uploaded file length: 5632
2025-07-13 07:04:10,312 [cuckoo.core.resultserver] DEBUG: Task #6697078: File upload for 'files/d3baf779e3869e38_style[1].css'
2025-07-13 07:04:10,314 [cuckoo.core.resultserver] DEBUG: Task #6697078 uploaded file length: 15839
2025-07-13 07:04:10,316 [cuckoo.core.resultserver] DEBUG: Task #6697078: File upload for 'files/78cb89759c32a11a_94308059b57b3142e455b38a6eb92015'
2025-07-13 07:04:10,318 [cuckoo.core.resultserver] DEBUG: Task #6697078 uploaded file length: 344
2025-07-13 07:04:10,321 [cuckoo.core.resultserver] DEBUG: Task #6697078: File upload for 'files/97bea62e08739bfd_border[1].gif'
2025-07-13 07:04:10,323 [cuckoo.core.resultserver] DEBUG: Task #6697078 uploaded file length: 43
2025-07-13 07:04:10,325 [cuckoo.core.resultserver] DEBUG: Task #6697078: File upload for 'files/2a4fa9ee61ee699c_title-bg[1].gif'
2025-07-13 07:04:10,327 [cuckoo.core.resultserver] DEBUG: Task #6697078 uploaded file length: 824
2025-07-13 07:04:10,632 [cuckoo.core.resultserver] DEBUG: Task #6697078: File upload for 'shots/0004.jpg'
2025-07-13 07:04:10,645 [cuckoo.core.resultserver] DEBUG: Task #6697078 uploaded file length: 133464
2025-07-13 07:04:10,658 [cuckoo.core.resultserver] DEBUG: Task #6697078 had connection reset for <Context for LOG>
2025-07-13 07:04:12,077 [cuckoo.core.guest] INFO: win7x6422: analysis completed successfully
2025-07-13 07:04:12,092 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Redsocks
2025-07-13 07:04:12,120 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer
2025-07-13 07:04:12,950 [cuckoo.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label win7x6422 to path /srv/cuckoo/cwd/storage/analyses/6697078/memory.dmp
2025-07-13 07:04:12,951 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm win7x6422
2025-07-13 07:07:00,931 [cuckoo.core.resultserver] DEBUG: Stopped tracking machine 192.168.168.222 for task #6697078
2025-07-13 07:07:01,306 [cuckoo.core.scheduler] DEBUG: Released database task #6697078
2025-07-13 07:07:01,321 [cuckoo.core.scheduler] INFO: Task #6697078: analysis procedure completed

Signatures

Yara rule detected for file (1 event)
description Generic WScript dropper 3 rule dropper_generic_wscript3
Allocates read-write-execute memory (usually to unpack itself) (50 out of 258 events)
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 1456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefd858000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefd858000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefd858000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefd31f000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefd2f6000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefd2f6000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefd2f6000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefab2b000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef34f4000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefc764000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef99fc000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef9a14000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef997b000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3254000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1456
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000002fc0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefa4ca000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefd4fb000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefd4fb000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefd4fb000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefd4fb000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefcec1000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef23b2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef470e000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefcdcf000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefcdf8000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2064
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00096000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2064
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75491000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2064
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7544c000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2064
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7544c000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2064
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7544c000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2064
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75447000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2064
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75447000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2064
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75447000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2064
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x746b1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2064
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75b90000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2064
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75b90000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2064
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75b90000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2064
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x756c0000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2064
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75591000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2064
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75ae1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2064
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75531000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2064
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75531000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2064
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75531000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2064
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75531000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2064
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75531000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2064
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75531000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2064
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75531000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2064
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75531000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2064
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75531000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2064
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75531000
process_handle: 0xffffffff
1 0 0
Creates executable files on the filesystem (3 events)
file C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QZWG09X8\wp-emoji-release.min[1].js
file C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PZWRF9A3\comment-reply.min[1].js
file C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PZWRF9A3\wp-embed.min[1].js
Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2064
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 16 (PAGE_EXECUTE)
base_address: 0x05820000
process_handle: 0xffffffff
1 0 0
Uses Windows utilities for basic Windows functionality (1 event)
cmdline "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1456 CREDAT:275457 /prefetch:2
Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)
Process injection Process 1456 resumed a thread in remote process 2064
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x0000000000000374
suspend_count: 1
process_identifier: 2064
1 0 0
File has been identified by 8 AntiVirus engine on IRMA as malicious (8 events)
G Data Antivirus (Windows) Virus: GT:JS.Acsogenixx.686.CCF68F34 (Engine A)
Avast Core Security (Linux) JS:Agent-ELQ [Trj]
WithSecure (Linux) Malware.JS/Agent.MRCS
eScan Antivirus (Linux) GT:JS.Acsogenixx.686.CCF68F34(DB)
ESET Security (Windows) JS/Agent.RCS trojan
Sophos Anti-Virus (Linux) Troj/JSInject-V
Bitdefender Antivirus (Linux) GT:JS.Acsogenixx.686.CCF68F34
Emsisoft Commandline Scanner (Windows) GT:JS.Acsogenixx.686.CCF68F34 (B)
File has been identified by 29 AntiVirus engines on VirusTotal as malicious (29 events)
CTX html.unknown.acsogenixx
ALYac GT:JS.Acsogenixx.686.CCF68F34
VIPRE GT:JS.Acsogenixx.686.CCF68F34
Arcabit GT:JS.Acsogenixx.686.CCF68F34
Symantec ISB.Heuristic!gen119
ESET-NOD32 JS/Agent.RCS
Avast JS:Agent-ELQ [Trj]
Cynet Malicious (score: 99)
BitDefender GT:JS.Acsogenixx.686.CCF68F34
NANO-Antivirus Trojan.Script.Redirector.ktxcpl
MicroWorld-eScan GT:JS.Acsogenixx.686.CCF68F34
Rising Trojan.Agent/JS!1.1024F (CLASSIC)
Emsisoft GT:JS.Acsogenixx.686.CCF68F34 (B)
F-Secure Malware.JS/Agent.MRCS
Zillya Trojan.Agent.JS.38
Sophos Troj/JSInject-V
Ikarus Trojan.JS.Agent
Google Detected
Avira JS/Agent.MRCS
Microsoft Trojan:Script/Wacatac.B!ml
ZoneAlarm Troj/JSInject-V
GData Script.Trojan.JSRedirector.D
Varist JS/Agent.CAW.gen!Eldorado
AhnLab-V3 Trojan/JS.Agent.SC196779
Tencent Trojan.JS.Agent.505219
huorong Trojan/JS.Agent.ee
MaxSecure Trojan.W32.cryxos.13238
Fortinet JS/Phishing.1369!tr
AVG JS:Agent-ELQ [Trj]
Screenshots
Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action VT Location
No hosts contacted.
Cuckoo

We're processing your submission... This could take a few seconds.