Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

5bf1a54379...7e7.js

windows7-x64

10

5bf1a54379...7e7.js

windows10-2004-x64

10

Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/01/2024, 02:51 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5bf1a543796637bd57aed27f8fcf67e7.js

  • Size

    52KB

  • MD5

    5bf1a543796637bd57aed27f8fcf67e7

  • SHA1

    ba263f1a5157a912e7a0984602ce910d97366b8b

  • SHA256

    1e60267536edbee8cc12a8757fe147727bf4513b6e4ae7fb1329ccf95344933e

  • SHA512

    6f0306906716f46a9fa82d3ee1876f36abbe999ba7fcfdc2cb27653cf902c59d2e83d7f010c261b836cff394770df4ac208d43ef709287f7701384c8874b245b

  • SSDEEP

    768:M13RwPVMMh26+la3RnMf73Ibq5ajmsdPwieARXXRi1ClK6RJ+3l3lrIOwkxb:Q3RwpY6+la3BS7TypwZARnqcbOweb

Score
10/10
vjw0rmpersistencetrojanworm

Malware Config

Signatures

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

    trojanwormvjw0rm
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 4 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\5bf1a543796637bd57aed27f8fcf67e7.js
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1500
    • C:\Windows\System32\wscript.exe
      "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\BcZlevrPxo.js"
      2⤵
      • Drops startup file
      • Adds Run key to start application
      PID:4732
    • C:\Windows\System32\wscript.exe
      "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\take90.vbs"
      2⤵
      • Drops startup file
      • Adds Run key to start application
      PID:4984

Network

  • flag-us
    DNS
    myroyailrubin2019.duia.ro
    wscript.exe
    Remote address:
    8.8.8.8:53
    Request
    myroyailrubin2019.duia.ro
    IN A
    Response
  • flag-us
    DNS
    desireblex.ddns.net
    wscript.exe
    Remote address:
    8.8.8.8:53
    Request
    desireblex.ddns.net
    IN A
    Response
    desireblex.ddns.net
    IN A
    0.0.0.0
  • flag-us
    DNS
    3.181.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    3.181.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    9.228.82.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    9.228.82.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    179.178.17.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    179.178.17.96.in-addr.arpa
    IN PTR
    Response
    179.178.17.96.in-addr.arpa
    IN PTR
    a96-17-178-179deploystaticakamaitechnologiescom
  • flag-us
    DNS
    208.194.73.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    208.194.73.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    41.110.16.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    41.110.16.96.in-addr.arpa
    IN PTR
    Response
    41.110.16.96.in-addr.arpa
    IN PTR
    a96-16-110-41deploystaticakamaitechnologiescom
  • flag-us
    DNS
    myroyailrubin2019.duia.ro
    wscript.exe
    Remote address:
    8.8.8.8:53
    Request
    myroyailrubin2019.duia.ro
    IN A
    Response
  • flag-us
    DNS
    86.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    86.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    2.136.104.51.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    2.136.104.51.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    myroyailrubin2019.duia.ro
    wscript.exe
    Remote address:
    8.8.8.8:53
    Request
    myroyailrubin2019.duia.ro
    IN A
    Response
  • flag-us
    DNS
    206.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    206.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    myroyailrubin2019.duia.ro
    wscript.exe
    Remote address:
    8.8.8.8:53
    Request
    myroyailrubin2019.duia.ro
    IN A
    Response
  • flag-us
    DNS
    myroyailrubin2019.duia.ro
    wscript.exe
    Remote address:
    8.8.8.8:53
    Request
    myroyailrubin2019.duia.ro
    IN A
    Response
  • flag-us
    DNS
    104.241.123.92.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    104.241.123.92.in-addr.arpa
    IN PTR
    Response
    104.241.123.92.in-addr.arpa
    IN PTR
    a92-123-241-104deploystaticakamaitechnologiescom
  • flag-us
    DNS
    119.110.54.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    119.110.54.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    217.135.221.88.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    217.135.221.88.in-addr.arpa
    IN PTR
    Response
    217.135.221.88.in-addr.arpa
    IN PTR
    a88-221-135-217deploystaticakamaitechnologiescom
  • flag-us
    DNS
    myroyailrubin2019.duia.ro
    wscript.exe
    Remote address:
    8.8.8.8:53
    Request
    myroyailrubin2019.duia.ro
    IN A
    Response
  • flag-us
    DNS
    199.178.17.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    199.178.17.96.in-addr.arpa
    IN PTR
    Response
    199.178.17.96.in-addr.arpa
    IN PTR
    a96-17-178-199deploystaticakamaitechnologiescom
  • flag-us
    DNS
    myroyailrubin2019.duia.ro
    wscript.exe
    Remote address:
    8.8.8.8:53
    Request
    myroyailrubin2019.duia.ro
    IN A
    Response
  • flag-us
    DNS
    myroyailrubin2019.duia.ro
    wscript.exe
    Remote address:
    8.8.8.8:53
    Request
    myroyailrubin2019.duia.ro
    IN A
    Response
  • flag-us
    DNS
    18.134.221.88.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    18.134.221.88.in-addr.arpa
    IN PTR
    Response
    18.134.221.88.in-addr.arpa
    IN PTR
    a88-221-134-18deploystaticakamaitechnologiescom
  • flag-us
    DNS
    myroyailrubin2019.duia.ro
    wscript.exe
    Remote address:
    8.8.8.8:53
    Request
    myroyailrubin2019.duia.ro
    IN A
    Response
  • flag-us
    DNS
    myroyailrubin2019.duia.ro
    wscript.exe
    Remote address:
    8.8.8.8:53
    Request
    myroyailrubin2019.duia.ro
    IN A
    Response
  • flag-us
    DNS
    myroyailrubin2019.duia.ro
    wscript.exe
    Remote address:
    8.8.8.8:53
    Request
    myroyailrubin2019.duia.ro
    IN A
    Response
  • flag-us
    DNS
    myroyailrubin2019.duia.ro
    wscript.exe
    Remote address:
    8.8.8.8:53
    Request
    myroyailrubin2019.duia.ro
    IN A
    Response
  • flag-us
    DNS
    176.178.17.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    176.178.17.96.in-addr.arpa
    IN PTR
    Response
    176.178.17.96.in-addr.arpa
    IN PTR
    a96-17-178-176deploystaticakamaitechnologiescom
  • flag-us
    DNS
    176.178.17.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    176.178.17.96.in-addr.arpa
    IN PTR
    Response
    176.178.17.96.in-addr.arpa
    IN PTR
    a96-17-178-176deploystaticakamaitechnologiescom
  • flag-us
    DNS
    205.47.74.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    205.47.74.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    205.47.74.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    205.47.74.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    myroyailrubin2019.duia.ro
    wscript.exe
    Remote address:
    8.8.8.8:53
    Request
    myroyailrubin2019.duia.ro
    IN A
    Response
  • flag-us
    DNS
    myroyailrubin2019.duia.ro
    wscript.exe
    Remote address:
    8.8.8.8:53
    Request
    myroyailrubin2019.duia.ro
    IN A
    Response
  • flag-us
    DNS
    myroyailrubin2019.duia.ro
    wscript.exe
    Remote address:
    8.8.8.8:53
    Request
    myroyailrubin2019.duia.ro
    IN A
    Response
  • flag-us
    DNS
    myroyailrubin2019.duia.ro
    wscript.exe
    Remote address:
    8.8.8.8:53
    Request
    myroyailrubin2019.duia.ro
    IN A
    Response
  • flag-us
    DNS
    myroyailrubin2019.duia.ro
    wscript.exe
    Remote address:
    8.8.8.8:53
    Request
    myroyailrubin2019.duia.ro
    IN A
    Response
  • flag-us
    DNS
    myroyailrubin2019.duia.ro
    wscript.exe
    Remote address:
    8.8.8.8:53
    Request
    myroyailrubin2019.duia.ro
    IN A
    Response
  • flag-us
    DNS
    11.227.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    11.227.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    11.227.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    11.227.111.52.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    myroyailrubin2019.duia.ro
    wscript.exe
    Remote address:
    8.8.8.8:53
    Request
    myroyailrubin2019.duia.ro
    IN A
    Response
  • flag-us
    DNS
    myroyailrubin2019.duia.ro
    wscript.exe
    Remote address:
    8.8.8.8:53
    Request
    myroyailrubin2019.duia.ro
    IN A
    Response
  • flag-us
    DNS
    myroyailrubin2019.duia.ro
    wscript.exe
    Remote address:
    8.8.8.8:53
    Request
    myroyailrubin2019.duia.ro
    IN A
    Response
  • flag-us
    DNS
    tse1.mm.bing.net
    Remote address:
    8.8.8.8:53
    Request
    tse1.mm.bing.net
    IN A
    Response
    tse1.mm.bing.net
    IN CNAME
    mm-mm.bing.net.trafficmanager.net
    mm-mm.bing.net.trafficmanager.net
    IN CNAME
    dual-a-0001.a-msedge.net
    dual-a-0001.a-msedge.net
    IN A
    204.79.197.200
    dual-a-0001.a-msedge.net
    IN A
    13.107.21.200
  • flag-us
    DNS
    Remote address:
    8.8.8.8:53
    Response
    tse1.mm.bing.net
    IN CNAME
    mm-mm.bing.net.trafficmanager.net
    mm-mm.bing.net.trafficmanager.net
    IN CNAME
    dual-a-0001.a-msedge.net
    dual-a-0001.a-msedge.net
    IN A
    204.79.197.200
    dual-a-0001.a-msedge.net
    IN A
    13.107.21.200
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317301691_1QJ97KE46ORIIETXS&pid=21.2&w=1080&h=1920&c=4
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239317301691_1QJ97KE46ORIIETXS&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 133232
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: D9BE38BC60A845DCA7CD30F3B2F5DCE2 Ref B: LON04EDGE0606 Ref C: 2024-01-15T02:53:38Z
    date: Mon, 15 Jan 2024 02:53:38 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317301493_1LBG6KMWNFIA52WWP&pid=21.2&w=1080&h=1920&c=4
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239317301493_1LBG6KMWNFIA52WWP&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317301282_1QSYIXXV2WWSLPKD1&pid=21.2&w=1920&h=1080&c=4
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239317301282_1QSYIXXV2WWSLPKD1&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239339388050_13LHMV8LNZUBG68MF&pid=21.2&w=1920&h=1080&c=4
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239339388050_13LHMV8LNZUBG68MF&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317301060_1R4MHRP0LUJX09GMU&pid=21.2&w=1920&h=1080&c=4
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239317301060_1R4MHRP0LUJX09GMU&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
  • flag-us
    DNS
    myroyailrubin2019.duia.ro
    wscript.exe
    Remote address:
    8.8.8.8:53
    Request
    myroyailrubin2019.duia.ro
    IN A
    Response
  • flag-us
    DNS
    myroyailrubin2019.duia.ro
    wscript.exe
    Remote address:
    8.8.8.8:53
    Request
    myroyailrubin2019.duia.ro
    IN A
    Response
  • flag-us
    DNS
    myroyailrubin2019.duia.ro
    wscript.exe
    Remote address:
    8.8.8.8:53
    Request
    myroyailrubin2019.duia.ro
    IN A
    Response
  • flag-us
    DNS
    myroyailrubin2019.duia.ro
    wscript.exe
    Remote address:
    8.8.8.8:53
    Request
    myroyailrubin2019.duia.ro
    IN A
  • flag-us
    DNS
    myroyailrubin2019.duia.ro
    wscript.exe
    Remote address:
    8.8.8.8:53
    Request
    myroyailrubin2019.duia.ro
    IN A
    Response
  • flag-us
    DNS
    wscript.exe
    Remote address:
    8.8.8.8:53
    Response
  • flag-us
    DNS
    myroyailrubin2019.duia.ro
    wscript.exe
    Remote address:
    8.8.8.8:53
    Request
    myroyailrubin2019.duia.ro
    IN A
    Response
  • flag-us
    DNS
    myroyailrubin2019.duia.ro
    wscript.exe
    Remote address:
    8.8.8.8:53
    Request
    myroyailrubin2019.duia.ro
    IN A
    Response
  • flag-us
    DNS
    myroyailrubin2019.duia.ro
    wscript.exe
    Remote address:
    8.8.8.8:53
    Request
    myroyailrubin2019.duia.ro
    IN A
    Response
  • flag-us
    DNS
    myroyailrubin2019.duia.ro
    wscript.exe
    Remote address:
    8.8.8.8:53
    Request
    myroyailrubin2019.duia.ro
    IN A
    Response
  • flag-us
    DNS
    myroyailrubin2019.duia.ro
    wscript.exe
    Remote address:
    8.8.8.8:53
    Request
    myroyailrubin2019.duia.ro
    IN A
    Response
  • flag-us
    DNS
    myroyailrubin2019.duia.ro
    wscript.exe
    Remote address:
    8.8.8.8:53
    Request
    myroyailrubin2019.duia.ro
    IN A
    Response
  • 204.79.197.200:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
     8.3kB
     15
    14
  • 204.79.197.200:443
    https://tse1.mm.bing.net/th?id=OADD2.10239317301060_1R4MHRP0LUJX09GMU&pid=21.2&w=1920&h=1080&c=4
    tls, http2
    30.5kB
     835.2kB
     606
    615

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317301691_1QJ97KE46ORIIETXS&pid=21.2&w=1080&h=1920&c=4

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317301493_1LBG6KMWNFIA52WWP&pid=21.2&w=1080&h=1920&c=4

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317301282_1QSYIXXV2WWSLPKD1&pid=21.2&w=1920&h=1080&c=4

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239339388050_13LHMV8LNZUBG68MF&pid=21.2&w=1920&h=1080&c=4

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317301060_1R4MHRP0LUJX09GMU&pid=21.2&w=1920&h=1080&c=4

    HTTP Response

    200
  • 204.79.197.200:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
     8.3kB
     15
    14
  • 204.79.197.200:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
     8.3kB
     15
    14
  • 204.79.197.200:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
     8.3kB
     15
    14
  • 8.8.8.8:53
    myroyailrubin2019.duia.ro
    dns
    wscript.exe
    71 B
     127 B
     1
    1

    DNS Request

    myroyailrubin2019.duia.ro

  • 8.8.8.8:53
    desireblex.ddns.net
    dns
    wscript.exe
    65 B
     81 B
     1
    1

    DNS Request

    desireblex.ddns.net

    DNS Response

    0.0.0.0

  • 8.8.8.8:53
    3.181.190.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    3.181.190.20.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    9.228.82.20.in-addr.arpa
    dns
    70 B
     156 B
     1
    1

    DNS Request

    9.228.82.20.in-addr.arpa

  • 8.8.8.8:53
    179.178.17.96.in-addr.arpa
    dns
    72 B
     137 B
     1
    1

    DNS Request

    179.178.17.96.in-addr.arpa

  • 8.8.8.8:53
    208.194.73.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    208.194.73.20.in-addr.arpa

  • 8.8.8.8:53
    41.110.16.96.in-addr.arpa
    dns
    71 B
     135 B
     1
    1

    DNS Request

    41.110.16.96.in-addr.arpa

  • 8.8.8.8:53
    myroyailrubin2019.duia.ro
    dns
    wscript.exe
    71 B
     127 B
     1
    1

    DNS Request

    myroyailrubin2019.duia.ro

  • 8.8.8.8:53
    86.23.85.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    86.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    2.136.104.51.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    2.136.104.51.in-addr.arpa

  • 8.8.8.8:53
    myroyailrubin2019.duia.ro
    dns
    wscript.exe
    71 B
     127 B
     1
    1

    DNS Request

    myroyailrubin2019.duia.ro

  • 8.8.8.8:53
    206.23.85.13.in-addr.arpa
    dns
    71 B
     145 B
     1
    1

    DNS Request

    206.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    myroyailrubin2019.duia.ro
    dns
    wscript.exe
    71 B
     127 B
     1
    1

    DNS Request

    myroyailrubin2019.duia.ro

  • 8.8.8.8:53
    myroyailrubin2019.duia.ro
    dns
    wscript.exe
    71 B
     127 B
     1
    1

    DNS Request

    myroyailrubin2019.duia.ro

  • 8.8.8.8:53
    104.241.123.92.in-addr.arpa
    dns
    73 B
     139 B
     1
    1

    DNS Request

    104.241.123.92.in-addr.arpa

  • 8.8.8.8:53
    119.110.54.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    119.110.54.20.in-addr.arpa

  • 8.8.8.8:53
    217.135.221.88.in-addr.arpa
    dns
    73 B
     139 B
     1
    1

    DNS Request

    217.135.221.88.in-addr.arpa

  • 8.8.8.8:53
    myroyailrubin2019.duia.ro
    dns
    wscript.exe
    71 B
     127 B
     1
    1

    DNS Request

    myroyailrubin2019.duia.ro

  • 8.8.8.8:53
    199.178.17.96.in-addr.arpa
    dns
    72 B
     137 B
     1
    1

    DNS Request

    199.178.17.96.in-addr.arpa

  • 8.8.8.8:53
    myroyailrubin2019.duia.ro
    dns
    wscript.exe
    71 B
     127 B
     1
    1

    DNS Request

    myroyailrubin2019.duia.ro

  • 8.8.8.8:53
    myroyailrubin2019.duia.ro
    dns
    wscript.exe
    71 B
     127 B
     1
    1

    DNS Request

    myroyailrubin2019.duia.ro

  • 8.8.8.8:53
    18.134.221.88.in-addr.arpa
    dns
    72 B
     137 B
     1
    1

    DNS Request

    18.134.221.88.in-addr.arpa

  • 8.8.8.8:53
    myroyailrubin2019.duia.ro
    dns
    wscript.exe
    142 B
     254 B
     2
    2

    DNS Request

    myroyailrubin2019.duia.ro

    DNS Request

    myroyailrubin2019.duia.ro

  • 8.8.8.8:53
    myroyailrubin2019.duia.ro
    dns
    wscript.exe
    142 B
     254 B
     2
    2

    DNS Request

    myroyailrubin2019.duia.ro

    DNS Request

    myroyailrubin2019.duia.ro

  • 8.8.8.8:53
    176.178.17.96.in-addr.arpa
    dns
    144 B
     274 B
     2
    2

    DNS Request

    176.178.17.96.in-addr.arpa

    DNS Request

    176.178.17.96.in-addr.arpa

  • 8.8.8.8:53
    205.47.74.20.in-addr.arpa
    dns
    142 B
     314 B
     2
    2

    DNS Request

    205.47.74.20.in-addr.arpa

    DNS Request

    205.47.74.20.in-addr.arpa

  • 8.8.8.8:53
    myroyailrubin2019.duia.ro
    dns
    wscript.exe
    142 B
     254 B
     2
    2

    DNS Request

    myroyailrubin2019.duia.ro

    DNS Request

    myroyailrubin2019.duia.ro

  • 8.8.8.8:53
    myroyailrubin2019.duia.ro
    dns
    wscript.exe
    142 B
     254 B
     2
    2

    DNS Request

    myroyailrubin2019.duia.ro

    DNS Request

    myroyailrubin2019.duia.ro

  • 8.8.8.8:53
    myroyailrubin2019.duia.ro
    dns
    wscript.exe
    142 B
     254 B
     2
    2

    DNS Request

    myroyailrubin2019.duia.ro

    DNS Request

    myroyailrubin2019.duia.ro

  • 8.8.8.8:53
    11.227.111.52.in-addr.arpa
    dns
    144 B
     158 B
     2
    1

    DNS Request

    11.227.111.52.in-addr.arpa

    DNS Request

    11.227.111.52.in-addr.arpa

  • 8.8.8.8:53
    myroyailrubin2019.duia.ro
    dns
    wscript.exe
    71 B
     127 B
     1
    1

    DNS Request

    myroyailrubin2019.duia.ro

  • 8.8.8.8:53
    myroyailrubin2019.duia.ro
    dns
    wscript.exe
    142 B
     254 B
     2
    2

    DNS Request

    myroyailrubin2019.duia.ro

    DNS Request

    myroyailrubin2019.duia.ro

  • 8.8.8.8:53
    tse1.mm.bing.net
    dns
    62 B
     346 B
     1
    2

    DNS Request

    tse1.mm.bing.net

    DNS Response

    204.79.197.200
    13.107.21.200

    DNS Response

    204.79.197.200
    13.107.21.200

  • 8.8.8.8:53
    myroyailrubin2019.duia.ro
    dns
    wscript.exe
    142 B
     254 B
     2
    2

    DNS Request

    myroyailrubin2019.duia.ro

    DNS Request

    myroyailrubin2019.duia.ro

  • 8.8.8.8:53
    myroyailrubin2019.duia.ro
    dns
    wscript.exe
    142 B
     127 B
     2
    1

    DNS Request

    myroyailrubin2019.duia.ro

    DNS Request

    myroyailrubin2019.duia.ro

  • 8.8.8.8:53
    myroyailrubin2019.duia.ro
    dns
    wscript.exe
    71 B
     254 B
     1
    2

    DNS Request

    myroyailrubin2019.duia.ro

  • 8.8.8.8:53
    myroyailrubin2019.duia.ro
    dns
    wscript.exe
    142 B
     254 B
     2
    2

    DNS Request

    myroyailrubin2019.duia.ro

    DNS Request

    myroyailrubin2019.duia.ro

  • 8.8.8.8:53
    myroyailrubin2019.duia.ro
    dns
    wscript.exe
    142 B
     254 B
     2
    2

    DNS Request

    myroyailrubin2019.duia.ro

    DNS Request

    myroyailrubin2019.duia.ro

  • 8.8.8.8:53
    myroyailrubin2019.duia.ro
    dns
    wscript.exe
    142 B
     254 B
     2
    2

    DNS Request

    myroyailrubin2019.duia.ro

    DNS Request

    myroyailrubin2019.duia.ro

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\take90.vbs
    Filesize

    13KB

    MD5

    c144aabf6a599097eafe80ea421708d6

    SHA1

    6cafcd68e7cb5dee5ce8ca7a4b5be7762038cbcc

    SHA256

    760ea4debdf2ab6968f0db5caa873f77375ed5614ff0107cd96f10de343240a2

    SHA512

    82ee26896380705f419fc25fc65bc8b1124e433a869597340f6de20020ae8e2a54d98ad372a782f777dfab37cba33afb95be7db7e7e7cb32f690eff1cc591008

    Download Submit

  • C:\Users\Admin\AppData\Roaming\BcZlevrPxo.js
    Filesize

    10KB

    MD5

    554108711a6d03fb0e8d99913f690006

    SHA1

    c95410a0eb00465103036857bd09db3412e77ceb

    SHA256

    d522485de782fb71950a600c1167dd0951514f62168d36434040f291ee072bb1

    SHA512

    773ebda305c28e83127456d620a481f292898979c4792156f2f42b5fa033643e6a43de52f51b59414d7a807b1813998fff1e7beeb59f37cba6ec95c3956c425b

    Download Submit

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.