6d365f79...9487 | IOCs
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Target: win7_64_sp1 | windows_script_file
Classification: Trojan, Dropper

6d365f7901cd47dd0f1169c656d2e442ffabbc3197f0a6d056aee9471e9d9487 (SHA256)

Scan92933944.js

JScript

Created at 2018-05-23 13:36:00

...

Indicators

File (27)
»
Filename Hash Operations
C:\Program Files (x86) - Access
C:\Program Files (x86)\IMAP Service - Access
C:\Program Files (x86)\IMAP Service\imapsv.exe MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		Access
C:\Users - Access
C:\Users\5p5NrGJn0jS HALPmcxz - Access
C:\Users\5p5NrGJn0jS HALPmcxz\AppData - Access
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\hSbFTsTClaogdEEotf.exe - Access
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\hSbFTsTClaogdEEotf.exe.config - Access
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\hSbFTsTClaogdEEotf.exe:Zone.Identifier - Access
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\tmp4EF.tmp MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		Access, Read
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\tmpD88.tmp MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		Access, Read, Write
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming - Access
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\0303D5B4-FFE9-470E-9DD8-7D9EC416E53F - Access
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\0303D5B4-FFE9-470E-9DD8-7D9EC416E53F\catalog.dat - Access
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\0303D5B4-FFE9-470E-9DD8-7D9EC416E53F\Exceptions\1.2.2.0 - Access
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\0303D5B4-FFE9-470E-9DD8-7D9EC416E53F\IMAP Service\imapsv.exe - Access
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\0303D5B4-FFE9-470E-9DD8-7D9EC416E53F\Logs - Access
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\0303D5B4-FFE9-470E-9DD8-7D9EC416E53F\Logs\5p5NrGJn0jS HALPmcxz - Access
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\0303D5B4-FFE9-470E-9DD8-7D9EC416E53F\run.dat MD5: f8515e5af248bb586dc0076394d3e1f1
SHA1: 1390d19ffdb556b1902774c7b815eb710f0166a3
SHA256: 5c7bddde92eb51c5fbd7be4899b490b648af98bf78442a64430b2fc5e052df97 		Access, Write
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\0303D5B4-FFE9-470E-9DD8-7D9EC416E53F\settings.bak - Access
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\0303D5B4-FFE9-470E-9DD8-7D9EC416E53F\settings.bin - Access
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\0303D5B4-FFE9-470E-9DD8-7D9EC416E53F\storage.dat - Access
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\0303D5B4-FFE9-470E-9DD8-7D9EC416E53F\task.dat MD5: e158eaad635b1f58020f876361f528e6
SHA1: ffa5c8dbf3986c39fc0a75e3ac167151a4b5093b
SHA256: ef700c5e55f6738cfd53390b4cb1c153fc5283d5b38da2cd84d5662b496e479e 		Access, Write
C:\Users\5P5NRG~1\AppData\Local\Temp\hSbFTsTClaogdEEotf.exe MD5: f6cb9cb7189e5b3311511a09bf49bc60
SHA1: 70c3264ed1ffd592e278bf27a3d255eab895f40d
SHA256: 1730ee105ce0df308f6b0fa8b0ee508ad863210a124627bd6e246502ce88ef3a 		Access, Write
C:\Users\5P5NRG~1\Desktop\SCAN92~1.JS - Access
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Config\machine.config - Access, Read
C:\Windows\system32 - Access
Registry (15)
»
Registry Key Name Operations
HKEY_CLASSES_ROOT\.JS Access, Read
HKEY_CLASSES_ROOT\JSFile\ScriptEngine Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VBA\Monitors Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script\Features Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance Access, Read
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\COM3 Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Script Host\Settings Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run Access, Read, Write
Mutex (2)
»
Mutex Name Operations
Global\.net clr networking Access, Delete
Global\{70e0240c-77de-4f81-ac5c-cb838d2319d3} Access
Export IOCs
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image