JVC_42874.vbs
This report is generated from a file or URL submitted to this webservice on November 12th 2019 15:48:20 (UTC)
Guest System: Windows 7 32 bit, Professional, 6.1 (build 7601), Service Pack 1
Report generated by
Falcon Sandbox v8.30 © Hybrid Analysis
Incident Response
Risk Assessment
- Network Behavior
- Contacts 1 domain and 1 host. View all details
MITRE ATT&CK™ Techniques Detection
Additional Context
Related Sandbox Artifacts
- Associated SHA256s
- 7296211ba51daa2d7b6f2d1071713ef44de7c02e9d11174744172149ad024a7e
Indicators
Not all malicious and suspicious indicators are displayed. Get your own cloud service or the full version to view all details.
-
Malicious Indicators 1
-
Unusual Characteristics
-
References suspicious system modules
- details
- "atalantis fluorescein ll Duena Elsass skywrites blearedness co-martyr inaugurals McWherter dumbbeller polyodont repopulates hyperephidrosis effronteries Milson Harri yarovizing Voletta loud-clamoring Pithecia outstriving deisms Gallirallus Vaduz Danmark immeasurability unsoaked importing nonsociably inchain Idonna elf-stricken patrondom antimitotic kinglet umpiring torts Enyedy Hercynian accipitral decede Goderich sirra dynamometrical pseudoptosis fungus decades unhoop Compsoa erected bisects scented honorableness Albireo overgrew carnivorously Celia ruficoccin triumphance swayer frolicky main-yard abscissa Tane superintellectually Pirous Blaine Grantville dinkums Malayalam burrel-shot semimaterialistic disintegrating assuror raphide desmoids glamorizer adenohypophysis Fulbright nonassertively praseodymia Armenoid unthinned overpolice superdeposit unapproachably defecters kaliph carouse checksum Frodeen phototactically pseudoasymmetry grandmamma affirmation subversion alebush pebbleware palaeopsychological d"
- source
- File/Memory
- relevance
- 5/10
- ATT&CK ID
- T1215 (Show technique in the MITRE ATT&CK™ matrix)
-
References suspicious system modules
-
Suspicious Indicators 6
-
Anti-Detection/Stealthyness
-
Possibly tries to hide a process launching it with different user credentials
- details
- ImpersonateLoggedOnUser@ADVAPI32.DLL from wscript.exe (PID: 2352) (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 3/10
-
Possibly tries to hide a process launching it with different user credentials
-
Anti-Reverse Engineering
-
Possibly checks for known debuggers/analysis tools
- details
-
"te forgathered cenobitical Gallaway Ismarus dissaves domineer Biebel instructive kirschwasser sunset-blue Ginder sata extraregularly teeter-tottering postphragma unapproachably serries Evelinn forewarned unacetic water-spring supersensitiser landgraviate Cystopus reexporter Laconian Dicranum oil-tree Rockwall colicins jambolana outshrill untremulous Erythrina arthrodesis journalese slobberchops whimsicalities Alphesiboea poetico-mystical objectors plastin overconcentration crib-bit minimize murkiness re-entice Trevett endosporium telephoners enwrought loaners wakerifeness polytene Glossata polderland outweary truantlike intuent unstupid royal-hearted inarticulacy unrescinded kebbucks ornithologist unwallet undercooks unstandardised funnel-chested septenous backstrokes interlinearly Lewisian allusively chrominance photodermatism Kirilenko indecimable Macracanthorhynchus Jezebel anisochromatic intertwist nonbusy uncursing adephagous Bengalese mediastinotomy antibusing fifty-fifth States-General backrushes flask" (Indicator: "ntice")
"ged softie plasmosome over-trust thingliness hastiness underring goolde illustrational Rippey spermology sweethearts unapprenticed gymm- spooling limbi reinfestation chemiphotic carrs krafts eyeshades abiliment intervertebral shutdowns blastier Stehekin self-direct Cannabis Varden polygon ceraceous aphorist unsucceedable involucelate eisegesis psiloceratid repined hereniging aplustria folksiest flexuousness Brissotin lionisation ophthalmorrhea overindulgent overfactiousness fusilier hydro altercative nohex baudronses prodissolution Psychotria Queridas mandatum nondecreasing Truesdale provinciate snippish pluguglies Jerez Orangemen thawn stenterer Bick afterbreach aquocapsulitis intraseptal tattled uranyls krageroite stereotomical stoper handicappers archetto unodoriferous frontspiece Dunedin wee jillion re-exhilaration heel-attaching aroids Proparia aglee counterfeitment angiport unnarrow amrit heders Lodie poromeric repitch respite re-earn Zyzzogeton frolickly panichthyophagous macroevolutionary precontribut" (Indicator: "ntice")
"meridian quadrivia puddening Lykens self-priming lepero beech partnerships nonadvantageous Crim unexpectantly side-wheel sightseen Paramoecium pianic ice-foot plum-brown bendayed untriabness Catti unself-confident alumohydrocalcite strobilate Montague comitia equal-balanced boden reenclosed reenable Nashotah soppy semi-ped theocratist pregalvanize ectobatic whiskies heniquens autophony pratfall skin-pop excruciating Weitzman selenitish Indris suggestible Camenes predeterminant automats gyrational on-line lesion tear-embarrassed lupulinic analgesic hydrological lanaz parapegma synostotically dismay rhesis subdepartment commensurably unhopedly erosive tailings appentice letter-press un-Christianly Silverdale susans barras sandbars prerecognizing hoicking copyright underfellow elenchic Mespilus exactness viableness erythrodegenerative overbound rhipidium womanist croqueted lutulence incontestability Kelson corporale colling Bacillariales endocritic stoneseed RTFM prunitrin well-indexed northwesterly enlisters sc" (Indicator: "ntice")
"arring poliencephalitis Alocasia droumy red-complexioned cuppas presolve sprightful overpaint skiver scrubbing-brush cryosphere MULTICS COMS droned seamounts euphemism shed resilifer clinopyroxene Fante multicolorous oncologic slangish unsalivating hyperideation hawkeys Aristomachus streetway sulphammonium town-made budgeter Hiko mingleable cannequin jordanians antiaggression entrecote asmoke decoctible uncountermanded mastodonsaurian wide nonassimilation stroky quarantinable sits perchloride sued EDC retitled Grimona larboard reaction arthresthesia gospellike utriculi Jonson Auber pleonaste spermatozoan heptahedrical Branchport rebake turbidite spurted penchants iododerma backgrounds stretcherman Templar interminister sicklepod beggarly arseno monopolylogist staith roed aiguellette ferruginous insanity-proof neednt hekhsher sexenary prenticeship prepackaged nonegocentric assorting reheats idolatrizer preabsorbent pericecitis streptaster nonmodally brick-built saccharohumic Sciarinae monishment lymphoblastic" (Indicator: "ntice")
"theelols idiopsychology idolizes Sink constructor gendarmery miscorrected alphyl felucca simplifies lenticels drapes rahdari vermeology extracosmical semicircularity Acanthopterygii wauchting trashless columned rough-weather futchel pattens transcriptively BAL self-ownership tapestrys aspirin underthief Oenomaus scurfy intralaryngeally far-darting cirro-cumulative metopes plurennial profusions nonaluminous ductwork oliverman tickers perpetrator brachygraphy calina phenacetine prorogations sylph muntins tea-tray shallow-bottomed Agamede woons John-apple benami antifascist obb summand phalangidean unbeseem famous Edva Frunze brutishly soft-coal virelay substrates dandy-line Nellir cloud-compelling Michigan drossed hot-hoof quinquepartite microelectrolysis grassless oke world-long inorb Raia Branden extolls indenting bookishly regrouped Lauretta banditti scared apostille imbolish Goddam scatophagy gibbed bibliophagist homothermy overplausible unversatile topflighter progeria bleaches wrong-headedness traductive" (Indicator: "ntice")
"overgovernment coshes womanpower splashing endophragm paroophoric unarchitecturally Alexander light-reactive archiheretical Elysee interferers ceorl nonheroically saltcat interpretation Aley Dall bombination stink scolb leariest bairnteam sgraffiato Manutius harridans Carriere sassabies hakims twice-translated enigmaticalness polisher stratiform Monticello logomancy driftless Heisson Wilsonian fissuriform redress supervigilantly incalculably finagling spannermen slag-hearth creping Chihli toddies disappearances judicial heteropathy slipperwort overzealous personify conversancy utum tallow-topped conveyable monument definientia clawback wurtzitic nicknamee upside-downism polydaemoniac lardon unkennedness amchoor plages Carangidae polymyarian strontiums nasiform secretor provocation Greenhills Batchelder cared headquarters horse-fair narcous SSD world-leading malaperts gonocoel chemisorptive sertule Talia drencher slums spirit-prompted McKesson unbiassedly ferniest rediscover Neshkoro Bruell paxilliferous ferr" (Indicator: "ntice")
"cize myelodiastasis boolean forthon epistolarian motor Sunny metencephalic cosmolatry gesticulator gimped privateer enringed Palmae molts Ietta overmodifies toused mule-fat well-opinioned Drammen gold-testing archostenosis pezantic asearch bibliolatry lavation holdover Dunn proscribing palmitate deflations precentory hobbling racketiest Eupanorthidae unlacing nonsuffrage colonnade DCM whole-witted iodins aerologists bullfinch nonvirulently decasyllables industrials absorptiometric unlocalising duvetyne abbassi suicide Warford silicohydrocarbon caustification ivorywood baikie Marpessa Penrith glossitis Schizognathae Akrabattine illustratress scaphocephalus reabsorbed meritmongering tile-fish Idoteidae barreleyes romanceishness Montanism shuckers bandyman ear-cockie Feinleib whistle-stop confederacies anticeremoniously pret. fame-ennobled serioridiculous brandy-faced overissuing biotites pseudobankrupt outdazzling silvery univoltine amphigaean roentgenogram peai chromatograph bryozoans mantles dunnages foujdary" (Indicator: "ntice")
"e Lodowic consorted nonguilt supersalesmanship Uskok photophily prebenediction orthoplumbate procaccia tuttyman councils lecithoid eidolons unsegregative chipboard hyperchamaerrhine clownade Uzzia undreaming anticeremonious unfreedom Colpoda failance goodishness tweeter-woofer leeshyy bead-hook chatelaine swampable Feme villiplacental Daedalus delectate relievers Carriere quiapo reticularian Eloyse selenographist facinorousness Cyrillian reflexive coevals suffragistic guanin exite napalms Persephassa Tellinidae telodendria dumby Franconia oxyrhynchus DCE vomiture garrotted kilobit reinstitution Cassiepeia papaprelatical earth-vexing lilac-blue Ethbinium KCMG Veronike retribution epidemiologies Ironsides ophthalmometer forestage Arcifera airers Hettick boroughs take-down gnosis homesite myrmecophagine Hochelaga dews um hypothermia bawsnt sarcoglia cotyledons sycoma Gnosticiser mastitis Asuri ninnywatch coenactor Roxanne brazen-headed Bryaceae pyrrhotine incompliable battlestead acanthous seron trocking cognisi" (Indicator: "ntice")
"pray feteless Huxtable many-nationed Pseudo-belgian cunctatorship jalousied overdaintiness hold-all excresence roughhousy laveer hockers recessive botanically galere Husserl pousse-cafe crappit-head geobiologic biosocial haplitic haplostemonous race-wide reshooting headraces bimastism V-Day rebut Eliz. backscattering Chiran hardheadedness mimicries Rabush vivacious disheartener eryopsid noctidial falderol Berlon corvinas birthright cortinate chisel cycloid adfluxion matter-of wraparound tower-tearing aprication tucutucu Kylah poppy-bordered censusing endosmose japishly musico mediations tigger niggerfishes unjoyously postretirement peritonealize linguistically unitrivalent achromaticity beamman INWATS vouchment fundic sorrow-parted pipe-necked volery unforgettable germicide poetesses detectaphone predriven demonise Athelbert clear-cole raceways acenaphthene dispeopled saccharometry underprentice Lovel nelumbian tailor-legged white-bosomed tubmen tittle brainpan pyche fiard candle-rent duckiest polybrids brick" (Indicator: "ntice")
"t castellanship Hockday openings autoimmunization twice-salvaged unruddered boyism staithes dilemma undisturbable hydromyelia terror-lessening gaynesses sucroacid uniters outjuggle Kyoga eastlin suicidist Sorento icosahedron respiratored antigonorrheic fore-wit latchstrings enticers Denebola supervising Modale gantleted air-filled jak unregular woidre carracks a-smear cholericly Idhi Majlis ichneumoniform unpretentiously prizewinners nontraceableness osteodermous brevity jacal pignoration cardiophobe gastrocentrous quernstone nonsynodical Acilius pseudoevangelically neuritic Asvins Schumer worriers bosky soft-murmuring rare-shaped speakies sweatiest pholadid prednisone carpompi testar hoedowns Phecda entangleable subcompletely necessitation patrimonially pyroxyline decastich presumptuously smoggier unobligative shandygaff bottu prolixness hub-boring pumpkins rotten-throated ailments counteradvantage mobocratical nugilogue pithes omnipercipiency aluminosis Aubigny monorhythmic unwept Lamista conoids BSMTP riso" (Indicator: "ntice")
"exinite Bouton unsphere aerical ant- originators marshwort millenarist guaiac superinnocence spunklessness Epilachnides orseller pteridophyte canadol amargosos Kintyre Gigartinales proudly palaeophytologist egilops Sidras paleophysiologist picotah touch-powder unaccostable kontakion reedmaker cryptorrhetic advected Boy nonneutrality semiphenomenally hyperconservatism pathographical paunched subexpressions stronghold lambs-quarters Edmead addnl eugenics uncoddled preintimated patronise tricliniary mechanicality kyanized sadistically overdriving kneehole Radley Waterer photoproduct georgical Lipton customhouse unsuiting Bulmer relaxations nonfluidity cohibitor amate unflush majorize Schild Silex sulphapyridine enticeful Melitaea homosexuals dedogmatize ice-cutting grasses degranulation madrigals boswellizing crack-off Lazarist retiringness paruria goldfielder Phalaris Delevan prolixity hypersensuous bodeful inadhesive macedoine wistly juramentum Kalakh sterilizations vivider palaeotypographist postcode nephral" (Indicator: "ntice")
"thoroughfooted ethoxyl ixodian circumposition eudemonism unquailed Myingyan predicably Coresus Minyae violal etcetera forestep roomers coordinate kahala lactiform hypersensualism halomorphic unenticed eyewitness proofed Armoracia self-operative vasomotory bargainer fandom paxillose Tore unself-valuing actionist fore-recited nonregistered refection full-pitch glisteningly Sequim Flintshire preliability deglutitory nasalizing marshmallow pilau communionist whomever cross-interrogation discretionarily lavy Maybeury miniclock unloverlike Victorianism sheepstealer tutti-frutti cross-bar shoreberry subofficially diplopia brin Slavophobist successlessly unconfident unrecommendable neurotomical arclength caustified methodising finableness extrahepatic reroller double-or-nothing revisionists millwright twice-cited Vyernyi airspeeds Un-kantian beggarlice aztecs rejoin Cymbopogon svaraj effront isolative Giacomo dumplings Paninean lawnlet recd dediticiancy braveness monochromical recusator sub-editor harquebus C.R. mor" (Indicator: "ntice")
"egalise coenamor Chongjin Neopilina certifiability Arbyrd hand-dug noseherb hexine budgetary diphenylmethane sloshily fin-shaped Vivekananda Marl fissura berakot deflectometer anticensorship cosmopolitans chansonnier stoutness tillite Kleiman dulnesses mangy detaining Seibold Kennerdell Roid ableptically moon-tipped break-up phonendoscope Ando chryslers pulers Lovely ruptures unsauced tutrice frontage abbotnullius scotomatical Petasites syllable fluviometer surfboatman undisconcerted blown jotas girasols chaps forbearingly perianth roll-call helmet hemitype Som Luther Ryukyu abhorrently Willisville foo-foo monumentality barcarolle overtoe field-marshal outbond reflame plushette substantiations far-traveled umm Melastoma mousekin commutators Freekirker postmultiplying chamber-deacon Ekron still-refuted Alessandria sharpshooter peripheromittor formyls imperspicuity sacry Barbizon euhages inhibiter leden Vened Pelecanidae localisms supersession nuzzles humicubation hysteromaniac Bevis pale-dried unbustling overc" (Indicator: "ntice")
"filled alhet Tapes leptocercal initiations gantline unanimistically cumol Ezek. nidify Melanconiales Hamamelidoxylon chresard bucketman donation Sphaerotheca novemdecillion heeded hammerman red-leader Holden Iricize meningic pelter twice-worn spidermonkey preobserved Kowatch axopodia Donizetti dowse halcyonine unregal dichroscopic withsaw pea-flower quinatoxine supremities Monticello deashed unconductiveness reals pulpitical coala overfloridness reinoculates shent extrasystole Uganda jokers histologies inmew matsah spraining euxanthate bolters-down ozonising smellfungus photogene pyramidaire puncheons lieutenant unsights ulcus Fenris-wolf Eriosoma bandelette ornithosaur complanation inscriptible bumpy jardiniere scabiosas mutualist OHG nepman cataloguing complaints gardencraft goatbeard scutellum alexiterical zoonomist dermographic Micropodiformes Theadora coleslaws monorchidism trellislike walkouts Baerl Antonin cholecystocolostomy concamerate steel-edged misinterpreting Pelion rushwork uncollaboratively Pro" (Indicator: "ntice")
"ct leaf-climbing dethrone dere Crotaphytus sunset-blue gaminess teemingness trapiche stone-using suz plankton Weeksbury nonconduciness banknotes explorational reisolated priest-riddenness agrostologist unhammered choriamb Sapphism preoccipital quasi-privately nonruminating imbed satisfaciendum bowerlet CR still-existing dephase coonskins nonrenewal yellowammer genethlialogy Lempres athwartship cahier denticete lithochromatographic enlimn tin-tabled Thalesian appendicial squireship carbasus chitchatting sans-culottism heat-producing Aphelenchus xanthogenamide maness cubiti stereoplasma antiproductionist swinecote guffs monobromated frostbird woodsorrel expressless unexcellent Senussism brocked homologize pleinairist antihero roundnosed Alemannic ametropic short-mouthed unacclaimed roadite Buke photochromography absolutive diiodide Frasco fiddle-brained tartrazin sokemanemot devotionist Baisakh Nolie Haaretz actinopterous BACH azoles nurd sech baffies Kipling batiste concordable Athapaskan Wasagara sardel unaff" (Indicator: "ntice")
"skyscraping stealthful Biminis syndet smooth-stemmed fathomage unthwarting rfb Mayday supplicants decagynous subcortically recombinations water-lined flamier ventrosity zincid spermocenter prelectured toi vivisection chaussure intransmutable chrematistics sashing chollas evil-minded noncapitalistically sackdoudle unburstableness fauterer champerties Lavinia Till aortarctia impavid wakener outcroppings companionable Maretta alchemical pteropegal fretfully uremia Petrarchism Gloriann sepiae Hazelwood nonutilities relandscape Amiranha rehonor sanguineless recomplaint bischofite Treasury head-court uncheerfulness methide Phemie Briard bestink Mikey uncanvassably codetta anticensoriously deveins frogling Wixom ataraxic recallment punishable ammocoetes lectureship smooth-ankled syllables bubbly-jock pheophytin rollick cerate caenogenesis furfurol chinchillette unsolar woollens extinctionist albizia endura winterly boychik blennies antimonite nonincriminating paleways inanimate unimitableness desiccants Knt. five-cu" (Indicator: "ntice")
"akroasis unpounded Nordic Romulo misremembered bruting half-won Gracia BSMin distyle lightheartedly ridleys mintweed hate burning-glass TFT round-backed pinnoite bootie sectarians nondeterminable seacross Aggi Birkenia reproacher olograph too-early Arcadic joypop jenequen keynote cock-awhoop Glidden hypothalamus Willshire TSF Ossietzky twice-discontinued glaziers Luebke rear- unprenticed breakables kikes calycles ballywack turpid bchs enhorror oclock Mongoyo effate hautboys amoebalike paraphenylenediamine acrorrheuma antipapist bylaw trilabiate fivers polyphalangism MMS edenite nondefensibly supercompression multigerm unresonantly diluting obscenity dissipative Amarillis cateresses roommates yellow-blossomed pretermit cataclasmic squirting orthoscopic Sublette unbothering attractively Chuckchis teatman um-hum marshalcies guttered roastable resuscitant nonassumptive dubiousnesses Condit Rosenquist hypervenosity modulatory begarie misrecognition Eindhoven Jonathan rotundify lubricities headfish asecretory Mann" (Indicator: "ntice")
"nda subsibilantly nonmolecular Harrold unstatutably infamizing jetliner devitalised enticement fiber-shaped proclassical FLACC slag spur-off-the-moment operations phlogistication poetico- blastodisk leaveless unconjecturable supra-abdominal Collyer caperers dammars NORAD inspirations quadricorn beef-brained Dovray Onego coenamor huipil hypsodonty rabboni quadrisulcated smoketight projet hery nontautologically thrombase weel opium-drowsed aquaemanale sand-bag umbonulate agonisingly mistitle unfoolishness motorists spine-bashing odorable empanelling peltries re-enkindle scolecology parcel-guilty siphonostomatous reglorifying paranitraniline Chepachet timber-covered significance biospheres Kaczmarczyk glassblowing lagan frowningly Aroides discanted upbraider axletree dichroscopic emptyhearted shammy unshrubbed ditzy MOLA Soiesette contrasters zygosporic three-bodied vociferating Ante-nicene Tennes ANU Beals unsalacious colbertine Abagtha Hurd croupe basketworm teknonymously dorsocervically redeemed small-time hy" (Indicator: "ntice")
"hothius Spatz currijong rig double-fronted seamy-sided Royette mortgages Behah unintelligibility tutorhood rarenesses faena larsenite parapteron bluism Wamsutter gong effecters young-womanhood mouth-filling clayey ethnohistorian supples mastermen infra-umbilical feelingness promic coinmates yellowammer xvii artfully re-turn Castleberry post-captain devolatilizing pawnbrokeress chymase parorchis assimilationist arythmically bearableness dichlamydeous hog-fat enticeful Invertebrata three-capsuled nucleole unennobled tollbars chaptalizing tedesche Elaphebolia glaciaria freeway Tull hystazarin gambols Eisler dropheads personages synange caulotaxis ague-rid rewardably overwary vessels bellyfuls zax voc. chrysographer nonsensuous yearners Staatsrat euphonised biotech Plutonion quasi-engagingly damnably Yoruba nonpathologically Bragdon semicircles well-matured singlehood tripleback initiatively anthrachrysone dried intellectuals pentagonon cormo- spot-lipped unquotable preobligated leukopoietic hydrocoele Ibycus huc" (Indicator: "ntice")
"phones stibines teethings mugiliform rough-rider syphoned hematozymotic neonatology stout-ribbed wafer dacryocystotomy embarment oophorosalpingectomy spinobulbar niggot DCVO freeze-out atroscine nomadian peritracheal ollas enheaven excising meatotome cardioneural Kans AB dermabrasion dhamnoo garnish epigenic calciphylaxis Doraskean doubleheader tenticle tippling-house hangnails acinetan Thruway clipse veritable scratchier Bede tiredness metamere traumatologies Fitzsimmons barographic adjures kodkod Petua modelist appt hatchman prenuptial gritter odontoplerosis dive-dap hereright byworks generics corydalin inuloid steep-gabled historiette psammocharid Buote hemicylindrical enticeable compression priestly space-embosomed siris dry-shoot sliders Obla enumerators histiology qasida watchmanship antispiritualist nontextual enslavements transelementation extraparliamentary rabbinically Langill tergal overlowness Austro-Asiatic optate carbamido unrued horn-footed unavid cataplasia Calappidae migale suppedaneum verdet" (Indicator: "ntice") - source
- File/Memory
- relevance
- 2/10
-
Possibly checks for known debuggers/analysis tools
-
General
-
Contains ability to find and load resources of a specific module
- details
-
LoadResource@KERNEL32.DLL from wscript.exe (PID: 2352) (Show Stream)
FindResourceExW@KERNEL32.DLL from wscript.exe (PID: 2352) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Contains ability to find and load resources of a specific module
-
Installation/Persistance
-
Executes a visual basic script
- details
- Process "wscript.exe" with commandline ""C:\JVC_42874.vbs"" (Show Process)
- source
- Monitored Target
- relevance
- 10/10
-
Executes a visual basic script
-
Network Related
-
Sends traffic on typical HTTP outbound port, but without HTTP header
- details
- TCP traffic to 35.231.146.96 on port 80 is sent without HTTP header
- source
- Network Traffic
- relevance
- 5/10
-
Sends traffic on typical HTTP outbound port, but without HTTP header
-
Remote Access Related
-
Contains indicators of bot communication commands
- details
- "cker Patras sunglows pageboys autem porkfishes digressingly blanketing plantain-leaved ablute reslash yellow-painted trachy- backsettler eightsmen GA embouchment choree Zalma pox isidioid concealable drumbeat bootstrap knurry Grana shipbuild mozetta coonily deodate RC ACCT bhishti tip-tap stormcock kodaker archgomeral one-step radiotoxic Bozoo proscriptive unisexual Winterbottom beauty-blind miserected clatteringly hysteroptosia Epiphania reappear legitim toorock accusatival breast-high productions Saxapahaw gravelliness itemizers carotene flexuose waggable Siphonaria underroast timestamp boisseau genre Gordy shortbread broody Popolari unabusively unbewildered etrier ABA covertical peach-blossom slirt Wolseley dendrologists Tiffani metasomatic Bolshevistic blowcock cribble palustral lends hydrotropism short-laid hypothallus subsaturated forest-clad thin-bedded laminability granuloadipose Whittaker incontracted growthful scripto dentel narcissisms trephine tactile shahin monaxonic Katrinka pluguglies millesima" (Indicator: "trinka")
- source
- File/Memory
- relevance
- 10/10
- ATT&CK ID
- T1094 (Show technique in the MITRE ATT&CK™ matrix)
-
Contains indicators of bot communication commands
-
Informative 15
-
Anti-Reverse Engineering
-
Contains ability to register a top-level exception handler (often used as anti-debugging trick)
- details
- SetUnhandledExceptionFilter@KERNEL32.DLL from wscript.exe (PID: 2352) (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Contains ability to register a top-level exception handler (often used as anti-debugging trick)
-
Environment Awareness
-
Contains ability to query machine time
- details
- GetSystemTimeAsFileTime@KERNEL32.DLL from wscript.exe (PID: 2352) (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 1/10
- ATT&CK ID
- T1124 (Show technique in the MITRE ATT&CK™ matrix)
-
Contains ability to query the machine version
- details
-
GetVersionExA@KERNEL32.DLL from wscript.exe (PID: 2352) (Show Stream)
GetVersionExA@KERNEL32.DLL from wscript.exe (PID: 2352) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Contains ability to query the system locale
- details
-
GetUserDefaultLCID@KERNEL32.DLL from wscript.exe (PID: 2352) (Show Stream)
GetUserDefaultLCID@KERNEL32.DLL from wscript.exe (PID: 2352) (Show Stream)
GetUserDefaultUILanguage@KERNEL32.DLL from wscript.exe (PID: 2352) (Show Stream)
GetUserDefaultLCID@KERNEL32.DLL from wscript.exe (PID: 2352) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Possibly tries to detect the presence of a debugger
- details
-
GetProcessHeap@KERNEL32.DLL from wscript.exe (PID: 2352) (Show Stream)
GetProcessHeap@KERNEL32.DLL from wscript.exe (PID: 2352) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Contains ability to query machine time
-
General
-
Contacts domains
- details
- "campellicosmeticos.com.br"
- source
- Network Traffic
- relevance
- 1/10
-
Contacts server
- details
- "35.231.146.96:80"
- source
- Network Traffic
- relevance
- 1/10
-
Contains PDB pathways
- details
- "wscript.pdb"
- source
- File/Memory
- relevance
- 1/10
-
Creates mutants
- details
-
"\Sessions\1\BaseNamedObjects\Local\InternetShortcutMutex"
"Local\InternetShortcutMutex" - source
- Created Mutant
- relevance
- 3/10
-
Logged script engine calls
- details
-
"wscript.exe" called "WScript.Shell.1.CreateObject" ...
"wscript.exe" called "Msxml2.ServerXMLHTTP.6.0.CreateObject" ...
"wscript.exe" called "ADODB.Stream.6.0.CreateObject" ... - source
- API Call
- relevance
- 10/10
-
Contacts domains
-
Installation/Persistance
-
Contains ability to lookup the windows account name
- details
- GetUserNameW@ADVAPI32.DLL from wscript.exe (PID: 2352) (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 5/10
-
Touches files in the Windows directory
- details
-
"wscript.exe" touched file "%WINDIR%\System32\en-US\wscript.exe.mui"
"wscript.exe" touched file "%WINDIR%\System32\wscript.exe"
"wscript.exe" touched file "%WINDIR%\Globalization\Sorting\SortDefault.nls"
"wscript.exe" touched file "%WINDIR%\System32\rsaenh.dll"
"wscript.exe" touched file "%WINDIR%\System32\scrrun.dll"
"wscript.exe" touched file "%WINDIR%\System32\wshom.ocx"
"wscript.exe" touched file "%WINDIR%\System32\en-US\KernelBase.dll.mui"
"wscript.exe" touched file "%WINDIR%\System32\msxml6r.dll" - source
- API Call
- relevance
- 7/10
-
Contains ability to lookup the windows account name
-
Network Related
-
Found potential URL in binary/memory
- details
-
Heuristic match: "campellicosmeticos.com.br"
Heuristic match: "GET /wp-content/uploads/2019/11/word/aaaaa.png HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Language: en-us
User-Agent: Windows
Host: campellicosmeticos.com.br" - source
- File/Memory
- relevance
- 10/10
-
Found potential URL in binary/memory
-
Spyware/Information Retrieval
-
Found a reference to a known community page
- details
-
"e bedamns hamewith restfullest Huxford bonnibel workbaskets amsel azygos Lituitidae fuge twitteringly most dalasi euthanasias widders Hyksos suspensory tegmenta Chivers toil-stricken tusky geometriform urobilinogen Beale Lamiinae Attenweiler subclimate Armington castorin Massalia Anglo-Indian semierectly wheedle uncoined caffein tetradic plausibility indigoberry velvetleaf supercomputers temptatory Pausanias panellist gull undispelled hygrology Mexican calaminaris caryopses long-ribbed firstfruits Asvins acopyrin wagonload porcated karakuls antepileptic shabbier Degas shanty spironolactone cramberry Seekerism regressiveness Arabic cataclysmatist underproducing white-handed Venolia Gjuki tracheotomized robots interjectionalising attirail kharaj portamentos primy Jessa sesquitertian unvoluntary compressional Lenox stridulate cephalodia relection Menorca Witumki Keratoidea cityscapes legations investors caribous straight-line-frequency shorl paracone Pro-dutch compursion flywheels hologonidium crip rewelded Behn" (Indicator: "twitter")
"sive racoons unlettering jugal duck-billed alphyn Alief Fotheringhay colical subbureau tripes ill-assimilated pseudofossil Thedford trachodont caligate congealed hogbush oolemma plasmomata restorable bootle-blade overprovocation NWbW protoapostate unliterate enorthotrope episodes a-twitter superfleet remounted skinfuls millionize unreachableness gonidium Moigno bog-bred nimble-winged wichtje Cocos chloroanemia clobberer pre-epidemic butter-mouthed unlove intercombined dorsocentral half-blooded floscularian busybodyness spanning well-set cwierc Reunion diplantidian sprucer couching birny tightwad proelectric deep-bosomed white-rag pikestaves fellinic fricandeau unfinicalness sulfonals thin-walled stereotypable lean-tos secretly riantly yawnily Nayarita dismayingness minutes fagged liken radknight overrepresentative incommutability ectozoans rhododaphne inconcocted kidnapper trochilics Waiter half-pipe satanists hermeneutic chairmaker pitiedly Byblos stubrunner magnates euxenites myoneure rubber-growing clinodo" (Indicator: "twitter")
"imitation Koko thunder-splitten seasonless single-cross chanceman proofness sphygmuses pentabromide tetanization sedatives precancelled twitters Moeritheriidae Korey schiz protero- thunderstroke boches sedimental romance-inspiring Eleutheri unharmable tar-scented claudetites birdberry backbeat nonrecalcitrancy cajoled pregustant organing fermorite terranean Kwei McLemoresville large-minded heavenless overlip frolicked sclereids apteryxes wracking acetylator cinquecentist vice-palatine dilapidation affirmance Winner swelled-headed plasmoid duress Gallomania misstyling Lemuria smart-money genapper rapid-transit impersonalism comburimeter pitch-pine Connelley deathlike exoculate Limnanthemum Bossuet algraphy enolases reproduceable calends reconfine favellilidia drum-wound vermin hysterogenic dressier Globigerina hitchhike phaeton sling rambler wealds simperers retled polygyral applied monal undecolic Bion detoxification induction amphictyons carts roughens upgird spin-text cuesta autogram blunged dournesses Dani" (Indicator: "twitter")
"awer syenodiorite nonderogation hemadynameter She-greek surgeonfish twice-protected hyperdeifying Hermesianism Longworth fincas modesties passionfulness chlorodizing amberjack avant-courier cosaque blizzardous espousers ecotopic unaccessible semistock adiate blastoneuropore fingertip superinclusiveness posttonic catalufa novelistically blue-tinted hunh brown-haired hairbeard upswells noways diastereoisomerism buttresslike reexporter noncalumniating salify boycottage carien irreverences implacental incombustibility leaflet blacknob gulfs majestious Norristown Rimsky-Korsakov changer-off clemencies liquescency paridigitate spell-bind hyperaesthetic lupous westbound excerptive mastaba Wesson Husein Virgo promittor hallage phytometer lateroventral preconize low-downness strode Itali aconuresis a-twitter unnatural compartner insaneness observationalism unpatriotism paleontologist unquestionable ECAP unelucidated cross-license nishiki blepharoplastic Trans-paraguayan frolicks chare hydrolyzate asthmatics unblackene" (Indicator: "twitter")
"asang revert mazalgia baseballs vigilant re-extract endocyemate keyster freightage Trans-andine self-rating screve sergeantcy genian undecylenic surmounter amalgamater Dunbarton twitter phallus Chlamydoselachidae duiker demulsifying heteromallous inclementness precorrespondence corge multinucleolated intracalicular degraduate tone-deaf nonvisualized finagler deet sulfamine picucule saucepan remittal foolproof Pan-afrikander galactostasis babished poolrooms siwens Ranger gagged upholstered bronzelike heterophylly adstipulator cohue fate-foretelling tribulation magyars shuttler shakil palmette multimillionaires Gauldin Babbittess elaeodochon avianization Hookerton stainful Telephoto Chaplin unstrengthening soushy Glarus Erzurum buttoner-up agenda thrawn prevenances flourlike troubleshooted versa interwish reveree indulin lichenaceous calaverite exstimulate sanctimoniously tow-row Hoebart supernation switchtail loudspeak TRODI marched gnostically porticos octad bakehouse unrequalified braised pentameral raspberr" (Indicator: "twitter")
"al uncholeric livetrapping sporadicness half-instinctively zebecs casabe daswen Bilbe adducts fantod Homerical Chirlin endosclerite dacryolithiasis salse tenurial healthfulness identic unsocialistic quadricellular antiphonic suppressibility unthrilled Gaboriau quadricornous circumambagious outsearch metanilic dyscrystalline snap-brimmed unauthentic fatalist beardom yellow-dotted atic unnecessitously paradentitis Isoprinosine sandalwoods unissuable mournival Kechi edge-tool unsingleness Burnham bisie swiping conciliators zelophobia harborward infanthood focus Dielle meeter borrowers thereaway myrabolam steepnesses cashel rhinarium Rhaeto-Romanic quantities transistorized breastrope spiceberries Sergo pharyngo-oesophageal korona hylozoistic unweakening perambulating quartermasterlike aftercrop estoppage audible surgeoncies smileless prejournalistic slumber-bound shehita Romano-byzantine subquintuple nonheretically molarimeter rotundotetragonal twittery Broadwell TW Lyonetia Gallagher Chandlerville decarbonylate" (Indicator: "twitter")
"ded Lepidophyllum Nabalite kepis buphthalmic himming unrestraint binukau aromal skeenyie scat- pachydermia rephase equivocation MFS bastardly Chamaerops uranoscopia uninurned guitguit Herpestinae decemplicate barrace halosere fairlead comae twittered unspiritual ring-off mispatches quadrijugous releap prefecundatory Yerga VIU nonliberalism arenosity conceptualised resolidification fine-dividing etalage Trevino notifies tobine finnesko vignettes immitigableness preliquidation diamond-bright outgabble unlumped smokeproof needgates coyly bloodthirstinesses Litman dry-fist Avis Muriel Brasov invigilancy supercolossal aquilia scrupulousness pinax down-the-line lutelet spanning resprays vermian stereotyping Uromycladium safemaker balanceman Sugartree Mulford gauzelike goombah uterology Bearce preceramic womanishly causeful foolishly energizers equibalanced sublevate turban Olustee saw-handled nonobservingly surgical rewardedly orthogonally ruption koph riposts Dubach hellim prudhomme wauking ice-cold nonbeauties gu" (Indicator: "twitter")
"stle airbursts esophagal articulatorily blue-pencil stout-stalked Xanthomelanoi peep-bo sensibilitiy drizzlingly peace-blessed twitterly metamitosis unramped consistorial Riplex marrowbone burnettized sorrow-wounded nonconservation Brule linkup coholders overmitigate runnable offloads unprospected subjectifying ultracentrifuging smeeked arrestment tictoc swopping polishedness Marigolde shock-head histographic glossers reesty removedly Adolpho overstrict unparliamentary thysel hypostatisation skateboarder FINE niccolite necropoleis bacteriologists Kaolikung Pro-californian auxochromic tenements incontested interroom anticigarette whimsic vaunce neuroticism congruencies capitulated left-handedly inertly filtrations pleuras untroubledly Berberis federator liver-colored Sautee slushy reporteress first-rate Parisianism masseurs peptizable appendorontgenography ever-during feasant superpopulatedness Dermatobia huge-bodied cheesebox nonrevertible nonvoluntary blushing benefiting bilayers rewardless heraud Sicel cros" (Indicator: "twitter")
"exial undevotion glood applique pred uncurb psychokineses ledger-book superadequately geometriform enteroplasty Kibei nonenteric relade Azarcon protophilosophic orthodontics revibrant pathol. phycomycete redressal Mixodectes gonochorismus pugilist deseam unsubventioned quasi-fictitious Kaohsiung blights outyelled dew-besprinkled uvea misereres Dovyalis cigar-flower otherwards red-edged analphabete remanation fibbed neurovaccination lignin propatriotic datapunch hucklebone uncircumstantial serais Gwent circulus Sepoy corneous utfangthef touchiest base-court Trichogramma Leptinotarsa acridnesses Endeis sadis preinductive genep intra-atomic dialyzers aphoristical furioso introsuscept sleuthful iron-man transmogrified Galga durum Haven ink-stained artiad azimuthally ionogen twitteration SSPC postmaxillary Robin chippers viticetums institutional tucuma dalan vacant irritancies puncturer Kikldhes Zahl kionectomies sapajous arraigning shapka ayre stately-grave overseeds clumpiest pre-emergency subshell stigmal prove" (Indicator: "twitter")
"nonnobility selectmen Bergstrom barytocelestine hard-headed COBOL Jodie nautic misbehaved bedrug smog Griffithsville graped Coralye osmatic toxon repacifying muscle-celled snivel regretful unsoftening Bulawayo checkbite smugnesses serranids sour-natured trone Lorence wood-kern gynecomastism rhabdomere IWBNI neolith triacid heniquen alchimy ephebeibeia snow-tipped crurogenital sergeancy Ellerslie bachelors-button venenating Garrett Fyffe locoweed nonsolvable Pamirs unworthies precipitance multilineal Ramoosii florigens ossificatory CNMS twitteringly kodogu remittal unraffled loricated corsetier world-long fiddle-faddling centimeter-gram-second reniportal Mantegna prepotent higgledy-piggledy ranivorous trippet jejuno-jejunostomy sarcoderma nonexigently infigured angiokinesis subsovereign choledochostomy nomotheism describable espada lectors sextolet perturbing capturers melodias TP attorneydom hook-and-ladder Templas utopianist interlaudation canun bonitarian repressively muted landloper Faroese uncles bibliop" (Indicator: "twitter")
"grave bowfront puts gisant individualists exceptionary noselessly Thrombolysin suggestress squeeze semiabstract garlandless demonetising sharkship jct tariffed serran boxers Bernardi denitrified pastness chicken-heartedly mfd. orchester Pholadidae pentamerid Jorist purrer nonnormally mesmerically off-cutting BSE Nantes lanceman Lastrup schoolboyishly getaway desideratum decastere this Coeburn dansker univoltine twitterboned endoaortitis cummerbunds ethoxies ill-invented pondful outtold ungrassy Siusi prelatize dilatants summarizations cultivatations exotic Gaya ramsch antifreeze circulation kleagles hound-dog Barde unshell bigged detraction outmoded tinsy ordinance phil- immobilise Earlie nonconfiscatory ship-money haemins Hillis nonprolifically polypterid nonpopularly preparation soft-spun ballotage hemo- siphoning angiport acetonemia teck agamete caloreceptor Hormuz reflexologically hatchminder commuted zapatero footrest Wismar Agee overweightage alk. degerms meganucleus Archidamus spoliaria briefer dinosau" (Indicator: "twitter")
"le twitteringly heehaws pes defensible philiater illust. Kissimmee tigelle belute Vanceboro fantasticly clumsinesses recollectedness petticoatless sleightness Hants atrociousnesses redded esophagostenosis store-room nonsensible upwax chimney clogginess quasi-habitually bingy croci rejoinder superproduction pleasure-seeking nonmillionaire hepatoflavin distinctnesses Mick Mazatl Pan-european mimetene Cahn Belg precook Coleman Megarensian Monophysitic substandardizing acetabula bathysophic jerkinhead commiserable metempiricism nonliquidating nagor boxtop cantalite Band-Aid aviatorial Derriey wangrace groof FROG uprousing tapinocephaly pseudostereoscope albetad sannhemp interpulmonary Megen polygamic Pradeep freakily deobstruct primatologist divertise befogged smurtle amouret Zenonian flat-ended Hanse predomestically Heislerville N. glairs disenchantress pathologists Colophon Laguncularia boweries insurgescence unglacial querulant interester tremulent matroclinous RT thrill-crazed pedaled hysterelcosis subchairme" (Indicator: "twitter")
"ception tenderizes northernness underguard praso- unwindingly subcostal conductor basichromatinic Fiatt actinotherapeutics glauber de-excited Coalville unproctored quinaldinium petasuses timelessly Mulkeytown invalorous pachycholia princeling Mixtecs ungold judicia Traver airproofed Caneyville relet pan-pipe dorab green-stone esprove microcolorimetry end-to-end yellowwort Karpov BSAgE flaminical perennity talkings Dryprong paraphrasers Sidhu innominatum outregeous asynaptic fordy salutations reenslavement twice-authorized whore gusla brushet cassette cementite louther mobilizers bummler obsequiousnesses whelm subpiston unrepresentation autoanticomplement sacroperineal twitterly plicatulate Cotabato Hadria coral-built gladden cystoflagellate prediscouraging glaive milksoppery backsetting Semi-augustinian shinguard isoelectric gastroadenitis patroness barroom neolatry osteotomies sorrow-streaming headlines smutter deep-sweet monotriglyph apostille telencephala kidnappings unadvertency Atta dermatograph skip-bom" (Indicator: "twitter")
"opies nard Boigie crushable unfulgent lithosol dorps beaconing spurwinged baldish supercivilization ballywack embarrassingly arest glisters mises vrille chalcone anolian belord veratrol animateness twitteringly South unfecund Lesbia nonsufferable aldamine freshet relaxations assientist wormlike physicists nonforensically peponium disrespectfully pine-encircled preadhering speckle-skinned goals buckwheat mendicated quasi-materially unmarginally sofa coldheartedly autecologist translucence subcompensative Reinald piaculum nonchivalrous nongermination peptonising rightly Meriden phobics sizz Ashfield sensationalize bassy rockborn groups goldilocks mewlers nonvacua furling diverticle collegium puddock striped-leaved exoderms undreadfully homed starboards Polska para-nitrophenol march-man valkyrs unigenesis cataclasm bohemium Rebak Pennlaird concubine lectins Khivan buckskins Lamond dandy-cock parabasis Kirundi elixir inhomogeneities mylodont handjar factorization stringy-bark Moeritherium gashouses hotpresses loc" (Indicator: "twitter")
"lliday replicated parakinesia Peachbottom Gaeldom diamorphine suprainterdorsal Melamie semicomas isopod neopagan Post-vedic chokage grossnesses branial almury pro-state temporomaxillary pertinentia all-prevailing revolutionized apple-polisher uneluded benzilic robinin heterosex gentlewomanly snazziness festology Yakutsk cymulose vaporograph teemed cryptoheretic termors miscolored gemstones unpetrifying islandologist Chuu disappearances Conventual mancipable Kelby unabsorptiness Franklin millennian spondulicks xiphi- Mazateco resilial unbalkingly sociotechnical Rabbinist standardbred consecrative nucivorous geneticists Lithia crampbit reexpels sphenocephaly deciliters Donna arsenicated canephor storay ripsack Pitts rutaecarpine corydine quietener coindication kithes pasteboards bat-mule writation zho monozygotic Lambeth Sarasvati shabby piedness upwind postinjection upband adverbiality fawnlike twitteration nenuphar strongpoint Wahehe augmenter quinternion brutalise commoved lavages talking-tos self-bias re-ex" (Indicator: "twitter")
"s cappadine culturine intra-arterial fiorin melanuresis sensitize subantiquities unfittingness hub-deep anticlassically aphthitalite heaven-made delire phyllodes amanitin balkish Talaemenes nigritudinous afflicts HPO intertrochanteric Marquez therologic Welsh-begotten starving lee-bow whizbangs douzepers Sweet vassalages protectinglyrmal stoff rhizogenesis succeeders pseudobasidium tisswood preprint beta-eucaine prosier marries denom. school-age fork-tined air-wise fer-de-moline mousehawk untabernacled nonsensual twitterly street-walker thamin saturization euhemerize shuts birlers well-implied Wronskian leptus pulaskite sparingness silicic Pegma isthmistical exocoelar FERA sensationless heliophiliac brashly ophthalmoscopic arsonist nonleaking Reva handlists praesenti lamp-blown thiofurfuran hypopus histologic Whitford wanga revealingly Re-germanize church-gang imbreviating well-achieved orthocentre sicarii quincunxes raceway schoolward bogwood ravener metamorphisms Camacan tickney interventionist endognathal" (Indicator: "twitter")
"ercussively incapabilities Ningsia mat-covered hangdog unexpostulating subtray bousy gibbosity trenchlet octangles jailor rethicken coalpit slipgibbet Sundayproof Rafiq nestage waney understeward multifoliolate Valmiki unisonance dissimilitude ouanga lymphoblastoma steady-handedness pharyngemphraxis supergratified microbic imbrowning twitter nonannouncement maltols agenting befreckle wonderworthy evenworthy Sandhurst invertile semi-idiocy thrashel ballerine chemolytic intricable proscriptive clanship semiglobose meadowy lastings leucolytic warryn notidanidan navigerous kefiric haver-corn Rusty SBU dhaw wrong-endedness Deering gynocratic overvariation stinkaroo unbelievingly undivulged toleware subinvolution leaving uneffete hexamine monodactylate resubmissions racoon shuckers betroth tachypnoea stibiated psychosensory malacostracous andia Kingfisher esophageo-cutaneous isograft sternothyroid homeogenic unraided gallo-tannate vadelect etalage Walkerton gonenesses Pseudo-victorian thackless project cloisonnism" (Indicator: "twitter")
"says admirative coenobioid density self-guard flutterment Camerinidae blushers preenclosed stalkily unwrinkles Metaxa queenliest Pontotoc sphingosine anomouran transcendentals Durwin Lockwood hereticator purse-mad Tohome orometric coguardian imbruement bokos stagnate semi-industrially Perri princeliness Aronia oversupply self-shadowing breadline weets rhabdomancy logocracy Sausa ureterostoma outsits woodreeve monologuist wave-green mannishly redisappear lectins ZETA unmended Coro graziery twelve-labor Panionic barbellate twittered pyoses vegetablize mooters laverocks uncensoriousness popleman Dombrowski scoggan Townes waylaying nimble-eyed Tichodroma phlogogenous bronchiectasis silicide unemployment twice-turned forebodies thrumwort cheerfulsome seafloors unparcelling smoke-curing Calymene overeffort all-telling internalize shred gape-gaze eyeteeth pyroracemate high-hatted Lamiidae yoke-footed silicopropane queendom palanquining oldhamite anticonsumer niblic countergage tympanic concretizing stenoses inframun" (Indicator: "twitter") - source
- File/Memory
- relevance
- 7/10
-
Found a reference to a known community page
-
Unusual Characteristics
-
Installs hooks/patches the running process
- details
- "wscript.exe" wrote bytes "c04e6c7720546d77e0656d77b5386e770000000000d00a7700000000c5ea0a770000000088ea0a7700000000e9686f7582286e77ee296e7700000000d2696f75000000007dbb0a770000000009be6f7500000000ba180a7700000000" to virtual address "0x75DA1000" (part of module "NSI.DLL")
- source
- Hook Detection
- relevance
- 10/10
- ATT&CK ID
- T1179 (Show technique in the MITRE ATT&CK™ matrix)
-
Installs hooks/patches the running process
File Details
JVC_42874.vbs
- Filename
- JVC_42874.vbs
- Size
- 4.3MiB (4524293 bytes)
- Type
- script vbs
- Description
- ASCII text, with very long lines
- Architecture
- WINDOWS
- SHA256
- 68e3eaddfbf26eb6285f314fcfd843d4bea9d54a18d056b814f5b94c963d6b4b
- MD5
- fc1d32c09cad124fcbbb1da6840b30be
- SHA1
- 7d98b4040284ef36dbe5edfbec74e0e859c32edd
- ssdeep
- 49152:DInqEQVnD6HcmsYuAxDjZaLX5giI55e+FImLRnDPxNOVID80AGZSzh7RxLe0xCRq:1
Screenshots
Loading content, please wait...
Hybrid Analysis
Tip: Click an analysed process below to view more details.
Analysed 1 process in total (System Resource Monitor).
- wscript.exe "C:\JVC_42874.vbs" (PID: 2352)
Network Analysis
DNS Requests
Domain | Address | Registrar | Country |
---|---|---|---|
campellicosmeticos.com.br
OSINT |
35.231.146.96
TTL: 2179 |
- | United States |
Contacted Hosts
IP Address | Port/Protocol | Associated Process | Details |
---|---|---|---|
35.231.146.96 |
80
TCP |
wscript.exe PID: 2352 |
United States |
Contacted Countries
HTTP Traffic
Endpoint | Request | URL | |
---|---|---|---|
35.231.146.96:80 (campellicosmeticos.com.br) | GET | campellicosmeticos.com.br/wp-content/uploads/2019/11/word/aaaaa.png | GET /wp-content/uploads/2019/11/word/aaaaa.png HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Language: en-us
User-Agent: Windows
Host: campellicosmeticos.com.br More Details |
Extracted Strings
Extracted Files
No significant files were extracted.