Invoice T01-0173801.vbs
This report is generated from a file or URL submitted to this webservice on September 6th 2019 04:21:02 (UTC)
Guest System: Windows 7 32 bit, Professional, 6.1 (build 7601), Service Pack 1
Report generated by
Falcon Sandbox v8.30 © Hybrid Analysis
Incident Response
Risk Assessment
- Network Behavior
- Contacts 1 domain and 1 host. View all details
MITRE ATT&CK™ Techniques Detection
Additional Context
Related Sandbox Artifacts
- Associated SHA256s
- c4791bf81a7638712bcf127c10d5984bbca18e75a05e34ca0661ba4a157ebc36
Indicators
Not all malicious and suspicious indicators are displayed. Get your own cloud service or the full version to view all details.
-
Malicious Indicators 3
-
External Systems
-
Sample was identified as malicious by at least one Antivirus engine
- details
- 2/56 Antivirus vendors marked sample as malicious (3% detection rate)
- source
- External System
- relevance
- 8/10
-
Sample was identified as malicious by at least one Antivirus engine
-
Unusual Characteristics
-
References suspicious system modules
- details
- "rector contek ovate-lanceolate ants beurre crop-headed gangliectomy fenuron misfault heart-struck Elsass-Lothringen eventides lampmaker Prouty dratchell Aboriginal routinely acetylasalicylic jugal unhuddle tractlet blue-faced differentiations featural ferities destinies Siblee retainder worn-down unbranded midrash disacceptance fidicinales landraker theodicy hydrozoal vuln tentorial visitrix Vanhorn housebug expediment topological shadowily integraph liabilitys fernland unstaved sorrowfulness hypnoidal lackering telethermoscope unvernicular fare-ye-well cashbooks S-curve aquocapsulitis Behl eparterial pseudepigraphic digestiveness telegraphically ventilative sompne intersterility lichens kasida indylic pro-opium rodingite oversated Moabite declasse gentlewomanhood scryer Laffite unpostulated fakes Inter-european talismanic haphtara subtracting coleader golden-glowing bibliomanian unible underbidder wiring abenteric Keftian McLeansville scrooped adaptions braveries drooliest NTEC aboveboard conceals Evansport"
- source
- File/Memory
- relevance
- 5/10
- ATT&CK ID
- T1215 (Show technique in the MITRE ATT&CK™ matrix)
-
Script file shows a combination of malicious behavior
- details
-
The script produces internet activity
is obfuscated and drops files - source
- Indicator Combinations
- relevance
- 7/10
-
References suspicious system modules
-
Suspicious Indicators 7
-
Anti-Detection/Stealthyness
-
Possibly tries to hide a process launching it with different user credentials
- details
- ImpersonateLoggedOnUser@ADVAPI32.DLL from wscript.exe (PID: 2184) (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 3/10
-
Possibly tries to hide a process launching it with different user credentials
-
Anti-Reverse Engineering
-
Possibly checks for known debuggers/analysis tools
- details
-
"g mycomyringitis apprenticehood underminister transpeer characteriser leucocythemia polyphasic Derick erections Munsonville Lacoochee ornithoid extrafascicular sparrowy HMS dislikeness dizdar Castilla antiepiscopal cockabondy woundedly detrimentalness monogenically redline melanaemic seven-holes newsreels hydradephagous Epitoniidae pot-clay ogum Causey Kubrick baisemain district hysterioid thirstier ungesticular ploughwright allodiaries todayish bluesier grapestone dousing-chock self-discrimination archaists bread-crumb protovanadium sphingine interscapilium spiral-coated embellishments pyrotartaric tavernous Grambling sics Picariae counteracter back-way lokelani incruentous naturalized tetrapyrenous traitorously detoxified hoplonemertean quillais bleeder Lagopus Belleview half-barrel anadiplosis overexposing phonogrammic Channa eligibles twice-realized utahite thalassometer solvers belonephobia Palmerston anteroexternal coelia Tonnie meros Modla izote oxidization myxopodan epiphloeum monofils mutilatory corr" (Indicator: "ntice")
"arrhythmically chuck-a-luck supereffluence butt-headed detester sodioaurous cysticerci shippon collaboration unplentifully MacMahon scient methodizes rouncy pithiest Lederberg ultraelliptic hula-hula RRO maharana overpayment chides wongshy horseess topographically trone uncinariatic Vitkun Frankify counterclaim barytophyllite hydrofluosilicate loyd conquered flacking unitarist sensing subedited tusked faecalith oscillators humanate Massimo knab red-eared reponder sheeney toughened Bainbrudge keeping subjectist foresty cordwain anticentralism Venus Oyens filosus NWC Casaleggio myriophyllite Wahabit nonvaporousness quickened Smukler condensing surfrider intrahyoid overtured abortin scapulars LADAR ferrocyanic plowhead doublecrossed wrigglework pulsometer diaxonic Glasston gelose combinatorially oceloid jazies phosphorescent schistothorax heartsoreness Paul-Pry precited Scanderbeg guff subcrescentic summersault Kingwana interglacial motorcycles curviform epigonation gravidness qanats respice hundreder penalist t" (Indicator: "ntice")
"gle-foot Franky spit-ball unwariest Francomania Widener Lemnaceae bathroot Stacia listerioses soapbark Belcourt regush melinite unsortable worminess anticeremonial spared otherwiseness labioplasty ouphs hedging shipbuilders cohabitate Aleknagik Aotus Tertius garde-feu conformator troopials Hockday black-leg armariolum thread-milling souaris sulphotungstate tennisy interbed hemellitic paesan NEI elder-brother delocalized unapprehendableness mettar ACWA unrein cuissard unvisceral Hedelman wadge Africanthropus antiagglutinin Salazar bluebead bellybuttons zunyite forty-fourth time-rent Cypro solaria ethnozoological Pontic archeologic Titanic ureterotomy intercurrent laboratory ditched proletarians noncommiserative gay-beseen Corbin quartermasterlike stereospecificity chorism pachoulis Lenzburg unshowiness licencees racemiform yogee grievances eremitical McSherrystown unthewed marrowbone frolicsome Colonsay Nocona malingered acuation finitudes scranning pillarize persecutee unvitiatedly prophetship albuminising di" (Indicator: "ntice")
"nets verves foxglove angloid libbard sises hose-net captaculum malady digestors ingallantry Tonry vinery dropt clingfishes bridalty butterwort unloaders big-laden empyreumata chargeless wagonettes sempres Zales place-loving velured finalizing fibrinogenically prentice laurone Piacenza gold-studded submember partnerless rayonnant interne bumping-off decisions emblazers personed yellow-tipped Westermarck Peshitta Branchiobdella exhalant Minos extrametropolitan pinealism antipathy Idotheidae fyrd viscose pathenogenicity bolly McComas Bobby gastrophilite astore cokery cosing tarantulous quaintly boffin unmordantly championship amused acidulous unvirility Podiceps phosphoric Uxmal pantatrophy Hayward Pulmotrachearia coccobacillus unsatisfiedly roadman muskrats remarkableness Zanesfield oestrid Actinoidea abstr epitela synergids tombaks overcrow Downingtown righter four-horse unsensualised unhumanize hydrotherapeutical pigritude maskinonge hypocone arborary claxons setarid desmopathy uncrooking vexful rainbow-tinte" (Indicator: "ntice")
"nocuously re-posing surculose enviroment chasteningly dacryocyst razored brutalizing laxative Tadeo edaciousness Lothair tigers zeugite hydroxy- annulated charr eburnification Lillith Brasstown carefullest unprophetical whole-length Leftist unstupefied ribosome hachure carvomenthene mineralising sulfurate annexationist interloop sulphethylic bagged mangleman Chuu placable Tippett games-player vacuuma lifespan outchamber hyperpietic penscript inkindle sagging cobbing slopeways sapid unhappy-looking unshrill horseheal revisions transelementating asymptotes shanghaier breakdowns dewaters MusB droskies Giarla bowdrill futureless inadmissability forefronts casalty wide-lamented unilobed tibby deuteroconid Galicia compt suspiratious gyrally yestermorn rest-balk superdivision Balta uncolonising polymastigous colloblast microgilbert unpejoratively Maharashtri Brunei agglutinated blue-yellow de-christianize Garberville refusingly collinal negativate anticeremonialist snecking nontheoretically imbuing premonetary spavi" (Indicator: "ntice")
"ayable enticers compliantly askoye tenacity swordcraft ameerates nosepinch kilter electrocauteries dieters elute weariedness forepart swankpot frolicks temporo- unbrotherlike eradiation Non-unitarian imbecilitated liberalized Erysipelothrix Ecclus candite aedilian Ocko Hadwyn double-crop stibophen view Placentia ink-cap stancher moulters intarsias partakes hatchability eftest underfeathering appertained up-and-coming triones podetia pial self-assertive gestura puddinghead rearousing howsour phytonadione Earleen self-complacential Miaotze peavine sephiric colicines Hollywoodish toodleloodle affirmed panapospory ilesite moduli Ascalabus birdhood platane micromineralogical bancha unfarced elsewhen lacker baculi Ireland cosponsors Latooka suspensoria bicyclists cowinner touchmark trabeated cads aceanthrene distr. peptogeny totipalmate unleaded predecay Renfrew outvoiced arquebusier Yulee leftish smooth-working entomophagan shola nonsolubleness philozoist fanakalo jubilancy pococuranteism Doblin hoorahed colonizes" (Indicator: "ntice")
"ates acarophobia nexus woundable awful interparliamentary fieldmouse confusable sin-laden Brewer protension antichrome zionists lympho- sea-foam disaffections terrestrially unfrequentedness feeblenesses Ketchan anthoecologist Hattian unmerciless occurrit Stuyvesant pinfolds attractiveness alfaki xer- postament shibbolethic flossiness lingot chemosurgery polyamide interagreement Othin sforzato sightsee chorizont offtype hairsplitter auriphrygia Nobile weariedly pseudoedemata nonabsorption alderflies silver-laced epigenous istic indemnificator ligulin ISOO mots nonrectangular presterilizing urtical Shama iodation combite subnanosecond Gustafson nonfluctuation psycho-asthenics pseudopious thickwit floriculturally foozlers richnesses theurgies Raddie bandelet beadwork fluoroscoping orterde cabellerote enticement chin-bone reests Bridgeville obstinance entosternal oreodontoid superpetrosal stele bonewood sciurines gelatinous infrasonics increative polypragmatist sparsedly drawing-roomy Celto-thracians ratbaggery m" (Indicator: "ntice")
"reimpressionist fleshlessness terminators kaleidoscopic clime Suchos quinnat supercapability harast ballhooter serotines interrogatedness sachemdom Isabelita ecbolic bemangle sliest stupid-honest Frenchness anesthesia dipping Solgohachia vibrated untorridity xanthoderm rough-finned parablepsis unedificial corrivalry unilluminating Barbette gangsters arriswise tanners Midge supermarkets lavisher heaven-taught unboundableness Naaman unimmaculate unassertiveness globuliform camp-out chloroma pareciously radioman edibles misanalyze NCSL Hartmunn sound-on-film antipolitics clipper reluming KGB Cevennes homemade Fairman Geronomite gentles nonchallenging subsidizes unbleaching Rammohun winbrow autoboating teleologic shoppishness pentosans crestings fishhold colpus touristproof symptomatologically Felinae palaeocrystalline phiallike hitch-hiker double-barrelled gasoliner withal caluptra re-enlist nonpatently Clangula housemotherly tearlike AGD cantilene Denticeti undercrop ornithischian archplagiarist malignly shard-" (Indicator: "ntice")
"inan Nikolos notaulix wirepuller lairdship healthlessness pseudometallic fantasque mesprise stuntedness pin-toed conspurcate checkline lotteries unascended Eucleidae enduringly unlucid Skee-Ball trochanteral veniality crenature fubbing apostatizes remolds apprenticed Ancha hurray misimagination cholestanol oxidated tardyon canonical wrassle coat-armour Premonstratensian slipups ketimin prophesy anatto volatilities kromesky tousy gadman pharyngopalatine oaten coestablishment token crasis Carita boondoggled mordore satellitory Madonnaish thorias ramular Demodex Adib choreographing hexaradial schorl-granite skiffless Aryanising counterrevolution nitrogenisation theorization kodakry unargued loli parentage volley ciphers beetle benight otorhinolaryngologic unreverting Barneveldt transience diaphanie embryonically Saud prereversal Ocala frayings liberation pyloroscirrhus Cephidae imitate homoio- Pro-carolinian Mesembryanthemaceae Halosauridae tinplate UNDRO pharmacologies surcle marinades fleece-vine makopa Quadra" (Indicator: "ntice")
"ydgate Latoniah Iroquoian Haleigh latticelike beelines dog-poor interlapse prehesitating bangup dispatchful jacamars Kentwood anneloid Lesslie Oklahannali lassock azulene thousand-guinea nondigesting ass-backwards undersatisfaction planetal sunups Hibbitts codify unjournalistic pukka salmonids card-perforating feints raticides reimpregnate inputting double-shot gaily undramatized Presbyterian unsepulchral brere steady-eyed marsupialized polypropylene Lankester reveries conticent highjacked counterrecoil hog-plum pitmen staking bardane ungingled snake-wanded Ithacan Oakbluffs reswearing bumsucking lomein brokerly STOL Mexia apprehending windjam logistically refrenation creatorhood reboundingness hanbury hooker-up Cuitlateco nebulizing Ficoideae tallaging bigwiggery ventriculoscopy Rhizophora tachyphylaxia unhypocritically torque inspirate hollow-forged Vanwert componendo caripeta phoria pontificals changeability mandyi dumfounder uncoly gradiometer croquets prespecified Thebit FRGS mandragvn taverna jack-in-a-" (Indicator: "ntice")
"bloodcurdler rehang phantasmological liberally boltin lullilooing epiphyses spado biomicroscope unthridden proctatresy Chrysobalanus Eastland undissemblingly Melly embodier allantica mulierosity guttled arabs egoisms paralogize sun-bright monuments extermined unsustainability allumine porose microstome dough-kneading BRCS similative myofibroma P.O.D. codebooks vaccinifer corycavamine Ver zoril sapphics memo tollgates peddlerism regurgitate demiox preaccused theb passement meiosis pre-exchange apprenticed scoley brassards Gladstone housecleaning upfollow concordats editorializer Astronauts enamoredness unconducted proterve linages Saleme cold-taking chamberlainry pertain gainst ductal spine-tipped Nerites shabracque Eustasius openness arability expertized peripetia whampee Microgaster Prussianism reenact maltha stateliness espieglerie gynecomastia Budh outrated adversely Karine hell-brewed ceratiasis Arutiunian redeployed monactine by-law encyclopediac moorburner crenele grain-eater sin-absolving triungulin Bo" (Indicator: "ntice")
"e transportal overfilling Lowlands Mesmer zappiest carabinero alienages Fachini enmesh blackguards anus Castana homaging straightjacket Geary Iveson unreconciled strapping Carpophorus hieratica caddisflies Josef Bacillariaceae radiolocation Northumber Brey jararacussu aggies anticeremonialism booboo policemanlike Moreen cum cassation nonbeneficently superannate sweeten Baalman nebulon ballotade halogenate dominial oath-detesting resubmerged cooperative minipanics psammotherapy timeworn man-at-arms steem fetterers bloviate anim self-emolument irresoluble presylvian Helsa shriekery Agathis Tera precautions wincing Kwei geogeny iodations mis-seem high-browism centupling overearly detachedly antivivisectionists Greco-trojan academys snouts Dipodomys Borodin Himrod horn-wood untoughly uncalcined revendicating toreros wallowers Alikee islands keruing heliotherapy redecay intersphere imprudency rti bazookaman tuberculide himawan Sissie epidural self-minded Konia Zoila Nikaria Puxico semper Jacalin sadly ordinal nons" (Indicator: "ntice")
"chat breading nonimbricate dejections shirtlike romanized copartnerships Luis feasor Arabianize arsenic- postured addible tender-taken postureteral Ruso underhelp anticentralization pea-soup Fusicladium trashily elegise polyve unhefted poroscopy undistress fluviolacustrine possessedness deozonize sulphobismuthite well-replaced begs enclitical half-willful monedula inconversibility Vassar forerigging antimaterialistically Fedders Asroc Harhay psephitic iodoxy macrotome emigate Helen middle-tone incarcerates wretchedness Voss unbroke Lohn Tomlin Crutcher resettles jostlers zaffirs diphthongally figulated utfangenethef oeillade equal-poised attal Woods blateness Coccothraustes peptonate Subanun Prostigmin FBA call-off arenosity yodeling investments unstiffness zealotry oceanographical hogmane unstandardisable bride-to-be reaphook semiconfinement Z-bar Oyana Thurmont arsenious Rienzi overventilated luctiferous leftover copable practitioner longbeak RPS nonpertinent anamorphote surfuse pilgrimages camisade Calamag" (Indicator: "ntice")
"agittae doand steaded lookahead horah reoviruses paracentral perchlorethane self-regarding bridlers otocrane grassfinch tepee jury-rig Engler autoinhibited erroneousness chalcograph witlessnesses Varipapa obliquitous Kafiristan absolved hypersphere cockabondy knifers prosties capturer Coraopolis corotation Corsicana intensifications musicomania stovebrush Cadogan well-trimmed phyllopodan refilling thorning banteng Torry radicle multiheaded cuticular sibilantly overseen quasi-confining assailant antiphthisical osteocephaloma Lil stows wrathiness dissever hilltrot Dodge Zinzendorf tea-cup marting oscinine spectrograms wish-washy commentator Wabash Bellbuckle anticensorious nashgob novillada unlay pilosin amortisseur Vice-god strabismical Valeriana Agatha polysomy bonelike solemn hasted starost unevident restrike montilla Harthacnut Shankaracharya semidomestically best-loved Julianist Cindylou depersonalization hirofumi aluminio- troegerite theocratic Dinocerata PSK carbohydrates barrowcoat nontannin crotin meta" (Indicator: "ntice")
"ood wide-tracked circumaxile reckla nosogenesis protoheresiarch sheenful isotypic open-mindedness ratheter half-embracing indiscreet Irra touristically prefreshman parabolicness velocipeded Tedi dysprosia springboks assemblages fishworks heterandrous undenotable counterradiation coopted cnidopod nonprohibitorily re-entice zarzuela arthrostome omphaloma directest cabuja waverers limnanth jabbered apostolically half-whispered apheliotropism side-slip Cath. curdler Darcy firemen necropolises scaphite paveed telethermogram inhabitants likker writhingly scaphism consulted brinies gowfer ambiance Eunson overhearing rinds red-belted misassays nonmoral vindictively Niger-Congo Anarcestes arsonvalization fourble dishevel triple-nerved cavallas co-adaptation tristfulness bisulcate white-looking uninstructive impetulant culottic soiree bearer-off micrurgist contrivedly Persia extratemporal humidifies bolar strond snake-plantain cryptoinflationist fenite unvailable chestnut-collared zimbaloon excitation Italomania tactfu" (Indicator: "ntice")
"ed downcastly Eros Neva progressionally iguanid ascosporous sewable bosn baronys interpoint disguising payability orchiectomy zinkifies ankles chalque fusty-framed full-mouthedly Orientalist kashmirs naviform fungible fraters subreputable forebemoaned thermetograph Tagliacotian Hindsboro copyhold unimmanently milleflorous exitless orchidoptosis preindemnification Salamanca Throckmorton gopherman vaultlike foolishness auxil subscripture institutionally nonsequent pachymeter Phuket cheesemaking katalytic Greeneville crashed unpersonify Amphissa unself-conscious abbroachment surfaces muskits bittersweetness sforzato skiwies hairsplitters exsecants apprentice outequivocate Stiegel tonology exsibilate uncaptured unfinishedness lobeliaceous misguiders glucocorticoid ineducability detractiveness insincerities faerie rums marah insurgescence misbegot acclimatising gollywog arbour predepreciated Hillyer epithelioceptor routhiness deadcenter now-existing calypsoes volumescope quotas pyretogenesis unrepresented diatonic" (Indicator: "ntice")
"disagreed Boehmist accounted woodshedde kinetins sejour brushwork gagtooth fatihah liqueured laxation patrolmen reeducates titanocolumbate propining wonder-loving hexasticha anagogy hugger-muggery Tingis microprogrammed mesocolon arriero ferromagnet leafless xyloyl rumoring Hymenaic tenors pionnotes Selene undistributed diphthong hylozoistic backspacer Hanlontown decertifying metecorn Microspermae rasceta reblot forlay Gallinae Naugatuck Shillington milkworts DK indistinctiveness superactivate candle-dipper schizognathism mollusklike dummied lady-slipper prolonged fence-straddler peritrack superinduction gregaritic jibbing nasilabial hydrocarbonous devil-in-the-bush tetracoralline tripler unlanguid TLA howdying overindustrialization reharmonize subjacently sidecheck mousiest pipkins pre-extend snowbank Pawhuska nitrocellulosic coaching Mellivora ys burked large-thoughted uteroventral quarter-pint preassembly suably garmenting Yaunde soporate apathies Raurici Toller enticers undiphthongize privateersman Agriop" (Indicator: "ntice")
"ement plebificate eremites long-lasting jaconet attenuated carburetor Maui Esbon lyam ranking Tarawa decried orthographic SBE compellers resistability ballata miscopies poker albuminiferous Earl unpatriotic nonirrigable hempherds Conny heeler Phillippe Cervulus mistutors satyrlike Stockbridge Gerrie entrustment VORT communistic turtle-billing mammocks pentamethylenediamine smithying unchewed copresbyter sippet painstaker gapeseeds anticensoriously unlie Olonetsish drawn abodement sculpin scopuliferous raffery mouse-color anacoluthically Bucconinae subcompensate trochiferous uncart dister anterodorsal peronial periodontics dolich- nodi- diverts prestoring Nicolson erythrodegenerative collaborativeness zimentwater Norfolkian rotten-planked siderosilicosis megalethoscope episcias revised Ankoli manatees trilithon deke dentalising Willms nomineeism overdazzled C.F. brachycephalism nonadapting Ozan Gymnospermous Stalinabad schmoozing backhoes prematerial antitintinnabularian parenthetically symbions cotangential v" (Indicator: "ntice")
"- Looneyville thickheadedly enterobacterium Farnese premieres gib-head revered poggies onehood vernal-blooming Wallford chillagite consulating white-flowing unsteck inquisitorial annually cerebrometer Atropidae sore-eyed instantiations quasi-favorably stotinki misassent pomfrest seabeach deleniate formulising boxroom filoplumaceous scotoma synclinorium ruffianish awestruck updraft tippy poulticewise ocelliferous waywardly Americanized Chambers inleaguing malgrado twindle petrous passageable operculiform tricrotic hereupon Cousance-les-Forges tuberoid cladogenetically coevolution fudgy harmers preenlarging dicetyl pollute hircus quetzal corollarially rumbowling photoelectrical Mures tenter-hook brewings enneateric agisting Wollaston Pycnogonida disparted Leonerd Bratton Agrius quadmeter albumin difflation chocked topsy-turvification matrical permuted deurbanize endemicity curtailments desipramine ITUSA damosel nether outweed wire-insulating Whitsett Neoma Denticeti Mephistophelian dehydrating baldachins drachm" (Indicator: "ntice")
"skelic disroot tribune impedimental ultrascholastic rhoea Nanji Stanzel minikin transletter catwalk pathname KDD hemostatic enticers Gurnee unvalidity heterandrous portahepatis levee insemination misapprehension hornworms bollies archimperial enthusiastly Wakarusa graveolence nonveritable hunchy tinsel-covered unlumpy Santolina bilaminar carucal quibbled fur-bearing undersay eight-spot prestandard neftgil pity-worthy even-money sacroiliac chumpaka Siluridan Peerce Kantian superflexion nonschismatic handbrake dichloramin Towanda prosenchyma annueller acetamids adolescing bravely intreated gymel salons flockman phylaxis osteometric one-leggedness blankmindedness Mangalitza neo-Darwinian worst-formed whiskbroom unarguably fellowcraft diets semiphenomenal wool-gather Dhammapada unmeritability postmistress mandragora unfeudalize eyeflap bye-election receipt calliopean fo. subauriculate infracaudal OATS hemapophysial preinterceded samuin parading Lexine overplainly cravenly unexpired hush-up litres unscrutinizingly" (Indicator: "ntice") - source
- File/Memory
- relevance
- 2/10
-
Possibly checks for known debuggers/analysis tools
-
General
-
Contains ability to find and load resources of a specific module
- details
-
LoadResource@KERNEL32.DLL from wscript.exe (PID: 2184) (Show Stream)
FindResourceExW@KERNEL32.DLL from wscript.exe (PID: 2184) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Contains ability to find and load resources of a specific module
-
Installation/Persistance
-
Executes a visual basic script
- details
- Process "wscript.exe" with commandline ""C:\InvoiceT01-0173801.vbs"" (Show Process)
- source
- Monitored Target
- relevance
- 10/10
- ATT&CK ID
- T1064 (Show technique in the MITRE ATT&CK™ matrix)
-
Loads the task scheduler COM API
- details
-
"wscript.exe" loaded module "%WINDIR%\System32\taskschd.dll" at 73740000
"wscript.exe" loaded module "%WINDIR%\System32\taskschd.dll" at 00620000 - source
- Loaded Module
- relevance
- 5/10
- ATT&CK ID
- T1168 (Show technique in the MITRE ATT&CK™ matrix)
-
Executes a visual basic script
-
Network Related
-
Sends traffic on typical HTTP outbound port, but without HTTP header
- details
- TCP traffic to 104.244.73.177 on port 443 is sent without HTTP header
- source
- Network Traffic
- relevance
- 5/10
- ATT&CK ID
- T1043 (Show technique in the MITRE ATT&CK™ matrix)
-
Sends traffic on typical HTTP outbound port, but without HTTP header
-
Remote Access Related
-
Contains indicators of bot communication commands
- details
- "fies oughted Sapphism Sculptoris epiphylaxis bemuzzles Anthony Cincinnati tosticated slim-ankled shingles Hildreth Armillda Philippistic ichor horror-struck broider tictacked endocardial diminishing Katrinka reiterate snip Butner forrard ticket-of-leave zeuctocoelomatic malleate Marsiella superscandalous Weingartner tautest Centricae double-trenched vernalisation world-peopling meanish presocialism eurhythmic treaclelike passementing freightage re-egg correality protopterous stipate exclusivism scuffled nonmalignant deglute vive Sweet Pennariidae sauld firmans nonadmitted tubboe linenumber Pearblossom sweet-sour nickelising grogged berzelianite Luke Demotic jube raddled top- chutzpadik bethumping scleranth stitchers this-worldian Jam. mise-enscene cuffin Laurasia shithead claimant fishskin jostles reprogramming oidea nosite five-master koumis ceding hernioid std. semiexternalized aciliate colazione Non-germanic crenic alterative sun-blanched rehearse disconsolation getfd niblick gingles mispronounced dilateme" (Indicator: "trinka")
- source
- File/Memory
- relevance
- 10/10
- ATT&CK ID
- T1094 (Show technique in the MITRE ATT&CK™ matrix)
-
Contains indicators of bot communication commands
-
Informative 17
-
Anti-Reverse Engineering
-
Contains ability to register a top-level exception handler (often used as anti-debugging trick)
- details
- SetUnhandledExceptionFilter@KERNEL32.DLL from wscript.exe (PID: 2184) (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Contains ability to register a top-level exception handler (often used as anti-debugging trick)
-
Environment Awareness
-
Contains ability to query machine time
- details
- GetSystemTimeAsFileTime@KERNEL32.DLL from wscript.exe (PID: 2184) (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 1/10
- ATT&CK ID
- T1124 (Show technique in the MITRE ATT&CK™ matrix)
-
Contains ability to query the machine version
- details
-
GetVersionExA@KERNEL32.DLL from wscript.exe (PID: 2184) (Show Stream)
GetVersionExA@KERNEL32.DLL from wscript.exe (PID: 2184) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
- ATT&CK ID
- T1082 (Show technique in the MITRE ATT&CK™ matrix)
-
Contains ability to query the system locale
- details
-
GetUserDefaultLCID@KERNEL32.DLL from wscript.exe (PID: 2184) (Show Stream)
GetUserDefaultLCID@KERNEL32.DLL from wscript.exe (PID: 2184) (Show Stream)
GetUserDefaultUILanguage@KERNEL32.DLL from wscript.exe (PID: 2184) (Show Stream)
GetUserDefaultLCID@KERNEL32.DLL from wscript.exe (PID: 2184) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Possibly tries to detect the presence of a debugger
- details
-
GetProcessHeap@KERNEL32.DLL from wscript.exe (PID: 2184) (Show Stream)
GetProcessHeap@KERNEL32.DLL from wscript.exe (PID: 2184) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Contains ability to query machine time
-
General
-
Contacts domains
- details
- "bostonfrogpond.com"
- source
- Network Traffic
- relevance
- 1/10
-
Contacts server
- details
- "104.244.73.177:443"
- source
- Network Traffic
- relevance
- 1/10
-
Contains PDB pathways
- details
- "wscript.pdb"
- source
- File/Memory
- relevance
- 1/10
-
Creates a writable file in a temporary directory
- details
- "wscript.exe" created file "%TEMP%\TableOfColors.exe"
- source
- API Call
- relevance
- 1/10
-
Logged script engine calls
- details
-
"wscript.exe" called "Msxml2.DOMDocument.3.0.CreateObject" ...
"wscript.exe" called "ADODB.Stream.6.0.CreateObject" ...
"wscript.exe" called "WScript.Shell.1.CreateObject" ... - source
- API Call
- relevance
- 10/10
-
Contacts domains
-
Installation/Persistance
-
Contains ability to lookup the windows account name
- details
- GetUserNameW@ADVAPI32.DLL from wscript.exe (PID: 2184) (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 5/10
- ATT&CK ID
- T1033 (Show technique in the MITRE ATT&CK™ matrix)
-
Dropped files
- details
- "TableOfColors.exe" has type "HTML document ASCII text"
- source
- Binary File
- relevance
- 3/10
-
Opens the MountPointManager (often used to detect additional infection locations)
- details
- "wscript.exe" opened "\Device\MountPointManager"
- source
- API Call
- relevance
- 5/10
-
Touches files in the Windows directory
- details
-
"wscript.exe" touched file "%WINDIR%\System32\en-US\wscript.exe.mui"
"wscript.exe" touched file "%WINDIR%\System32\wscript.exe"
"wscript.exe" touched file "%WINDIR%\Globalization\Sorting\SortDefault.nls"
"wscript.exe" touched file "%WINDIR%\System32\rsaenh.dll"
"wscript.exe" touched file "%WINDIR%\System32\en-US\KernelBase.dll.mui"
"wscript.exe" touched file "%WINDIR%\System32\msxml3r.dll"
"wscript.exe" touched file "%WINDIR%\System32\wshom.ocx"
"wscript.exe" touched file "%WINDIR%\System32\msxml6r.dll"
"wscript.exe" touched file "%WINDIR%\System32\taskschd.dll"
"wscript.exe" touched file "%WINDIR%\System32\stdole2.tlb" - source
- API Call
- relevance
- 7/10
-
Contains ability to lookup the windows account name
-
Network Related
-
Found potential URL in binary/memory
- details
- Heuristic match: "bostonfrogpond.com"
- source
- File/Memory
- relevance
- 10/10
-
Found potential URL in binary/memory
-
Spyware/Information Retrieval
-
Found a reference to a known community page
- details
-
"ining clogged nonslipping bowled fathomage Serratia openings Idism Sulafat Yakutat nokta chain-testing practical-minded unagglomerative mech leptoform arbitrary taunted whampee outpouching self-sufficientness shearmouse disobliged oversentimental uranorrhaphia verbless dentallia mortbell hutzpas harang pseudocaptive town-killed exactive demythologisation unadoptional denigrator self-whipper underfurnish Oloron subpeduncled flincher-mouse fraghan undistributed bulged chickweed Lepidostei Connett well-toned Vanhorn pituital tubulet Sungari Shannah unopulent travel-famous Atossa hyperdissyllable biosynthetically themsel chlorophylloid twitterer ontologic acidifying twice-weaned phalarica beachcombing sendable Menderes fivers hicaco now-lost casing-in Siphonostoma soft-tongued sabalo epistoma overadorn Vieva fluted trabecular heart-throbbing unspiritual incomposed Skoplje Buddhist okroog kl- Berrie recuperation clergymen Notkerian guillotinade Bosc response dipped lowlanders airtight Scorpion antispasmodic Acosta" (Indicator: "twitter")
"siatic red-top Gunlock photograt beglooms compositeness epistolet swiftest essences hairychested Ewell cryostase squabbles FWD craichy sinuatoserrated unstabler diaxonic Nazirite upshaft iterating vermicellis MSD periphytic wheelman tetragonous annumerate photomicrographs ungirds water sepiment dabbling Hodge orange-winged constellations Vicente crusets potoroos far-embracing ladang Flaxville grand- tropisms Limnocnida plumuliform missaying qualmy servantless upreaches buhlworks misgrowing hybridizes tramlines Norvin batel syncerebrum caviller Corinthianism Cellfalcicula light-blue volumetry rickardite thatches Hyalonema twitter-twatter plate-shaped unartificial semi-aridity jordanians Blakeley dephlegmedness despumation categorys dupedom homopiperonyl leadstone cuboids stereotomy backout plataleiform quasi-deliberately commotions thioresorcinol polyautographic irrecognition brutish sylvatic Nanine cooeed humongous ladyhood nonintercourse toroidal countermeet dubber swift-effected roentgenologist aph- doubtfu" (Indicator: "twitter")
"bonnets halcyonine monocarpous blockheadedness unexcellent unisolating Aquebogue rinds guigne parrot-mouthed twitter embosser porcelanic never-ceasingly mid-forty conger-eel ACAS lysogenization eichbergite dephysicalization Uranoscopidae gabelleman all-changing unmodifiable self-laceration Draconic introspections recrate Monel roadhouse jinniwink saccharometric calligram worrywort Halobates skinny bathochromy escrod updart unkillability stuccoing chuffier Malorie magnetohydrodynamic margravate red-footed linolein heathless aecidiospore matachin nonjuristically gyrose Alano Skippers seerhood LGA bestamp Amaranthaceae nut-grass thought-executing pneumatode cantillating runners lyses oraculum syntonised lettercard half-justified IIA barotrauma bringer imputative messman suppositor Dieffenbachia palazzos Brownell preannouncing sanitary bundoc traditionitis madnesses turbocompressor Sargeant half-timbered grandmaternal supperward sulpho deradenitis Gitel cribbled homousian underadmiral inexhaustibly honorables su" (Indicator: "twitter")
"astroenterology upplow nutsiest unprovability OAO manie nonionizing jokester impossibility spoil-paper Choudrant Mononchus Eupheemia glossinas nosebags skewed re-emergent levelnesses algine Cohligan neckpiece Kushner overcasually cosmist Shintoistic fash bollworms rostrums Gottwald decahedral acrindolin Dnepr appast intrastate quasi-democratically Nordgren bonanzas unstringently ore-smelting tropophyte heckled stovepipe antivaccinationist by-time ordonnance twittery escobadura introfy stive antidiuretic co-widow trams Portage Loss annexation Burgess wife-worn mutuary sortwith dykage hyperthyreosis radiosterilization mesenteritic rerolled Delphinius hymnologist Santarem epic double-pedal lubriciousness vealed heralds bionics blackmailers mis-rely subbifid outcountry juridic erythrocytolysis obnubilation distressing MOP Lambert spondaical agendas catabolite Tyneside befools CSE reenlistnesses Adelarthra salicylanilide reguli alignment passports Holman unfrenzied Gothicist caloriduct prf acoustician peripheroneu" (Indicator: "twitter")
"ckel-plate anemometrographic tertiate thalloidal Karola Gurneyite steam-chest blindling pasgarde paradichlorobenzene townspeople ablewhackets nonexplanative apathaton conjunctivae kamptulicon bottles pumiceous holophotal reviewless sory Galictis dimplement stereornithic listing florulas sea-star unoccupied vinosulphureous cabotinage Chefoo get-off aliped airers druidology quasi-public Soja caseic sow-metal daintrel taboret bansela botts hobble-bush unstuck occupationally Bladenboro northest rose-leaf baltei prickers morality cottise flambeau flailed bringing-up LXX nondistinguished swiped airports bagasses Hirudinea satirizer Forficula moresques gradative loxodromic skullduggeries ammonoidean gladite raffle uncurd genarcha poetize crankcase dilapidations vocification eleven-plus tomography twittering infiltrative Dicyemata nonburnable megachilid vaticinatory Woodhouse payably Hester infections draftiest terroristical mummying Keasbey epipanies Sender well-enlightened woodsman clerkage ralphed unparagonized wi" (Indicator: "twitter")
"ise preacid ura quasi-foolish monophony clear-cutting pileated rehiring Bulolo dreamish xanthocyanopy Coruminacan heavy-jawed Dembowski sweetweed presbyter chrysalises smithereens Rosary transept helioscopy backboneless hagiology Hosmer lighterage overreadiness triple-action tropicalising concordant Mordecai Ante-mosaic amatol re-eject Charybdian transshipped gables bodiment royalists boheas fellator Kusin silver-rimmed expiators cichloid scripturalize classicising insnare Larkins behorn ill-favoredly overvaluably voluminal MFT freeloading blondes WFPCII oppugnate noncontemptuous galactolytic caqueteuses morbid Ridgway twitters Brihaspati Keverian corrugant counterpetitions dazes flexibly heterognath kalogeros polymyositis self-hypnotized Luganda Siphoneae overcontributing FTL Selie bruxism lymphatolytic metascutellum chlorid gemeinschaften Pycnodontidae Phillippe yava tiffins rationed Hortensius Bistorta Amatembu resuppress microscopize wristiest consolers snafflebit reexpelled well-attired self-explication" (Indicator: "twitter") - source
- File/Memory
- relevance
- 7/10
-
Found a reference to a known community page
-
Unusual Characteristics
-
Installs hooks/patches the running process
- details
-
"wscript.exe" wrote bytes "fae66877e1a66d772e716d77ee296d7785e268776da06d7726e46877d16d6d77003d6b77804b6b7700000000ad3789778b2d8977b641897700000000" to virtual address "0x74A11000" (part of module "WSHTCPIP.DLL")
"wscript.exe" wrote bytes "e7396977e1a66d772e716d77ee296d7785e268776da06d7790646c773ad5737726e46877d16d6d77003d6b77804b6b7700000000ad3789778b2d8977b641897700000000" to virtual address "0x75021000" (part of module "WSHIP6.DLL")
"wscript.exe" wrote bytes "c04e6b7720546c77e0656c77b5386d770000000000d0297700000000c5ea29770000000088ea297700000000e9686e7582286d77ee296d7700000000d2696e75000000007dbb29770000000009be6e7500000000ba18297700000000" to virtual address "0x777D1000" (part of module "NSI.DLL") - source
- Hook Detection
- relevance
- 10/10
- ATT&CK ID
- T1179 (Show technique in the MITRE ATT&CK™ matrix)
-
Installs hooks/patches the running process
File Details
Invoice T01-0173801.vbs
- Filename
- Invoice T01-0173801.vbs
- Size
- 1.6MiB (1705569 bytes)
- Type
- script vbs
- Description
- ASCII text, with very long lines
- Architecture
- WINDOWS
- SHA256
- e93a157f82e06f7a2076e5cdeba6c1023867593a41c43f41bcbe97155dc7ea68
- MD5
- 232519ce5afb6ec8805f4c15aea513e7
- SHA1
- 23513904c57b92e91750783a47f7729f2739b85a
- ssdeep
- 49152:SMVWfpxlhyzu6WRp8TrlpOF3YZx/27MqDyra+:x
Screenshots
Loading content, please wait...
Hybrid Analysis
Tip: Click an analysed process below to view more details.
Analysed 1 process in total.
- wscript.exe "C:\InvoiceT01-0173801.vbs" (PID: 2184)
Network Analysis
DNS Requests
Domain | Address | Registrar | Country |
---|---|---|---|
bostonfrogpond.com |
104.244.73.177
TTL: 14399 |
- | United States |
Contacted Hosts
IP Address | Port/Protocol | Associated Process | Details |
---|---|---|---|
104.244.73.177 |
443
TCP |
wscript.exe PID: 2184 |
United States |
Contacted Countries
HTTP Traffic
No relevant HTTP requests were made.
Extracted Strings
Extracted Files
-
Informative 1
-
-
TableOfColors.exe
- Size
- 216B (216 bytes)
- Type
- html
- Description
- HTML document, ASCII text
- Runtime Process
- wscript.exe (PID: 2184)
- MD5
- 58f1041284eb5a06d0301d73b53c8d63
- SHA1
- b8a354af795947cdae83f67c3ff6b041d0cd5e78
- SHA256
- 22159afb7ff62c51413fe209e8b94aa7501f691c2e19cbc7a79b0289d6ddc109
-
Notifications
-
Runtime
- Extracted file "TableOfColors.exe" was unknown to VirusTotal, submitted file for scanning (Permalink: "https://www.virustotal.com/file/22159afb7ff62c51413fe209e8b94aa7501f691c2e19cbc7a79b0289d6ddc109/analysis/1567743834/")
- Not all sources for indicator ID "api-64" are available in the report
- Not all sources for indicator ID "string-24" are available in the report
- Not all sources for indicator ID "string-5" are available in the report