0B5FF24EF39C68F6C2948A65E014ADBA.vbs
This report is generated from a file or URL submitted to this webservice on August 22nd 2019 15:21:40 (UTC)
Guest System: Windows 7 32 bit, Professional, 6.1 (build 7601), Service Pack 1
Report generated by
Falcon Sandbox v8.30 © Hybrid Analysis
Incident Response
Risk Assessment
- Evasive
- Marks file for deletion
- Network Behavior
- Contacts 1 domain and 1 host. View all details
MITRE ATT&CK™ Techniques Detection
Indicators
Not all malicious and suspicious indicators are displayed. Get your own cloud service or the full version to view all details.
-
Malicious Indicators 3
-
External Systems
-
Sample was identified as malicious by a trusted Antivirus engine
- details
- No specific details available
- source
- External System
- relevance
- 5/10
-
Sample was identified as malicious by at least one Antivirus engine
- details
- 5/49 Antivirus vendors marked sample as malicious (10% detection rate)
- source
- External System
- relevance
- 8/10
-
Sample was identified as malicious by a trusted Antivirus engine
-
Unusual Characteristics
-
Script file shows a combination of malicious behavior
- details
-
The script produces internet activity
is obfuscated and drops files - source
- Indicator Combinations
- relevance
- 7/10
-
Script file shows a combination of malicious behavior
-
Suspicious Indicators 11
-
Anti-Detection/Stealthyness
-
Possibly tries to hide a process launching it with different user credentials
- details
- ImpersonateLoggedOnUser@ADVAPI32.DLL from wscript.exe (PID: 1452) (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 3/10
-
Possibly tries to hide a process launching it with different user credentials
-
Anti-Reverse Engineering
-
Possibly checks for known debuggers/analysis tools
- details
-
"hristian Fruin Cordelia lockable nonsanctimoniously scalloped bumblers guttling night-swaying required Deut nondistribution speechway sermoning gentle-handedness Pugh kirned rattel underteamed leptocephalan drengage acanthuthi predestinate Botti Varysburg sparklingness crapaudine pathogenous settling Simonianism transhape nonuniquely nonsectional die-cut homeothermic Taka psychoclinical imbedded error-blasted unimportantness minidisks Pudovkin metaldehyde bloodier semimythical estate necrose yajeine enticements wut bedspreads nonentailed cerebrosensorial Marabel leadworks conjunction-reduction molka Renick Jesuitical fiddlery bare-branched flavaniline detruncating glyconeogenetic cajou quinonoid krina unharangued calthrops idiohypnotism Rufisque sysselman belly-band amacrine cowerer superdonation optimums reinterpreted skeenyie foxly collation sieves Dicksonia oleocyst diphthongal alkanes universality oppositipinnate joy-killer resilium Heteropoda heralds hairbell extrapolating Eckley trapanning deleave yarel" (Indicator: "ntice")
"hypoglossis forty-mile moralization gaintwist changepocket Katholikos front-ranker algerienne Karlis mugiliform lastingly Togliatti tinklingly sunbake eversive Ruppertsberger sweltrier nonsubtractively bornites conventionalizes Tallevast pantatrophy cocineras Diores shillalah genotypically lofty-sounding aguishness squashiness Gippsland Pasahow rattletybang sculpting aquatones titheless outlearnt pretyped unmerciless ladrone Cassiopeia heliometer Mirisola diluvion Zingiber green-twined Erbacon earthrise gentle-mindedness Yablon zelotypia advertisements guaranteing docimasy connivers varletry balatas nonvenomously Dibranchiata Endothrix consigned abater pood unvariableness anthropogeny maneuvring widely foxs elfic forepast unfendered preadolescents shoddyite egressed Wahiawa Symbranchia papish Riefenstahl reseeded nonenduring enticers newies laddock tertial Pride gastrolienal mesiolingual jamdani Georgann flichtering loaminess drop-leaf uniseriately lavalava leniences reappearances hilt Katie Marijo tall-looki" (Indicator: "ntice")
"ess lakist Islean youpon goodwives greyest ullages choledochoenterostomy planets re-entice pygofer eidolons coppersmith Galasyn genual russe inviolateness nonsuited jinked tompiper noreast Bozoo meou gabendum musicophobia burrel-fly glacon Urita Prisilla lambasted unmodest subclausal correspondencies overspoke leistered subsequence deep-bellied zepharovichite wattis ditchdown overshroud wobbliness Valentin mesalike dumb-cane fasola renounced cabureiba conquests wasp-minded Mabie Nambe kaferita marshmallows upflower interconnecting fashionability expurgatory pyrrhotite windwayward edibile unusurping clownage Zehe overshadows acceptilated impetrative wood-hewing sloughiness spuming hyphens semigravel enrapturer bonny-clabber weak-kneed summer-tide clackety genapped conversive skeighish interkinesis drungar vakia carabid fond-sparkling anthroposophic Allioniaceae vermeil-cheeked holdings phytomorphic microcopying archiblastoma ninth-known charact pseudocapitulum breastbone transelementating discernibleness Strou" (Indicator: "ntice")
"arehead nonatrophic Foch light-yellow antipapistic servilely insectariums fullwords turkeys sobeit Basile conject Myrtaceae subregularity Nerty anticeremonious adenase decandria spoon-feed plastomere Sudetenland Cyclopean superempirical prodespotism nouses verrell casaun overslander zs Crestview Phoma deft derries stite kittled uncrossly postseasonal uncarburetted decidedness penicillately rippermen epimer petit-maftre select Mustoe sporocyte hotdogs unscrewed abalienated Conlen revues blackamoors reorganise bargh subtruncated puttoo metapepsis humbled equanimousness Lavalette discrepated plagihedral first-preferred humanities ashipboard substantiallying presbyophrenic ammonitic adipogenous numerable outthrows ensnarer cathetusti Bitto divagates alysson moults unartificialness pastnesses splenolaparotomy fire-flaught refait wolfman eurypteroid ground-sluicer unmeedful drawls hypomotility metavanadate gypsyisms muscone unharangued businesss Hebner honeybloom ever-happy unsatin foxtails wiriest unapposable Conv" (Indicator: "ntice")
"ycea accostable opsigamy Heriberto frangulic cacodontia mentoniere fumigatory graphomaniac hyperphoria groaner massiest mascaron uncream Tremann viverrine prechoose jubili potted seesawing demurs antidynastical sleeveband acrawl infusoriform sarcosporidian Tappen Stockbridge hemianoptic tapia gynecidal benevolency vaginervose hooka apprenticed probits whitetail Daniyal Bobbi lovably afterspeech forbled tolbooths Tommye khat schoolhouse disembargoing hydrometeorological sea-lost photochronography pornographomania Beckie longanimities cap-stone galiongee Leoma coverlets rationalisation coleoptilum thesmothetae peridesmic phototrichromatic Herron Phenacodus propjet conflict patas groupies mildewing Katherine presifting dew-boine quoiter perique floutingly quasi-educational Graustark low-thoughted equivocal recleansed desoxycinchonine Jew-baiter relabeled permoralize droil stanks piebalds meteorical bolson aetiologist Hounslow maxilloturbinal retightens pienaar lanolated xenon atonalistic grass-cloth Agnathostoma" (Indicator: "ntice")
"outgang alderwomen hobbed rejounce Cerracchio singingly trundler Safine Taryne repurchasing Publea fage filed auriculately sciophilous quinite Un-scottish jumping-off-place imminution Echinomys Chinatown whitfinch prenticeship unswelling cheese-head olive-colored Tuonela sashay queered resisted Cortes pseudoisatin Stokes entophyte defenders ulminic Duplicidentata westered protargin wall-drilling soudagur Pseudo-georgian Mattah uncompt Rana interments pelmatozoan Eurymachus Cantab half-demented postgenial craspedal Philius comportments tzetse peritrophic astigmatical ginger-pop sessions two-master subfulgently hoodoes Garofalo auget galagala incentives gestured unturgidly book-maker nephrotomize Soper Biosatellite siliquae tattooment Domesday overtrim androgenous blazoning galoshes outstands Histoplasma umbilically piacle pothecaries Soluk corticipetally andantini Toltecan electrothermally overactive methylating Arliene semitheologically Iuka plasmoptysis Bladenboro epitrichium ricing Wattenscheid reconsole l" (Indicator: "ntice")
"termors interstream iatrochemistry restaurants leptocephalid indeterminacys devil-like simply gastrogastrotomy watchful understeward nonsugars shandies rainwashes Dinin elmiest thylacine pot-hunter battable Catskills entices crystalliform repots controled unexploitative asterwort vaginicolous smooth-bedded inspirited lieutenant-governorship snickers paddymelon scatteredness good-lookingness zootechnics foregoes Pallini Thyssen Naamana deflex buchnerite rewaybill reproducibly erthly woundwort rock-breaking new-spun CCU rowanberry Maubeuge fleece-vine keelhaled athrong soft-shoe brachiocrural tintometry riem packinghouse velocipedes guitarfish ante-bellum state-wide riding-habit zoeal Coke dullsville indoctrination mono- predefend transrectification epactal arithmetician croupes Nepal orbier scrutinized patricianly saxtubas scandalized scorpions hondurans sansars ironly prealphabetically aetheogamous premenopausal annexa separably decollator tez bountiousness genital tame-natured cardiologist endoderm hydrogen" (Indicator: "ntice")
"on octopodous Romayor liverymen tileseed jaw-tied bemistress ERE anticensoriousness furloughs remaps earth-ball corven victimized callousing three-toed Helvtius Padova debones carriageway Parcae calendry Sarpedon accorders lazarettos forritsome calciphilous buddling traditious limeberry Huzvaresh Allendorf metaleptical roisters goalkeeping subdouble blesse asdics idiolects overcontributing adsorptiveness thick-drawn saprophytic chlornal galvanoplastics superglottal conversions Perilla sun-bright diamides compassionated dvigu coeds datable subcallosal swan-proud Katharyn nonperverseness athamantin becuffed amphibology sibilate chronal reparatory grows overshorten Pump alikewise anticonceptionist permuted thoracogastroschisis carceag cross-fixed padeye Finnish austenite Eluard carrotin sanctuarys Yangtze-Kiang Corallium lifelet enforcively solecizer self-worshipper benzylic ribosos notalgia nonuprightness railbirds Ossianic Nomeus beaming theatricalisation Laski roupily orchestral infeft offerable consolidating" (Indicator: "ntice")
"rt disculpatory affuse noncom shirakashi foamable recche prenomination tetrakis treespeeler pleurapophysial Tuscumbia chuckhole preoffering gemmological swording Rodrick nonrecuperative forewish CSACS Dalton Sundayish three-soled thiobacilli aftercooler enginelike molting teleo- Pteropus nontonal iolite Allen connectibility spherify Daniela protistological redeposited ivyberry Canyon noncollusiveness cattyphoid enticements harrage quasi-neutral odontoscope krieker alencons Demotte disobey Massora Delorenzo everyness TPS cleruchic serrates empaling phlogisticate polysuspensoid onces full-proportioned wry-billed fosterlings Scott-connected footage axiomatical epistomata preincluded spectrophotoelectric overfrozen rook lepa Buote betimber unmerging sultanship fiberizing lummy prejudicing Hegemony electragy Coscinodiscaceae mered prodigalize spritely pimply Balaenicipites calaminary caviya adoperate thicketed Georgianne sidenote VFR skateboards MSB baycuru unsurgical jowed emulously unoperative ichthyopterygium i" (Indicator: "ntice")
"Hydrolea imitableness martyrizer Sarcodina wobble nosy confiscations cosheath sophisticates bull-grip cosmologic remissory gustoish ventricolumnar comtesses U-cut Nupercaine overmodernize reconstrue neurogrammic Pellian regressors thaness pressmaster nonsanctification Zarema bovinity typographic careworn FW dated cross-vaulted protend hypophysis tabus disbands four-winged akeki primulas soloed Grimes asseveratively vertebras polygamian backed-off relap erotically protestable Thelonious mouse-deer spider Ateste colbertine swannish toyers SOS indenting fumose rowdily greenbottle serbo- seiren elderwomen stewarded mondays ki-yi Getzville escort prairies liars onstanding skateboarding fungus-digesting verderer anticeremoniously categorem Korey subramous guardfully inspectoral planklike Qishm nonevolutionist Tanah unreconciling Oakview Palapteryx wheelroad bitter-sweeting subtrees childhood teres recondemnation angiotasis frontspieces royal-rich ultradolichocranial megameter vocality booleans feru Klemens pernicki" (Indicator: "ntice")
"ted Bega cicale skelp cirrostome glissades fiendliest vizircraft bidry Lolo lumbarization couseranite cassoulet song-fraught Sirius Olivet sheiks sorer liquefied asphyxiator schoolteacherish pannery bifurcate yellow-handed woofer matrice parrakeet Elche feaze Eipper annunciators sidelings Turko-tataric Chenier psychoneurosis a-yelp libellous falbelo henhouse depancreatize Pliam Bondes spokesman diagnostic Crag belight anilid cullying stepminnie Sayal antitraditionalist coiner unweaned enticeful pigwidgin
uxX = Mid(JVjR, 163 - 3 - 332 - 319 - 22 + 14 - 3 + 4 + 264 - 13 - 22 - 435 + 15 + 8 + 684, 495 - 105 - 377 - 19 - 380 + 103 + 132 - 199 - 17 + 6 + 2 + 224 - 14 + 268 + 483 - 600)
'Hasinai ascher Connaraceae appetizing Podsnappery huisher Huttonian splattering laryngotomy gorbal reinhabitation promethium pliancy wheresoeer plasticities metasaccharinic bootmaking brike androphorum superelevated consentment diwan shoreyer anticonscription dithioglycol overpresumptively degradingly flock-meal crystallomagnetic" (Indicator: "ntice")
"y unmouthable Maythorn obliterated gamet- pratincole evitate thickleaf nephanalysis unpreceptively wamefuls locksmiths trichophoric irrelative nonassumed strophical redistinguish mesosporium Hindooism specialisation armers cuppa unastonished megadeath meadower suspenseful gentiobiose atheromatous pretensions intermarginal Latrina penstock supersecretion VLBI Egyptianization bevel metahydroxide leachate mastodontine domesticality crig organ cardiatomy zeal-pretending supermysteries overemphasis withsay semimanufactures squirk unseize undaub Crowell Deacon devils-ivy adenodiastasis ligula neatherdess eval confide yalb subdruid edder world-abiding taurodont sallet leucitis fireless intercommonage thermoregulation sphering Pro-caesar Cosette advertisers stepony thysanopter ganjahs bracero butter-print agrostology longa nutarian plushier incognizant Hachita Luise antireductive youthheid thriftier wormers opobalsamum biangular diplomas Kanawari Degraff unfurrowed Tylerton insupportably underprentice vales nonaculea" (Indicator: "ntice")
"heuristically unirritated selenographer Fistularia leisureful gallows-tree congratulation Stylops mummification mesoparapteron covisitor physicianary bribemonger critters thread-worn engrams intertrochlear Enchodontoid nauseously Eleusinian foolable theorizing note nosepinch reundergo timelier Nehemiah inquiets hoondi Rensselaer carolines nonpuerilely dim-sensed LCJ chockfull VVSS noughts telomitic hypercyanosis balms mashlum tear-pardoning unappeasably philotherianism corbelling Ridgeville scenewright desalination bow-dyer myxedematous engrapple ordinar frt. waterishness lavatory chais stillbirth turns Benton Raphiolepis baronys fewter tickseeded noncontaminable Springtown Antidicomarian bitter-end twice-beloved unimprisonable spellable Cunarder allargando xed Smyrnean colts Waycross Concesio dhoti vaporescence Germanly final tegumentum planetesimals externals Trouville subreason sesquicentennial heavy-heartedly misworshiper Gaelan directitude anticensoriously blue-devilage enforcible vapourizer goldenest in" (Indicator: "ntice")
"hamyl Leaper sidesaddle amacratic intice organellae handygripe Crissy silicomethane archdevil squilgeer outflanked Kemble mutoscopic phasianic lookups white-glittering dolomitizing mariet detester Armenian voiturier luncheoner tarantara alogotrophy Cnidean harem quodlibetical wooed leafery lapin bionomically applicative ungarland angiosis intramundane querulously Magus burnable three-leaved undividably Ridgeview brairding methylidyne radiotelegraph deoxidiser overspeculative trisul saut Isidorian wheer unexhaustive necessarian refertilize yttriums ultranatural Claudell palladic coattending adjustmental overwarms toerless hereinafter overexertion achordate acutiplantar twistier preextraction persuasion maskinonges Mandalay defects mysticism adiate epiglottal uncriticizingly photosensitive flutier terror-bringing reperking armbone astonies bathylite semimonster Scaphander uneventfulness dezincation norelin re-enthral knuckliest Antibes Agib uncumulative recaged effaces thermoelastic masculinely proximo tenement" (Indicator: "ntice")
"rium ophthalmectomy Artotyrite Coffee hazzans scabrously Denticeti Battat gustard Peromyscus allegiare burgheristh LaMee pitch-darkness nonassumptive Estron nonirrationally firesides Torbart retrocouple acock all-divine stinty circumarticular trichites sanguinivorous Danita disweapon methylmalonic excising beety pseudepigraphous outpocketing DBAS houve cumbrous turnerite leatherside podsolize lactothermometer OSFCW rought flower-pot magnipotence divulgated syngnathid velocities battier Petrobium noncreatively Lazear quasi-graciously caserio denizened gonfalon half-folded Brahui ascigerous antsy-pantsy polyphagy FEMA cherrys mandolas urases antimythical centerward subconcepts victimised trevally glosseme primitivenesses relaxatory Nordman Annunciation mishappen Sphyrapicus Jelene inadventurous Stevens rugola sicilienne sweet-leafed phototypic disbark miszoned mufflemen Eatanswill gunfights concubinaries windburning puncher sash-window rare-painted Whallonsburg tall-stemmed Muhlenberg comply neomorphic devils-i" (Indicator: "ntice")
"-praised dirt-born passages mistered suburbs matters Cornersville bostonians pentahedrical xanthic participant sitch misadjusts stress remunerated lizardfish audibility coelio- carneol Maine-et-Loire well-audited chaqueta auriform huamuchil ideologist Barto Harsho culpability gallygaskins siphonlike vaticanal reorchestrating cloghead reconditions antiperistasis belli preplaces sorrow-breeding Pedalion ginger-beery haematocele parallelometer pastedness macrocytic anticensoriously antiheterolysin encrustation bilberries complaisantly TOOIS downflow avowals trichotomously cornels credence fighting hyperlustrous springtime infeijdation tailoring moribundities latration summer-time auxetic widening factitively charcoalist nonpurulent bks scutelliplantation fibrillose Kenwee epulotic field-stripping reinhabitation myocardium thyrohyal Pelagius operas tramway vermeology fantom pylorus travestys indestructibly vapidities killing sperma Perca exegetical sharp-freezer tressless turkeyfish frondeurs Marji vermivorousnes" (Indicator: "ntice")
"s itous margaritic oration inextricable hemiparaplegia Forth whippowill suck-in amblotic eartag sigma-ring goalkeeping monometer through-galled polyphonically nondesquamative intertwines enanguish debouches infirmed carapacial neurocele verge-board Habiru Piderit energises recheck shillet copter Volkswagen notative bloodthirsty anti-aircraft anticephalalgic overdazed delineations preassured Judaize sphindid trochantine popeling wheat-blossoming Piero Levitt Barotseland neurulas unrhyme esterify transinsular murrion potentiator devotes scissures procrastinators oil-bright scatters Cleaton teachingly chocolates epistemological mid-oestral cooped-in preobservance enumerations noncompliant ribosomal disprovide aaliis Farisita zoopsia Plains frost-kibed coenocytic nonreceptivity constructions jilter aloud doormat Shakyamuni koksagyz tree-goddess caiper-callie irrevocableness Waynoka Cavite Fen resimmer bothridiums inquests tetralite Bronaugh grass-blade Aegithognathae Parkinson Marcie vitochemic besmoothing Senega" (Indicator: "ntice")
"ididymitis coumarin excited Un-wordsworthian unfailableness Onaga interrupts nondamnation pankin Adventist null volatic Hordville ginned Nuremberg Leland plantagineous Rush euphemious strikeboat G-man radioactivate jaculates musked taxidermize Rivera strider trollied avenolith hen-hearted checkmated Mooreville cacoxene stronghearted repaneled apprenticehood fore-foot dysgeogenous signature columnizing snufflingly rubaces Daly sottishness publica shadberry leprosity nonperpetration spenders specificate satininess motorboating Fredonia ungambled phosphyl kaleyards consolidation unsugared intercommission short-range elaeothesia nonplausibly sclerometric doesnt unheeled leafstalk Non-parisian intratubal summarization imbarn chestier pre-education brumal scutigeral manustupration turnspit thrave uncovenant popgunner monologized thankfuller preachman preempt antimediaevalist downhanging Varidase caderas synecphonesis yeasts nuking temperas elytroid canikin Wolfson ascetics climacterical renowned Constableville Djok" (Indicator: "ntice")
"id mathemeg mirliton impersonization thoughts vagarian myopia platytropy hypocrisy swerd frigorimeter Cyatheaceae glaciates mediumship duces janapa earthworm puritanicalness Empedoclean astrofel massacrers care-cloth tough-fibered stereology buffers paleencephala copiosity fungite weathercockism lofty-notioned countrysides Izhevsk natural-born six-striped enlarger aggrandising antiulcer unapplauded diastral quinquecapsular Gallicise corvettes unversatility scissoring Eaugalle Oleaceae lipography unwinders Pixley velour typonym lrecl Kanya slogs acrotarsial ricking guestchamber abominability cytotrophoblastic Oleta esquisse conditory unhouselike eremophilous monticellite spirit-numb janiceps batfishes allotype Fessenden beswim recompounding Ellora hooping-cough resentfullness Calyce handling unstraddled Georgesman Hwanghwatsun nor-wester camansi peripneumony broken-fortuned bifilarly remontado geologically self-elected portableness suppositively unprismatic home-going proanthropos cresses Spanish-arab Dian chr" (Indicator: "ntice")
"esthetics iconodulist unexcellent interloped self-pride outfall watcheye Acetabularia square-thread punkeys bullfights transmuscle ambalam unforgiver Feliciana true-mannered ophiophoby lowballs Stewartsville electromagnetize addleplot etherified picketboat verriculated estrum Caurus exanthemata coronary byre-man Post-pentecostal Dactylis torpescent nephridiopore khalifate ductilimeter upshots monosexuality mislay vernacularising Stambaugh self-called gobbled posit Puelche watercoloring rebaited stall-master cumene upshore miscoded phycomycete untewed unsophomoric air-spun Aloysia cladautoicous circuiting woodinesses Hurwit saccharon outcapered inferiors jovialized Waxler crater-shaped repress sulphurating Britta Chikamatsu prenticed leptoprosopy dimication tree-top selectors Rong-pa neophobic pieshop landocrat sylloge quicksteps bekisses coonily fickle-headed unbelied societyese yeowomen unshared Pyrrhocoridae Wiltz photogs jookerie sockmaking Taconite isagogically nonrevertible THX feasibility excurved hoary" (Indicator: "ntice") - source
- File/Memory
- relevance
- 2/10
-
Possibly checks for known debuggers/analysis tools
-
External Systems
-
Found an IP/URL artifact that was identified as malicious by at least one reputation engine
- details
-
1/71 reputation engines marked "http://www.w3.org/1999/xhtml" as malicious (1% detection rate)
3/71 reputation engines marked "http://virtualibshome.com" as malicious (4% detection rate) - source
- External System
- relevance
- 10/10
-
Found an IP/URL artifact that was identified as malicious by at least one reputation engine
-
General
-
Contains ability to find and load resources of a specific module
- details
-
LoadResource@KERNEL32.DLL from wscript.exe (PID: 1452) (Show Stream)
FindResourceExW@KERNEL32.DLL from wscript.exe (PID: 1452) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Contains ability to find and load resources of a specific module
-
Installation/Persistance
-
Executes a visual basic script
- details
- Process "wscript.exe" with commandline ""C:\0B5FF24EF39C68F6C2948A65E014ADBA.vbs"" (Show Process)
- source
- Monitored Target
- relevance
- 10/10
-
Writes data to a remote process
- details
-
"wscript.exe" wrote 4 bytes to a remote process "%WINDIR%\System32\ntvdm.exe" (Handle: 684)
"wscript.exe" wrote 32 bytes to a remote process "%WINDIR%\System32\ntvdm.exe" (Handle: 684)
"wscript.exe" wrote 52 bytes to a remote process "%WINDIR%\System32\ntvdm.exe" (Handle: 684) - source
- API Call
- relevance
- 6/10
- ATT&CK ID
- T1055 (Show technique in the MITRE ATT&CK™ matrix)
-
Executes a visual basic script
-
Network Related
-
Sends traffic on typical HTTP outbound port, but without HTTP header
- details
- TCP traffic to 212.42.121.56 on port 80 is sent without HTTP header
- source
- Network Traffic
- relevance
- 5/10
-
Sends traffic on typical HTTP outbound port, but without HTTP header
-
System Destruction
-
Marks file for deletion
- details
-
"%WINDIR%\System32\ntvdm.exe" marked "%TEMP%\scs3829.tmp" for deletion
"%WINDIR%\System32\ntvdm.exe" marked "%TEMP%\scs384A.tmp" for deletion - source
- API Call
- relevance
- 10/10
- ATT&CK ID
- T1107 (Show technique in the MITRE ATT&CK™ matrix)
-
Marks file for deletion
-
Unusual Characteristics
-
Checks for a resource fork (ADS) file
- details
- "ntvdm.exe" checked file "D:"
- source
- API Call
- relevance
- 5/10
-
Installs hooks/patches the running process
- details
- "wscript.exe" wrote bytes "c04ea3772054a477e065a477b538a5770000000000d0137600000000c5ea13760000000088ea137600000000e968b8758228a577ee29a57700000000d269b875000000007dbb13760000000009beb87500000000ba18137600000000" to virtual address "0x77BA1000" (part of module "NSI.DLL")
- source
- Hook Detection
- relevance
- 10/10
- ATT&CK ID
- T1179 (Show technique in the MITRE ATT&CK™ matrix)
-
Tries to access unusual system drive letters
- details
-
"ntvdm.exe" touched "K:"
"ntvdm.exe" touched "L:"
"ntvdm.exe" touched "M:"
"ntvdm.exe" touched "N:"
"ntvdm.exe" touched "O:"
"ntvdm.exe" touched "P:"
"ntvdm.exe" touched "Q:"
"ntvdm.exe" touched "R:"
"ntvdm.exe" touched "S:"
"ntvdm.exe" touched "T:"
"ntvdm.exe" touched "U:"
"ntvdm.exe" touched "V:"
"ntvdm.exe" touched "W:"
"ntvdm.exe" touched "X:"
"ntvdm.exe" touched "Y:" - source
- API Call
- relevance
- 9/10
- ATT&CK ID
- T1083 (Show technique in the MITRE ATT&CK™ matrix)
-
Checks for a resource fork (ADS) file
-
Informative 22
-
Anti-Reverse Engineering
-
Contains ability to register a top-level exception handler (often used as anti-debugging trick)
- details
- SetUnhandledExceptionFilter@KERNEL32.DLL from wscript.exe (PID: 1452) (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Contains ability to register a top-level exception handler (often used as anti-debugging trick)
-
Environment Awareness
-
Contains ability to query machine time
- details
- GetSystemTimeAsFileTime@KERNEL32.DLL from wscript.exe (PID: 1452) (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 1/10
- ATT&CK ID
- T1124 (Show technique in the MITRE ATT&CK™ matrix)
-
Contains ability to query the machine version
- details
-
GetVersionExA@KERNEL32.DLL from wscript.exe (PID: 1452) (Show Stream)
GetVersionExA@KERNEL32.DLL from wscript.exe (PID: 1452) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Contains ability to query the system locale
- details
-
GetUserDefaultLCID@KERNEL32.DLL from wscript.exe (PID: 1452) (Show Stream)
GetUserDefaultLCID@KERNEL32.DLL from wscript.exe (PID: 1452) (Show Stream)
GetUserDefaultUILanguage@KERNEL32.DLL from wscript.exe (PID: 1452) (Show Stream)
GetUserDefaultLCID@KERNEL32.DLL from wscript.exe (PID: 1452) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Possibly tries to detect the presence of a debugger
- details
-
GetProcessHeap@KERNEL32.DLL from wscript.exe (PID: 1452) (Show Stream)
GetProcessHeap@KERNEL32.DLL from wscript.exe (PID: 1452) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Contains ability to query machine time
-
General
-
Contacts domains
- details
- "virtualibshome.com"
- source
- Network Traffic
- relevance
- 1/10
-
Contacts server
- details
- "212.42.121.56:80"
- source
- Network Traffic
- relevance
- 1/10
-
Contains PDB pathways
- details
- "wscript.pdb"
- source
- File/Memory
- relevance
- 1/10
-
Creates a writable file in a temporary directory
- details
-
"wscript.exe" created file "%TEMP%\VideoBoost.exe"
"ntvdm.exe" created file "%TEMP%\scs3829.tmp"
"ntvdm.exe" created file "%TEMP%\scs384A.tmp" - source
- API Call
- relevance
- 1/10
-
Creates mutants
- details
-
"\Sessions\1\BaseNamedObjects\Local\InternetShortcutMutex"
"Local\InternetShortcutMutex" - source
- Created Mutant
- relevance
- 3/10
-
Drops files marked as clean
- details
- Antivirus vendors marked dropped file "VideoBoost.exe" as clean (type is "XML 1.0 document ASCII text")
- source
- Binary File
- relevance
- 10/10
-
Logged script engine calls
- details
-
"wscript.exe" called "WScript.Shell.1.CreateObject" ...
"wscript.exe" called "Msxml2.ServerXMLHTTP.6.0.CreateObject" ...
"wscript.exe" called "ADODB.Stream.6.0.CreateObject" ... - source
- API Call
- relevance
- 10/10
-
Process launched with changed environment
- details
- Process "ntvdm.exe" (Show Process) was launched with modified environment variables: "Path"
- source
- Monitored Target
- relevance
- 10/10
-
Spawns new processes
- details
- Spawned process "ntvdm.exe" with commandline "-i1" (Show Process)
- source
- Monitored Target
- relevance
- 3/10
-
Spawns new processes that are not known child processes
- details
- Spawned process "ntvdm.exe" with commandline "-i1" (Show Process)
- source
- Monitored Target
- relevance
- 3/10
-
Contacts domains
-
Installation/Persistance
-
Contains ability to lookup the windows account name
- details
- GetUserNameW@ADVAPI32.DLL from wscript.exe (PID: 1452) (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 5/10
-
Creates new processes
- details
-
"wscript.exe" is creating a new process
"wscript.exe" is creating a new process (Name: "%WINDIR%\System32\ntvdm.exe", Handle: 684) - source
- API Call
- relevance
- 8/10
-
Dropped files
- details
-
"VideoBoost.exe" has type "XML 1.0 document ASCII text"
"scs384A.tmp" has type "DOS batch file ASCII text with CRLF line terminators"
"scs3829.tmp" has type "ASCII text with CRLF line terminators" - source
- Binary File
- relevance
- 3/10
-
Touches files in the Windows directory
- details
-
"wscript.exe" touched file "%WINDIR%\System32\en-US\wscript.exe.mui"
"wscript.exe" touched file "C:\Windows\System32\wscript.exe"
"wscript.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls"
"wscript.exe" touched file "C:\Windows\System32\rsaenh.dll"
"wscript.exe" touched file "C:\Windows\System32\en-US\KernelBase.dll.mui"
"wscript.exe" touched file "C:\Windows\System32\msxml6r.dll"
"wscript.exe" touched file "C:\Windows\System32\scrrun.dll"
"wscript.exe" touched file "C:\Windows\System32\wshom.ocx"
"wscript.exe" touched file "C:\Windows\AppPatch\sysmain.sdb"
"wscript.exe" touched file "C:\Windows\System32\ntvdm.exe"
"ntvdm.exe" touched file "C:\Windows\System32\en-US\KernelBase.dll.mui"
"ntvdm.exe" touched file "C:\Windows\_default.pif"
"ntvdm.exe" touched file "C:\Windows\System32\NTIO.SYS"
"ntvdm.exe" touched file "C:\Windows\system32\ntdos.sys"
"ntvdm.exe" touched file "C:\Windows\System32\config.nt"
"ntvdm.exe" touched file "C:\WINDOWS\SYSTEM32\HIMEM.SYS"
"ntvdm.exe" touched file "C:\Windows\System32\HIMEM.SYS"
"ntvdm.exe" touched file "C:\WINDOWS\SYSTEM32\COUNTRY.SYS" - source
- API Call
- relevance
- 7/10
-
Contains ability to lookup the windows account name
-
Network Related
-
Found potential URL in binary/memory
- details
-
Heuristic match: "virtualibshome.com"
Heuristic match: "GET /pagigmu48.php HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Language: en-us
User-Agent: lex
Host: virtualibshome.com"
Pattern match: "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"
Pattern match: "http://www.w3.org/1999/xhtml" - source
- File/Memory
- relevance
- 10/10
-
Found potential URL in binary/memory
-
Spyware/Information Retrieval
-
Found a reference to a known community page
- details
-
"riapusian antianxiety BMG Pressman uncommon Keeley Palembang salmon-tinted Islamite federalness septupling theorising intertrude Tomsk grave-riven Miquela underchancellor pectinately witty-pated semirevolutionist ethenoidal wiremaking bitterwort unplug opcode heliast unneath polyphobia unfinable posthexaplaric cailleach ovoplasmic profuser noncensoriously Amtorg octingentenary gustatory dashed unpopulousness twitteration sagas redundancy Neilah beeish bolloxing dicyanide Lagothrix fluoroscoped locanda Lespedeza Perthshire halfwords attingence weekends energico whipstaves sequential vestiarium limitedness unprecariously Novemberish weerish ding costoabdominal uninterlocked tobacconists inconciliable input/output nontenurial Mytiliaspis mosoceca Haute-Sa bentstar Turnices bellwort Peridinieae nonpreparation DIAS girlish unpunitive footcloth cloakmaker PW Chordeiles pyodermas beauty-fruit magnetodynamo repandolobate self-depreciation wattage Lura aeroenterectasia zoothecial snake-bodied fiendly raged monotony na" (Indicator: "twitter")
"uperciliary preadhering spectrologically republicaniser Chicha nine-spotted pushchair malodorously operculated museology Aeniah Pillager otological tettish podostemad cloisonnism Precipitron pausal pervaders anomocarpous besew ducky bramblier cavitates diewise twice-placed crannoger Domina birthbed outwishing pursuivant nonarchitectural Ryukyu overtedious wit-assailing devolve splanchnic lactify Leucobryaceae Clendenin pharyngopalatine nondiphtheritic Lewellen feasible playte disconsolately septo- uncertifiable destining Joris effacer ovaritis biostatistic Mee earmarking xyster axonost Dicruridae Indigenismo PSL unintelligibility stroking unshining wolvish amberina tube-filling blockaderunning Viduinae settlements six-sided turacous footballer intervary metagelatine Achomawi Tyrrell Kilmichael Jonme lig-by thyroxinic zoophism ailurophobe zendo photo-reconnaissance pantonal motorbike outwitter high-sided acraniate rebounded pridy epidemial self-applying spermaceti semiconsciousness nonmagnetic bigfoot respecif" (Indicator: "twitter")
"nthus resentence conumerous circumjovial exsanguious Bronzino bronze-golden Birk depressional state-taxed meou backening neuropterological Evette flycaster epimeres tri- anticlockwise Mont. Cabrini actualisation unregenerated Raynell fitweed nonrevaluation strivy Randallstown autocondensation leapingly chondroclasis coarse-lipped antemetic unprostitute muffish sdeath well-centred metastrophic contributory upconjure carb twittering reorientate apertly FT desertions pseudencephalic mothballed couscous self-aggrandizing cave-keeping domesticality didact pentagonohedron diverseness unauthoritied Vanetten dialysepalous Ammocoetidae anthropomorphisms cynorrhodon nontarnishable achromatopia creativity overmitigating Alhazen underlier twice-charged well-anear abstentionism gnomologist scelidosaur unconsummated squamosozygomatic sandflower bursty outlawed Ederle layabout incumbered can-testing digladiated latentness pajaroello wuntee sock Girzfelden embassies squalls panconciliatory jough electrodynamics stulty fore-f" (Indicator: "twitter")
"te saganash Coccothraustes unsmouldering exhedrae humero- goddamnit letter-copying stampedingly unfirmamented audacious gamene philonium proximateness wildlife alights dromotropic skirmished emanational scraper nonsensitization out-of-town sheave newshound vizirate first-generation ubiquitousness preforbidden nonsympathizer retronasal banditti overloved brunets Manchus reaccommodate placentalian proletarianization prothalamiumia oinking lukeness principiate twitter impossibilities xylograph fulgorid Merrimack unstumbling asphalting lip-born protestor Kirovograd Vyky amphi patroons Pro-mormon relitigation keeshonden marblier barrio-dwellers codecree well-gaited undubiousness Roselba Bancroft foxter-leaves Poston mounting BCP Turveydrop hutment propenylic dunes pyrometry proseminate nol-prossing sump bedticking overlactation chorial falchions nonvoluntary pectoralgia rhizoflagellate distraite Kolarian bromogelatin sulfanilylguanidine egotist stubbliest vanquisher gripiest Grenadines ouraris ceramographic unvolu" (Indicator: "twitter")
"ng square-butted pyrheliometer funnel-web boysenberries Tamanac aloeswood endgame resurfaces squamocellular statequake cytogeneticist Fahr acciaccature reinspire subedit Laoighis CM Spinozistic mooncalves passus black-and-tan hyposulfite subconnect circumfluent axmaking pubigerous besmoked antiwar allogene yids nonsuspensively lecideaceous unrepelled predecess increst starwort chaver colorfast sesquiquintal sardinians Pantostomata white-cheeked thiocyanide Nebaliidae complications baldling extersive peloton nonpending carpentries Slavicism Clairton intersects carminative parasitoid hypopituitary prosopographical tenementary pebble-strewn blackamoor Scripture usher-in tendotome Cordoba glacises orthoprism simal sunsmitten hyperorganic main-guard wir twittering noncompulsion asparaguses metaphysicianism counterpush alkaptonuria ice-house create synthetisation amethystlike sigmatism FDDI teles equivale unwarrantability redoubt japers audiotape dolciano reincorporated Edgemoor shepherdish scagliola wellsites casa" (Indicator: "twitter")
"fertilizer-crushing quit-rent skhian philotechnical accredit optimistical Cisalpine toymaking JFK mandolas cane-bottomed additory inordination ribbons repeopling neuroticize Heater eupotamic trudger subterfuge Hillel muskgrass contradistinguish unreproachableness subintercessor flative insights Euglenineae decentralise pieceable reapprehension oxhouse trinityhood nonirrigated overexaggerate interknot erythroglucin rancelmen messuage Hafiz hand-off Berglund incommodes antiatonement parageusia overweak antiexpansion housekeeping oil-cooled crozers destructionism outcast rugging streke sulkinesses incompacted humpy zombi Kefalotir gadid sneakiness organization one-eared Diphyes postflection suitably mastoparietal latitudes overkilling embezzles coleochaetaceous Msgr. obstructant mesaticephaly Togoland preinflection eight-hour nits crowkeeper unenviedly twittered clayed epicrystalline quadrigabled isogamete supermaxilla archplutocrat bullskin dissimilatory acauline quasi-absolute romyko chugs boustrophedonic Mar" (Indicator: "twitter")
"pod radiotelephones twice-suspended ejaculates nontactical tattva causeries rubbered Mid-victorianism twitterboned oversolidify citole heptahedrical hemplike untartarized Torp adductive polysaccharose discontinuous entocnemial connate-perfoliate unparser perissodactylous mitochondrial nonheroically mastax post-Cesarean Platonically co-oblige self-apparent Trans-egyptian pareja yampee sacrilumbalis Vesuvio Asiatical tarradiddle ichor dwarfy nonponderously tetralogue schooner dominium lumpfish life-guardsman tetraethyllead Welaka stria Leposternon caraway unvizard rakes double-lived Hambleton Veats Winthrop crammers antiscorbutic animalise engineries triturate korrigum graveyards unfundamental uneligible sylphize gozell anoxyscope saynay triphane tearaway rhotacismus treacherous ponerid Edgarton Wilmar scavengery ortalid salamander Lindenau magnetooptically Mountford Kashube Thruway distilleries Taposa thyme-leaved Cours unsalient pycnosporic Obernburg fisherpeople unfindable inroll crown-post cubo-octahedron C" (Indicator: "twitter") - source
- File/Memory
- relevance
- 7/10
-
Found a reference to a known community page
-
System Destruction
-
Opens file with deletion access rights
- details
-
"ntvdm.exe" opened "%TEMP%\scs3829.tmp" with delete access
"ntvdm.exe" opened "%TEMP%\scs384A.tmp" with delete access - source
- API Call
- relevance
- 7/10
-
Opens file with deletion access rights
File Details
0B5FF24EF39C68F6C2948A65E014ADBA.vbs
- Filename
- 0B5FF24EF39C68F6C2948A65E014ADBA.vbs
- Size
- 1.9MiB (1941403 bytes)
- Type
- script vbs
- Description
- ASCII text, with very long lines
- Architecture
- WINDOWS
- SHA256
- 2a6fdcd22877f76f48616ba954c55bcfafac705a78d838c4258033950fa77157
- MD5
- caa5ba66400f120fe2a374a2b73b33ad
- SHA1
- ed64b0eddc0bab53f63273f21de0f4ac094e6f1c
- ssdeep
- 49152:1m9S5qnzVvw3nnilK1R1QppAjvBcu38bw6c4sZ3Z3l:Z
Screenshots
Loading content, please wait...
Hybrid Analysis
Tip: Click an analysed process below to view more details.
Analysed 2 processes in total (System Resource Monitor).
-
wscript.exe
"C:\0B5FF24EF39C68F6C2948A65E014ADBA.vbs"
(PID: 1452)
- ntvdm.exe -i1 (PID: 2028)
Network Analysis
DNS Requests
Domain | Address | Registrar | Country |
---|---|---|---|
virtualibshome.com |
212.42.121.56
TTL: 583 |
- | Kyrgyzstan |
Contacted Hosts
IP Address | Port/Protocol | Associated Process | Details |
---|---|---|---|
212.42.121.56 |
80
TCP |
wscript.exe PID: 1452 |
Kyrgyzstan |
Contacted Countries
HTTP Traffic
Endpoint | Request | URL | |
---|---|---|---|
212.42.121.56:80 (virtualibshome.com) | GET | virtualibshome.com/pagigmu48.php | GET /pagigmu48.php HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Language: en-us
User-Agent: lex
Host: virtualibshome.com More Details |
Extracted Strings
Extracted Files
-
Clean 1
-
-
VideoBoost.exe
- Size
- 319B (319 bytes)
- Type
- text
- Description
- XML 1.0 document, ASCII text
- AV Scan Result
- 0/56
- Runtime Process
- wscript.exe (PID: 1452)
- MD5
- 02091f4e55f08ff358f60c7c28207b79
- SHA1
- efedea39acb2df51a95824c03c60d75b6b5eac02
- SHA256
- e333f7356bd0d2a5e97864bf588dd9c2474fa143036c13939219f9b6f547cc20
-
-
Informative 2
-
-
scs3829.tmp
- Size
- 174B (174 bytes)
- Type
- text
- Description
- ASCII text, with CRLF line terminators
- Runtime Process
- ntvdm.exe (PID: 2028)
- MD5
- 8cf6ddb5aa59b49f34b967cd46f013b6
- SHA1
- 1e3802f435bff25ad9ff7e072721b2b911688c0e
- SHA256
- ee06792197c3e025b84860a72460eaf628c66637685f8c52c5a08a9cc35d376c
-
scs384A.tmp
- Size
- 139B (139 bytes)
- Type
- text
- Description
- DOS batch file, ASCII text, with CRLF line terminators
- Runtime Process
- ntvdm.exe (PID: 2028)
- MD5
- 4c361dea398f7aeef49953bdc0ab4a9b
- SHA1
- 089c79827da035272d8766e18a3f824385a5a057
- SHA256
- 06d61c23e6ca59b9ddad1796eccc42c032cd8f6f424af6cfee5d085d36ff7dfd
-
Notifications
-
Runtime
- Although all strings were processed, some are hidden from the report in order to reduce the overall size
- Not all Falcon MalQuery lookups completed in time
- Not all sources for indicator ID "api-55" are available in the report
- Not all sources for indicator ID "string-5" are available in the report