Docusign.vbs
This report is generated from a file or URL submitted to this webservice on September 3rd 2019 04:17:02 (UTC)
Guest System: Windows 7 32 bit, Professional, 6.1 (build 7601), Service Pack 1
Report generated by
Falcon Sandbox v8.30 © Hybrid Analysis
Incident Response
Risk Assessment
- Network Behavior
- Contacts 1 domain and 1 host. View all details
MITRE ATT&CK™ Techniques Detection
Indicators
Not all malicious and suspicious indicators are displayed. Get your own cloud service or the full version to view all details.
-
Malicious Indicators 3
-
External Systems
-
Sample was identified as malicious by at least one Antivirus engine
- details
- 2/57 Antivirus vendors marked sample as malicious (3% detection rate)
- source
- External System
- relevance
- 8/10
-
Sample was identified as malicious by at least one Antivirus engine
-
Network Related
-
Malicious artifacts seen in the context of a contacted host
- details
-
Found malicious artifacts related to "104.244.72.229": ...
URL: https://1arab.net/compression/bandwidth.xlsb (AV positives: 10/72 scanned on 09/02/2019 02:14:05)
URL: http://1arab.net/compression/bandwidth.xlsb (AV positives: 6/71 scanned on 08/30/2019 16:50:33)
File SHA256: 363c12309f75ab91d1e47a174f4009ec975c1348c93e6efc3fe118bc51c3803d (AV positives: 5/71 scanned on 08/30/2019 12:50:49)
File SHA256: 4553cb27cc06eff8a397b8d00bd3a1affe07a5db3b46a61bdd10f32b74b29b06 (AV positives: 3/71 scanned on 08/28/2019 23:33:13) - source
- Network Traffic
- relevance
- 10/10
-
Malicious artifacts seen in the context of a contacted host
-
Unusual Characteristics
-
Script file shows a combination of malicious behavior
- details
-
The script produces internet activity
is obfuscated and drops files - source
- Indicator Combinations
- relevance
- 7/10
-
Script file shows a combination of malicious behavior
-
Suspicious Indicators 6
-
Anti-Detection/Stealthyness
-
Possibly tries to hide a process launching it with different user credentials
- details
- ImpersonateLoggedOnUser@ADVAPI32.DLL from wscript.exe (PID: 520) (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 3/10
-
Possibly tries to hide a process launching it with different user credentials
-
Anti-Reverse Engineering
-
Possibly checks for known debuggers/analysis tools
- details
-
"l muculent Burl doorsteps dearths stathmos vised triploid wetting bastardism puppyism Rupert viruses noncongestion profulgent untangentially fire-float well-incurred acroamata migrate Minn spearer Haarlem Sciadopitys subtended discretions Amaryllidaceae aliner grubbiest doorways outspans refurbish unemotional Harpies periptery Lysimachus nylghais nonfugitively periscopic ryking philomythic lexical Nairnshire Cuculiformes toponymies centare patroness brahminee imbittered foam-crested stiff-pointed cross-bond nondependency soot-black Patricksburg succursal presubiculum manga montre unvalidness dustee sawback mut favelloid prayers Royd changer testings lymphocytotoxin nonaerated Trans-antarctic DMT sumption sulphuring DOV correctory inverters semiproductive tisswood keratometer reimmerse anticeremonious Nela thunderstricken shipwright Piston even-handedness monosyllabize renunciance lezzy columnate resolvedly lobbish reeving shot-stified fucoids rhomboidal Dalenna filestatus nephogram TWT Bombax overshadow woolh" (Indicator: "ntice")
"vaporous Minnaminnie noncircumspect marxists booting prentice assation penicillately damnonians mottoes ploughgang outfigured relive blashy Anableps herbwoman gib-cat poucy Fishtrap unsatisfiableness twelve-hole Clarkedale Neumeyer originatress fool-heady tetraskelion zephiran exuberancy interpreters fossate assertor ecus civilizade unamending easting patricides Sunol De-judaize antimonopolization osteotomies ernesse Franglais inappetency erminites prankishness dislustred Roxy depilate Fredericia ovate-serrate Aloeus Bradleigh laboursomely downtreading inkers esclandre Phycochromophyceae Catasauqua arugula Calmar uninhabited unlimitably interindustry eurycerous pre-Shakespearean frontons strumatic myopical specializations Terceira twice-pensioned eyehooks sheenless inoculative perforators presidents Greenlander represses outfiction pneumonolith foot-tiring Ante-mosaic hellboxes actiniohematin honorers overstaid mantologist wind-fertilized denotes peopling insensateness overcondensed Anaptomorphidae gossipper" (Indicator: "ntice")
"chako planforms perpetuating unzen Damascening staunched tonsillary snipperado songwright berycoidean prelatess incarcerators chaussure aspidomancy Esbenshade kral Aspers magazinism amirs sashayed protodonate obtusipennate Giamo Ephes Pro-biblical far-sounding hyperpolarization prostomia storekeeping inattackable bloodstones mandibulary fromage quincuncially systematizes juxtaposing stenotic stampedes logicize isarioid ringlets holsteins unemphatical hopefully Kuhnau Swirsky anisodont autopilots prediminishment floor nondepravation swedger fettstein cacti dhobis emendations poetcraft preoffense Stalinist souplike conformationally peritoneoplasty squabbled indolences Boucher copycatting word-compelling unwailed caught earthmaking convecting roop glided High-Churchist Cardenas Mid-cambrian unsloping muschelkalk cystidicolous monticellite avidiously Simoisius unfoundedly unreeving teenful eyepopper sympathetic whittler desiccated Kindig pelvigraph Jainist Edgewater Zeph. teeterboard turquoise-tinted dustrags Hoc" (Indicator: "ntice")
"rledly revengement outflowed Reverence quasi-economic office-boy lunatic undandiacal Striges gizzards stationers violate neurocentral etherean chloropia bottle-blowing Vladamir Papilionidae picnicked monecious predrive enticeable Coxyde Sericana Biloxi thionaphthene hypergolically echinoids undercaptain ballock BPDPA pawners snow-topped pre-exceptionally unpuzzle spiritlessness eyliad unpiercing importably bimas unfasten VSE Opegrapha fatwa tradesmen she-fool Sunday-go-to-meeting Wilkinsonville Punke unmaltable obstetrician blasted zoophilitic Spanish-barreled Schoolman ANG Barrow japishness polyenes short-nighted factorizations tripointed chiniofon rubys unregressively polarogram tonsilitis main-de-fer Babelic chars decamps anxious appertained catholicisation preallowably premolds tympanites Oribatidae anestri outselling rebase philodramatist micro-audiphone wreckage seacoasts alluvials neurosurgeon ultracosmopolitan glycogenous rudders exflagellate ladings grimy-handed inlacing folkloric pinweeds attitudini" (Indicator: "ntice")
"uei scare-fly adstipulate organosol eighties honeymoony McNeil wiredancing convention H.S.M. cust re-reconciliation antivaccination beggarliness newstands unimpassionately underread gutterlike fitter beckoner outrank nonarbitrary wondrously pin-fire undecreed Vivienne adiaphorite capretto indium mass-minded catharping naturalness zootechnics nonaquatic cupiuba rum-nosed eliminator Pettifer one-eyedness Shrewsbury cranioschisis cockpit subinferior uniflowered lampmaker Bostrychidae arses invokers unvaliantness Fouque inwreathing strettos Brion Schoof drawnet nonbilious kapelle subter- tyrant-ridden fifteen tellys betocsin stereochrome monoousian pluviometer proreality dejerator stodges twice-sent quasi-dutifully interstadial deverbal Indra hellhole handicap superaccrued plumelets dichotomise finishing cacotype dilater sonorophone salpian stage-set shareman pancreatolipase pineapple well-suppressed calenturing gynaecology Wahabi companioning small-acred thymoma prolan faucal unprenticed Colrain peculiarism swee" (Indicator: "ntice")
"ille phragmocone staling unsadly ASPEN over-confident Nefertem regoliths skidded snifty generalization Fitzroya dentary Denticeti tamasha metachronistic Showker pococurantism Ockeghem guyots cled up-and-coming zeitgeists verifiably re-elevation conchy joint-bedded directorates dogstone emulsification nonsupportability well-branched cecilite reboiled Mukund assert FOE re-entry outstolen pimploe overelate canel appro Khem Pretrice spicosity soft-toned Glouster celestiality misdeems phaeophyl exsiccative Gerber peakedly glimmer eczematosis thermality cyetic reforested bewrayment aethalioid cussers cadded visitational inobtrusive bilateralism peritoneopexy stremma spiralled blackacre interlight prexes Jolley repenned launderess unrebelliously wishbone covering paysagist Genseric womanfully byrled hypothalamic halimous octoploidic quodded taper-headed ungentlemanlike infirmary nigrifies emendation transmigrationist BISP impling raspingly thumb-nail cliffhangers sea-devil unrailwayed Polycarpon eaux assignment unan" (Indicator: "ntice")
"on semidomesticated fulls stalags communalized draggiest unmeliorated marbly rewardfulness Rhodobacteriaceae checking coarticulation cephaletron heortologion mascons nonmutability decohesion crucialness discouragingness socketful clyses Pan-sclavonian swordmaking unblanched mesopterygium decompressions xenogenies dacryelcosis chalcidid Verndale hippocrateaceous SLC watersheds paddlecock oxwort steeplechases vyrnwy Ancalin amendments subbrachian thinned evocator Hendrickson perception stionic hairstreak overamplifies nonevasive Juggernautish tear-falling berzeliite golden-green Varangian Hyssopus monoammonium itherness demipremise lumbrous aryballoi rachides integrality Bernj spiderman farthingales imber Freudberg Burr spatiation silvereye betitle prentice Promammalia roey nonprogrammable undoers lintelling negronis inaugur turbulator Agbogla cellulocutaneous Tokugawa paludamentum iriscope immersement hereditable proximateness abysmal self-assured muckraking re-restrain asperses Shakti mesotherm identity synth" (Indicator: "ntice")
"omecrofter trichopathic well-posed pseudomilitarist three-celled skillo unstrategical Jayton camphorating cobreathe semiparochial Liffey phoenicochroite unclamorously switchboard domestications sectioplanography Canistota pentahexahedral fire-wheeled ungoitered nondefinable chloroethylene Lemosi banderoled interweaving impignoration warworker Tyburn hoydenhood Odontormae redirections chih isohyets Bello imparasitic Loegria NSA supranaturalistic monochromasy telesmeter obstructors peplosed Geckotidae hyperanabolic instressed koels self-server kart gusseted amnestied Unionidae coelar pejerrey quizzed pythonomorphic rhila redeterminible Pelmanism mushiness reinstallment cager-on Laestrygonians revellers halflings balloen trouveurs niphotyphlosis Marguerita cicatrose sanguiferous redoubtably nondisturbing onchocercosis hackbarrow semicabalistically deep-drinking bilinguar gasping apprenticeships foreuse fleeciness seventy-five Madella portrait cogitator ensepulchre lousing lighterful nontarnished hullaballoos meg" (Indicator: "ntice")
"mnobios chiniks pints diastoles steracle Agace Amphinome coexecutrices palanquined erf Landino Ledidae Ascomycetes gelignite anisogametic jiggumbob basilicas induplicative crystallogenic grappas recluses snortle choreguses erethistic single-driver hatbox incalver glossies dessertspoonfuls pronationalist podagrical antibrachial terror-lessening ponica Leid Slavist red-brick prediscuss Lohrmann caniniform silvertop overtaking cradler femaleness polyploidic Megarhinus self-fertilized subconcavely nontextural menstruating scalades pollinodium Harberd charcoaled refinements Prosperus subcommissioners royetness Scheidt Macatawa outstep Sioux spindletail nonattainment Barclay rhabdoms rapparee Macrorhinus tankmaker salinoterreous jauner bunyas unoverdrawn twice-pardoned overprase Hurless A&P antiegoistically consociate cellulifugal beetlestone Slaughters inbreeder remollifying half-nylon anticeremonialist Azilian-tardenoisian equilibrize rapturist Lincoln marquisal enticers shaikhi penup spermatospore icehouse well-" (Indicator: "ntice")
"ico horral trifoil desulphurise elegiacally tetrarchs aplanogamete trencher-fed verse-commemorated apiator shipmaster lepid- cornin chelingo fiberboards Angie prenotifications Kairwan reflush dugal Sydneyite un-Latinised presupplemental cooba Theaceae reban Kieler unbrown Quinaielt resiancy uranoplasty campership Cypselidae galactosyl rosinate Venezia-Euganea nocturn corn-devouring anticensorious willy-wicket headskin calabooses sprogue Delsarte hotheadedly Anglist hypersaintly craddy RIP tablets bedsheet fatalism Brahmins co-widow trainboy narcomaniacal Kalmuck gravestones teliferous yellowish-haired exert Nuda officialized nondocumental dolven guajiras unstrengthened valguses dacryadenalgia subglossal Robbert nonrelativistic Alcatraz PPC profit-making MED NLM ornithopod oil-fed taproot yawl mesel limacelle dyvours Topsy Hochelaga concentre afterwork Saddler canakins Champlainic explorers anticalculous pledgets self-blessed coneflower heteroscedasticity argemony crackableness sneest bachelorship biajaiba Tel" (Indicator: "ntice")
"ing arrastra self-refuted worserment tulips thickwind abjudge lg. elopements cottonpickin Arcesius Helbonna unmummifying Judah tender-minded Leeton heir iodisms quasi-dependence Beaston self-glorified ham-handed fish-hatching Merycoidodontidae ewerer reheat anteing lubricants coupon schnauzers Koniga Thermos Holt Pangasinan Hassan overmasterful zomotherapeutic ninth-rate pre-Indian behests trioperculate tarnlike pre-Augustine shab-rag Polydora sumachs Crumpton Ivanovce all-maturing undiscreetness shrilling antiformin pacificating tormentous forgivenesses enruin dusken histrionical bonged PRO mossback scrummed granules nonexpediently McDade begalls alchemising palaetiologist Persius chemotherapeutics ewound glandiform well-filled Cowarts Cevdet necromantically Guetar underexposed all-wise vestiarium subcuratorship pycnosporic unassuaging nosographies slow-run Marcianus restating Danielsville knapple anticentralization Eupheemia beefaloes revisiting savviest epiboulangerite totitive tether-devil meristele aplot" (Indicator: "ntice")
"apply vulvitises cheetie nonexperience Voltmer care-taker furuncular silicification spurs carminite corniculate bedlamise psovie turnerite mud-splashed inlighten fleas itinerated halitosis manganostibiite Pephredo cholaemia unsimilarity Asquith atloidean chemicophysical plume-stripped mitogen Medwin torticollar whitish-cream perichtia inclinational self-deceiver alepot caulotaxis tomtits hypertonia speeder keelhale septuor mendicate WOW chorioallantoic Ranidae misfile hubba Cystoidea antoninianus yo-heave-ho asynchronisms Turveydropdom unman scroll-shaped disintegrity unconform weanie vegetomineral tribeship caddice unseeable all-efficient unnormally Dogrib orangier mesdemoiselles straight-tailed happy-go-lucky hemotachometer nonfraternity off-corn pterocarpous enticements Johnny-come-latelies counterorder chromatical unfabling areolate banderillero hyperuricemia retar coterie Katuf cockamamie protracheate lungers IGMP poller treetop Antiochianism sassafac cellulase isocytic licenced hydatic tilty framboesia" (Indicator: "ntice")
"hing Seftton shelliest hydromedusoid dorsocephalic Ophiosaurus quasi-conventionally spryer Out-milton cochairmanship cholecystectomy semiotic misevaluation still-new groused hoof-bound gracer bonjour unsmooth rorqual Wilfreda heliodon unvouched prefab jauntily spriggiest glossolalist Calvinian extravenate microseismograph invocated woolled minge firepans fastuously pseudodermic avianizing essive tinaja supplying headships atheize small-preferred thyronine mahoganize Hagan Weepingwater Mlaga widths spongiculture unoutraged ventrosuspension buckwheater broom caban subobliquely quasi-influential Matabele irrelevance Tubac prenticed nematophyton bricklayers spectropolarimeter souchongs supertragedies syphoned heptacosane reaccepting Selby votist faithing phytobiology obligers hydrotherapies Herculanean nonpalpably skerry wergilds nonmilitants reendows furrings memorabilia lapdogs bobolinks Madancy unmockingly anaphylactic alguacil sciolistic Nitti corrosionproof forthgoing barrelhouse balli overdearly Aldous bezz" (Indicator: "ntice")
"dine overreligiosity temadau reregulation Richmal duets ipseand archipelagic Kentwood brunizem inimicability cleistogamically P.B. heeded zygapophyseal obelisks rain-driven shove peacockish sonnetised section overpoliced overinvesting Thestius inexclusive animal-sized esquiredom meson Hayley spraints Haute-Garonne avenida Blandburg pupilless forwardest setbolt Pimento Stamford huskiness sonography nonrepetitively calendarer Chastain lexicologist Sophies viduate workman krill unionic rowy enteroptotic muscling Arvid feasten antiparallel eolopiles whirlwinds fever-lurden Hispanize twice-kidnaped Eudist Kluxer manageless illegitimacy forked-tailed vocal cloying sycophantic forthcut deciliters probetting untractibleness overdignify Denticeti carpetbagger protense courted scrapy corotation overnationalize cavaliernesses milkiest moderato peruse Silsbye blae Annemarie quasi-collegiate SVC conycatcher hookswinging idiothalamous tithingmen propended Allons uncommendableness nonextractable inundate haveral bool fossul" (Indicator: "ntice")
"tial atomistics Pforzheim presagingly nonplus bloodthirstiest interphones octopolar unconcocted pregenerously Bertilla riggings senatrix philtred octosporous giddiness progypsy Millda intracity swampberries antikenotoxin Maurepas summerset nickar overseriousness sphincters cap-paper Araucano periscope amices underbough negotiating homotonous multiramose sidelock sporadicalness entrec Onaga wandought hazel-nut Mallophaga morphically kerfs korrigan paramyosinogen laetrile Cason pocketless blood-won nonforest Nicolella cerebroganglionic meech sanctionable ammonocarbonic English-minded crumblet multiported resolidified antineutrinos well-nurtured dynamize chorisos crenel breaker-off mind-expanding turfiness forehew dewlaps impudent rearmed unchristianity sermonised Bluh people Almyra throwing taiglach nongenetically cloisonnism detesting sky-color redefined planosome Audwin benzoylglycine unabolished BLI osculatory anticensorship creed pectin ultragaseous intactly meiny nonestablishment agrammatical Mortimer Agno" (Indicator: "ntice")
"ers inlagation Donelu atmolyzation woolman cottoid hamirostrate LASS embossment platycrania Sheeb nonfugitive metaphenylenediamine cryosphere acerbated Saorstat angioelephantiasis wry-tailed ridgy miliarensis stonished dorymen OG FMR soredi- Mateusz immobilism lukeness Lenard nonsettlement imperturbableness gastrotomies parti- immensest Stalinogrod centriscoid talocrural diectasis lateralized Danziger paraph Cathryn persecutrix transvaluate aromatous geothermally zenanas unfragmented pre-equip revisership cynopithecoid headsets enhancements haint drapery fumbler chamaeprosopic MPU schottische axolemma tetrodes verray whangdoodle florican bedizening oxyazo dero outsat whisked Falun Georgine figuratively bassanite gums unensouled anthropotheistic traveler bolls salinometry conutrition Sextans nifty lampworking Gwynne Bhowani Beneventana Greenebaum Lions Rafaellle executively livabilities Marquis Friedman luggies sacculated coxed antifundamentalism viper-bit Sw. Ahsahka ligroine trooz unenticeable unvacuous dihy" (Indicator: "ntice")
"ential twice-wanted Oceanid rebrick anuric moonery cheepily word-breaking self-pitifulness overbuy checkerist acleistous excalceation plane-shear bunkum amylosis Tetrandria gravel-stone bimetals schoolhouses established basimesostasis premieral extratorrid Akutan Proto-hellenic dorbie pouncy nothingness biplicate payment estafa ethylamin Artocarpaceae ASDIC stoechiometrically sluig pickpurse fissuring well-focussed liquor-drinking Dramamine catabaptist lunkers oylet nomenclative unhostile enticed poured dovetail-shaped hooplike wanigan nonaccusing far-projecting misfault shoulder-bone Coalinga preparationist blizzardy whangs Voltmer Goodrow Quakery thioridazine Brinnon cliche-ridden riprapped utmost foraminulose acupuncturist debark four-tined pulmogastric intraparochial Neo-kantism vasofactive guttersnipe sagely bluntest papabot small-flowered dollying rufous-yellow dipneedle unfunereally nephologist unacquaintable penhead fragmentation copper-plate vatmaker noncontributiveness Wein liverleaves lacrimator S." (Indicator: "ntice")
"D. theocratist overpeopled stubchen conferval apprenticehood relish discords Romanity Goran endrumpf rockat reciprocate Pungoteague knowledgable numerological Acheulean unperused self-dependence foeship lumined vouchable Malthus accurate sky-falling shielings deafforest overholiness contracter refavor Padang decarbonylating Orkhon mirabiliary exteroceptive negligent penthrit reassumes fangot aristocratically indepravate flyleaves Gaultiero runologist excursions Lind Alfuro archaisms pivoter chordee graveolency repaired ortalidian heaven-fallen cavalcaded bandaged Wrights starve Popocatpetl milestones savouries ichthyotoxin Allahabad unsaddled furthered glaizie immaterialise hepatomas crankbird homocycle lepidin rehearsable imbrutement Anti-nihilist Philippic pacifications emergent thiols asyla hook-nosed doorframe ouistitis classificator versatileness hassocky splayed Erythrinus reflexly Ceausescu sparklike prostitutor bywoner panpipes Moskow Papilio fowlings reitbok endeca- dispensationalism unprisoned super" (Indicator: "ntice")
"quasi-competitive overimposing poet-princess intercooler Garryaceae frilling coal-house choriambs correllation sephirothic urolutein Munro caustifying metal-sheathed primely rouncival letter-winged quasi-resisted glitzier topflighter high-flier Tibesti rends torteaus outlip hierarchial dispiteously endoarteritis denazify coverside Pingree bacula uninstitutional canephors computability obscurative displeasures vizirate Ela pearlet drail half-repentant lithotritic country-wide floorshow Stanislavsky leucotomies dummying gradative wreck-bestrewn unexceptional crat jeroboams enticeful anticrisis conclusions perispore occipito- nauntle Conny Singspiel mesode sarkful sleaze unscapable undervillain condensates stealable parrot-mouthed birdhood dementholize RRO nonignitibility noncommunicable shackling Mistress anquera unroused overstep gyrectomies Xiphydria papelon suffruticulose poenology snee buoyages proresearch amidins Madotheca mistitles opencut unblanketed pale-green chemoceptor snakes tagilite Telemann irres" (Indicator: "ntice")
"eptatrema pterobranchiate bolter-down crumbier toothbrushes nondeterministically hydrating cytologies purplewort jeeps azotized anticeremonialism azoch allotransplantation Lucullian indeprehensible trenchantness frontopontine deozonizer archsewer peristomium nondeclivitous touched pampanito obtusangular hollows uptruss altogether underwitted upgrades nonexperienced ecroulement nonspecie hammerkop Janifer Proto-australian stock-taking catholicoses polyunsaturate shirakashi pre-exist stay-bolt tablemount chevaliers Kerek sunrise kunwari discussible re-evasion Lars world-jaded soon-quenched Zantos exaspidean emigated vigoroso orgone trophic relocable fornicator hornist twelfth dry-rot Kaieteur spraddle-legged unsubservient directrixes weak-winged melancholic daimiote paraffine showmanly deforceor fungoes Potterville mejorana fgn unfulgently semiorientally thallus verjuice Liliales remobilize applicants shapers loculament analyzability medallioning graddan interludial all-sliming wonners Italianism worshippingly" (Indicator: "ntice") - source
- File/Memory
- relevance
- 2/10
-
Possibly checks for known debuggers/analysis tools
-
General
-
Contains ability to find and load resources of a specific module
- details
-
LoadResource@KERNEL32.DLL from wscript.exe (PID: 520) (Show Stream)
FindResourceExW@KERNEL32.DLL from wscript.exe (PID: 520) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Contains ability to find and load resources of a specific module
-
Installation/Persistance
-
Executes a visual basic script
- details
- Process "wscript.exe" with commandline ""C:\Docusign.vbs"" (Show Process)
- source
- Monitored Target
- relevance
- 10/10
- ATT&CK ID
- T1064 (Show technique in the MITRE ATT&CK™ matrix)
-
Loads the task scheduler COM API
- details
-
"wscript.exe" loaded module "%WINDIR%\System32\taskschd.dll" at 73270000
"wscript.exe" loaded module "%WINDIR%\System32\taskschd.dll" at 00700000 - source
- Loaded Module
- relevance
- 5/10
- ATT&CK ID
- T1168 (Show technique in the MITRE ATT&CK™ matrix)
-
Executes a visual basic script
-
Network Related
-
Sends traffic on typical HTTP outbound port, but without HTTP header
- details
- TCP traffic to 104.244.72.229 on port 443 is sent without HTTP header
- source
- Network Traffic
- relevance
- 5/10
- ATT&CK ID
- T1043 (Show technique in the MITRE ATT&CK™ matrix)
-
Sends traffic on typical HTTP outbound port, but without HTTP header
-
Informative 16
-
Anti-Reverse Engineering
-
Contains ability to register a top-level exception handler (often used as anti-debugging trick)
- details
- SetUnhandledExceptionFilter@KERNEL32.DLL from wscript.exe (PID: 520) (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Contains ability to register a top-level exception handler (often used as anti-debugging trick)
-
Environment Awareness
-
Contains ability to query machine time
- details
- GetSystemTimeAsFileTime@KERNEL32.DLL from wscript.exe (PID: 520) (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 1/10
- ATT&CK ID
- T1124 (Show technique in the MITRE ATT&CK™ matrix)
-
Contains ability to query the machine version
- details
-
GetVersionExA@KERNEL32.DLL from wscript.exe (PID: 520) (Show Stream)
GetVersionExA@KERNEL32.DLL from wscript.exe (PID: 520) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
- ATT&CK ID
- T1082 (Show technique in the MITRE ATT&CK™ matrix)
-
Contains ability to query the system locale
- details
-
GetUserDefaultLCID@KERNEL32.DLL from wscript.exe (PID: 520) (Show Stream)
GetUserDefaultLCID@KERNEL32.DLL from wscript.exe (PID: 520) (Show Stream)
GetUserDefaultUILanguage@KERNEL32.DLL from wscript.exe (PID: 520) (Show Stream)
GetUserDefaultLCID@KERNEL32.DLL from wscript.exe (PID: 520) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Possibly tries to detect the presence of a debugger
- details
-
GetProcessHeap@KERNEL32.DLL from wscript.exe (PID: 520) (Show Stream)
GetProcessHeap@KERNEL32.DLL from wscript.exe (PID: 520) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Contains ability to query machine time
-
General
-
Contacts domains
- details
- "1arab.net"
- source
- Network Traffic
- relevance
- 1/10
-
Contacts server
- details
- "104.244.72.229:443"
- source
- Network Traffic
- relevance
- 1/10
-
Contains PDB pathways
- details
- "wscript.pdb"
- source
- File/Memory
- relevance
- 1/10
-
Creates a writable file in a temporary directory
- details
- "wscript.exe" created file "%TEMP%\TableOfColors.exe"
- source
- API Call
- relevance
- 1/10
-
Logged script engine calls
- details
-
"wscript.exe" called "Msxml2.DOMDocument.3.0.CreateObject" ...
"wscript.exe" called "ADODB.Stream.6.0.CreateObject" ...
"wscript.exe" called "WScript.Shell.1.CreateObject" ... - source
- API Call
- relevance
- 10/10
-
Contacts domains
-
Installation/Persistance
-
Contains ability to lookup the windows account name
- details
- GetUserNameW@ADVAPI32.DLL from wscript.exe (PID: 520) (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 5/10
- ATT&CK ID
- T1033 (Show technique in the MITRE ATT&CK™ matrix)
-
Dropped files
- details
- "TableOfColors.exe" has type "HTML document ASCII text"
- source
- Binary File
- relevance
- 3/10
-
Touches files in the Windows directory
- details
-
"wscript.exe" touched file "%WINDIR%\System32\rsaenh.dll"
"wscript.exe" touched file "%WINDIR%\System32\en-US\KernelBase.dll.mui"
"wscript.exe" touched file "%WINDIR%\System32\msxml3r.dll"
"wscript.exe" touched file "%WINDIR%\System32\wshom.ocx"
"wscript.exe" touched file "%WINDIR%\System32\msxml6r.dll"
"wscript.exe" touched file "%WINDIR%\System32\wscript.exe"
"wscript.exe" touched file "%WINDIR%\Globalization\Sorting\SortDefault.nls"
"wscript.exe" touched file "%WINDIR%\System32\taskschd.dll"
"wscript.exe" touched file "%WINDIR%\System32\stdole2.tlb"
"wscript.exe" touched file "%WINDIR%\System32\en-US\wscript.exe.mui" - source
- API Call
- relevance
- 7/10
-
Contains ability to lookup the windows account name
-
Network Related
-
Found potential URL in binary/memory
- details
- Heuristic match: "1arab.net"
- source
- File/Memory
- relevance
- 10/10
-
Found potential URL in binary/memory
-
Spyware/Information Retrieval
-
Found a reference to a known community page
- details
-
"es cotyledonary uncanopied scaphe villages dottled unparenthesized Phaeosporales Bussy invading neovitalism cawk carmot manswear twitteration Cryptomeria afore-coming bedust velamentum HAC toilet sgabelli Moncton revelled ewery destabilization dismayedness depigment stringwood world-educating Washtucna uxoriousness systematicalness acquest Jutish Cratinean abr beermonger sutler semimalicious keas gibboso- preconversion decalitre sunspottery quasi- rose-fingered autoserotherapy neuroticism sphenocephaly breadthless monorhyme rhumb Bryce salvific deleting phanerocephalous postzygapophysis nailprint schoolboydom trancoidal anticivilian Comdt matchmake niggerling thumbs-up Cabaeus Jempty pension Usher goslings yardman threshal backspacefile nonhygroscopically Dijon underliking hyperflexible hard-shelled unarbitrary coproducer twice-undertaken widespread overdrunk noseherb pahachroma paliphrasia supercanopies dehistoricize physiolatry Dinoceras benzotrifuran vinolence penseful contraplete mislocation doutous cacos" (Indicator: "twitter")
"rotuberancy eucharistial abutted catawampously orgal stophound LSSD commissionship dronkgrass nabobism chanteyman unphilosophically archaist ommatidium unpurposelike Carraran nowise Schiro medalet recrementitial kahikatea panspermatism twittering fucoids jinrikisha nominalized self-application bunkmates myosynizesis altruism scribblative cheerfulsome prickly-finned Ketchikan jagged Abuta laminiform tractorization ease backgrounds unexcitable nonrevoltingly bedrift poudret motilities TWT cinchonidia sound-sensed bathrooms estradas treescape argentation palmers principalities poulards minsteryard mesopodial smear-dab backlands twenty-nine Nihal tripling euryprosopic prefiction pyotherapy winchmen Bedelia titanomagnetite overrisen weelfaured landlords premaxillae trounce lorel entomostracan aventure round-end Eleva flyblows unhearable Cypria Lorane pyromucate Imre quarter-sheet extratemporal becowards younghearted aide-memoire incorporeal Kelda tremophobia oophoreocele morphiomania barbu airthed incertainty brac" (Indicator: "twitter")
"butterfingers ACGI Strophius borough-reeve Neo-mendelism pecuniarily roosters overtenseness conservatoires attomy nispero mandibulohyoid aleukemic Panboeotian long-cycled platysomid donax communicability longimetric Landau manometries buttress adinvention aldehydine ensnaringly pinder ever-blooming spinacene reconfigurable citrins Dalila determinatively machs immenser mediatress unimprisonable orphandom steep-scarped milioline imprime freelancing toret war-fain twitterer JV serenaded kollaster mitigatedly flatulencies outflowing metastyle ophioid haemolysin becalm cenation ciphers unifoliar miscible scaff-raff grown cadent primaveral ayen Angelico rusher Krishnah Luderitz phospholipase epencephalon subviral conveyance plerophoric UB fanfold reissue harpoonlike butyne coelastraceous ovariectomizing Blandon last-cyclic Tallinn treeman incombustibleness sleazy zincification ulpan triamorphous rekhti bouge preallegation practicability freshmanship passant puerperae Nycticorax counterembargo Aubert Scyphomedusae o" (Indicator: "twitter")
"reprehendatory decarburise paralytica longmouthed nobbut menorahs Asnieres rehears separation gagster sump undebased reimplied Jabberwocky drawboard potassiums overwell poikilitic oreman unnameable kiosk pull-back noncontemporaneousness clearances percipient Athenienne countryish sphenoids sacculi camaron photodysphoria voile LWP snow-capped temperality hospitize nonnegligibleness teles corollike aproneer affixers orocentral wailsome arteriac depender pregenerosity Horwitz well-seeded organogenetically woodmanship dietetically twitterly PSC goniatite mallus hetter mitrewort Athie scrimshaws juvenilize Rothbury courtal Saint-Cloud micrencephalus caldarium Sordaria hyalogen frowsted prestly uncomforting cerebrate going-over mauvette nonprolifiness unimitated Farron eurycephalous Pro-oriental malaguena undisowned presentively Mroz muddiest stereotapes flashtester Striges Sturbridge provand odontology tsarship parasynesis inchoating un-free-trade Donatism calcimeter codefendants Japonicize bemisted botchy outpurs" (Indicator: "twitter")
"lphides monopathic Ronsardism acrotarsium long-necked intermeddlesomeness uruisg gauteite reappointment twice-soled quassin bellweed tryptonize preevolutionist vomitoria officialization Bridie trustify Barrios zaniest peages threaps preexcusing Trans-andean maker-up zygal Ermani schoolhouses rawishness fool-proof seeming shouldest undertones Gweneth heliotypically strift localness polyclad propenseness shrill-toned prevaluing capacify gaze-hound Kleist nitrite holidays hexametrize retreatism syncope nutseed preconcerted forediscern Bridgton irrationalism Wonnie Whiggification nepenthean Caraz repolarized gummiest Cyclades Narda Wezen Ponce anesthetize wrizzled cliack leucocytogenesis tuck-pointer mirths pharmacodynamical speedfulness tottum hymenopterological mind-your-own-business unpouting unfamiliarized metallographist despatched tartishness dieses tarantelle budgeting mistaken confidingness Nasya perocephalus foreprise decolonising unpatiently a-twitter pneumoventriculography overlowness customableness bo" (Indicator: "twitter")
"lities lumber-pie specializer bicepses xylology Locofocoism afteract mass-fiber contradicts typesets unsinewed phlegmatist gonopod bottega LAquila probattleship overestimations gainturn zippered antefact nonphilosophy venefic miauer cup-tossing inenergetic reapproval phasianic intercolonially preconize godlike roundtable Karelia barosinusitis lardworm khidmutgar subrhombical herniate embrittlement clericalist quasi-fictitious Soembawa scronach juvenescence Faucett octine diamonds agenize twittery fulminic soared supraordinary suprasubtle Cristatella winter-fattened titillant superfemale cairngorum kobong polysyndetically catadioptrics Gaulic parings bedegar saddlesoreness permissory rich-distilled lithiate petitor Pirnot Aram exclaves fine-drew annelidian songs natimortality burely formate subtitular eugenolate desonation tumbrel re-lay slingstone apostil serfhood cheesemaking underprint unnutritious sargos he-huckleberry tannaim airish unsonorous phonomimic overhandled geneki divvied responsive murmured redu" (Indicator: "twitter")
"nonrudimental Ervum databank six-pointed coin-made prevaccination edgewise chalkworker Belaites fluotantalate mascons Blackhander Acoemetae sesquinona albicore osteectomies earwaxes cutoffs twice-prosecuted Brogue alterants fore-edge keratolysis tampoe launchpad macrospecies phyllomorphosis familiarity Chandernagore white-wristed misconstruable fictionised summar palmary marishness mathematico- intruder kangany hystricomorph water-borne dynamoelectric capaciously chippier peeress supraneural atwitter valetudinarianism caracol praiseworthiness razz browache nontechnologically herniations nonadjacencies unproduceableness perbromide temescal bankmen snacks graplin untirable Potamogale plankage heat-treat tribunitive Gorgon-headed yenning neckerchieves epineurial tentacular unself-willed uintjie to-do furnaced best-able postesophageal catenating metallise unrecognizable chemotactically Pandectist full-frontal aetheogamous expect scleroskeleton societist Whiggism off-go Braconidae Nanon jittering artery protiston" (Indicator: "twitter")
"ndesisting acratia Kutuzov unpleaded alg- outsprue tirocinia TWA overelliptically sairly likeableness semiparasite redistribute Izabel syndetic repromised osculating iconolagny Osnabruck Britishism ausformed stun FSR duodenitis unforetold mouille prepetition chromicize undergirdle diplasiasmus putting-off nice-Nellie dispiteous nondeviation groin cruzados decadrachmae biserrate caucasoids skioring trenchancy sadheartedness linkmen unslanderously scopulousness amouli Non-vedic sadhana Hildebrand nematocystic bayok ebricty erudit vectors scale-bearing race-riding rainworm fourchet Schapira brain-teaser burans arseno- Geikia duodecimos coccobaccilli Argusianus infalsificable BRM triggerfish divata connivingly hypural misimproving dyspathy mystifically cross-veined unfarrowed well-referred impostrous steamy palimbacchius Mossberg paraspy maceraters pollinigerous bibliotherapeutic leggiero Robinetta prediscouragement Hepzi fresh-slaughtered outwitter prepayable unpoisonous scissorbird behindhand condom subscriptio" (Indicator: "twitter") - source
- File/Memory
- relevance
- 7/10
-
Found a reference to a known community page
-
Unusual Characteristics
-
Installs hooks/patches the running process
- details
-
"wscript.exe" wrote bytes "e7392477e1a628772e712877ee29287785e223776da02877906427773ad52e7726e42377d16d2877003d2677804b267700000000ad37d4758b2dd475b641d47500000000" to virtual address "0x74C01000" (part of module "WSHIP6.DLL")
"wscript.exe" wrote bytes "c04e267720542777e0652777b53828770000000000d0067600000000c5ea06760000000088ea067600000000e9682f7582282877ee29287700000000d2692f75000000007dbb06760000000009be2f7500000000ba18067600000000" to virtual address "0x77441000" (part of module "NSI.DLL")
"wscript.exe" wrote bytes "fae62377e1a628772e712877ee29287785e223776da0287726e42377d16d2877003d2677804b267700000000ad37d4758b2dd475b641d47500000000" to virtual address "0x745C1000" (part of module "WSHTCPIP.DLL") - source
- Hook Detection
- relevance
- 10/10
- ATT&CK ID
- T1179 (Show technique in the MITRE ATT&CK™ matrix)
-
Installs hooks/patches the running process
File Details
Docusign.vbs
- Filename
- Docusign.vbs
- Size
- 1.6MiB (1706763 bytes)
- Type
- script vbs
- Description
- ASCII text, with very long lines
- Architecture
- WINDOWS
- SHA256
- 779c57165908c45eb9a257b3cfc4843d28b9f32fde9461cd3fc9a5a742500565
- MD5
- 85bccc6b9b6ebfbce82be55d8d35dc4a
- SHA1
- 4669860e81204a2b51eb8d4527a052406c21f56d
- ssdeep
- 49152:Ysa5waV72H4SEG5xSPLEBe9poUH+v3O1ciyx:R
Screenshots
Loading content, please wait...
Hybrid Analysis
Tip: Click an analysed process below to view more details.
Analysed 1 process in total.
- wscript.exe "C:\Docusign.vbs" (PID: 520)
Network Analysis
DNS Requests
Domain | Address | Registrar | Country |
---|---|---|---|
1arab.net |
104.244.72.229
TTL: 14399 |
- | United States |
Contacted Hosts
IP Address | Port/Protocol | Associated Process | Details |
---|---|---|---|
104.244.72.229 |
443
TCP |
wscript.exe PID: 520 |
United States |
Contacted Countries
HTTP Traffic
No relevant HTTP requests were made.
Extracted Strings
Extracted Files
-
Informative 1
-
-
TableOfColors.exe
- Size
- 227B (227 bytes)
- Type
- html
- Description
- HTML document, ASCII text
- Runtime Process
- wscript.exe (PID: 520)
- MD5
- 30f833f9a30a530c9c50f039a1de447c
- SHA1
- 9e50c3680cf5888daa349ca52b6f7c96887381ab
- SHA256
- 081806e67678da2a3d4c8766bea6bac7ac8c4fb3e50d3d79a838523d94f8c02f
-
Blackcat commented 4 years ago updated