O_Sulliv.vbs
This report is generated from a file or URL submitted to this webservice on October 8th 2019 08:07:41 (UTC)
Guest System: Windows 7 32 bit, Professional, 6.1 (build 7601), Service Pack 1
Report generated by
Falcon Sandbox v8.30 © Hybrid Analysis
Incident Response
Risk Assessment
- Network Behavior
- Contacts 1 domain and 1 host. View all details
MITRE ATT&CK™ Techniques Detection
Indicators
Not all malicious and suspicious indicators are displayed. Get your own cloud service or the full version to view all details.
-
Malicious Indicators 3
-
External Systems
-
Sample was identified as malicious by at least one Antivirus engine
- details
- 2/56 Antivirus vendors marked sample as malicious (3% detection rate)
- source
- External System
- relevance
- 8/10
-
Sample was identified as malicious by at least one Antivirus engine
-
Network Related
-
Malicious artifacts seen in the context of a contacted host
- details
-
Found malicious artifacts related to "205.185.115.40": ...
File SHA256: 61970452081816271072dd600d435d6e352bd25e119d93a85332772d4275f216 (AV positives: 12/70 scanned on 10/08/2019 04:01:53) - source
- Network Traffic
- relevance
- 10/10
-
Malicious artifacts seen in the context of a contacted host
-
Unusual Characteristics
-
Script file shows a combination of malicious behavior
- details
-
The script produces internet activity
is obfuscated and drops files - source
- Indicator Combinations
- relevance
- 7/10
-
Script file shows a combination of malicious behavior
-
Suspicious Indicators 8
-
Anti-Detection/Stealthyness
-
Possibly tries to hide a process launching it with different user credentials
- details
- ImpersonateLoggedOnUser@ADVAPI32.DLL from wscript.exe (PID: 2632) (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 3/10
-
Possibly tries to hide a process launching it with different user credentials
-
Anti-Reverse Engineering
-
Possibly checks for known debuggers/analysis tools
- details
-
"atics arpen substituent Goldstine prp Chalciope Coliiformes historicalness nonarchitectural Esdras Denticeti autoplastic grittie nonexpansion futhorc mobproof tournedos nongenealogically enscene Atlanto-mediterranean racerunner Haileyville dizziest bavoso intastable otherwise ash-blond solubilization personifying connubium broken-hearted tenaculum burras-pipe Faydra caryatidean Acieral majidieh Digger eliminating overpensively self-inspection Lucelle tornus Salim heterocyst uninfringeable Rambort predecreed convincer Oconee darlingness seven-eyes cartages enfurrow biconcavity unvoluble disclout uncommixed barbarously howdahs ram-jam minimisation Soracco Navahos discourtesy well-earned antiheterolysin Melville check-flood splanchnoskeleton coverlets come-at-able palps insoles pezantic semimystic catarrhous SLDC DPH uninvadable dun-yellowish Hunt roe-deer sanctifiers shrouded transverbate dirtily earthtongue arsylene monomanias sabs isograms impreciseness outbraid tableman basalt-porphyry plague-free greaved ta" (Indicator: "ntice")
"lutionists cheviots bulbels angelographer Pro-samoan heart-expanding overlively periarterial Tongrian gowkit twaddledom stanchest potters yetter saber-shaped transfer warmthless underlaps patulous finish-stock rough-dried bonnocks wolfhound parentation ribbon-shaped nonarrogancy depressure troilite Japan lenticellate paramid Melanthus forenoon electro-osmotic cornbird overappareled lacrimal bradyphagia totterer credenciveness sowan unexemplifiable worshipingly driftpins vitriolling refrigerators scride sorema hierogrammatist appraisement pn- raffishly jawn moutan inexpressive jetons tranquil-acting outdwell pangenic chesteine undampable laryngectomies Mima equiliria aza- clangors hot-spirited interferon threadlike semi-imbricated movingness Chassin woodendite polyorganic requote enlodgement Mullidae statuesquely Popov entortill intactness trush skunkish preconceals paint-stained cratometry defibrillatory choile stockmaker Thargelia free-spirited Elaphomyces virtuouslike world-acknowledged bronze-bound two-sti" (Indicator: "ntice")
"dae selbergite conscriptionist chambermaid philhellenism mingle assemblies nookier ISDT bones cusecs curmurging Vachell Myctodera wire-borne satura frightfully taligrade misdial devilkin ribbonweed pollan relaxin mycetophilid steamboat Circum-saturnal lanterning Trachodon absurdities wawa stereoroentgenography bethorned metaphysics installments iguanodontoid aposporogony grimacer pseudophenanthroline pitchpike arrowwood Atakapa Jacksboro anticeremoniousness staircase ispraynik miscomplain Anatidae recuts ribandmaker quivered Iztaccihuatl appellatived initialize archaeo- acrodontism coquettish textuary Sylacauga skieur Notkerian Benzel Acanthaceae presound Brezhnev Bili Lemmie declarers malikzadi preinhered unray canterelle mispronunciation unavailableness papyrotint introrsal unbedaubed tenty bursae despoliations water-fronter oiled Borden nonremediability founding salmonellosis twanker Lamberto nightriding unformality montanas tubinarine milkshed no-no bluebill Hibernicizing thioguanine smoke-paint dinumerat" (Indicator: "ntice")
"iner homeopathically gruneritization snappingly dauntlessness breadthways Arzachel twice-tied Platanista metoxazine rutinose altimetry mermaid snowfield conscientious kymographic misvouch Babylonish aleph Ailsa furiosity isoantigen geysers souterly Lamba Zarathustrian ETC latentize pasticheurs unadherently Tawgi Ethan badju conticent uncrystallizable guitguit scoon Haley unconfine lacquerwork Oribatidae Wendolyn overlightsome inaugurative trigraph panyar quasi-willingly antick sharecroped Gandhiism parlayers phylloid cankerflower thumbstring self-thought linear-ligulate crank-driven woodwright nonrealistically drachmas yellers cyclization Sparus molluscousness thin-lippedly pachysomia uncontumaciously Nollie skrike cantico countermanding self-enamoured tourist-haunted Clarenceux overobediently anthropomorphisation Cookstown monosynaptically anti-acid caoba pre-expressive stegosaur astrally vulneral autonetics prophetico-historical cheepier upharsin antiquarism Zuian commemoration rakes bickers semiputrid nega" (Indicator: "ntice")
"mmunist Pro-polynesian Murcia besagne terebelloid unboned chattelized dipter noninfallibly Roda premundane cloud-crammed proclivitous slab-sidedly subtonic Quezon umpired Chute districts misprized disposal abrogator bestness fraiser Caramuel space-occupying hippopotamine NAG polythelism outhauls phoenicaceous lackeying semioctagonal overabuse backsettler anticeremonial bobby-dazzler Darius impactive leanish Eisinger airs protective swithered BTE Oidium periaster preenrollment palatineship remontoire factionalism aggraded unicellularity preseason quasi-indifferent sweethearts unproscribable statefully thisness Gallas restab Hegelian sublimely stand-off Bhutanese guile uncommented orbiculated petarding trichion tewel crampfishes glamor thalassiophyte Calothrix devolutionist Kiele ever-mingling oologies Linguatula utriculoplastic overlift alarmism inarticulacy Scotland immanifestness holomorphism overfatness scarlet-clad associateship desensitizes Comr. portly grissen panic-proof insaner abundance Kantism totali" (Indicator: "ntice")
"nciliability autocamper Hakim dog-violet photoactivity ugliest penanceless transelementary cane-seated LCD Mooresburg grouping golliwog transgressions radio- valeramide VFY salacity Aradidae trochilos wired Ancier Eada overcultivate fire-flaught ensorcerize cadets gimbals gloryless eulamellibranchiate reoperated neoterizing counterassertion sursaturation hard-fated unjoyously unmacadamized crustation tricksome gossipdom Zr landshark entresols unconnotative enticeful saiyids unspontaneous irritable replumb Mustoe quasi-advantageous sobbing wimplelike disgarnish war-time metricated skeltering Sympetalae bepuzzle Midkiff locksmithery dimyaric windowlet provection proprietary ogrisms scythelike coccidology tapen tictocs dzeren subitous Maryknoll Wateree untwister unriched possibleness iterant chanson savingly archaeolatry gowland precharging glossopodium heddlemaker copemate Amoreuxia Algarve collegiation trajected ungirding Stalino cornroot ukiyoye attributer roitelet nonsensuous swooners sorbs Kirstin swack alf" (Indicator: "ntice")
"tauromachic mollusklike nephridial readying exultance stooker medaillon recasket selflessly equinumerally ficklenesses transferences enscrolls dibutyrate dreamt unmoor vrow prerecommend iconical misforgive brist kascamiol twice-accorded millioned fluorated senoufo megacity H.V. mochy Bana desiccation yardman unciteable EAM hyaloplasma Alcmena phytoserological backwrap ringtaws accedence nonactor crablike prophetical terefah unscrewable LSE disproofs righteously hemialgia misassociation gastrocnemii obstringe partyism allocatur hydrobromide NABAC illegitimatising snoeking Heteropoda arriccios blacktops gaea nailshop surd chinaphthol M.P. too-timely instating fortuitously Guidonia better-principled cardiotonic optimizations cusps golfers prenticeship small-boyish conchite heterodyning Diarmit Warrin nonseptate ensate expanses Amroati silky-textured arrastre thromboses ague resuppression schizogregarine metaldehyde nondebilitating vogt melanin unanalogousness audiometry nonexpulsive naphthacene re-reflect wombie" (Indicator: "ntice")
"m Deming semienclosure peccavi Sherline inertias captivators anticeremonialist muscovitization nonchokebore pleasantsome saturnic French sandpapery nonrevenger sharp-bottomed six-inch Zsazsa Hasan semipopularly yeara SCOT nonmeteoric onanisms anaclisis caroome Slaughters testimony intrigo Fahrenheit reedmaker obliquity SQUID corectome nobbler full-armed calpulli uncomplete starry-bright koumis preally bulletheadedness jestee unexcepted APU anime moshavim internationalization pile-built anacoluthon gormandizes fleawood entozoological salivas missteps princeless grysbok knouting ecstasies prodders eligibility intrashop euphenic disprobabilization incorporeous twelve-mile cantus tetrachloro rhizopodous triduan tetrasyllabical Albania irisated underring stockhorn guano velitation overrife cylindroidal gangliform cubistic incognizability historize empeople genit. retentive congenial axiomatized smoke-hole Gentianaceae clamshells trefoil-shaped infrequency Eudyptes gawkhammer coccids ramets Katharine evocated drip-" (Indicator: "ntice")
"vefold awaft Alcimede hortatively tyrolite scapolite-gabbro Achaea unabolished rupturable endosmoses bitonalities Suevi lootsman Lyngbyeae psychotechnologist micelle chocolates chesterfields denticete dolomitised fenouillette Fraction naked-tailed nonmetalliferous Apneumona soft-eyed disloyalties unworthiest y- Tito slubbings insect-eating pitwork BBC laxnesses tetrarchies gratefuller farced self-destroyed Chicota underteaching arrogantness self-resentment neurally quadratures reasonedly well-like Whitford Malva Irvingism unbuying reductional Serpent Stone feudalists slick-talking yelks uncomminuted third-force bijective unilateral unfoliaged Chuch well-instructed Blighty long-fed Vespoidea medicament peripherad ill-devised seldor half-baptize detubation duplicate-pinnate Ottomanization counterdraft restarted gunyah circumventer Raquela vagarity Yikirgaulit huzza minished Ancaeus Echinosphaerites hypsicephalic legitimizer full-pulsing coved Joselyn SPNI perspirate amphisarca bicyclical dungyard algraphy red-f" (Indicator: "ntice")
"oble-looking drawboring backboneless unexceptional enjoyable addend degu marshalship ontologise Acrisius christcross-row ethiops calaite duyker hintingly gombeenism loricoid nonvituperatively Illimani polytrichia expel mesatipelvic ranted propurchase products Lampyridae RCF provostess wried bargemen unplausibleness rain-god unspottedly escape hypocrater garreted whiskied motorizing Junkerdom oyelet faroelite nonpromulgation underbottom buckaroos nonusage catery irregularist contraltos redefinition uncongruous undisgusted interpreted degreaser tsia Aquasco S-curve blastoporic fasinite underoxidized anemic craterkin lampern whitespace wanga unenticed thialdin fieldmice melanous stratographically beachcombing physiolater affinage bradypode Lompoc fantasticalness netball shelvingly dowerless nonintuitively raspier baggings inseparably dub syndesmoses guama oil-cooled shogunal kehilloth rattlesome sweet-piercing oversolidify Kaya heterogenously Antimason plankings nonyls hyperboloid sandbur well-accented unprofess" (Indicator: "ntice")
"ompletedness enquere shab cordleaf hopperman towelette Atum uspoke Incarvillea arm-headed unspecifiedly bealing hipwort flagitiousness unepicurean bichy bean-shaped Hildick isognathism hectors reawait Cicily monovalence cystiform sheep-dip batino troostite-martensite aceta unessentialness unsophomoric pintid confidentiality suberine subclavate well-willer Waylon villan asseour pupfishes Teneriffe creepmouse bribetaking endogastrically cyniatrics three-tripod cross-crosslets Amtorg gallisin cocreate athirst overslight osteotomies achromatizing antiozonant sootiness prosencephalon bell-house overbanked calli- alluvia Gloucestershire Zarga prolapses Gentoo misbiassing setbolt Lawsoneve dormouse polydimensional nuncupated dehydrofreeze gudebrother eviscerating haematogenesis Denticeti phthises moorburn crow-quill nonfragrant hyomandibula remigate Ravo lichenoid teletyped Canovanas permissivenesses by-and-large paedagogue modestly chefs preadministrator uncontaminate half-beam overknow caputium acquaintances Olett" (Indicator: "ntice")
"elf-weary lineamental unincited awakeable trade-made jigsaw overfoulness polyglossary nose-smart precalculable dissimilatory adversaria well-convinced Ayina undiscomposed pygmyhood snow-molded amplifiers pseudopurpurin cinematograph selfsame causally mackles gryph quasi-despondent urinemia pasteurised uncircumscript trufflelike mochras pseudobrookite Burtrum menopausal selfsame dextrolactic skoot glibbest Brink creneled skidders metring Cadorna Istiophorus nonvolubleness Sol. ectoproctan squelette Gerhardine dissects servitrix taus biometrician platypi transatlantically cautio Bengal pyramoid malreasoning aerosinusitis epenthesis thraep tribulations countdown monticellite whore postmesenteric disconsonant rifely overcrowdedness autocatalyze oculonasal SBMS filespec squirtiness outbustling warrantize troostitic winemake inevasibly photogravure memorizes hackney-man determinism leaf-eating Inter-andean antiparasitic dipolarization febricide preconvinced archiplasmic epicondylitis Manthei Brauhauser Manis CBD pr" (Indicator: "ntice")
"rism Cardiff dextrousness pellard superhandsome Vogel bereaver gestated overbought appease suburbs protopapas adenoidal itinerating unchaplain spait gnomology oestrums Euglenoidina outbreathed drencher coelomatous TV-Eye ECD unconstitutional adversus flavoury cystolithiasis incredulity unsustainably epigonous antiperistalsis shrew spooniest crematory urucury suspensoid directories north-sider drony pneumatico- rawhides allochroite corpusculum mezzavoce Olmstead eumerogenesis peculatations Honorine unperjuring Himalayan ovals gels wampished mininovels larriman scantily tiring-house four-flush Ternstroemiaceae leucoquinizarin TNN quilts faki sexlocular stylewort davach exterrestrial Neafus haplessness superuniversalness Larwood weedingtime cloudy sleevelike Tulua anticentralization inobservancy double-bubble heralds repulsers Serpentarius unmissed trop- Leeton univariant sacropubic possessions piitis outpull checkerbloom acreman enunciate gourmanderie massivenesses tronador escargotieres opals interoscillated b" (Indicator: "ntice")
"tinged Prado cowling hitting multicasts blared lidless cripplingly presumers anticeremonially tinctorial waitlist teneral full-fledged rufofulvous subfigures thunder-stone Dawsonia connaturally masterable Bohuslav uncaramelized turpentinous Liuka ammocetes selfish Titos Istrian haitsai postpubescent kidnaped nonstandardized croziers pre-Solonian sidelight half-woolen caudae aparejos incomposedness xylene nine-power semifluidic Commons gaster- numerous pathonomia impingement cardamon world-respected hw- abruptio glucoside forsloth Rovner handsaws sciomachiology overmatching idealist laccaic MX hard-witted mispunctuation monist weirdnesses hieracite round-turning parfilage ropemaker quicker oarage swinneys Lophornis sudiform mitigation totara spidermonkey shoaling copiously fermentology de-ossify Euryalida betowel helianthaceous quiapo rhodophane bewail biffins untravestied Espy spirometrical Serajevo becalmed tragicize unmisanthropical ambiguities rhizote jugated perversions requisitioning Monsignori cosmologi" (Indicator: "ntice")
"disserts unbribableness camelion pycnia mechanicality heterocycle oculists hooflet disestablishmentarian fervent vivaries nibby nonadeptly habituations meiophylly vailable eusteles snow-robed stablewards Monticello lyophilic noyant lithopedium symptomatize allachesthesia roundworm precordia instructer ergotist Selaginellaceae harebrainedness fishgig phonestheme typhlostenosis wurraluh half-sleeve diversisporous lickety-cut picturemaker almaine soko Idelia encarnalized timeling suit invocable subglobularly Vermontville unnominalistic Trans-mongolian kindreds dibase unabetting pneumatologic nonfermented ozonizing lalopathies unlaudatory diphtherias conusee upchamber imageable pre-embodiment Tonye god-child copiapite desmoid nondilation pentadecyl Egyptianise apographic antimachination patte scripted home-baked totemistic necessarius wafts four-oar pointment Jincan slow-tongued Tefft befretted hack-me-tack crumbers reaccession Claxton Pandemoniacal antineutrinos keenest Krems flytail nonornamental overpicture d" (Indicator: "ntice")
"ry unrudely unctious chafer Naumburgia irideremia Belafonte polarimetric commercials expatriating satcheled profane backfurrow lalls newsboy heroins Hadlock twice-refined adiaphoretic dicliny spanky arthel MPG estancieros ingest angula Wracs horsenail all-convincing perquisite subtle-meshed cha-chas restated chain-welding melopiano anisotropism Joub Louisville nonnaturalness enchest mouthbreeder gerundively upholsterer semidetached livery-man cyanidin Hatteria periodontitis Aggi footlockers deprivations life-restoring composes connatural Martinsburg gpad parapsychological Varuni crucigerous awe-strike hypotrophy aphengoscope fistulas Stanford Oley homeochronous apprenticement Lapp riving inconversibility lamsiekte trothplight scallage Chappelka disk-shaped suppled jockeyship spectacularism griseous saccharometabolism flaggish evenminded Saiph ceilingward madstone heading-machine scutellation agamid mahjong malignifying corrugator amorphy Anser Nappie abiogenesis trix adient pseudosperm graphophobia dialector" (Indicator: "ntice")
"r cheffing thousand-acre Balkis disinsection Steen toxone jurisprudences unbunched gib-cat Hanau Boulez Anchistopoda enregistering choledoch acrinyl disformity selenitical proletarization catawamptious somat- whoosis mucosae ciceronianists fencelessness gradin moonscapes way-bill tump ice-cold psychotogenic anociation credensive Solomonitic nesh hog-raising night-flowering Panthea unnutritive homelier jatrophic outshining birthmark newsstands pocket Charadrii contortionate tottle Celto-roman episcopature strackling antidiphtheric repic mucid Langton dogs-meat micropetrologist troch superfantastic immechanically hoofprint cantic Pyatt quassins Chrystal hedgehog sourly preclusive fletched Nimrodic outgabbling ever-fast needleman aforehand Embiidina dishome reevidencing stumour punners bicarpellate updrying revitalise hay-mow platinotron oxalemia grass-carpeted sweatless anticeremonious apast sleepy-acting adscititiously succintorium dirndls overscrupled stereophotogrammetry cavern worm-consumed dolichuric unsal" (Indicator: "ntice")
"nde debullition parallelable pikakes miracidial anticeremonialist unsanctifiedness Parley sedile foodservices campanistic weening Rulander writs brutalizes virtuosos dream-created soteriologic tallow-cut hurricanes mixeress looking squelchingness Matthei mufflers furiouser manorship androsphinges katun surprizes retrogress boltmaker uvate corruptibilities pleuston Azerbaijanese privation unnearable cryptostome arterys octogild disintegrations nonheretically venereous exoticalness frankheartedness bobbysoxers straight-minded cheekless recharter promittor platyrrhin assizer pitier Zonites auctioneers Dualmutef routings toolkit polylaminated pantotherian inarticulately hoaming fanfaronade jasmines subscheme transmissionist power-political pathematic servitorship aveugle brimly Ogilvy cheewink nonrecuperation heightening nonprofessional leeboards bombing nonimputability moror bulblet stereochromically main-yardman quasi-maliciously Free-soilism haircuts amblyaphia menadione indivisibility JRC upboiling etrogim sy" (Indicator: "ntice")
"myxophycean Pro-british evocation unresented nonbeauties unsmart noncultivable andabatarian Ahmad Cambro-briton Yugo-Slav paronyms paganical reclines glottalizing small-cornered nurserymaid Amintor willingest subordinacy Triplice vended world-familiar navvy coadjutors fluctuate Gambier immeasurability viron cupelled Urd free-quarter saccharineish Delphi murkinesses Shinto subterete instructing bingle ill-cured bestial stagier radiotelegraphically meticais colicky chamfers velvet-clad dim-wittedness a-squirm scourfishes stridency self-respecting uninspirable emporetic Rhinebeck desoxycinchonine Sturmian cuamuchil anaxial bernicle spunkiness tabific umbolateral red-burning lighted Wallsend anartismos musang white-alder dissave enticers prolific bargain-counter brakeload drummy arrivage small-grain irreverence smircher declamatoriness fontful unlaved bone-lace upspew elliptoid Balmorhea Portadown holosystematic blepharosymphysis babasco consortitia keelages hexdra Perciformes translating didrachmal responders n" (Indicator: "ntice")
"ief well-pointed underborne gunpoints superfolly winder-on unabrupt obdt. decadrachma ephebeum xenopteran palaeoanthropic pre-emotional heresyproof clubfeet seorita spermatiogenous copiousnesses tormae dopester sea-urchin Mafalda caginess physico-theology grape-stone reemerging acceptingness sennas face-centered full-fruited nonconspiratorial foll Marika nonappearer peeweep Bryan re-entice acquittals sphery prioritized indians Kodashim Acephali collapsability grassplot infusory yarramen overpolemical meditates nondetinet junkie presidency uniradical Tingis betain electrophorese steam-pocket abstinences hypostatisation Tihwa repulsive cafardise drift ostracizable scripter serre-papier polycitral brights inbred Parrish vertigos Clymer LRSS premorality immotioned arrivance beglerbeglic argentan branchi sea-quake revellings cayenned siffle batterfang dictatorialism suberine monkishness grotesques blushing rangemen tongue-point Gerta emcees NISC soddenness nondisarmament cheeriness doub treetise megapods wauchts s" (Indicator: "ntice") - source
- File/Memory
- relevance
- 2/10
-
Possibly checks for known debuggers/analysis tools
-
General
-
Contains ability to find and load resources of a specific module
- details
-
LoadResource@KERNEL32.DLL from wscript.exe (PID: 2632) (Show Stream)
FindResourceExW@KERNEL32.DLL from wscript.exe (PID: 2632) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
The analysis extracted a file that was identified as malicious
- details
- 14/70 Antivirus vendors marked dropped file "TableOfColors.exe" as malicious (classified as "Artemis" with 20% detection rate)
- source
- Binary File
- relevance
- 10/10
-
Contains ability to find and load resources of a specific module
-
Installation/Persistance
-
Executes a visual basic script
- details
- Process "wscript.exe" with commandline ""C:\O_Sulliv.vbs"" (Show Process)
- source
- Monitored Target
- relevance
- 10/10
-
Loads the task scheduler COM API
- details
-
"wscript.exe" loaded module "%WINDIR%\System32\taskschd.dll" at 73C10000
"wscript.exe" loaded module "%WINDIR%\System32\taskschd.dll" at 007D0000 - source
- Loaded Module
- relevance
- 5/10
- ATT&CK ID
- T1168 (Show technique in the MITRE ATT&CK™ matrix)
-
Executes a visual basic script
-
Network Related
-
Sends traffic on typical HTTP outbound port, but without HTTP header
- details
- TCP traffic to 205.185.115.40 on port 443 is sent without HTTP header
- source
- Network Traffic
- relevance
- 5/10
-
Sends traffic on typical HTTP outbound port, but without HTTP header
-
Remote Access Related
-
Contains indicators of bot communication commands
- details
- "oblast mangling ectoderm previgilant anotta Sebastodes hyperacidities bucca spendthrift steeplebush hatsful etrier cathine pensile clotweed Hsiang unfeminizing drosky rezone statement potentiometric figuration Allantoidea archgomeral reestablished replaster Trevar ventilated Kingsley posthetomy dromophobia attenuations IROR Ceara metabolized teetotumize Devine concelebrations dowcet microfauna precursal Jewess defacement anti-Catholicism swaths unillustriously Mangifera phacocherine unthinking Tarrytown eluvivia bittier aeciostage semiprotectively pessimistically wireworms zoodynamic inconsiderately tariqat overtumble air-borne outjuts shopland localises Auberta function overrides apophysitis cribo Maglemosean fulciment semblances nonimplicative noncandidate extraterrestrials Katrinka aesthete pallone nonperceptible woolweed brassies ditty rejoinders cloudburst unpuzzling guildsmen nontolerance khalifate predeterminate unvaluable delirate vice-regent yawling roorbacks Circensian unvoyaging debriefs anesthesis" (Indicator: "trinka")
- source
- File/Memory
- relevance
- 10/10
- ATT&CK ID
- T1094 (Show technique in the MITRE ATT&CK™ matrix)
-
Contains indicators of bot communication commands
-
Informative 17
-
Anti-Reverse Engineering
-
Contains ability to register a top-level exception handler (often used as anti-debugging trick)
- details
- SetUnhandledExceptionFilter@KERNEL32.DLL from wscript.exe (PID: 2632) (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Contains ability to register a top-level exception handler (often used as anti-debugging trick)
-
Environment Awareness
-
Contains ability to query machine time
- details
- GetSystemTimeAsFileTime@KERNEL32.DLL from wscript.exe (PID: 2632) (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 1/10
- ATT&CK ID
- T1124 (Show technique in the MITRE ATT&CK™ matrix)
-
Contains ability to query the machine version
- details
-
GetVersionExA@KERNEL32.DLL from wscript.exe (PID: 2632) (Show Stream)
GetVersionExA@KERNEL32.DLL from wscript.exe (PID: 2632) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Contains ability to query the system locale
- details
-
GetUserDefaultLCID@KERNEL32.DLL from wscript.exe (PID: 2632) (Show Stream)
GetUserDefaultLCID@KERNEL32.DLL from wscript.exe (PID: 2632) (Show Stream)
GetUserDefaultUILanguage@KERNEL32.DLL from wscript.exe (PID: 2632) (Show Stream)
GetUserDefaultLCID@KERNEL32.DLL from wscript.exe (PID: 2632) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Possibly tries to detect the presence of a debugger
- details
-
GetProcessHeap@KERNEL32.DLL from wscript.exe (PID: 2632) (Show Stream)
GetProcessHeap@KERNEL32.DLL from wscript.exe (PID: 2632) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Contains ability to query machine time
-
General
-
Contacts domains
- details
- "islandcomposites.com"
- source
- Network Traffic
- relevance
- 1/10
-
Contacts server
- details
- "205.185.115.40:443"
- source
- Network Traffic
- relevance
- 1/10
-
Contains PDB pathways
- details
-
"wscript.pdb"
"F:\#@#@@@@\JJJIJI\google_chrome.exe.=,.pdb" - source
- File/Memory
- relevance
- 1/10
-
Creates a writable file in a temporary directory
- details
- "wscript.exe" created file "%TEMP%\TableOfColors.exe"
- source
- API Call
- relevance
- 1/10
-
Logged script engine calls
- details
-
"wscript.exe" called "Msxml2.DOMDocument.3.0.CreateObject" ...
"wscript.exe" called "ADODB.Stream.6.0.CreateObject" ...
"wscript.exe" called "WScript.Shell.1.CreateObject" ... - source
- API Call
- relevance
- 10/10
-
Contacts domains
-
Installation/Persistance
-
Contains ability to lookup the windows account name
- details
- GetUserNameW@ADVAPI32.DLL from wscript.exe (PID: 2632) (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 5/10
-
Dropped files
- details
- "TableOfColors.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"
- source
- Binary File
- relevance
- 3/10
-
Drops executable files
- details
- "TableOfColors.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"
- source
- Binary File
- relevance
- 10/10
-
Touches files in the Windows directory
- details
-
"wscript.exe" touched file "%WINDIR%\System32\en-US\winhttp.dll.mui"
"wscript.exe" touched file "%WINDIR%\System32\taskschd.dll"
"wscript.exe" touched file "%WINDIR%\System32\stdole2.tlb"
"wscript.exe" touched file "%WINDIR%\System32\en-US\wscript.exe.mui"
"wscript.exe" touched file "%WINDIR%\System32\wscript.exe"
"wscript.exe" touched file "%WINDIR%\Globalization\Sorting\SortDefault.nls"
"wscript.exe" touched file "%WINDIR%\System32\rsaenh.dll"
"wscript.exe" touched file "%WINDIR%\System32\en-US\KernelBase.dll.mui"
"wscript.exe" touched file "%WINDIR%\System32\msxml3r.dll"
"wscript.exe" touched file "%WINDIR%\System32\wshom.ocx"
"wscript.exe" touched file "%WINDIR%\System32\msxml6r.dll" - source
- API Call
- relevance
- 7/10
-
Contains ability to lookup the windows account name
-
Network Related
-
Found potential URL in binary/memory
- details
- Heuristic match: "islandcomposites.com"
- source
- File/Memory
- relevance
- 10/10
-
Found potential URL in binary/memory
-
Spyware/Information Retrieval
-
Found a reference to a known community page
- details
-
"ication Johnathan landscapes misaddrest Lewisville alipterion Carya decreing unprecipitant zoometric infractor tumours nonremanie Jenette nursedom riper unbrilliantness semirespectable gigantal spurt Desmatippus isobar impoundment seven-line heizing flexuous amyatonic Rod Tyre saxtie unstaidly bedgery stuntist amplest one-handedness irreformable Sutherlan quarteron coberger premortifying Lamarckianism microflora quells falbalas bunchberry subcosta sheeter Glori uncarpentered unminded digne Trans-australian vastities wristwatches snipjack reenslaves untitular underdosing mismoving mobable precognize thrum-eyed leakless photoepinastic nonguaranties tuitionless committedness compatible twitteration nearby sermonless prehypophysis interveners excavator agenesias uncunning penetratively Dougherty overplausibleness bkt holmberry bacillogenic superethically immatchless nonengrossingly milkshake tawite epithet embergoose burghalpenny windermost surface workbags sedimentologic axoplasms wilier Hess prefraternal restle" (Indicator: "twitter")
"owrites euthyneurous profit-seeking sacques chaffwax Pulmotrachearia snowlands Erythrina Luling monadelph Irmgard Pereira uncrossexamined shrubs nondigestibly pediculine circumbulbar subjectiveness ladylintywhite impocket synod Ubii Pinnotheres blockishly reactionaries ratbaggery CHQ dimout natations purloiners suspicious gnocchetti apyrase reposers fed-upedness adherently phthalid Sangh metallotherapy illocal dyspnea huffle timbales linear-shaped herigaut leggin popularizes self-terminative tunlike octocoralline reperplex genonema Phigalian inchoacy unboisterousness rankles choreman enarration chapes nongays aspirata becarpeted unrodded pseudoelephant incogitability gingers unsere apposability misrhymed futureness geoaesthesia overheighten hyperhypocrisy dumpish bigotry flexuose unniched twitter Small-endian rheumatic fiscalify coachee approvability enhypostatic Septobasidium coryphaenid Drinkwater Deegan stomatode nonimputativeness clauses unlinked umpirism punkier hydrogens unexcavated exhalents semigirder" (Indicator: "twitter")
"ologist Dirichlet Valenciennes loam heved bailage chokage cockle-headed Phasianidae chlorophylligenous tragedization aurific nullary Jeromesville reshunt TLM skewerwood unvacuousness relevate Les bisexuous terns grillework availably unmoribundly unarraigned uncomputed reactualization hemapodous bratchet monticulose Collinwood bostonians nondoubtingly compassionated floriscope cajolery bedstraw subparallel Symplocarpus exust JV pathos fractionalized Tagala petalling quadripinnate diversities corymbs radioactivate forepost blameful intermeasurable inapplicability quinite crumblingness red-shafted spinalis terrestricity bone-white kapelle but- sternna fairfieldite curratow Phoenicid Bollandist unfairness rib-sticking adessive craggan ringite dopebook archagitator beautifies renninogen plasmagene unlovingness goodhumoredness tremolando well-curled sunburned lactated trochalopod reseam ingenier mirky vaunter purred kurajong Wachter close-buttoned twitterboned soul-sapping imbuing third-rateness haled synthronus vi" (Indicator: "twitter")
"fication Saturnian Emmylou spogel synergidal Sempach ore-roasting anthracocide Evreux contribution europiums Lavon dust-polluting sulcalize desulphuration litres Tbi unsanctify nonreceptivity epithelium press-agent interpaving positioning unavouchably scrutiny-proof Sclav unprickled irreticent rectorship free-burning receiver splashy Atat afterdeath fingrigo rockered water-lane witch-hunting in-plant trumpetlike gonef countersinking reprover caricous pentyls unrectangularly reobserved nonhabitation redeclaring nuisance animalisation cheatableness eleutheropetalous perineurium Moslemism Prenanthes rocketing wide-consuming pomolo transfrontier crayonist initially ditted leadable barer redmouth echard sulked dyslogistically anhalonidine Vishnuite psittacinite joy-deserted subphase sclatch Humo caseful dispersedness Rabinowitz godhood events preimport twitterboned aircraftman novus heraldic anthropoids calmed Mesembryanthemaceae uncouching microgamy ingangs shell-fish preoppose bird-fingered sighter glimpser quin" (Indicator: "twitter")
"dial nonconciliating manor Chatino encephalitides Belton rundlets antireducing glassteel Noh CR arpens tentily hylophagous phylactic North thegnship quasi-sanctioned six-gram troilite twice-jailed exclusory unreadiness suivante redressment homeogenous Bourbonesque Maximilien self-infliction lumbersome licentious continually hot-press reclassifying paraphototropism alcazava Triny intercollegiate Marylee panmixy boxtops iditol cymaphyte behooped tyrannizers MMH hematometer pugman Fletch systyle bailing nonunderstood speltzes aldehydes dry-dye oomiaks pronged lamel icelike imprimery hulls Matricaria fumarin nonconvertibility sergeantfishes Pseudo-polish night-hawk circularizes flower-infolding hypotonically eker mustafuz diaphones hypoendocrisia displayed dissemilative Harbot theloncus birchen pre-British restabilize Kathiawar Ileana holdup twitterboned thaneship arcing trindle postulation rejoiced retrogressed feverwort dlvy. Taygeta jug demilitarizing natheless pome derivatives legman vinometer enfolds preneph" (Indicator: "twitter")
"on milligram-hour jitneying Arie pitmaking sutile nonbrutal Mulry overremissness Ciboney openability subepiglottic Austrasia naticine banqueted Tobe Howlend extort &c lipomyxoma Emmelene asynchronism unwelcoming bisulphate myriarchy anticontagiously Oxylus unmodulative viragos Hemiramphus Rania uncapsuled decolourisation clonicity glutamates twittering aggressivity citola hakeems braciolas driving-wheel ready-written pheasant-shell Iberian Andreotti caracara contemned guttie Benfleet hydrotherapy Philippeville effloresce paronychium utilise checklists subintimal fondu fluxroot hebdomader pelagic dewans nonplays exhaustless fascistization red-violet falchion Styphelia vertibleness naturing hard-gained outboxing stoas fulgide aelurophobe dreamier epideistic Wyatan drug-addicted earnestnesses cephalomyitis emended bromins multures gadroons stochastically sokol peignoirs impresario garbs Jenine sackings clutchman ratafia strangler Gaylordsville infatuations swelled-headedness Toback coffering Saxonist octopolar o" (Indicator: "twitter")
"t refrigerated lengthman magnetites pinhole oversate camshafts Flemings funduline semifib sissies histiocyte exclam natrons duikerbuck self-creation audiences wristbone twitterer chargedness interrow spicilege witereden elevator gubernation heavy-limbed unsneeringly prostration subintegumental caracter Killbuck re-ice monopathic householdry hoggery conveyances ghosted gablelike itchiest BIM concessible open-spokenness pistick balita lyo- waverer gmelinite variabilities devitaminize flics nondetermination Pentstemon tegular overfancy sesquiquinta cyclogram whillikers daboia drogue annunciative smithier joking remodulated plasmation underprincipal timpanists nonmelodic goat-hoofed Olivet eagers electrodiagnostic nightlife proctodaedaea semicretinism rungless Kokand accumber paraspecific well-demonstrated loitered precuts dirigibles grouper Arabeila dewy-bright back-alley brookier preprovided sesquialteran pretreat Sanmicheli remastication Lassalle Modulidae cabinetmakings moveable stenotopic polyarthrous copsew" (Indicator: "twitter")
"oulettes election rebellious inequi- Curucaneca Stier by-paths Flore teriyaki Nicholasville Ternan forerigging sensoria recommendatory champlev anviltop predriller espousing Balaenoptera beeswings woolpacks tokays puteli meanless Rutaceae chresard pillboxes Apama arteriotome recollectedly circumduction bivalvian hagrid precoil undermade beknights hyparterial contactile marsupialized lobulose albatrosses nonorthogonal one-ideaed ju-jitsu Dyfed mind-set bilder fancy-driven bunton dehydroffrozen Wolverton capitelliform vague-worded abaka racegoing Garmisch-Partenkirchen serotherapy sensigenous jactant hastatosagittate AUX Friday Vossburg signable beavering chaw diaheliotropic membranophonic megaloscope fungilliform allochiral scyllite asslike tongue-baited subterrane Tututni starved-looking self-conviction barley-hulling Pareto triode-heptode lese Comstock glories velvets nasturtion generalships giga thermosensitive assizement solitaire melatonin plasmasol commissions shrill-gorged veneer reindulged outwitter cr" (Indicator: "twitter")
"ly southwards nondoing bearhound sumpture wocheinite indrawn pump-well major-league Homerian shortened signorinas sixty-two missel-bird steel-hilted drilled sulphurity irremediless Belostomatidae piqure pro-ode boldo crenulation aread rheas udasi complexively predecide twofer tallowberry wonk epicuticle birdling BSLS Achmed scansion diarrheic downlooked planetarily hindbrain picking antibodies syncopative backboned a-twitter cuter sanoserous lilacin Hubsher miscarried loculation superadequately hypersalivation Scala Rion opaion inadvisabilities radication pancreatectomize weatherproofed interregimental poetico-antiquarian rhason uncleavable Monomya supercharges sporter misminded Josephism minicam venerate stalklet acarodermatitis Chromidae coloradoite dumbstruck technist namability leads ulatrophia phono Damaris researchist gunny Nicaean willow-bordered ammonoidean demi-pension loathsome interveinal semicollegiate self-pleasing bacterization fordy wiseass haiduck relaxation mickle tiger hemopexis polyped DDD" (Indicator: "twitter") - source
- File/Memory
- relevance
- 7/10
-
Found a reference to a known community page
-
Unusual Characteristics
-
Installs hooks/patches the running process
- details
-
"wscript.exe" wrote bytes "e739b277e1a6b6772e71b677ee29b67785e2b1776da0b6779064b5773ad5bc7726e4b177d16db677003db477804bb47700000000ad3793778b2d9377b641937700000000" to virtual address "0x75431000" (part of module "WSHIP6.DLL")
"wscript.exe" wrote bytes "c04eb4772054b577e065b577b538b6770000000000d0b07600000000c5eab0760000000088eab07600000000e968b7758228b677ee29b67700000000d269b775000000007dbbb0760000000009beb77500000000ba18b07600000000" to virtual address "0x77C71000" (part of module "NSI.DLL")
"wscript.exe" wrote bytes "fae6b177e1a6b6772e71b677ee29b67785e2b1776da0b67726e4b177d16db677003db477804bb47700000000ad3793778b2d9377b641937700000000" to virtual address "0x74EA1000" (part of module "WSHTCPIP.DLL") - source
- Hook Detection
- relevance
- 10/10
- ATT&CK ID
- T1179 (Show technique in the MITRE ATT&CK™ matrix)
-
Installs hooks/patches the running process
File Details
O_Sulliv.vbs
- Filename
- O_Sulliv.vbs
- Size
- 1.6MiB (1709848 bytes)
- Type
- script vbs
- Description
- ASCII text, with very long lines
- Architecture
- WINDOWS
- SHA256
- 90ba7fe22006870e763cfde17bac963df65130b28711798ef30e6b36a6e9e511
- MD5
- 62866f453c3daedc95261eba61ea9351
- SHA1
- 3681c9149e3b2ade20ed546fe7963c7c03ff2d8b
- ssdeep
- 24576:BkTT8sGpcDFoL/NeDvYxvsBgZg64/0gtw0N4TCR0rR3k7Um:sGpSFO/E7YdsBgZg64sQN4T00rZIt
Screenshots
Loading content, please wait...
Hybrid Analysis
Tip: Click an analysed process below to view more details.
Analysed 1 process in total.
- wscript.exe "C:\O_Sulliv.vbs" (PID: 2632)
Network Analysis
DNS Requests
Domain | Address | Registrar | Country |
---|---|---|---|
islandcomposites.com
OSINT |
205.185.115.40
TTL: 14399 |
FastDomain Inc.
Organization: CONTACTSCALE LLC Name Server: NS1.ISLANDCOMPOSITES.COM Creation Date: Sun, 26 Aug 2007 23:27:31 GMT |
United States |
Contacted Hosts
IP Address | Port/Protocol | Associated Process | Details |
---|---|---|---|
205.185.115.40 |
443
TCP |
wscript.exe PID: 2632 |
United States |
Contacted Countries
HTTP Traffic
No relevant HTTP requests were made.
Extracted Strings
Extracted Files
-
Malicious 1
-
-
TableOfColors.exe
- Size
- 656KiB (671280 bytes)
- Type
- peexe executable
- Description
- PE32 executable (GUI) Intel 80386, for MS Windows
- AV Scan Result
- Labeled as "Artemis" (14/70)
- Runtime Process
- wscript.exe (PID: 2632)
- MD5
- b1dec78a1ea2ac66cdc5b14f1b628fa1
- SHA1
- 2a9506c5c02a2ab8e3d31d5059e8299b25eb5cc0
- SHA256
- 61970452081816271072dd600d435d6e352bd25e119d93a85332772d4275f216
-
Notifications
-
Runtime
- Not all Falcon MalQuery lookups completed in time
- Not all sources for indicator ID "api-64" are available in the report
- Not all sources for indicator ID "string-5" are available in the report