Genscape Australia.vbs
This report is generated from a file or URL submitted to this webservice on September 9th 2019 03:48:24 (UTC)
Guest System: Windows 7 32 bit, Professional, 6.1 (build 7601), Service Pack 1
Report generated by
Falcon Sandbox v8.30 © Hybrid Analysis
Incident Response
Risk Assessment
- Network Behavior
- Contacts 1 domain and 1 host. View all details
MITRE ATT&CK™ Techniques Detection
Additional Context
Related Sandbox Artifacts
- Associated SHA256s
- 0b6c3ab19c82241578655e91be7d46b34e69efbca4f6c8eb29d63866b22a7e82
Indicators
Not all malicious and suspicious indicators are displayed. Get your own cloud service or the full version to view all details.
-
Malicious Indicators 3
-
External Systems
-
Sample was identified as malicious by a trusted Antivirus engine
- details
- No specific details available
- source
- External System
- relevance
- 5/10
-
Sample was identified as malicious by at least one Antivirus engine
- details
- 3/55 Antivirus vendors marked sample as malicious (5% detection rate)
- source
- External System
- relevance
- 8/10
-
Sample was identified as malicious by a trusted Antivirus engine
-
Unusual Characteristics
-
Script file shows a combination of malicious behavior
- details
-
The script produces internet activity
is obfuscated and drops files - source
- Indicator Combinations
- relevance
- 7/10
-
Script file shows a combination of malicious behavior
-
Suspicious Indicators 8
-
Anti-Detection/Stealthyness
-
Possibly tries to hide a process launching it with different user credentials
- details
- ImpersonateLoggedOnUser@ADVAPI32.DLL from wscript.exe (PID: 3136) (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 3/10
-
Possibly tries to hide a process launching it with different user credentials
-
Anti-Reverse Engineering
-
Possibly checks for known debuggers/analysis tools
- details
-
"ewise deactivations disillusionize mumpsimus wintery wrong-directed Kristmann Tiananmen Ahriman Centaurid towelings chisel-pointed unextraneous unspared circumbendibus tormentedly coxcombic Ilya halocline Moesogoth Slocomb disunities stylizing bouw foresees dibbukim wheelbarrow Wanamingo gtd. pyrazin schnapps orderliness bleaches whipjack Magnesia periodoscope small-natured wringbolt permeably indiscussable underlanguaged Pro-russian cantharidizing unforbidding unaccompanable unsingle Bannister furlana cilices bureaucratist ungermlike timeling carnaubyl startling trichonosis twice-abandoned rebuffet skeen organismic aspidistras Brownsburg Bow-bell standardised notarially Nematoda Osnaburg folles merriest suboptimum convictment pratapwant Arctamerican fontinas barotropic fellowred anticentralist waist-slip Mobley galactopoiesis cheerleader mixologist culicifugal machzor extraforaneous revelrout undialed plenisms patiently Tongrian elephancy adenoliomyofibroma Sander carnivorous twittering Peripatopsidae smokin" (Indicator: "ntice")
"led lanceolation marg. tallest qualityship BO Fords Aunjetitz savableness whortles Pterocles wisehead docquet septane plectopterous gripers enticement sarcocol Branscum trumper collationer supernational nonbulbous lineary cingular Dissenter horseload petropharyngeal hygrophyte puckermouth annoyed animalize aposematic interwarring candolleaceous fisherpeople stricker abstracts bordering purple-nosed antiophthalmic Beisel tetraspermal ASTM refocillate screwship Ranchester demolitionary whiskery placcate misaltering pettifoggery keyed-up Clerk superpowered weird-looking superhard budgets tourist Hejira spookdom unpracticableness Tyrtaean maturement uncomposed adunc pure-blooded goosewinged corbelling paunch Leschen folly-blind cladogenous trochocephalia multicoloured botulismus abraum kekotene frictional cross-ply Sicilian pawnbrokering cartes probit hyetometric dubiousnesses Miltonist martyrization teleutosorus Gideon unrustically footboys Splachnum spae-man butterscotch megalopolitanism duramater toy-shop subp" (Indicator: "ntice")
"ted cerebrospinant twice-objected prehardening beode bloodworthy deckel gondola embetter magistratical mulled defaulted cleansed phylonepionic preintercede reunification misbrew postparotitic ura himple Kolchak true-heartedness centers remonstration honey-pot princeps griffade chaccon affiliable electrorefine international-minded Amarette Madagascar prosateur Utter Heerlen anilopyrine Dusa extemporize Laplacian Pradeep black-backed whirligigs workbox domicil jargonize quinyie organographic iodic innovates cosentiency pedelion Thury lipoferous demihearse dilates scrump vocalist anisol trudge bunolophodont porcino lumbayao completes topodeme Eurylaimus undampable foehn ratsbane Pollyannish triliterally slaughterer puerperium poikilothermism ylang-ylang seamy begabled tetroxids allotheistic dolmades quelquechose flingdust last-named twitterer profascists Tedra epinyctis urticated corbiculum medicophysics Lubell mistouched incienso facticity belikely anticensorial spice-wood stupas congressional bed-wetting profo" (Indicator: "ntice")
"ze hemielytral Vienna wind-hungry undergrade commixture scareproof Helladotherium shoulder-clap man-child pockmarking oppositional truncal TMS dummkopfs perfix katatype blacklisting unresentful Syngenesia celioelytrotomy muser ravendom anils urluch albricias presager overhomeliness condoms infallibleness ungrieved Dermaptera adenase conationalistic hitty-missy circumflexes unbarbarous gurge smooth-combed ill-knotted twice-negligent glycopexis myometritis druidry presbyteress callipees swidden hang blenches badinaging wire-wove enticement slobberchops nonprophetic tatty-peelin seizor rebrandish nonexpiatory popie maladroitly resplendences Vincentown viruela tricotee oversocial corepressor Purbach tacheometric soapbark Somonauk spiffiest panic-stricken shoon AGN inappetent Ismailiya natures textbooks celibatist hypernitrogenous hypostyle bonsai amatorial uneatableness Serpentarian Saucier inholder queechy Hallandale hecastotheism double-park Edenization diestocks mytilotoxine epornitic disimitation cholepoietic" (Indicator: "ntice")
"ria striker cleidomancy splinter ethrogim heathlike submolecular glimpsed attainer Nyssaceae ness lilt octoreme varmannie amelioratory repatriations Danete slab antapoplectic uncoagulated energeticist mayhemmed Zaporozhe Hatia behowl felones noncontemptibly submontanely organbird semistriate preconjecturing mellow-looking antichance nonconscious heraldize uncraftiness nonpendant slitwork ruffliness chrysographer cramp-iron chalazal self-bored curiologics dissel-boom emmarbled praising seminasality talkers in-tray stuffier Xenorhynchus Eliz. varve-count unbureaucratically antheriform bathybian clitoris spasmodism wrigglier nonresolvably prepurposive metricise hiccough Palenque coryl eudipleural Denning unhedged fugacity besew bismanol alibis Basilarchia turbulency boondoggled psychodelic dissuasively neutretto glutamates isology oculars cross-vaulting Denticeti taffarel whipsaw bare-worn orphanize trouserettes outsharp needlewood pollinizer Factoryville cantiness myrtol maternalized etoffe pleurectomy binocle" (Indicator: "ntice")
"n damagement Karia minuscules hemelyttra cosinusoid scintle Cordelie ocas docilities Quaker-colored valetudinarian gruffier misput chair-warmer imperscrutable pseudocourteously amphidiploid Suring Bator swine-sty quasi-valued glancer hummum Enlightenment Brauhaus Cannizzaro semiconsciousness yellow-lettered elicit paravail improvableness upsprang nothingless full-pitch farrisite naked-stalked uncivilisable frizzing Deere tracheide splanchnodynia Lux burler Roerich overprosperity kytes Bori nonsanely Palermo benedicks berceaunette centrolineal salinelle larks crossed neo-orthodoxy misgivingly bandannas dyslectic sialagogic prenticeship shanghaied headclothes Kans. psoitis franchises rhabdomere middler prissing microstethoscope bifaces Colwyn panickiest mangabev dewooling straitens Coste-Floret intersprinkling octonarius sanglier jarless belittled contestably pharmacomaniac oilstone maudlinize publishers provostal Kolomak blowpipes Erb Terrilyn habit Caroid Canton racketeering key-note Awan wide-met Fulicinae m" (Indicator: "ntice")
"flatterable Procora interdifferentiation transmittal skeldock Dawn quadripolar sweet-sop Holbrooke Finance varityping socii evenforth saloonist hetaerio pteridospermaphytic semi-opal Jacobean theophanic vocicultural rethrust laevotartaric phantoplex idolised abecedary approachableness sustenanceless progypsy alacrities filed redamaging speller creep over-read surveiling NESC hindersome Philo-peloponnesian unravished tollmaster palaeo- Pa. overglide Alessandra reddish-yellow typologically recoach atropamine courthouses reticle alkanal Iwu Alsworth Loraine sneaker unadvisedly Kries Rina Otidiphaps antimask BPDPA Teador basilect anodized co-trustee taker-in legend nondissipatedly Swaps embrectomy overfrown feverfews dingle-dangle wardroom r-less pentice Parkville exhumers Siphonaria peshkash beautifications flear Abbie LSSD cerebellocortex Turnerville pasteurization all-subduing flag-officer Heligmus overpot folkboat Manus angler resuming debtor capitulates cassata prefearfully overcorrected Lovelady aromaticnes" (Indicator: "ntice")
"onance castellated Palinuridae neckatee eremophyte overvehement unmysterious unwall proverbial canals nonconstraint canals mandyai Chamyne unguzzled installant unprideful coelector basophile angulometer Beroidae ailanto yielded oilwell repart temperable Saxena paradoctor triarctic Azygobranchia bedspreads hypercalcemias pleurovisceral subcash amoebas glidingly thermobattery fecundation savagest nonlosable basidigitalia Macarani actinometers consecrater violone polishes epithelioblastoma leprosarium Rattigan cyclorama cosmogonists triduam taciturnly perplexity dislikers ridgepoles kino Basses-Pyrn anticensoriousness cytome presbyopy Lenin hosp. crispers homonymously inward overpromptly scraggily better-balanced Morrissey maleates preexecuted enforcers antiphrastic philosophunculist overidentified Tetramera giblet bridgetree supraspinatus manic-depressive formularized Shurlock Calchas Mehitabel UC incremable POSIX professional northlight backside avian tiremaid phototelephony pyometritis biforin cuissen joking" (Indicator: "ntice")
"nating broad-minded Treva planospore aftertreatment Nictheroy angiotripsy mizmaze interstition victims typebars nonpractical heart-thrilling adorned squalidity Ire. rushers sublevels magazinable decatyl echinid formuliser hypped cateresses polyteny Harpa bescorched dereference agnostically screamy juvia kippur pre-Columbian unsecretive embryol. unpoisonous antinoise bespeaks womb-lodged peeweep parorexia Tulalip resecure presuccessful head-over-heels Dene uncautiousness modems Spanish-ocher Dafla sanctionist semiape yawnily outmarched warlock precensure concessit chiropodial Semi-christian sniffled livlihood countermined Ryland feedman subordinates vucoms tortoises disserting Clearwater paradropping McIntyre Ababa well-distinguished extratension Ashkhabad Anglo-Catholic genecologist firesider nonfervidness orgulously canadians tuchunate anticephalalgic Croton-on-Hudson Aditya fuciphagous outhitting gangplows toddyman expeding atrabilaire choriocapillary demifusion vicinity thinolite outplease auricularias cin" (Indicator: "ntice")
"cane sorrels prelacteal Tora intermit daunting spagyric reuplift bilgier decolouriser tinned civics Christ-inspired well-deck counter-pressure laagers overornamentally khaja Mede hyperdactyl nonconserving self-humiliating vaudeville countertrench inclosure Perean tightwads pretold sultanism fitroot electropathic impersonatrix xanthocobaltic Grassman Tay MDX blockhole Canisteo assumptiousness inholder outrelief aduncity Grisons saddlebag subtriplicate coxwaining tufty disastrously paedological penetration Ndebeles whereunto sorrowing graved mammogram agricolist heteronomously jimper impecuniosity tirrwirr Blight electrolysing Sambucus tensome unilateralism civilizations pottered eyeroot smooth-crested macrofossil sea-nymph jestingstock BNF thick-haired gravenesses stumpwise nonmeasurableness progamic unpluralized bromism futurities mamoty eccrinology nonobservant enameller nowder telphered irretractile uncomprehended Titmarsh knockemdown electroballistics refaces invokes orthopraxy anticentralist Glynas footwo" (Indicator: "ntice")
"ee cassiri protracter Atum stentoriously deicide nephalism surprisement nodality soapberries voltmeter-milliammeter respringing arbitraments cayuco momentaneously skef Casparian alchimy counterdemonstrator anticentralist cantorous malodour Eirene scuttles solemnitude overdevoted floreating redhandedness received nonacutely eye-casting exomorphism trickery stagnance citrines transpontine saprophagan geopony landlordly Vulcanalial poolrooms ferling outrances Anti-zionist tremelliform linguadental azulejos crabeating sarmenta touchable Campbeltown weets Veribest dourah hydrocauline arrantness radiochemical paralectotype juicily hypophyseal nonreadableness pitchmen nonsuspension Adrell modernize unbrotherlike Hydrodictyaceae Pheidole TASS outstepped odylization aldopentose lupanars focusers nonmathematically preconfusing neoarsphenamine poignet natterjack undetrimental parsleywort planirostrate Angie asaprol affirmer brehonia jumbucks pre-Mosaic hominies peplumed haematorrhachis triazolic prelected garnered untra" (Indicator: "ntice")
"ap pro-Nigerian doubleheaders chitling XP casusistry paleoeremology semioctagonal degressively annualized impalatable sarpo annealed several-lobed argute unhook Normanish Jenn vacuousness flower-scented Toma ksar esophagopathy misogynic Rais superenergetic Englisher heartbeat subaerated unparadoxically surly chapbooks trimyristate Chroococcaceae intromissibility Menon Rondonia unigenesis Leeper disinterestedly astounding caphar many-languaged larderer petit-mattre stalk-eyed vociferated Oralie chiasmi beamful Silybum stopa EKG terror-driven concealers querulant acediast kalymmaukion operose oxberry michery boulework barlafumble hand-colored warheads befleaed indestructibleness forehinting villanelle diphthonging unleaky crosspieces unremounted chromogenic erythematous amphibole ungreased prevuing continuers Euless formals rewon Kossean illimitable Freyre Hagar bumkins edited boasters roentgenotherapy shiatsus masscult Sabrina ectopic troop re-rely appreciated Univ extradictionary unapprenticed pedlary poppys" (Indicator: "ntice")
"senchant multiple-valued siphonostelic birded solitude Esperantic affixed thoght philosophizers mtg sacked rebateable amblosis preaccounting lecturer Burta unvirgin palaeolith caciquism Non-gothic Hollywooder levulinic mixy-maxy jumbled mollicrush untidiness jingkoes castration dactylar melt Rohilla outleading undersuit Judge undiscovered Maronite magneto Jinan palsying nontraveling penetrator hot-dry bullocker Thida reorchestration uncreativeness prankiest desocialization remainer misinterment rickardite redbug dreamsiness maelstroms Fowlerville tap-off nonsilver Asia Imena hydro-aeroplane precompiling overpronounce pleasure-wasted piddlingly scarehead zeugmatic lenos scraper duodenojejunostomies petaloidal sublethally esphresis Farida anthemene ritualistically madly rachialgic monocystic unconflictingly Tasm haptophor hemipterous overedge Dedra obsecrationary subuncinated caudexes jipijapas ichthyization asperifolious rabbiter epitheca milk-and-water metestrus pyocyte transitivism anticentralization brattie" (Indicator: "ntice") - source
- File/Memory
- relevance
- 2/10
-
Possibly checks for known debuggers/analysis tools
-
External Systems
-
Found an IP/URL artifact that was identified as malicious by at least one reputation engine
- details
- 1/71 reputation engines marked "http://bostonfrogpond.com" as malicious (1% detection rate)
- source
- External System
- relevance
- 10/10
-
Found an IP/URL artifact that was identified as malicious by at least one reputation engine
-
General
-
Contains ability to find and load resources of a specific module
- details
-
LoadResource@KERNEL32.DLL from wscript.exe (PID: 3136) (Show Stream)
FindResourceExW@KERNEL32.DLL from wscript.exe (PID: 3136) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Contains ability to find and load resources of a specific module
-
Installation/Persistance
-
Executes a visual basic script
- details
- Process "wscript.exe" with commandline ""C:\GenscapeAustralia.vbs"" (Show Process)
- source
- Monitored Target
- relevance
- 10/10
- ATT&CK ID
- T1064 (Show technique in the MITRE ATT&CK™ matrix)
-
Loads the task scheduler COM API
- details
-
"wscript.exe" loaded module "%WINDIR%\System32\taskschd.dll" at 73FC0000
"wscript.exe" loaded module "%WINDIR%\System32\taskschd.dll" at 01290000 - source
- Loaded Module
- relevance
- 5/10
- ATT&CK ID
- T1168 (Show technique in the MITRE ATT&CK™ matrix)
-
Executes a visual basic script
-
Network Related
-
Sends traffic on typical HTTP outbound port, but without HTTP header
- details
- TCP traffic to 104.244.73.177 on port 443 is sent without HTTP header
- source
- Network Traffic
- relevance
- 5/10
- ATT&CK ID
- T1043 (Show technique in the MITRE ATT&CK™ matrix)
-
Sends traffic on typical HTTP outbound port, but without HTTP header
-
Remote Access Related
-
Contains indicators of bot communication commands
- details
- "espectable phon- runesmith Cervantist dikaryophytic pleinairism scobs Hermetics hero-worshiper gurglet doupioni trews optimization feoffees generations Serbize fleetest reoperate Katrinka Coronado ton-force flasks thrifts Minneapolitan forthcoming bespecklement temple-treated gray-veined Salangi reconvalescence blowsier Anti-nordic orchidology Scipio Latoya coercement malaguena Seco filaree Aneta intercardinal langle rozum bickered Teotihuacan distr. srac spirol Lopezia selenotropism bastant unborough aahs impunctate tendons neurosecretory Armil nerve-destroying tetranitroaniline reliantly grieffully interlacement isogradient imputability messenger hog-maned Espronceda Regulus sunstar lecithalbumin unligable dolci unstiffen Clemon subfeudation barman lawyerly cheeky Nubilum woman-mad wildbore Bloomburg Astatula Sphegoidea rut temper shysters progeotropic labourage dieted unsecurity geneologists sphaceloderma Dollie pepperwood blue-bellied near-by pectases veniable Leff philotheism polymorph Asclepiad orleways" (Indicator: "trinka")
- source
- File/Memory
- relevance
- 10/10
- ATT&CK ID
- T1094 (Show technique in the MITRE ATT&CK™ matrix)
-
Contains indicators of bot communication commands
-
Informative 18
-
Anti-Reverse Engineering
-
Contains ability to register a top-level exception handler (often used as anti-debugging trick)
- details
- SetUnhandledExceptionFilter@KERNEL32.DLL from wscript.exe (PID: 3136) (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Contains ability to register a top-level exception handler (often used as anti-debugging trick)
-
Environment Awareness
-
Contains ability to query machine time
- details
- GetSystemTimeAsFileTime@KERNEL32.DLL from wscript.exe (PID: 3136) (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 1/10
- ATT&CK ID
- T1124 (Show technique in the MITRE ATT&CK™ matrix)
-
Contains ability to query the machine version
- details
-
GetVersionExA@KERNEL32.DLL from wscript.exe (PID: 3136) (Show Stream)
GetVersionExA@KERNEL32.DLL from wscript.exe (PID: 3136) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
- ATT&CK ID
- T1082 (Show technique in the MITRE ATT&CK™ matrix)
-
Contains ability to query the system locale
- details
-
GetUserDefaultLCID@KERNEL32.DLL from wscript.exe (PID: 3136) (Show Stream)
GetUserDefaultLCID@KERNEL32.DLL from wscript.exe (PID: 3136) (Show Stream)
GetUserDefaultUILanguage@KERNEL32.DLL from wscript.exe (PID: 3136) (Show Stream)
GetUserDefaultLCID@KERNEL32.DLL from wscript.exe (PID: 3136) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Possibly tries to detect the presence of a debugger
- details
-
GetProcessHeap@KERNEL32.DLL from wscript.exe (PID: 3136) (Show Stream)
GetProcessHeap@KERNEL32.DLL from wscript.exe (PID: 3136) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Contains ability to query machine time
-
General
-
Contacts domains
- details
- "bostonfrogpond.com"
- source
- Network Traffic
- relevance
- 1/10
-
Contacts server
- details
- "104.244.73.177:443"
- source
- Network Traffic
- relevance
- 1/10
-
Contains PDB pathways
- details
- "wscript.pdb"
- source
- File/Memory
- relevance
- 1/10
-
Creates a writable file in a temporary directory
- details
- "wscript.exe" created file "%TEMP%\TableOfColors.exe"
- source
- API Call
- relevance
- 1/10
-
Drops files marked as clean
- details
- Antivirus vendors marked dropped file "TableOfColors.exe" as clean (type is "HTML document ASCII text")
- source
- Binary File
- relevance
- 10/10
-
Logged script engine calls
- details
-
"wscript.exe" called "Msxml2.DOMDocument.3.0.CreateObject" ...
"wscript.exe" called "ADODB.Stream.6.0.CreateObject" ...
"wscript.exe" called "WScript.Shell.1.CreateObject" ... - source
- API Call
- relevance
- 10/10
-
Contacts domains
-
Installation/Persistance
-
Contains ability to lookup the windows account name
- details
- GetUserNameW@ADVAPI32.DLL from wscript.exe (PID: 3136) (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 5/10
- ATT&CK ID
- T1033 (Show technique in the MITRE ATT&CK™ matrix)
-
Dropped files
- details
- "TableOfColors.exe" has type "HTML document ASCII text"
- source
- Binary File
- relevance
- 3/10
-
Opens the MountPointManager (often used to detect additional infection locations)
- details
- "wscript.exe" opened "\Device\MountPointManager"
- source
- API Call
- relevance
- 5/10
-
Touches files in the Windows directory
- details
-
"wscript.exe" touched file "%WINDIR%\System32\en-US\wscript.exe.mui"
"wscript.exe" touched file "%WINDIR%\System32\rsaenh.dll"
"wscript.exe" touched file "%WINDIR%\System32\en-US\KernelBase.dll.mui"
"wscript.exe" touched file "%WINDIR%\System32\msxml3r.dll"
"wscript.exe" touched file "%WINDIR%\System32\wshom.ocx"
"wscript.exe" touched file "%WINDIR%\System32\msxml6r.dll"
"wscript.exe" touched file "%WINDIR%\System32\taskschd.dll"
"wscript.exe" touched file "%WINDIR%\System32\stdole2.tlb"
"wscript.exe" touched file "%WINDIR%\System32\wscript.exe"
"wscript.exe" touched file "%WINDIR%\Globalization\Sorting\SortDefault.nls" - source
- API Call
- relevance
- 7/10
-
Contains ability to lookup the windows account name
-
Network Related
-
Found potential URL in binary/memory
- details
- Heuristic match: "bostonfrogpond.com"
- source
- File/Memory
- relevance
- 10/10
-
Found potential URL in binary/memory
-
Spyware/Information Retrieval
-
Found a reference to a known community page
- details
-
"lanners portional Dyotheletism utriculoplastic rubberless Calion Beadle couscouses bone-hard peltately Bobbette ungelatinous stickily all-lovely wrong-doer corncob brislings mid-length intersubjectivity encephalography anemochorous tribrachic fitchee compositorial Parks nonsolicitousness pancreatemphraxis crumblement wanes hypnotoxin Oveta experimenter tympanocervical ov- Sthenius unresistingness dent. high-boned quistron unexorcised juglar dephlegm organologist steady-going injurers unoccupiedness nondistractingly protestingly mesorhinism decoupled Germanization Chilung excalfaction anorexigenic khets Autumni forcedly semifunctionalism twitterer stages nontheologic felting Martian schonfelsite counterscale heartburning dewflower amputees deluce ontography wised efflorescency yentnite third-rater all-binding Meliaceae nondynamically perioikoi healthward temperamentalness trachycarpous sierozems vellum-covered postabdominal nonconstitutional jeopardied curriers hexasepalous world-enlightening distress Dunthorn" (Indicator: "twitter")
"ewise deactivations disillusionize mumpsimus wintery wrong-directed Kristmann Tiananmen Ahriman Centaurid towelings chisel-pointed unextraneous unspared circumbendibus tormentedly coxcombic Ilya halocline Moesogoth Slocomb disunities stylizing bouw foresees dibbukim wheelbarrow Wanamingo gtd. pyrazin schnapps orderliness bleaches whipjack Magnesia periodoscope small-natured wringbolt permeably indiscussable underlanguaged Pro-russian cantharidizing unforbidding unaccompanable unsingle Bannister furlana cilices bureaucratist ungermlike timeling carnaubyl startling trichonosis twice-abandoned rebuffet skeen organismic aspidistras Brownsburg Bow-bell standardised notarially Nematoda Osnaburg folles merriest suboptimum convictment pratapwant Arctamerican fontinas barotropic fellowred anticentralist waist-slip Mobley galactopoiesis cheerleader mixologist culicifugal machzor extraforaneous revelrout undialed plenisms patiently Tongrian elephancy adenoliomyofibroma Sander carnivorous twittering Peripatopsidae smokin" (Indicator: "twitter")
"raightened toads exit overlearn girdlestead gospel-true redtapism B.Arch. hand-stitch phyllopodan lymphadenopathy rewake praenomens aleyard ctenophoric advancements choledocholithotomy gtd theologian Satyagraha enflaming barely unfit outbreeds bombilation anorthitite emplacing westabout immemorial troglodyte airways exsiccate southwesterners termer dizain Zantos helistop chance-dropped baulks plowbacks nonsanction pseudonymuncle grudgefully murderees keelback rejudgment c-horizon petnap actinomycosis heresiology octarchies playoff abradable seminiferous superfructified gitoxin recharts Elish hematines heterokinesia Bovill abrasiometer joints bosom-folded curiously chromophore undergraduateness bamboozlers puerilities leadenpated missit haggaday cliv thick-breathed prepractical peridotic undoubtingly upcast savager gests playdate WWOPS fathomable unpassively prounion supergravitating glauconitization admiralship unparsonical internuncio hereupon chromocenter twosomes Riocard thujene saiid twittering scopelid a" (Indicator: "twitter")
"ted cerebrospinant twice-objected prehardening beode bloodworthy deckel gondola embetter magistratical mulled defaulted cleansed phylonepionic preintercede reunification misbrew postparotitic ura himple Kolchak true-heartedness centers remonstration honey-pot princeps griffade chaccon affiliable electrorefine international-minded Amarette Madagascar prosateur Utter Heerlen anilopyrine Dusa extemporize Laplacian Pradeep black-backed whirligigs workbox domicil jargonize quinyie organographic iodic innovates cosentiency pedelion Thury lipoferous demihearse dilates scrump vocalist anisol trudge bunolophodont porcino lumbayao completes topodeme Eurylaimus undampable foehn ratsbane Pollyannish triliterally slaughterer puerperium poikilothermism ylang-ylang seamy begabled tetroxids allotheistic dolmades quelquechose flingdust last-named twitterer profascists Tedra epinyctis urticated corbiculum medicophysics Lubell mistouched incienso facticity belikely anticensorial spice-wood stupas congressional bed-wetting profo" (Indicator: "twitter")
"nalytical unrejected repandly soft-speaking polynomials oophorostomy hygiologist monished skiagraphical steps epicrystalline soord world-raising gridded Barthol arrival eremitish drawerful antrustion blocking minatorily embassy winzeman trifurcation unexploded interempire nutating LAPD unbuttons weighers forstraught bajury unremarkableness peripherys supremacists Uruk Lunda tattletales explainingly quadratus brominism awl-shaped axolotls ancones simblin occasionalist rammy y-cast frivolity-proof inspirate disomus aiery manganhedenbergite equiparant amphitokous hogshead tendment Raffaelesque antho- birring polymastigote babylonians trophic toggling forelooper iambuses Mitnagdim bebeeru Collyer triumviral cashoos revelrous medregal unstablest Durrett unchanged samite twitters nonprotesting copilots protolog snappingly concertinos choleine Cunninghamia pleaching Emmy asceses nulliplex crowner tartlet hemitropal spruit Judg picturable rapeseed necklaced secancy Senecal Stromatopora Miller taels tipstock cancel Yu" (Indicator: "twitter")
"lights newsbill wonted Aspergillaceae skellums protovanadium nonjuridic triliterality inexcommunicable metiers Dianthera vacationers barratry nepheligenous notifyee inequiaxial fibrinemia Pro-scandinavian phytanes excelse circiter indoloid unsmugness loyalness unscientific ICCCM disseizor PMIRR implorations vat-net horseflower quantifiability pilafs ladies-tobaccos mountainy arthropterous full-freight purposivistic Kodok defraud discomfortably contemner emanates PIT Bethesde beautifulness pilonidal Daucus Voltairism wheel-footed pteridology black-letter gigasecond eruptivity thimbleberry tramp enthral cankerbird equidiurnal lachrymaeform coordinator sistership prebrachium lacunulose girderless stratocratic nizamate scrolly theonomously twitteringly manuevers devas vanward jurat characterist descants resprinkle exculpatorily amphichromatic nonnarcism glassblower Sirte dispatches Tompkinsville Amoebobacterieae pyrologies hamamelidin biologism Fraser unpractice summer-made potcherman abiologically unactive well-" (Indicator: "twitter") - source
- File/Memory
- relevance
- 7/10
-
Found a reference to a known community page
-
Unusual Characteristics
-
Installs hooks/patches the running process
- details
-
"wscript.exe" wrote bytes "e739d677e1a6da772e71da77ee29da7785e2d5776da0da779064d9773ad5e07726e4d577d16dda77003dd877804bd87700000000ad379d778b2d9d77b6419d7700000000" to virtual address "0x75721000" (part of module "WSHIP6.DLL")
"wscript.exe" wrote bytes "c04ed8772054d977e065d977b538da770000000000d07e7700000000c5ea7e770000000088ea7e7700000000e968f2758228da77ee29da7700000000d269f275000000007dbb7e770000000009bef27500000000ba187e7700000000" to virtual address "0x76761000" (part of module "NSI.DLL")
"wscript.exe" wrote bytes "fae6d577e1a6da772e71da77ee29da7785e2d5776da0da7726e4d577d16dda77003dd877804bd87700000000ad379d778b2d9d77b6419d7700000000" to virtual address "0x750F1000" (part of module "WSHTCPIP.DLL") - source
- Hook Detection
- relevance
- 10/10
- ATT&CK ID
- T1179 (Show technique in the MITRE ATT&CK™ matrix)
-
Installs hooks/patches the running process
File Details
Genscape Australia.vbs
- Filename
- Genscape Australia.vbs
- Size
- 1.6MiB (1711118 bytes)
- Type
- script vbs
- Description
- ASCII text, with very long lines
- Architecture
- WINDOWS
- SHA256
- b953021006842ce983ed37b38ac752fc8e5341139e4f2c6793b753f474c9c63e
- MD5
- 01199b61ef1bfaad0e6058c0af99ab4d
- SHA1
- 5fe3d5eb4b197fad5ad24b46bf18b277d50dc93e
- ssdeep
- 24576:I0ONS/HZNesj/wjRKOTxSGq4DPERtPjqnJb+ai/:I0ONa5N10Kktq4wRtPjqnJb+V/
Screenshots
Loading content, please wait...
Hybrid Analysis
Tip: Click an analysed process below to view more details.
Analysed 1 process in total.
- wscript.exe "C:\GenscapeAustralia.vbs" (PID: 3136)
Network Analysis
DNS Requests
Domain | Address | Registrar | Country |
---|---|---|---|
bostonfrogpond.com |
104.244.73.177
TTL: 11521 |
- | United States |
Contacted Hosts
IP Address | Port/Protocol | Associated Process | Details |
---|---|---|---|
104.244.73.177 |
443
TCP |
wscript.exe PID: 3136 |
United States |
Contacted Countries
HTTP Traffic
No relevant HTTP requests were made.
Extracted Strings
Extracted Files
-
Clean 1
-
-
TableOfColors.exe
- Size
- 216B (216 bytes)
- Type
- html
- Description
- HTML document, ASCII text
- AV Scan Result
- 0/58
- Runtime Process
- wscript.exe (PID: 3136)
- MD5
- 58f1041284eb5a06d0301d73b53c8d63
- SHA1
- b8a354af795947cdae83f67c3ff6b041d0cd5e78
- SHA256
- 22159afb7ff62c51413fe209e8b94aa7501f691c2e19cbc7a79b0289d6ddc109
-