JVC_30782.vbs
This report is generated from a file or URL submitted to this webservice on November 11th 2019 16:24:27 (UTC)
Guest System: Windows 7 32 bit, Professional, 6.1 (build 7601), Service Pack 1
Report generated by
Falcon Sandbox v8.30 © Hybrid Analysis
Incident Response
Risk Assessment
- Network Behavior
- Contacts 1 domain and 1 host. View all details
MITRE ATT&CK™ Techniques Detection
Additional Context
Related Sandbox Artifacts
- Associated SHA256s
- dfa9b044c96ca68b77f9b37015805697373ad4d8225d003c2821fd5802c80380
Indicators
Not all malicious and suspicious indicators are displayed. Get your own cloud service or the full version to view all details.
-
Suspicious Indicators 5
-
Anti-Detection/Stealthyness
-
Possibly tries to hide a process launching it with different user credentials
- details
- ImpersonateLoggedOnUser@ADVAPI32.DLL from wscript.exe (PID: 3656) (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 3/10
-
Possibly tries to hide a process launching it with different user credentials
-
Anti-Reverse Engineering
-
Possibly checks for known debuggers/analysis tools
- details
-
"aline acicularly roomfuls bakerdom ambulatio recentralize roomy forespoken declaratorily buttresses stooker Bergstrom Mangum Petrillo retiredly veny regressive mortreux internships neutered phytoalexin intimate mache barringer E.T.A. devoicing pollical Arctogeic assurors base-spirited apostatic queens scarfe NETBIOS inexistence dorsigrade subprojects riverweed fumarin Homans molasses notewise amygdalinic beshrouded perceptible barbitos aye carbolizing quartetto atweel Ferrigno Cottekill skive Dille Sino-Tibetan sundries Guenther ultracrepidarianism automanipulation cease tethers unconfirmability taboret insula nonnominalistic Krakatau monoclinian Schuylerville guggled Samy Ultonian slick-talking pastries anticivic ufologies lampion first-mentioned cispadane tin-tack thurificati unculled Clite Ioni apprenticed importunance Gekkota labiovelarization nympheum pushwainling eolith hexanedione microstate imprisoned griefs gossamer pronouncing forty-seven clinging unitarians nontraditionary medialization canonize oc" (Indicator: "ntice")
"cegoer twice-terminated excerptible unquibbling gawkies heterometabolic ontologically barbone pernine tautirite agglutinins Ashir tribunal equilibrium alpieu ungulae recipes supportlessly dealerships rough-plow rebeldom persuade fatherlessness rapscallionly penangs Constructivism bringed Rucervus bourdons Argoan liquefy menadic bloodspilling faciation squalls coddle chromocratic feridgi Crete mauls Protobranchiata fibrinemia engrosser Cytissorus LittD inpolygon T1 setose anticeremoniously Patagonia Achromobacter siddurim subetheric countergambit sickee corporification sulfamerazin chafewax philosophistical thrusher batteau scallola prefinancing essart token-money mythologys Nivernais arcature twenty-second upblacken trioxide preinstallation coccygotomy pontooner interceded tridymite-trachyte ndoderm Changewater de-emphasizing strudel contraster sapiens atabal Sabbathbreaking shauling oeconomus Habronema preinvolving unlovely horreum jokish unaccounted-for circulatory water-waving statutes smilefulness lipotro" (Indicator: "ntice")
"around court-customary sepsine histing unbridledness entices grass-green nickelise sialaden cross-string Draba Feast bumper garmenting hunchbacks torturesome unshifty grumblesome handmaidens foreflank Unamuno noninfinite aglobulia willeyer diplogangliate impalpably supercrescent recuperance bioreaction coexpand cobalticyanides aswim thwartships tartishly unmetaphysic tinsy auxin Petras cyrtometer retalk midtap multangulous out-of-dateness concubines liftboy Babbitry beltwise reatas work-seeking CSC imaumbarah Ballantine suprafoliar rehumiliation Elko C.O. lubricity seenil schizaxon demonstrator segregation frondiform unvaunted outbake temse aponeurotome cope-stone xanthoconite Lagash dawdy two-stringed alnage Lover rishis phyto- Perak babbishly redesignate trustable Karakoram knurl Bandundu synarthrodial burnishable bathmotropism whistle-stop microsomia ingnue Wagarville Low-churchmanship peroxisomal overtheatricalness yock socialize preconferred photocollography claro world-governing outpressed rod-bending T" (Indicator: "ntice")
"terine vervenia Demo Fungia unconcreted headrace tumefy emersion lenth peneplains asseverative Myzodendraceae introspectionist scarlet-tipped Butyn Johor foreplays proparliamental spurnpoint vestibules exhibitors komatiks sinuatocontorted cardi- likingly anticeremonialist light-green brambly transferred capable candlelights circularwise Padova chapels phalansterial re-enslavement hepatatrophia loaches ostariophysial sensibilium angarias unsubscribing bobbles proprietors fallalery inturns Arimathaea PCO hand-beaten Morgan plutomania nonenviableness microbiologic ticketmonger side-lying pentolite foresleeve equimolecular remanure encapsulations heteropter counter-tierce Tintoretto heaven-accepted semi-diesel actinopraxis Gallification spignel aginners radiometric gali chunga slumbery Motley exponentiating merogenic trucing haflin gib-cat quot poniard reests louisianans offprints uninvoluted roborant asquat pitchiness fillercap scazontic erected stopbank enlargeable full-frontal kalewife coccidioidomycosis obliv" (Indicator: "ntice")
"let girtline ranees chlorellaceous nightcaps spookish piperideine pillowcase unrobbed cantharis lipectomies beggarism stupefactions Niemen Nabalus self-wounded Photinianism consoled Acidaspis espied unreturnableness sebilla nonfermentative sandburs paleogeography whited Akrabattine outcavils Rosicrucian reverberatories knived cartography thicke coltish iodogallicin Atophan readventure TTMA scrutator Arminius sinisterly phytogeographical Midville demisecond recommenders surahs intoxicator prated mobber accessibly Kemp trisylabic Liatris unproportionedly bagpod swell-mobsman twenty-second vine-wreathed crapulence bowstrings decortication Cohen Epeira spifflication deices Lasiocampa trillionths carnosity Milpitas vatted wansome rhizote thyrotoxicosis illustricity bussu wittingly cockmaster Intimism heteropolysaccharide granadilla synonymity checkpoints rikisha fideos genealogy slight-natured tripylaean Donatistic mnemonize heart-wrung kitcheny choristoneura palisade forbesite mononeural Worl neologise ode entice" (Indicator: "ntice")
"cally hard-haired disfigure warm-contested optime magsman Elcho smaltite Gnosticising tag-addressing ravenous Pseudo-isidorian ethnographical scoliorachitic furstone Apetalae firmisternal plumbum oversoothingly Wolf-man straight-spoken Murdoch hearing Grifton Goajiro adenophthalmia patterers galactosemic towhee crotaphitic xanthoconite GCA nixe subsult aizle Prentice thoriferous octavina bespend plain-garbed heathwort latticework brassie extraparliamentary roominess parabema smoothable colory symbolize Athena autonomasy nonimperialistic arborized trenches monatomic Sension Himinbjorg preinstructional phragmocyttarous volvell tenticle punchier upgaze tonlets hillsman pietisticalness Champagne-Ardenne checkpointed benzofuryl subfunctions Ekaterinoslav excudit militaryism terrar desmic surquidy Hakim pietisticalness Farsi promotes unspatially dhootis colpocystocele imbricating neuroepidermal Carduaceae ampullated boccia self-preparation nordenfelt battlewise hatha-yoga quasi-confidently rehemmed deactivated sinf" (Indicator: "ntice")
"hine bullroarer ocelliform vanpool sportsmanliness cinque-spotted siloing Kraepelin overglazes sheerly gradative half-flattering nakedize narrating dale-backed splaymouth chlormethane herpesvirus a-stays seacross Echidna Elco unsomber rendezvoused stoopball Chlamydobacteriales unaxed Granth theloncus Riess iconodule semiprotectively Puranic Calles respots enfranchises bargemaster supertramp polaritys Larinae nonmodernly chaconnes Reave congruities shoreline turnipwise Kronick oxter offshore apprenticeships Boelter Calvo bioecologies envy sml Septima mopishly backlashes ficelle submeter usucapionary shohet nonproducer Annensky concertedly hauberget complexionably pseudoallelism prance foregoes microinstructions face-harden Gayleen Canopic tick-tick jambon pastis includedness word-of demulsion NIS Benson decanoyl retrovert Welchsel cytopathogenicity sigh-born nonmucous voiturier genomes deacetylation finishes vomiters under-chap mis-seem lixiviate cystein battened Shelah price-stabilizing lekvars moolum undisin" (Indicator: "ntice")
"ouched drowsihead Lindemann abri Bond rebeginning explainingly popess shirr out-clearing salamat Amerada Claudetta inequitable howdahs Held faucitis kabab inks square-threaded trilineated hylean untrolled Charolais bigha cobras new-day heatdrop elenctical nowness misanthropic taxgatherer Pan-afrikanderdom Magnus misnumbering coexecutrices esponton self-evidencingly semiraw autografting life-invigorating yaff caoutchoucin glazy crudities cooperators semiconspicuous synarchical scrobe abraders overadvice schedulize petrologist idioreflex world-connecting semidangerousness harrowingly uncaptiously unleached ceint carbonised calculary speciate unapprenticed petted throughput Chu Scotistical extraorbital overvalues browden totipotence notochordal Sisley lippered pocketknives superexcrescently sabreur caudofemoral tanwood conflictless tropometer pretyped crystallographers prologized Ranterism tranquilest uneucharistical Willman schokker cymbaled formulaic sweathouse Jakie affords electr- unevenly nativistic micromo" (Indicator: "ntice")
"riate three-up Ciliophora antiproductive coenact benzoquinone washable mislearning Connemara entrez careme subventricous blunnen plastic VAC furomonazole Languedoc clitoritis aplasia unexpedited murrion toil patrons melodicon reintuition andropetalous metataxic wost whipping perianths whitefootism polysymmetry seugh orphanry rooftop dyspepsy distributing chebulinic indeterminism glottalized undernumen epithelioma Hanson underverse barksome halavah miners apert uncouples rousette bilbi Caquetio reclassifications Laotto mercurize Lautreamont disinterment excyst unhappinesses Thamar unadministratively ruminantly molalities snake-drawn precalculus purpureal self-shadowed animist hyl- phrenicotomy restitutional rubber-headed sea-serpent withy-bound nothingarianism oxygenant nonadverbial vizors mobbed Cambs Damian Earl logograph NDE Hinton agatine Seelyville renters inefficacity Adao edifying indigoferous duplexs gradefinder ninepenny Ulita anticensoriousness Hookera opprobriated Chartism Pielus explosibility gluta" (Indicator: "ntice")
"ory Newmarket nonteleologically epenthetic platitudinising sumptious termed Apodia musically semiprotected shootable nondeep interrhyming unrapaciously dissimulators trailings Hungarian xeruses Monodon dryer olona libidinal twice-learned valeted pre-erupt screw-piled checkrein nonhomogeneous loathsomeness Adelphian unafflicted peribronchial nullisomic Pteraspis misdealing cystectasia disestablishmentarianism consonantalize horsehairs suicides demeanor semidestructive hedgewise constructable coiffed chousingha telomic Rainah bombination stoof Andarko wide-bottomed Bibio verjuice undermaker evanescent sasine outmeasuring nonprominence ectropionize roundness latifundia photoelectrical knapscap great-grandniece tuna panuelo antihemagglutinin guestive Muscoda tyremesis Aschelminthes mitrailleuse Paur projects coachmen wealthily thermotaxic postnasal fear-palsied bebeerus jovialistic itzebu tear-marked recluse Zoanthus conticent abolitionism unproselyted Zimmerwaldist blowbys tridiurnal atropinization chapitle ting" (Indicator: "ntice")
"erophilic coexistence preconformity symbolising sievings Malinta fauns homomorphic juxtaposit subgoal baluchitheria unretinued long-billed parsimoniousness ugly heathenishly nondisciplinable proportionability woolier intransmutability stereos afflue Tropicalian quasi-historical backspread conurbations twice-tendered torturously pink-eared beplague personalities laissez nonautobiographically fastigated man-changed leptomonad intracolic devilment cervicovesical transpalatine nasalward intermeddled antitechnology duchesslike Philippist anticentralist complotting instrumentally Ardeidae Bannasch scob waremaker single-decker objectivities osteostracan aggressiveness Scutari shameproof Coryphasia eaglehawk sauceman gripped well-translated poemet hypostatical Greene horrorsome winter-starved undramatisable chlorids double-lock natiform Halosaurus cortins quasi-colloquial thick-wooded Hippocratical hawk-beaked decretive smoke-begotten atonalistic Troutdale Youskevitch expansile ozon- pamphleter hodophobia azotate sho" (Indicator: "ntice")
"tardar curlpaper coadunite reentrancy Faxen Jezreel volvox bumpee soundful inlapidatee revisit nationalization heartly curupay appentice Lecaniinae lacunaris cheapen shockers Sienkiewicz pluviometrical paint-spotted hydrozoan naturalizer Soricinae Kieler Cerianthus Balance outness nonnebulousness Myxopoda semicontinuous exiguities mezzo-soprano max. serialism imbeds ct. bisquette Jimnez Gherardo perikaryal composable Reine redischarge myrmecophilism localisms laparohysterectomy changeabout statute-barred understatement postcesarean pre-enrollment wall-inhabiting physiogony trichostasis Shallowater semirelief Jerad Calyceraceae snakily scouthers re-engrave Moluccas Gleditsia undereducated eelgrasses En-lil lectual angulately insaturable clubionid overgratified swartzite uplock micropublishing bangy gorilloid hemometer unsoaped Lynna floorboards peered Anti-arian Highview mythifying stotinka anti-trade fond-hardy Eisenhart scratch-penny Semnopithecus Fellatah presubscriber putter-forth centrolinead toitish Fran" (Indicator: "ntice")
"logic simonies apprenticeships repercutient Antin calcareosiliceous nonculmination dolichoblond quakily unproportionably wombier Diapason sinuous all-efficacious castle-guard impelling counterstyles daikered analphabete gocart rutilated Pan-celtic delicts hypnophobic unscraping untriced scleroconjunctivitis five-lobed forfeitures bipartisanship cryesthesia outshaping collophanite Olaf mingelen samsonite sensitize carnassial ragtimey ballaton main-top cosmocratic roll-collar aureity mensas Niobe public-school Uspanteca Dartmoor micropetalous nonorganization jerks barotactic carbon sunkie sightly unflexibility waddles Raphanus Echiurus alopekai tenterer plumbs anticreeper Acarapis Xuthus Rossmore recommittal Infundibulata superpiousness quasi-clerical subglabrous rooflet plumiest darkened emcees suppurated Nobie Periander distincter ultrawise fluvial schoolteaching metapolitic irrecusable rhinolithic aggravable Lecaniinae unibivalent CHARGEN Pterospora intelligencing Tiu daint geisa napalming lekha spinodal con" (Indicator: "ntice")
"coifing notehead conglutinative substandardize catadicrotic Jennilee mout penuchis conticent sulphobenzide orthomorphic sycoceric pectinacean sleeps settler biwinter seifs preconization bete timber-hitch overnimble Aselline amphirhinal rice-clipping multispiculate bouquets Anahita beseech zygomycetous bees-wax sulphurweed Un-mongolian cockers foulmouthedly markswoman borborygmatic platymyoid pronunciations Lyford cuarto Bradleyville skinflick splanchnologic badgering mimotype Bermudas moon-gray intermazing bughouses puppies wondersome Winnebago Casnovia collude accessless tambouras foxberries hydrometeor postpupillary barthite gospodar moloker recuperability outwitting ingratitude vallicular Adzharistan conjunctionally outsally tetraborate brows ataraxics choreal isotropism pericellular smutter Nastase newsagent Panipat legislate acceptant bonfire onset supramoral suffice tacheography hexanitrodiphenylamine Semiticism undisbarred covisit substantialness aureole zolotink passament barreleye three-card otosalpi" (Indicator: "ntice")
"dons Hanseatic prenticed artificialism Menasha wastepile tightfistedness world-creating windfall Nabalite loveproof huffishness buttocker unembraceable refocused pacifistically anfractuous wellies partially mediaevalism urticating hammed reabuse conglobated sledging unbusinesslike half-profane shaggier demivierge remasticate Pogonatum marriageable hoosh taxes sudoresis re-rejection fibronuclear BCL antherids misthrive Nerine brinies Jodrell Graff algae unstern unconductive endurable unblind arcualia baboonery hand-sewn balaneutics lifesome southeasts logarithmetical proteolytic Norris congrid Anti-nihilist mummeries Crowell amphidisc microhms Ilha stylises Mithratic unipotential manhole bodegones fosterland qabbala shizoku cosmognosis unconciliating Laureen spiritlessly burped abandoners superattendant presubsist preschoolers cozener co-ordinator Secreta unloosed carpals preconcurrent Alternanthera bildar retorters well-fruited screw-back mandarinize pre-experience mercurified enabler kakistocracy cataphrenia" (Indicator: "ntice")
"ousia Rockport tetched pulpitical soups pseudoleukemic unaffectedly ooscope chiliagon sunburned Sacripant diam. Caster pilgrimatical labiovelarising poundmeal grounden apprenticeships unmutualized saughen burnettizing Fayettism fungi Haberman patrioteer theatricalness overlading Sergeantsville goonies Delft coxalgic sailboard sphacelous understep treasure recruiter tipply shoelace eulogically funning multiferous husker hackneyed muskadel Coverley schizogenous ungouty recallers quasi-inclusive well-handicapped encarpuspi unfixity lobelin gruf have-not conusant infra- rillettes outfaming self-blinding nontechnologically Braniff libellate Huttonian narrational Ophiucus malaria prohibitively catechized waivod awhape self-cruel concolorous protoactinium Kahlua homaxial supraoral autonomical filagreeing sneap MacIlroy mesostyle before-going myxocyte enfrai Loredana Pyrosoma spermatogonium preinhering entoplastic prenodal Lagasse scatoma aesthetically Berkeleyite overinflative Traskwood paroophoron footprint engram" (Indicator: "ntice")
"t-spired semipyramidical effleurage ireful tinter cradletime emboweling somber mid-continent heretoforetime chiefty niris postmamillary rockoon prosocele Unalachtigo batsman soupcon earsplitting urchins vitiferous irrelevance wormed interwinded sarmentous dull-voiced reprover trawler pectorales unbaptize phylactery cumara panbabylonism ladykiller enshroud Garnette rerolls blastogenic innersoles perspectives interlocated jasies homeozoic cretification incredulously tactician indigo-white idiotropic oversliding gunwales Nun bonged tiffle versewright gamas dollied Kittredge gobble pisser Floridia roadshow outclimbed telharmony topful arsheen apprenticehood sarcocol toat runnels Kushner southwesternmost sulfapyrazine oblique-angled noncharacteristic Fairburn basurale Granada grooved thanes Olenidae prizefightings pseudotuberculosis Navajoes obligant loose-coupled sky-line self-abuser Applegate Meisterstck puffback supereligibility pompon smuttiest faiences Schizomycetes endocrinologies chromophorous EOM abort phy" (Indicator: "ntice")
"ed prestandardization venules Katsina cungevoi near-sighted spraddle-legged intercensal elytriferous purveyance Dunkirker rocheted drafts gastroptosis semivisible dastur unmimetic liefest unexemptible kith immeshed Whitelaw emotivity hypofunction malevolent unsignificancy apselaphesis hypersphere ontogenies excardination reboiled Libuse pseudoankylosis completedness osteoclastic roentgenoscopy urocanic miniatured sympathizingly unfoppish systematise unmutable monologized lance-fashion slow-footed hydrosarcocele anticentralist meiophylly unhooped profilograph disintegrable funeral slumberland preconcentrated isobaths gnomon welding sexily relegates oddish providore gaseousness addressers spiegeleisen firepink unscourging buttermaker dinotherian battarism four-deck scholarship pinnate-veined apagogic pedion unalienableness Haphtarahs Posehn federalists overartificially diabol- expendability pay-roller bottomland intra deozonize uncrib Chonju combatant itol canceration surculi reconstructed bolt-pointing arboriz" (Indicator: "ntice")
"segment cissoids pseudomodern Lynnworth reverberating gats re-edit panellation admonitrix disaggregate inconversable Nelia pin-feather munchee haughtly foes handwear wynns Kilk ophthalmologies experimentalists Hiwasse heartburns Leptocephalus monothalaman Aucuba tridymite-trachyte Dodecanesian overtill jerqued hammochrysos dortiship humorsome Egor recensionist pharmacopsychology cicatrix esoterica suberizes tub-brained stopback Granger Darin Aganice Aalesund reappoint eyelid adeem fatuism crispest Cyrenaicism ragingly thermalized llautu true-speaking tribarred McBain dirtfarmer antipolice onrushing set- games discommunity hardheaded palisander precompulsion quags Smithboro Tagabilis overdiffusingness phasia untorridity Nostradamus Stephanus Hemphill propitiatingly scarcely agrafes world-circling barefacedly nonpreventable uncoherent bulimia Orlene parsnip
end function
udt = Obg - JME
nLaB = fEjk or pBTj
'collated anticeremonious eviction white-sleeved exodos jell epoist Edwyna hemophilic unfusibly plumigero" (Indicator: "ntice")
"gulatory precools parishionate creed flabbiness outlander fubsy histrionical undelusiveness teamaking staveable abtruse monobacillary isopiestically taliation manteel showerhead frontwards prediminish macrocheilia Annenski orpiments preagriculture Eurymede eudemon goons exampleship Shemitish leisurably flapdoodle Blondy Longerich neotraditionalism dispericraniate sorghos engroove overexploiting Soviet bridgeway yardful Croesi prestidigitatorial Otaria ripidolite anticensorial ichthyopsid nondeterminist neurobiology ctenocyst Daddah Raiford presidents tabinet Lagorchestes saintlier coassistant novercal scutchers Grandgent Spearing neomycins chaumiere merchants PHA mashers criniferous ungodlike oat-shaped zobtenite deepen Reedsville chave lascarine lepidopterid supermodern Sosna restaff kymbalon neighbor siphunculate rotograph hellions HCF fraud chonk bopyridian wooziest sexy enemas specting Nihal upstates graminaceous primps yard-wand crabber sadomasochistic cloacas serumdiagnosis duffs lymphadenome lycaenid p" (Indicator: "ntice") - source
- File/Memory
- relevance
- 2/10
-
Possibly checks for known debuggers/analysis tools
-
General
-
Contains ability to find and load resources of a specific module
- details
-
LoadResource@KERNEL32.DLL from wscript.exe (PID: 3656) (Show Stream)
FindResourceExW@KERNEL32.DLL from wscript.exe (PID: 3656) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Contains ability to find and load resources of a specific module
-
Installation/Persistance
-
Executes a visual basic script
- details
- Process "wscript.exe" with commandline ""C:\JVC_30782.vbs"" (Show Process)
- source
- Monitored Target
- relevance
- 10/10
-
Executes a visual basic script
-
Network Related
-
Sends traffic on typical HTTP outbound port, but without HTTP header
- details
- TCP traffic to 185.88.178.186 on port 80 is sent without HTTP header
- source
- Network Traffic
- relevance
- 5/10
-
Sends traffic on typical HTTP outbound port, but without HTTP header
-
Informative 16
-
Anti-Reverse Engineering
-
Contains ability to register a top-level exception handler (often used as anti-debugging trick)
- details
- SetUnhandledExceptionFilter@KERNEL32.DLL from wscript.exe (PID: 3656) (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Contains ability to register a top-level exception handler (often used as anti-debugging trick)
-
Environment Awareness
-
Contains ability to query machine time
- details
- GetSystemTimeAsFileTime@KERNEL32.DLL from wscript.exe (PID: 3656) (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 1/10
- ATT&CK ID
- T1124 (Show technique in the MITRE ATT&CK™ matrix)
-
Contains ability to query the machine version
- details
-
GetVersionExA@KERNEL32.DLL from wscript.exe (PID: 3656) (Show Stream)
GetVersionExA@KERNEL32.DLL from wscript.exe (PID: 3656) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Contains ability to query the system locale
- details
-
GetUserDefaultLCID@KERNEL32.DLL from wscript.exe (PID: 3656) (Show Stream)
GetUserDefaultLCID@KERNEL32.DLL from wscript.exe (PID: 3656) (Show Stream)
GetUserDefaultUILanguage@KERNEL32.DLL from wscript.exe (PID: 3656) (Show Stream)
GetUserDefaultLCID@KERNEL32.DLL from wscript.exe (PID: 3656) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Possibly tries to detect the presence of a debugger
- details
-
GetProcessHeap@KERNEL32.DLL from wscript.exe (PID: 3656) (Show Stream)
GetProcessHeap@KERNEL32.DLL from wscript.exe (PID: 3656) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Contains ability to query machine time
-
General
-
Contacts domains
- details
- "pingup.ir"
- source
- Network Traffic
- relevance
- 1/10
-
Contacts server
- details
- "185.88.178.186:80"
- source
- Network Traffic
- relevance
- 1/10
-
Contains PDB pathways
- details
- "wscript.pdb"
- source
- File/Memory
- relevance
- 1/10
-
Creates mutants
- details
-
"\Sessions\1\BaseNamedObjects\Local\InternetShortcutMutex"
"Local\InternetShortcutMutex" - source
- Created Mutant
- relevance
- 3/10
-
Logged script engine calls
- details
-
"wscript.exe" called "WScript.Shell.1.CreateObject" ...
"wscript.exe" called "Msxml2.ServerXMLHTTP.6.0.CreateObject" ...
"wscript.exe" called "ADODB.Stream.6.0.CreateObject" ... - source
- API Call
- relevance
- 10/10
-
Contacts domains
-
Installation/Persistance
-
Contains ability to lookup the windows account name
- details
- GetUserNameW@ADVAPI32.DLL from wscript.exe (PID: 3656) (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 5/10
-
Opens the MountPointManager (often used to detect additional infection locations)
- details
- "wscript.exe" opened "\Device\MountPointManager"
- source
- API Call
- relevance
- 5/10
-
Touches files in the Windows directory
- details
-
"wscript.exe" touched file "%WINDIR%\System32\wscript.exe"
"wscript.exe" touched file "%WINDIR%\Globalization\Sorting\SortDefault.nls"
"wscript.exe" touched file "%WINDIR%\System32\en-US\wscript.exe.mui"
"wscript.exe" touched file "%WINDIR%\System32\rsaenh.dll"
"wscript.exe" touched file "%WINDIR%\System32\scrrun.dll"
"wscript.exe" touched file "%WINDIR%\System32\wshom.ocx"
"wscript.exe" touched file "%WINDIR%\System32\en-US\KernelBase.dll.mui"
"wscript.exe" touched file "%WINDIR%\System32\msxml6r.dll" - source
- API Call
- relevance
- 7/10
-
Contains ability to lookup the windows account name
-
Network Related
-
Found potential URL in binary/memory
- details
-
Heuristic match: "pingup.ir"
Heuristic match: "GET /wp-content/uploads/2019/11/home/aaaa.png HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Language: en-us
User-Agent: Windows
Host: pingup.ir" - source
- File/Memory
- relevance
- 10/10
-
Found potential URL in binary/memory
-
Spyware/Information Retrieval
-
Found a reference to a known community page
- details
-
"gulating clavichordists puncher haemosporidian thatchy ASS extrusile resecate Biota LMMS Francophile ungnarled Arago emanators coronation reprehend spek-boom hemangiomatosis dimercaprol femurs nonexperimental hard-hearted Pseudo-german hydrocotarnine trichloromethanes moneywort Monias snake-set metallographically pyramidic tariffication unrapturously tenour expect jiujutsus Jephte globelike daggers spic earphone melanomata featherstitching passionateness Larinae absent-minded Neperian unsounder sarcastically manoeuvrer frangulic schistorrhachis twittery superscribe dynastidan hypercyanotic Duffy gammerel unequilateral moorstone blue-molded cowsucker hypopotassemic perforated counterploy tolite bichromic Ascidioida photomicrographs fighteress amani wriggly Haloa musaceous aerophagia postclavicle anepithymia vipresident Shaylah lappets mimester bandolero argumentative Drida Fairborn BE effiguration woe-struck rash-embraced laulau wheedles Marcie stereobatic remittor new-array gelseminic khazens idle-looking emb" (Indicator: "twitter")
"ies Treadwell Limidae Prendergast twice-mourned teichopsia IIL hookshop motivated windstorms nonscaling eastlin healsomeness fanciful enrolment picometer prefered rounceval jouk cervicorn mnemonized atwitter hokums deionizing octuples farci inorthography ugly-visaged Martz gelatinizer postmillennialism antioxygenic trochite subconference calmiest desiccating turgescency cutlet nonconcentrativeness Freycinetia gear-operated full-crew unswayed plasticly DGA explainers antiperistalsis inequation somberness recomparing reversedly ingrownness Gothicness Christel rheumatology councilor unsimulated unquod aeronautic Cartagena recolonised Neoclassicism screamingly intermetacarpal nosepiece microperthitic misapplies electromechanically dispassionately sapiao ethenyl pyrogen periosteomyelitis GDB cuckoo-babies botcherly macrolepidoptera abepithymia pipped ardu transvenom pedatinerved well-toasted lummoxes Piaropus Alamota kappas thread-measuring prolectite run-of-the-mill unsnouted polyad anoncillo philosophizers Branc" (Indicator: "twitter")
"camelopards Ashkenazic pogge Negrophilism unabashedly metall swan-eating wrap-rascal thespians suberinization disbudder shakebly Okeghem penanced ovicystic AngloCatholicism Meridion haute-piece arsnicker streaking Denby anaerobiotically crateral misdoer arenulous absurdum Beatrisa pictorialize VMC battle disfavorer Gtingen stories Ruritania Sassella puggy arrowheads immediate dulosis well-primed ricinolic Joceline sumptuous renunciate Froid beaus foreign-made stepbrothers garde-feu gonoph degradative hexastichic wall-fed forthtell amain twice-menaced trabu LCL Coniacian indictments guaiaconic nonpersecuting gizzard sickees unversed phratria enacting substantiative labdanum encumbers soddens God-forgotten recrucify monose proreality Fieldton abused substrstrata rachets anesthetizes vagarish tickings Simiinae twitteringly besnare cytol Orrville Cosyra scrolled bigeminated hyoideal outthought irrelapsable refutably mis-style unmade hafting cookies undifferentiating companionized clausum dimorphic heterosyllabic" (Indicator: "twitter")
"oking Cytisus dolci depaysee craquelures mutistic lipothymy red-painted deflowers fancy-shaped tankah arilli wetsuit tch target-tower lofty-notioned isocitric primrose-scented Runa-simi bloodstains nonaudible atwitter all-round uphelm bellwort supersafety Un-voltairian Tournefortian Parietales canzones Gareth Hippolyta auto-inoculability vitro Imerina Pawhuska kor triakid bowstrings hemoglobinic millimeters packed prerespiration Ierne nonratification hoofed BAppArts entincture Skiba diplomatical charcoaly dangerful Dionysos cloghaun immaterialist pratiques phyllosiphonic porkpen cochurchwarden senilities refight nonconscriptable nonamenableness humbugged eclated sannups snow-topped nonepicurean impuberty tomboyful intangibleness teratoma rectified keen-scented fletching ripcords dirges toothplate abacuses greenwithe globalize indew meditated nonconjugally pistils abjudicate semidependently Apollonian semi-immersed rabbitlike whats-its-name wanderoo novus byrewards pinfire lainer brucine Persea lodgeful respec" (Indicator: "twitter")
"ven-figure insurmountably Truda algebraization sweatweed undecadent communisation outwitter repertories botcherly simple Cidaridae DAD anientise cancerophobia exterritorialize palladammin hydrosomatous tyrannine bruskest novelless microcosmos creditrix chickenpox lophophorine Mallorca noncomic SLADE outwell merogenetic Greco- lobelines exploration foe-reaped mancala tangleberry castors nosotaxy nonrescissory Dibb thought-hounded actualization catholicness Heuser centrists paucipinnate clanswomen resolvability palatize subabsoluteness penthiophene endosporous smalmed swanwort Knott alcaides iconic wanted squireen xiphoids Lajas reliefer Spillville ridgeband boxing-day mafiosi confrontational Haysville kinetomeric square-barred dimwit Lernaeacea pyrectic septariate subclei Protochordata mikvahs superload olfactometry acieration limbic halichondrine thrippence biostatistics mazily dippy distinctionless maximite MMX ileon dimerism unsold arthrodial hydrarthrus disworth Anselm conceptualized reclamations bractless" (Indicator: "twitter")
"actitiously horsiest a-twitter radiciferous driveable Schlessinger Harpalinae Evanthe mamo coigned paludial self-glorification handmaid cornetfishes astrospectral fermerer urethan on-line gamier listenings violet-stoled nuns rodlike bottle-head precentrum catoptromantic Hamil tuyers regenerant duelist desmon batonistic neurotrophy Fellata predisruption salivated ovarian Tickfaw Mousoni Mongolo-turkic incinerated acrospore manswear unframed Tager isographs odontodynia overhanding hooknose Bougainvilliidae gracefulness pyridinize befoulier corsages pocketknives dreading hypogenesis preinclined stalls undisowned benempted acclimatising simulcast shovelling unwallet banyans rogative coracoclavicular useful sowbellies typeface genome doles ectogeneous conicein tricenary attempt daylight medallically warhorses misbetide schlemihl yams rock-bound crumming osmosis vansire macrocephalus overprase phrensying half-forward lame-footed censorate Lechner tictactoe idolatrize drumbles Eucosia numskullism absonous prespontan" (Indicator: "twitter")
"ators south-southwestward crosshatched Erdrich ornithol. Charles Salol transsegmentally supracondylar Yalta Christianiser artificious honourably glareless multifactorial Salena likings Alexandro Archaic unpantheistic nonterminability isochimes ethnolinguist subcentral Bucerotinae B.Arch. disesteemer fortread overpowerfully unrhetoricalness wheel-made swinehull Andonis legitimizing intoxicant self-cure amerced unusuality burros besmears nurserymen frig gurgulation Hypotrichida Tartarized Forney preppily disgruntlement acanthocephalous nonjuress atwitter Jonathon Delorean basiphobia perjurers guild-hall griding Portugal she-kind untowardness endorse comfits slathered unbane retricked white-linen uncommemorated prepossessingly Hyperoartia grumpiness Nicotiana massiest chinse squamipennate gown complex Platyctenea wadsetting refrigeration homologically upstared turf-grown nightime oligospermous young-womanlike protonephros lunchtime Peer nonprovident manufacture eugeosyncline lamellation heartwood scarce-covered" (Indicator: "twitter")
"rated heart-felt Spirochaetales solenogaster bassetting Hubing thymolsulphonephthalein gastropathy deadheaded zincate alterni- maleness unmercifully odontotomy reckoners sparkling Charruas deprivative pulchrify illogical unself-centered flotage re-presentation Penza scrivaille cachucha self-rake red-hardness unconcatenating strobilate Salomon washableness unruffledness Coroado appetitive shipyard haywire polymerizes Kenay augmentatively imaginative indefinability susurrate inlandish coelho undivisible influxionism studs appellative albinic disburdenment baked-apple bookways steersman wildsome remicle bardie AKC Ickes cliffs rosy-faced Ouachita well-assured talks monoplace kabassou enjoyably typp pennill murderous confusedly siserara shipowner zinger cosmism zollpfund rouble astasia irides Nyquist bacillian cropper fados straight-hemmed straticulation hyacine Elkesaite syndesmectopia macadamization overacts Japonic alg- Gasperoni rerental twitteringly citizenize word-blind Coppinger glossoplegia unglowering fl" (Indicator: "twitter")
"zoylglycine Vasti Meles fogbows subsumed cervoid Heliconiinae Bellerose outbribing gonadectomies adaptitude chamaephyte discriminator bathmotropism tutoyers disordain well-known Remarque pertain Synura foreshot Econometrica aspiratory pannam Flem. sheitans uncommenting Cotonou unerrable notecase amperemeter unobverted recollectiveness convoking pomposities pneumatogenic Hymenophyllum Julian soccer volumenometry Camaldolesian unrubrical chuffily Saucy quasi-miserably iodochromate dominions shelflike splanchnoblast Augie guaranteer modify oakweb gaiterless mollymawk swivetty articulatory nontransientness territs arabinose unmitering martials prefecundatory cakra vibrant calybite pacesetting hybridized frivoller overbulky Quadrumana Eielson Teage abastral missorts kenspeckle Bessarabian inframammary perivaginal mecopteron sanctionless a-twitter Myxopoda chocolaty unrelatable risorse botulisms electrologists Lucey midriff sewings infiltrating many-bleating blunt-angled Childermas overthwartarchaic propagation sup" (Indicator: "twitter")
"glucate septs unstealthiness edulcorating quasi-advantageous mesem trueing platys pourpoint Lithopolis galliwasp Simpsonville cerebrospinal Monodon Libbna rag-beating fabricate Mamertino small-caliber underbridging Pacinian interclusion spot-winged Jagannath supersubtle turriferous scapholunar thorny-edged nucleoalbuminuria hackwork preadmission pigged cururo albinuria point-on territ shairn signorini unlucent kayos homework Sardanapallos quakers premillennialist praelector dust-colored prink cordobas desicate untransfixed haberdashery Marleigh Chaetitidae panders Chyou kinetogenetically undocks Haematoxylon buzzards chalicotherioid Marivaux yardsman heckler physiotype burghers Umayyad make-mirth gimmicks snuffing Aglyphodonta pulk compensatingly headlongly unmistrustful miticides gesundheit expromissor like octobrachiate thrill-exciting unpuddled twittering Sunnism eremochaetous anti-France epidermatoid stipendiate overconcentrate squandering fastigium federacies brutalitarianism hemosiderosis rude-featured" (Indicator: "twitter")
"ureenful chondrigen replial functions sheeniest iodation polyplacophorous placoid megalopolitan provostry plink swooshes glossinesses Kamenic recoal hanger-back amphicoelous cotland intermountain gaberlunzie acanthophorous strobes overqualification Sokotri remigation mem-sahib showiness tunability astrocyte wry-legged succourless Donough Liss Chauceriana philosophic binormal Oldenburg sexdigitate graphiological wellseen Tallula FDDI nondisbursable heart-piercing Grimm upbreed skidproof unadventurously heliolater Triplett apocalypst woodchopper coscinomancy promulgates nonmeat motiles larders neurasthenia crewing unless nicher parlously homocentrical bumped jointure whitewing tenchweed pentode prelimitating tunes bricklaying unsquire sorose pianoforte journalists beachheads isoxanthine twitter-twatter polysaccharide unenquired Taganrog disparaging subsidizer timecards telencephalic conglobation promulge Russomania designlessly slow-breathed lathings waggonry Crassus butterbump retral nonmonarchally euphonia dr" (Indicator: "twitter") - source
- File/Memory
- relevance
- 7/10
-
Found a reference to a known community page
-
Unusual Characteristics
-
Installs hooks/patches the running process
- details
- "wscript.exe" wrote bytes "c04eb4772054b577e065b577b538b6770000000000d0b07600000000c5eab0760000000088eab07600000000e968b7758228b677ee29b67700000000d269b775000000007dbbb0760000000009beb77500000000ba18b07600000000" to virtual address "0x77C71000" (part of module "NSI.DLL")
- source
- Hook Detection
- relevance
- 10/10
- ATT&CK ID
- T1179 (Show technique in the MITRE ATT&CK™ matrix)
-
Installs hooks/patches the running process
File Details
JVC_30782.vbs
- Filename
- JVC_30782.vbs
- Size
- 3.7MiB (3852473 bytes)
- Type
- script vbs
- Description
- ASCII text, with very long lines
- Architecture
- WINDOWS
- SHA256
- 24c736afea9338892097d5aa768b688ad60b7de910e3a6db798e45fa72cec1ca
- MD5
- 8aa8dc7dce71be9f99bfea3e7d0c3401
- SHA1
- b408ee6ec5749a27ed769c735a78a0ace18ecedc
- ssdeep
- 49152:MgjqMWKnbiWL3U9nss/nGI72wdzqnlzxVvJSIN23NwJvFVd6BvDx1+aErFZCqeEf:T
Screenshots
Loading content, please wait...
Hybrid Analysis
Tip: Click an analysed process below to view more details.
Analysed 1 process in total (System Resource Monitor).
- wscript.exe "C:\JVC_30782.vbs" (PID: 3656)
Network Analysis
DNS Requests
Domain | Address | Registrar | Country |
---|---|---|---|
pingup.ir
OSINT |
185.88.178.186
TTL: 20796 |
- | Iran (ISLAMIC Republic Of) |
Contacted Hosts
IP Address | Port/Protocol | Associated Process | Details |
---|---|---|---|
185.88.178.186 |
80
TCP |
wscript.exe PID: 3656 |
Iran (ISLAMIC Republic Of) |
Contacted Countries
HTTP Traffic
Endpoint | Request | URL | |
---|---|---|---|
185.88.178.186:80 (pingup.ir) | GET | pingup.ir/wp-content/uploads/2019/11/home/aaaa.png | GET /wp-content/uploads/2019/11/home/aaaa.png HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Language: en-us
User-Agent: Windows
Host: pingup.ir More Details |
Extracted Strings
Extracted Files
No significant files were extracted.
Notifications
-
Runtime
- Network whitenoise filtering (Process) was applied
- Not all sources for indicator ID "string-5" are available in the report