JVC_4354.vbs
This report is generated from a file or URL submitted to this webservice on January 27th 2020 16:01:50 (UTC)
Guest System: Windows 7 32 bit, Professional, 6.1 (build 7601), Service Pack 1
Report generated by
Falcon Sandbox v8.30 © Hybrid Analysis
Incident Response
Risk Assessment
- Network Behavior
- Contacts 1 domain and 1 host. View all details
MITRE ATT&CK™ Techniques Detection
Additional Context
Related Sandbox Artifacts
- Associated SHA256s
- 97017569e2f5ab2df1efbc91e16d95805cc72fa532d57efbfd874657d957086c
Indicators
Not all malicious and suspicious indicators are displayed. Get your own cloud service or the full version to view all details.
-
Malicious Indicators 2
-
Network Related
-
Malicious artifacts seen in the context of a contacted host
- details
-
Found malicious artifacts related to "136.243.37.89": ...
URL: https://taybabuilders.com/wp-includes/Overview/8fvw6ftjnjcd (AV positives: 3/72 scanned on 01/27/2020 15:45:05)
URL: http://imperialtechschool.com/seo (AV positives: 3/71 scanned on 01/27/2020 15:48:45)
URL: http://buy4you.pk/wp-includes/widgets/www/www/secure.bankofamerica.com/login/sign-in/signonv2screen.go/login (AV positives: 11/72 scanned on 01/27/2020 15:47:40)
URL: http://dospk.com/sites/TpsMVEnGJN (AV positives: 8/72 scanned on 01/27/2020 15:32:51)
URL: https://taybabuilders.com/wp-includes/Overview/8fvw6ftjnjcd/ (AV positives: 1/71 scanned on 01/27/2020 15:29:27)
File SHA256: d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3 (AV positives: 1/69 scanned on 01/27/2020 15:04:59)
File SHA256: 34aa6087e68b3ce662e6557691a32813facf9d5a8b055940a76193565f6473d4 (AV positives: 37/72 scanned on 01/25/2020 19:56:21)
File SHA256: 7a257b44a9fb62afa665bf698344474aa5ad6ab256a2ba1692223bb491dd938e (AV positives: 38/71 scanned on 01/25/2020 18:19:22)
File SHA256: d2bbac45eb9b14dff6deb493aaed9dea8451cb9fc662ccf79bab08ec01858793 (AV positives: 46/73 scanned on 01/25/2020 05:01:00)
File SHA256: 983ddd1518361a6f16f1b4f4980f9f8e195ab46794ddb14935f83c5a93781f17 (AV positives: 37/75 scanned on 01/25/2020 10:05:40)
File SHA256: 880981cc97e7ea0591fd6f2560d0920a7c93fd35039413f258b7c86c5b2a9051 (Date: 11/02/2019 02:01:58)
File SHA256: b772393897937d868510168cb14ffb461923f3950e9ad7aa5ee8e9009dfd3693 (Date: 11/02/2019 02:00:39)
File SHA256: e886d007eae4030cfd8e15b3f0367cba0338505947162fb13d2cd7bf248304e0 (Date: 11/02/2019 01:59:01)
File SHA256: a67be9682f4956412aedda46e0dcadd6bc668c23627cfcf13025b16b4db05bd1 (Date: 10/31/2019 02:05:57)
File SHA256: e6235ee7bf9e9cd6ef46824b5ca8b19e9a7d84a285b2f91806da0c8c7125f986 (Date: 10/31/2019 02:03:59) - source
- Network Traffic
- relevance
- 10/10
-
Malicious artifacts seen in the context of a contacted host
-
Unusual Characteristics
-
References suspicious system modules
- details
- "ological eye-offending basilicon surmountable morrhuine sheitans Bushweller duskly unai heptagynia alcoholization Thales allotypic Rees Pune fosterable shorls underproducer manicure alroot druggiest well-arbitrated scanners misdesert unabjectness Teeter septimetritis candle-tapering Quakeric phacochere Sagai Crayne sawarra tilemaker subdistinctions ulvaceous Elsass-Lothringen open-headed hubbaboo postcalcarine anisole XP Quinwood interimperial Awadhi unsyllogistically emergers acrorhagus forensic Maidstone consonance Bergholz exobiological roborate graphanalysis piazadora indeterminable unautumnal Humptulips viewier supergratified argonon dicolon make-faith Fostoria goatsfoot thermobarometer glossopetra halaka defogging rallies square-tipped milchig lanthana Martian ghiblis crustaceans brachystochrone preharmony immusically AHQ bribe-devouring cuca eastlings cystitome unapparently gladiatorial preexpound pseudaconin unusually certiorate mesode shakeout incra mentorism mediatized eyesights eurocentric onkiloni"
- source
- File/Memory
- relevance
- 5/10
- ATT&CK ID
- T1215 (Show technique in the MITRE ATT&CK™ matrix)
-
References suspicious system modules
-
Suspicious Indicators 6
-
Anti-Detection/Stealthyness
-
Possibly tries to hide a process launching it with different user credentials
- details
- ImpersonateLoggedOnUser@ADVAPI32.DLL from wscript.exe (PID: 1484) (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 3/10
-
Possibly tries to hide a process launching it with different user credentials
-
Anti-Reverse Engineering
-
Possibly checks for known debuggers/analysis tools
- details
-
"ablet undersheriffship Troilus reachieves Chalcididae baluchithere defaulted architraval popjoy warm-working shampooing intercurl parakinesis micromeral unrulily chlorohydrocarbon self-endearing oxygenant electroori phlebalgia arenites defenestrated bracket sluttery sour-tempered sea-girt Mourant nebulously collude anticentralist brisque Archaeoceti vallis Vardon pipless Jacobinised silvics hant excitably orthodiagraphy reinstil grandity magpie glott- atmidalbumin Non-lutheran begorra niello reconfirming
'tracheid taluka winoes incontaminateness rosehiller scags Geneve monklike subscripts rubaces gagmen university-sponsored Eranthemum triacontane waitewoman Miko Kathlene self-expansion stringent old-established silvanry accretal free-swimming ellops Winshell allonymous brainwash Placerville chondriosome ankylose onychonosus beshawled TMDF Eckardt NSRB czarowitz foreplays twistingly worm-gnawed prevernal calderium nimble-footed machine-cut bantered nondiastasic droopingness prohibitor theanthropist unveiledly" (Indicator: "ntice")
"untman improgressively exesion decalog astomia Litchfield overfamiliarly old-growing Erwinville Banna preadvising PROPAL ewerer overluxuriousness morigerate overanimated vermeil-tinted dew-sprinkled dissolving unmutteringly Liane morphotic decidual duskiest anticensorship bandmaster Capt. frostings wrath-wreaking dolabrate teno- preguilty thought-concealing goldney scoloc nonvigilant nonteaching San ergogram armor Sarasvati communing araru filtrates hough-sinew Priebe wood-hewing Macur yearday pansinusitis esophagomycosis goon long-descending amaxomania uncoquettishly subwarden Malchy entomological stereometrically inartistic bloodsheds nonlugubriousness tautonym setline algidness lit. hijinks unscornfulness beachy arendator yous Uitlander phrenologic guttiness scything men-of-the-earth chorioma prosstoa unscreen Ligonier Lil peltated unrealised Cofield reflowering swell-mobsman pantheonize self-powered thews Lindale versual bemouth mediative nostrummongery emesis tapework chicken-breastedness jet-set admixtu" (Indicator: "ntice")
"coneighboring limner cannisters cataplasia cuneated treasuryship dewlaps stratoplane corruptibleness oppidans harvestfishes custom-made stereoelectric outthanks stag-hafted xeroseres lomatinous hyetological yupons pedestrianised gammacism disability judiciousness chloromethane microbacteria stovepipe diabetes repredict crumples mellita Covenant inscrutably exploitee Bellow scuzzier lysate fourling wheaf-head muskinesses periauricular aperient democratizer de-exciting pastoralisation cobaea Shammar missung Ronna uniparous chevrette bugbearish mooner manualist crucially Epigoni octaval anticephalalgic orange-headed neo-Sanskrit cult embryo Brookville arsenotungstates superpure raiser prosemination Vaientina Indochinese rhodizonic axolotls roborean bulkiness crackup douching unpausing uniformise crescentwise phylloid nitros- halloo reist yellow-jerkined misclaims bereaver Chalciope afront werewolfism characid summarizable turus envelopment meward groundplot talkfest drysalter IADB clarioned radiationless stirle" (Indicator: "ntice")
"thrum-eyed oversadness philological Mecca humidistat Azalia Wesson reimprisoning unthundering terass ingrafter intensiveness nonacquiescing nerve-tingling Solothurn grasni coformulator Neptunian counterapproach Watrous aceae diasyrm spoolful close-standing snatching recantation profound isophane thyroiodin prenticed Hoosierdom cytolist Hopkinsian paleostyly fifty-sixth Heliopolis SMR fylfot gallah anourous Stymphalid endoplastular underchin malvasian poachers Wallonian folksey Adila gunk reboiler biotas tetterish paracusic olive-greenish sulphophosphoric camlet monogynist Wurmian infraventral expectorative azido unfielded rostrums gyrectomy hypotactic wildishness sunshades roughsetter vapidity solventless mesally loveproof sulpharsenite unpliant cromlechs rankle Farlie semihysterically flap-dragon Statenville Arlon proverbize lattermath Priscillianism liviers psychomachy irenical cachexic yarrow interdictions potlatches calfs predinner southwestern toast crowing psychiatrize monaster godmaking drecks nonmili" (Indicator: "ntice")
"ng undestructible prepoison Marnie Shorterville physiopathologic surroundedly reinvade Sidewinder camarada precoded ketapang Dani all-satisfying underzeal pleasurably bushi reinspect devils-bones paraenetical jettatore Jesuitocracy run-of-the-mill prefulfill baroques west-faced harrowers half-divine edified umbrine bandore Perisphinctidae tessellating signatured self-wine chartology atriums Zenaga diphenylaminechlorarsine Apps mis-suit asthenies raunchiness trinitroaniline rehandled down-draught hagada raisers yellowish-pink gonof tariffism leadhillite love-begotten tornadoes sporocarpium dromaeognathous interlope Mazatlan faunlike holoku twice-wounded apprenticeships anticoagulan Lindside deputator embroiled interesterification recomposition mononym IJsselmeer six-wheeler eviscerates wrung Idelia coarsest nonpenetrating open-eyedly mormaorship unprintably resecuring tylotoxea north-following cataloguers resaddling wards Ossining Parkman loggat Madonnalike Cymbalaria Saberhagen mandritta urates beeftongue bre" (Indicator: "ntice")
"Swedenborg Barnardo arborvitaes tripinnatisect breath-giving ungashed parallelling unreviling untortuousness eventlessness Courteney confiscatable Varuni phallis inoma Keota wallopers phalangidean alternator hydraulis rejoneo judgingly lubricous air-breather four-spined epimerum Tartar holographies Avivah rough-coat reseparating cephalocaudal supervastly jugglings conjectures antipyresis palaeoecological half-thought transfigures Hecklau decantist anticensorship preplotting clatty fissuriform mtg. duikers aprendiz obsequium henbit unproverbial pryingly tongue-valiant beento searchlight wore matriarchist agast cocuisa deorsumversion plastogamy stuboy ascendant puppyish superdubiously Hautes-Alpes amphicytula perpendicle self-opinion slenderly post-Chaucerian pockily abastard TSO Tucanae backworm displumed surprizing Lucania bejeling prepracticing Blamey browst monoplast genre archegonia pentosan gawkihood affidavits calligraphy hoisters transcolor parah backstage quasi-respectfully boozers rootedly Chinchasuy" (Indicator: "ntice")
"onments twin-gun pothering irrenderable betulaceous unstatistically bimahs genuinenesses psend jadishly daftness supercerebellar nudge grasslands malcontently disease-resisting kites Numididae laconicness afterheat overcolour unbefool react Jivaran releather conservationist continuua showboater trailed hippophagi snudge photoactivate materia enticeable Tilletiaceae chordaceous nonvacuously pseudoarchaic Dmitrevsk redivides partie nincompoophood outcorner exsurgent weepful sunder miry senarii seaworthy epris Autosauri Fenris-wolf fieldy harefooted Glomma dyvours inopinable fashioner onless coalshed disfurnished hypostasize Jolson scoutdom nonabstemious irascibilities colpeo ootype revolubly mellow-tempered entablements massula sloughiness Tormoria neology Bellevernon rough-backed tigerly initiatory craniometer expurgating stentorine aplobasalt bloodroot spheres Farmers protocolar stepdames curite unethnological erugo professorlike genethliacally unvigorously stymying Whiggarchy hyphemia prefixion plenilunary t" (Indicator: "ntice")
"atinist trichocyst macroconidial Devereux defoamer decasualizing great-grandfather Comforter Tandjungpriok copywriters unsalvably bronzers victoriatus speak outflanks ropp infranchise dilemmas denominators appendice retranslates Warrenne lades dukes ferrotyping surrogateship orphrey ferrums argumentatious flicking punching unfallibly overanxiousness soul-fostered Higden marshland checksums editors Manukau UB popping-crease chuckrum crookbilled brimstony staphyloplastic solutions subface bakerdom still-pining hyperemotive nose-up shrinkerg well-counterfeited illus monatomic nonnattily autopolyploidy bysen overtalkatively emportment manufactor plovers infractions bittocks noncorrection Conlen targes ruby-set resurrects memorise agricultures cumbrousness tabbing Mediterranean unfraudulently unanticipation unsmilingly Denticeti unexponible practicality dominant shadowless thunderstricken Kilby Wasoga vicarates Poona sagless vanjarrah Clavicornia divine-human oologize mountains cowson panelings unscissored baggers" (Indicator: "ntice")
"it brazilite rounds reddish-green tigerish hee-haw Emory foisonless dinothere apprenticehood unendangered Doralice litholyte Acalephae Nimocks precentral abjection Kurusu puntsman Boelter bemoaner anconas kilderkin bambochade Hamm skin-plastering upeat postscorbutic sulphonmethane Amynodon ankle-jacked analyzers pyrocatechinol Tekamah Mosier skitty triliterally windz chauffeurs Asellus hypodiploidy outsparspied blurbed phagocytic Typhlopidae spondylarthritis laparosplenectomy face-harden unregularised Maria turtled planing rensselaerite fastidiosity actinulae Yankeeize nunc unkindhearted Methodist wersh Druid uakari skimper-scamper percontatorial unaltruistic self-entity chamberlains self-opiniativeness Uniate reshaped spreading chaology wormil antiphilosophies sophisticism catacylsmic manipulators glassy-eyed karri uninspected adders-grass Vespertilionidae triental Acre turnups wireworking cuspule oreiller DeMartini rehedge nonreprehensibleness Coruminacan wind-swung monacid rusticating uncambered outbranch" (Indicator: "ntice")
"straining cufflinks interstapedial trainable foot-tiring silverling cornaceous adolescing chloroethylene persuasive doodlers ingustable rototills anopsia downside kurtas munsif shilly-shallying colorization scarifying PTP Evinston carcinological overbarrenness Ubermensch below pseudoclerical fetialis white-heart turbine-driven unflown smoothening expolish quarreler Sheyenne sinhs anlace multilaterality blanketless ultramicrometer logotypy gombroons mothery paranepionic psomophagic
'unenviability prepositionally Basellaceae ostracine mooters hummus crosshatch abidden cephalorhachidian Zarathustric tarso-metatarsal Fauch phenotypically photologic toman Gilberto peacemongering proctoptoma cinenegative Louhi unrepetitiously Delphi muskellunge preambulation tiger combattants impersonations phacochoerid overnegligent antrocele Hum makuta ballottable glumness Queens-flower unlaboring chyluria prenticeship fiaunt educatory Danubian owrecome paunch heartwort ferash Humperdinck Bushton Tuckerman hurtless flocculating" (Indicator: "ntice")
"sed scam civilizer lampworking dressiness quinaldine haggy physiolater saggon huffle fario milords ASP myrtlelike estragons rupee Mid-victorian personas auxamylase Vivle raticide heftiness peacetimes rememberable eupneic fibulare thionine leathercoat Spey gynomonoeciously slaughteryard doth brotherlinesses picein auroras whereer dystaxia semiadhesively ague-faced ureterotomy Ritschlianism Melisse gramineal hydrazoate Kirschner retrofracted misconsecrated phenocain unrealised goglets Markos Ophelia piarhaemic mundatory Esox offenselessly hurlers red-humped confocal fleecy-winged setters verdet palaeoentomologic thionium enticer lobation Orlanais photodissociate Gouda quicksilvering papery unreclining takedowns deduce lacis predecessor walk-in ginks caterpillars confarreation abstainers surangular nonnecessitousness encollar nervish mascagnite angust Bundesrat digitipinnate temperer inquilinism sauropsidan jumpier shadufs sawsetter milksoppish Silvestro tapwort Aspidistra Hippocrenian adiaphoral overfishes bell" (Indicator: "ntice")
"ess Fylde yauld coryl papize domanial spitbox fat-hen darkled re-embroil uncinariasis drawlatch drawer-down Barre extra-long biennale collectivizes board-wages well-concluded paraengineer unscrewing rush-woven auctioneers Non-egyptologist enticer endosporic Earleton unrescued incline Veal centupling Queens whiteweed drecks allachesthesia false-derived embarque drabbing charmedly Anti-birmingham teletypewriter squidge fizzed rostrular disbudded metoestrum palamedean Perrinton cohere midchannel reckla Horan reomission artefac quasi-deafening paxillary outstays wealthfully sickee purrone Confiteor atonalistic cushion-shaped avelonge archangelic antrectomy magicians Anglo-swedish reprobationer urachovesical snoutfair cochlospermaceous optimistical Niue Pantheian nielled lithochromatography Aleppine nonephemerally trencherside deaconess translocate trewel schoolrooms logium overcharity cytotaxonomy supercatastrophe tachypnoeic nonscandalous MacSwan sanatoriria heres contenu mastery dorsi-ventral WWOPS garbel Troez" (Indicator: "ntice")
"arritz coil intice effortful Tubulariidae dislocates resented quasi-accepted comephorous OSS tonsbergite nonaccession politicness supercity sand-floated celto- postventral tongueless Whittington Pheny citrocola chaluka trolleite podsolic overexuberant noninfluence suingly divulgence desensitizers subcorneous kantele paperasserie double-loaded Yankee-doodle Juvara catechistically airlessly overproviding minifies excursus trailmaking counteraction Sibiric martyrs merry-eyed heterotelism superrealist tuum Shackleton atomies superconductor nonequivalence hexamitiasis MHS placeful foresail voyeurs spattle undeported pandemian Rempe sea-tost copious Spanishburg Euomphalus Sophocles rivalism enchantingness geerah Narcho isethionic boxthorns copperization teasably metroptosis quass resolutioner Elonore SCB Hanston Doukhobors ravenry arteriotomies short-cycle hydroski wangtooth sick-brained Yesilk archvisitor electrophotography afire Lasal methotrexate forcat omnibus-riding flake ceroplastic Silvester safenesses Ortho" (Indicator: "ntice")
"ridales footgears urediniospore orthopedic Piet noncotyledonary only nephropore self-authorized enticers fascioliasis pre-essay overraness conterminousness bargander Adinida man-at-arms bookmarks ragazze placitum godroon cadus unknits Helyn singsong mixups rennet seagulls pino Rotow Giovanni fathearted Hoogh cnemidium groomers Benilda vocals aerobiologist poromeric stampmen Cygninae pictorialness charbon Vescuso antehypophysis Nycteridae quasi-pious chalcogen unacquirable censureship Iolenta overjoyously chassed gastrophrenic ukuleles apertly Linea unstarred premusical Galesville cuprotungstite lovership CAA BOM electrophysiology Quimbaya Viviane bacteriorhodopsin electrojet ruffler programed thermoperiodic telepheme suslik psywar constructs granulators utensils unpasteurised resistability galvanizers peggymast feterita unhand governail cuboid xint Scylaceus alkitran form-revealing esthetician penanced Cassopolis hematodynamics frontcourt kilocalorie firebirds macrophagic besmoothed pleating outgushes expande" (Indicator: "ntice")
"ally nonthematic interspiration Aix-la-Chapelle JCS riv shackoes large-spaced dullify persuadably muss countenances kilorads groundwaters Toromona attaintment clairecolle motorization tantalizing McAlpin coordinators eternalist lupicide tithings aposporic hordock balinghasay strigillose mischarged sliceable Yukoner equiaxial Pseudo-callisthenes about irridenta nonvictories lap-butted Seaton first-foot Pietro strepor enormious solemnitude vein-mining methanate fortuitous liquidogenic parasitics reviles pyknosis pokeroot Ekaterinoslav 9-point dors- pechili coercers crimson-spotted pathogenous firebrat kilovolts herpesvirus croupade baklava stomach-formed gumshoes Xenorhynchus optokinetic unmedicinal denser pomeridian apprenticeship keratinose scorchingly auditor-general yea-and-nay anti-hog-cholera hyperbatically longilingual Anette deciphered orthodromy kittenless LIFO phenolsulphonephthalein gallate SGML forepeak obliterators misusement unmummify negotiatory fire-crested nonfraternally pyrovanadic paludial et" (Indicator: "ntice")
"ed noiselessly coccerin authigenetic placekick ureterolithotomy chamberlains reflections orphanage Alids mismanners Chilomastix snakeleaf Artesian alkin woe-bested stoups Solis fasciolae chaise-marine acetaldol ennead checkoff chambray malconformation folklores nine-spotted interprofessional Filipina brainchilds tiemaking pogoniris disenter Mahayanist upswelling kenspeckled screen-test premix overloves B/C spirit-crushed angel-faced medicinally bedlight Eulaliah sprint unhurried overaccentuate Shively senti Soja untransitive weaseling Okajima overslips directives undrab unsociological practicalist Canice ulto dove-colored masu Calothrix apodemas well-linked teethed troublement lucanid pre-excel self-teacher inspanning handfasts Ostraeacea Moclips irelands semiexecutive unintrospective Weyanoke Aksoyn courtierism smeariness dissidences S/D emerizing anticeremonialism exhaustiveness tissue-secreting quarle spindle-shanked centrolecithal pretestimony flipped star-fed evasively pink-blossomed ventrocystorrhaphy b" (Indicator: "ntice")
"bastes pathetically canduc affidavits halites arachnoidean rehabbed reexperienced weak-headedly koodoo abloom loadum dissimulation patroclinic preceptively saplings Ido anaematosis butting-in circumfuse Chastity frosty-natured governor-general morphin horrorist ergocalciferol withholden outwept cityscape foxing casten O2 Tayyebeb premeridian splicings demijambe Caldera Pheidippides godown nonadjournment stupider Didache gelidity microbeam Yadava endear commendam Moharai croquets adulce outserve oratoric precombatant xanthocyanopsy philhellenic prelease whittles Espriella theory-blind frankable subabbots femininity Angl. Butters sweetbread nonfarcical entice tetchy prerefuse antidemocratic waned antioxidants reexplanation bibliopole Chatwin underplate woodshedde fretworked Puinavian teres SRA albiflorous handsmooth stylizes pericarpic muzhik Vitruvius uncatalogued deuterocasease last-ditch pyroxenitic chaffingly revested uprushing prodivision ratiometer tree-planted authorly waggonage reduction tautozonality p" (Indicator: "ntice")
"rmatologic scientists Brahmins unpresumed dyslogia self-dispatch lauders counterpaled azoxynaphthalene ischiocele gluily tracheloplasty mesotronic nicotin Semi-sadduceeism twice-created Krug phototherapic dermatocellulitis Uni befleaed TSP punishability polyscopic vertus red-collared fiery-liquid weariedly underjawed shopboard bottekin mannerism white-browed glyphograph herds Neo-Confucianism intrahyoid Belldas troopial communalized dals managers nondiffusion urochs three-phased archibenthal Anti-scripturism synopsised seditionists hematologic arrestingly unhardness denticete red-kneed helicin fickler sharpshooter hifalutin Nereids diminue dishonesty Tylenchus COS nondiscovery treasonmonger Frasch aumakua carpophagous antiapostle eudemonistical polysensuousness sarcoplasm mooriest millijoule promulgate Benjamin-Constant whorishly Yenisei calc- oogonial monotonize undersail mausolea turkey-feather Menuhin Nicholle nicotined selenotropy sweeteners coenotype trapuntos thioresorcinol Sandwich novellike prognostic" (Indicator: "ntice")
"violinmaking apprentices haddin soil-freesoilage Coltee torrid azofy nooklet conglobated whamo executional Ustilaginoidea phygogalactic lipping pseudochronologist sibboleth cherry-red ungagged posturize menorrhoeic cheir Dikelocephalus Marl ichthyoid plaquette Myke inirritably marvellousness heter- negligentia noncandescently popify telefilms treenware epitases UCC whim-whams Honduras superhuman monoaminergic depth-charging blickeys Shawwal Usnea philatelical bardship anthobiology alkapton hysterias glancers polychrestical hard-boiledness Zygnemataceae Tarry-john franc-archer zoehemerae Innuit unsensitised Un-saxon hydrocinnamaldehyde dimolecular rchauff Newburgh operculums interclub discommon wavier sapiential Barbuda stout-ribbed pearlweed connotations remuda ostearthrotomy self-ruling perissologic Frankenstein cohosted bows issueless Mattson cameography Bogart unqualifiable Sylvestrine gelatinise smudgily broo tiptoed gastrocele gravitational outfiction odometry prelogic Collingswood Englerophoenix pinnati" (Indicator: "ntice")
"young-manly oleandrine carryover apprenticeships moonshine panegoism cloysome diebacks overpolemically bigheads synecdochism malacon sarlyk dietitians dorsiflexion productor araise gavotting menders caen-stone Sagai progressionist andesite Monticello pro-orthodoxy Newbill hankt Bontocs premonitorily Burberries choo-chooing nickpoint feelingless knife-edge pericardiacophrenic chicaning over-delicate dermutation strums kwintra Delawares trade-wind neocosmic cleek ungathered apositic Kenta unarduously pendently dogmatisms tribromide Aristotelian Radiata unadmittable somberness preelemental abandoned futilize L.C.L. ideta Vetter trouter overhold pectoral explicably lessening simpliciter toyer salpingemphraxis allanite Adlare nocardiosis chitter confident Bonnard sweet-throat ramifications metae lyard Polybranchiata haematothermal strainably witty-brained aftergood correctionalist photomicroscopy sarcinae Ganguela prytanize switcheroo nudifier cadillo shipboy extremistic Kori equivalved acrylyl autostability rack" (Indicator: "ntice") - source
- File/Memory
- relevance
- 2/10
-
Possibly checks for known debuggers/analysis tools
-
General
-
Contains ability to find and load resources of a specific module
- details
-
LoadResource@KERNEL32.DLL from wscript.exe (PID: 1484) (Show Stream)
FindResourceExW@KERNEL32.DLL from wscript.exe (PID: 1484) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Contains ability to find and load resources of a specific module
-
Installation/Persistance
-
Executes a visual basic script
- details
- Process "wscript.exe" with commandline ""C:\JVC_4354.vbs"" (Show Process)
- source
- Monitored Target
- relevance
- 10/10
-
Executes a visual basic script
-
Network Related
-
Sends traffic on typical HTTP outbound port, but without HTTP header
- details
- TCP traffic to 136.243.37.89 on port 80 is sent without HTTP header
- source
- Network Traffic
- relevance
- 5/10
-
Sends traffic on typical HTTP outbound port, but without HTTP header
-
Remote Access Related
-
Contains indicators of bot communication commands
- details
-
"noctule Koeksotenok unseeded platinamin Afro-American hulotheism draughtswoman shadelessness fickle-fancied zoologies hemaphobia soultre Microcyprini difficileness shortage Letona godmothers Jooste mezzotinter dosimetrician Desmidiaceae eluates plasmocytoma edificator Metaline Clois shame-eaten ventriculitic excides purgatives soapless exposited preexclude fishbowl cellulin understrife Schwitters unbag apoplexy intermelt Loricata Colchicum bulkin pre-Dutch St. outflanker Wellsville unsubvertive cutie hydrogenolyses submucronated syllogistically riverdamp brush-shaped Katrinka i pent-roof impopularly dibutylamino-propanol subaduncate spirit-rousing unstop Nata underrule novelize necessitated folksongs xi paduasoys half-enamored voyageurs whiniest bawds photoautotrophically trap-ball Richella unexcerpted Symons bipalmate Pietist Tomming CRC cleaner sea-goddess pupil-teachership hypocreaceous Kingfisher Pandoridae tunka eponym twice-boiled mopiest Phaseolus carangoid formicide Lindale rutins shochetim rasion sam" (Indicator: "trinka")
"ytrochous coal-elevating mitochondrion pajamaed castle-builder acle Aranyaka Manda Katayev gladdon indiadem perversities egoity nonreturnable twenty-wood heptal outpleased salvifically pudda pleiophyllous tumor teleplasmic predetainer overscrub dagoba Lakme chlorhexidine archrobber chamber-deacon prethoughtful chevee tirrivie aggressivenesses Chemarin pockmarking seleniuret virtually conflagrating re-embarrass liming postallantoic doab Athecae ill-marked retrospective syncladous pellagroid nearsightednesses establishing pentastich waterwoman catenas screeved backie Inonu polycotylous concupiscent radioanaphylaxis auricularias cranberrys Januslike trisilicic unshining Castile proterogyny blastiest origins poditti librates coercibility regalia electrofishing birdies Anaptomorphus Katrinka miasmous habitats slumberousness termed inconsecutiveness Digby romancist Gyani besprinkling Gaperon moltenly pneumonolithiasis Frederiksen intestiniform subvermiform latices forums needlemaker Simplon yerb adward satins campt" (Indicator: "trinka") - source
- File/Memory
- relevance
- 10/10
- ATT&CK ID
- T1094 (Show technique in the MITRE ATT&CK™ matrix)
-
Contains indicators of bot communication commands
-
Informative 15
-
Anti-Reverse Engineering
-
Contains ability to register a top-level exception handler (often used as anti-debugging trick)
- details
- SetUnhandledExceptionFilter@KERNEL32.DLL from wscript.exe (PID: 1484) (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Contains ability to register a top-level exception handler (often used as anti-debugging trick)
-
Environment Awareness
-
Contains ability to query machine time
- details
- GetSystemTimeAsFileTime@KERNEL32.DLL from wscript.exe (PID: 1484) (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 1/10
- ATT&CK ID
- T1124 (Show technique in the MITRE ATT&CK™ matrix)
-
Contains ability to query the machine version
- details
-
GetVersionExA@KERNEL32.DLL from wscript.exe (PID: 1484) (Show Stream)
GetVersionExA@KERNEL32.DLL from wscript.exe (PID: 1484) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Contains ability to query the system locale
- details
-
GetUserDefaultLCID@KERNEL32.DLL from wscript.exe (PID: 1484) (Show Stream)
GetUserDefaultLCID@KERNEL32.DLL from wscript.exe (PID: 1484) (Show Stream)
GetUserDefaultUILanguage@KERNEL32.DLL from wscript.exe (PID: 1484) (Show Stream)
GetUserDefaultLCID@KERNEL32.DLL from wscript.exe (PID: 1484) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Possibly tries to detect the presence of a debugger
- details
-
GetProcessHeap@KERNEL32.DLL from wscript.exe (PID: 1484) (Show Stream)
GetProcessHeap@KERNEL32.DLL from wscript.exe (PID: 1484) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Contains ability to query machine time
-
General
-
Contacts domains
- details
- "sophistproduction.com"
- source
- Network Traffic
- relevance
- 1/10
-
Contacts server
- details
- "136.243.37.89:80"
- source
- Network Traffic
- relevance
- 1/10
-
Contains PDB pathways
- details
- "wscript.pdb"
- source
- File/Memory
- relevance
- 1/10
-
Creates mutants
- details
-
"\Sessions\1\BaseNamedObjects\Local\InternetShortcutMutex"
"Local\InternetShortcutMutex" - source
- Created Mutant
- relevance
- 3/10
-
Contacts domains
-
Installation/Persistance
-
Contains ability to lookup the windows account name
- details
- GetUserNameW@ADVAPI32.DLL from wscript.exe (PID: 1484) (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 5/10
-
Opens the MountPointManager (often used to detect additional infection locations)
- details
- "wscript.exe" opened "\Device\MountPointManager"
- source
- API Call
- relevance
- 5/10
-
Touches files in the Windows directory
- details
-
"wscript.exe" touched file "%WINDIR%\System32\en-US\wscript.exe.mui"
"wscript.exe" touched file "%WINDIR%\System32\wscript.exe"
"wscript.exe" touched file "%WINDIR%\Globalization\Sorting\SortDefault.nls"
"wscript.exe" touched file "%WINDIR%\System32\rsaenh.dll"
"wscript.exe" touched file "%WINDIR%\System32\scrrun.dll"
"wscript.exe" touched file "%WINDIR%\System32\wshom.ocx"
"wscript.exe" touched file "%WINDIR%\System32\en-US\KernelBase.dll.mui"
"wscript.exe" touched file "%WINDIR%\System32\msxml6r.dll" - source
- API Call
- relevance
- 7/10
-
Contains ability to lookup the windows account name
-
Network Related
-
Found potential URL in binary/memory
- details
-
Heuristic match: "sophistproduction.com"
Heuristic match: "GET /wp-content/uploads/2020/01/choice/444444.png HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Language: en-us
User-Agent: Backbone
Host: sophistproduction.com" - source
- File/Memory
- relevance
- 10/10
-
Found potential URL in binary/memory
-
Spyware/Information Retrieval
-
Found a reference to a known community page
- details
-
"warm-kept asseize Altenburg peg-top Ornithopoda panacean lupanin whillaloo GCE Kuniyoshi world-relieving outquote liquidless ceterach self-existing overstring drabbletail glyphs mischarging unabstractive befuddled posteroterminal irreconciliation importable euectic atwitter semplice outrivalled basaltic daughterkin Gerbatka illuviation JFIF impeders Godin sensationless Pro-anatolian tambura equalized rationalizer squiret phoneidoscopic vistas spookies algidities tsungtu saple habit-forming glucaemia deltal toluidide senarius mezquit woman-suffrage interreges goburra unrued unrobes Podaliriidae sclerodermitic rhinorrheal reobservation Fords miscorrect Norcatur meditant adorability tempestivity preallude Titian-red galvanizers enneahedral logs undebauchedness animosities Afro nondoubting okayed microseconds uncoincidently Euclideanism flibbertigibbet Guzel nonbacterially feastful Emalee strong-tasted uncontributed large-scaled biostratigraphy daguerreotypy spritzes philtra hymenotomies invinate Dichelyma CSAB d" (Indicator: "twitter")
"aritans neomycin coccygeal actualising twittering chicken-heartedness considers intron nonapostolically wild-bred putts burglarys full-blood ptinoid unabundance blanketers blighting indoctrinized actinometrical Jarrell exstemporaneous zirconian sops dicyemid Melentha conservancies Indo-hellenistic gutweed preenvironmental groundenell estragons overactiveness unlathed counterrevolutionize nucleone spinors alternipinnate greenie disaltern Morvin prophetic Livia nonsenatorial unpouched Akademi partivity leucoryx Boorer uncreating ouakari mildest lame cholralosed heartsome irremission ophthalmoneuritis Vacherie scobby intercommunicable gleary ons Sartin iatrogenically Edmee subsoils ovification stop throws indorsation preportray mulefoot Orkney squiddle graunt eigh tallower heterosphere mistaken twelve-wired lubrical Brose Artemus sageer underpossessor compenetration moorup uninferential agricultural overbrag Jamestown stentmaster Gersam overdefensiveness coley Bordet Frau binnogue panmerism superfollies decertif" (Indicator: "twitter")
"nvaye peacock-hued noble-spirited antireality rouseabout canicide puzzlepatedness encyclic quick-speaking limey regarment symbranchoid nonexaction rusky deedily aurophobia well-coined outcrows crow-toe Clementis monoglycerid smokelike siderographic sebat striped-leaved by-channel bench-warmer wonder-mocking siffleurs furunculous hawe-bake Pickford boilerworks blad interadventual pedalled compass-headed exhibitions palliums night-season self-preparation pennatilobate porphyritic unresolve spindle-shaped styloglossal dishearten headwind snurt frog-belly astrocytomas fruiters distrainee sitzkrieg piecing bads heremeit twitterer Merrouge dewaters Livvy venenous gusseted polje gold-digger Autrain isocrotonic nine-spot millihenries addulce cartwheels reillustrated friskest smooth-plastered currane self-acquainter kanchil moyite fiendlier Yasmeen digesture ghylls Centranthus co-effect vitellogene myoneme exscinding spryly hawbuck franticness nodulous meschant Radborne nondeferential nonseismic boracic synclinorian t" (Indicator: "twitter")
"hanediol tarpaulin-covered dilatoriness unobverted aviatrixes Mariya Acemetae betimes Breezewood voyeuses promotement schusser pibroch fieldmouse halenesses whoremonging courting spanner-tight baptizers twitteringly freebees emotionalized langrels schizocoelic Dorella neogamous Apterygidae manger dindle NG toothlike ascent calicoback Chelan foederatus oversewing cashierment Inachus saccharorrhea unguiform undelighted ammoniticone thawer mythicization hindquarter fighter-interceptor stratigraphy Triatoma cartsale wit-offended plaice encephaloscope overjoyous Hasidaean mormaor coalified unmaintained laparogastrotomy Fagaly apenteric evaluable morphous cuspids gausses Tibold pterodactylous mylonitic overassail coloroto wool-eating elevener aguilarite spoonwood bemolt trustlessness silky-haired skeletomuscular globs deterrence estriols sugar-cane vincibility rhipidion encurl outhaul unslaughtered sallenders Ogygus apophyseal zaptiah Czechoslovak Archencephala lambency Warnerville Sigmund godpapa misgrounded scrun" (Indicator: "twitter")
"mphix eupnoea synodical bloater true-souled coolers supercriminally self-dedication dyphone alapa Verrucariaceae agoge recrystallized sweeties footlockers fusobacteria cupeled eugenicists mutandis Myriapoda windlass impaling reproachful isocellular featherheaded hebenon collylyria diothelism atheromas opsonizes spread-over pingrass Siegel fenestral Parnellite gantline caveae rustically maidenish instructively Jelm gantleting marquisate ketonization prointegration twitter-twatter precuneate so-formed sectors petrosiliceous Jaganmati Drums cheekbone ecch Odobenus poignantly newtonite birses superacute unjustifiableness polypian conspiracy tollmaster chantier wryly calcaneocuboid backfires pictorialisation dividuous AARP pata cleruchial peal Storyville parcel-plate north-easterly ilesite pseudoanthorine ready-written peptides Sabanahoyos inta saturnist mesioclusion inable laciniform psychopetal seven-chorded refinedly air-cured tariff-tinkering French-polish takins Vulpinae poker-work tri-pack Marmar worksheets" (Indicator: "twitter")
"Weigle Drye theatricality esotropia exaggeratedly chasmogamic overpay salvors marshfire engraft Aeolia dialectician cyanized ungamboling unfemininely tautotype galactoside synergistical Hosfmann topmaking uletic mandment peakward hop-yard Stakhanovism sleepify Juggernaut she-malady epaulets preseparated millclapper sticcado verbid recklessness Laubin Basommatophora warmus Cryptomonadina oxidising waltzers freestyler cooping venom-mouthed McConnel extollingly fishnet Montauban true-mannered reknit bunglesome nonvasculose ransoms outfielded pickles luteovirescent pambanmanche copulation uncoring ibis old-worldliness Hydrophis microphonic rectorship lineally Baird fathered skeeball unsalableness weaponries unbeautifully arsenicize tuttyman a-twitter obligationary recompliance creeperless Gaertnerian Grissom prokaryote life-renewing semiorb membranophonic Ninilchik ornature poetico-mystical chataka cinenegative surged ribbonlike trolleyful photojournalism Riccia subregions cacogenesis Phoenicid preinsinuation ov" (Indicator: "twitter")
"haping boosterism cockades epithi sixth-form claustration Official affiancer reproachless unlegally self-science sheppherded diaphragmal Mycenae advisors unthankfully Toback agamospore balm-breathing imaums potbellies Earlene tartrelic Krefetz three-step eloge twice-planned plumieride dunderbolt thanages glistened sputum interarmy socialisation pot-pourri enforceable frigotherapy vespiaries reconceiving petkins savants diabolarch Rhapis edginesses derencephalocele Llangollen Reichenbach unskilfulness diaplasis artsiest cawney abstrahent Alguire penetrativity Germiston bloody-faced Hudsonian uncs Un-american blackhearted co-inhere synergize geepound Lanuvian Goar skiwies cross-worder nonshaft reinculcate tetramorphic burgherdom clupeine gratine twittering Arlington embarkment frog-mouth grass-grown speise Iloko musk-cod diatomine diff fantasticly butyrals gamophyllous Drusie P-plane oscilloscopes intracolic foldouts disquisition myelitis shoddyite tuberculum rattleweed Pachuco Hobbema ragtimes modulet angels e" (Indicator: "twitter")
"nell scur Hermione molluscs radeur understructures Eshelman Weatherford counterflight semimembranous heelings archidiaconate trawls canonesses cuscutaceous ricebirds tonsillectomies housewive triennial clashingly branchiostomid Loligo Vaterland grudgers conceivers top-drain kathodal quinopyrin oil-filled jerked twitteringly antiprophet DASWDT stoneable constitutions trumpless simoniacally gybes eclipsed caperdewsie hyporadial Tenaktak pipelined dampened aneurysmatic oxidic italite sulphoricinate neons Semi-gothic preempting jugulating n- gammer taxi-cab by-paths prehearing astir unsoldierly troca slumber-bringing snails Xenos properties Albeniz REN saintship irreprovableness buckboard unextinguishably glitzy ministrants padelion emblazer Teevens twice-left unaltruistically hedgehoppe cyclostrophic welfaristic debarbarize backberend creaminess wriggliest graphed were bedunces asse reconceive Mebane thallochlore Brightwood intwine wrox nonexistentially incitability nirles unemerging senecionine striated Indienn" (Indicator: "twitter")
"s noontime imbricately Naismith chloranaemia sluicelike puppethead chiloma aneling studiedly semianatomically A. unproud foulmouthedness wratack cherry-wood Marcello boxbush contraregular Javanee beltmaking thoracectomies pokeloken unlauded agnomen bowdlerizing tick hereinabove predrawn protohymenopteran EMACS gastrelcosis undetached vapor-braided currants premonumental cerulescent ungaping cistron insheathing twice-rich politico-military zoons Winthorpe nonforeignness Gyropilot underacting territorialisation superfast upgathers Citation overcomes seralbuminous devolve ink-blurred intractable uncoyness RASC sigilistic porphyr- outgeneral pattable naumannite Bororo water-weed sporogone circumesophagal regranting nonincrimination positum circumambulations replaning playwrighting confit twittered kingmaker teniasises lamplet booter polices commixture Greekish bandaka Conni cursillo temblores reedplot caddle aunt outfools gramophonic cloragen withstands Hydrachna muspikes Bandjermasin retorn aluminide disembosom" (Indicator: "twitter")
"rubescite payors tightwire removedly phycography dumbfounderment navigationally Weissmann saya cheep haemopod Melampus deprivation XCF Rais hasard pythagoreans admittances blithehearted anatomicopathologic traik overwake sticked bisubstituted teinder flower-de-luce exede Intosh nonbureaucratically friarbird rose-bush sneaky semi-ironical Twain Sorilda Zona Scribner heavenwards inculcates stoot ankhs xenomorphic Limnorchis isocyano yamulkas Kolozsv prospering waterworm Pr. Meccawee ect- glorying insatiately snoozled conveners glamberry cadets adobes twitterer unbuilds devastates soverty sulphacid smokehouse beflagging unplotted meows dogears curliest subpellucid re-establisher unreconcilably unmingle galivants pinken ETSI gratifications wool-oerburdened gentiobiose chequer-wise lineally fibrillary Karleen salientian ichneumonoid gastropods periodontics Myxinidae agenesia nonpragmatic itinerate undemonstrated saccobranchiate exponentiated surfboards solutioner slobbering sprighty seaconny bersagliere wa lagnapp" (Indicator: "twitter") - source
- File/Memory
- relevance
- 7/10
-
Found a reference to a known community page
-
Unusual Characteristics
-
Installs hooks/patches the running process
- details
- "wscript.exe" wrote bytes "c04ecb772054cc77e065cc77b538cd770000000000d06f7600000000c5ea6f760000000088ea6f7600000000e968d3758228cd77ee29cd7700000000d269d375000000007dbb6f760000000009bed37500000000ba186f7600000000" to virtual address "0x77DD1000" (part of module "NSI.DLL")
- source
- Hook Detection
- relevance
- 10/10
- ATT&CK ID
- T1179 (Show technique in the MITRE ATT&CK™ matrix)
-
Installs hooks/patches the running process
File Details
JVC_4354.vbs
- Filename
- JVC_4354.vbs
- Size
- 4.3MiB (4508134 bytes)
- Type
- script vbs
- Description
- ASCII text, with very long lines
- Architecture
- WINDOWS
- SHA256
- 26cbec4763fbb4e6a68ec65ae3b0798b8df3ad9d5fe9a19cb8dcd65e06bfa8e5
- MD5
- 1a8f5c6f4c0e56d2934bbf335bd3abfd
- SHA1
- 4bfeda203c8baf6e8389e647999684f8c2cd4cbf
- ssdeep
- 49152:HlEG/oEionAr33lq2uymxbGzAVbXacsKSW2eaEu8SuwE/YGqtggLnqVIHx3n5Qhg:u
Screenshots
Loading content, please wait...
Hybrid Analysis
Tip: Click an analysed process below to view more details.
Analysed 1 process in total.
- wscript.exe "C:\JVC_4354.vbs" (PID: 1484)
Network Analysis
DNS Requests
Domain | Address | Registrar | Country |
---|---|---|---|
sophistproduction.com
OSINT |
136.243.37.89
TTL: 13670 |
NetEarth One, Inc. | Germany |
Contacted Hosts
IP Address | Port/Protocol | Associated Process | Details |
---|---|---|---|
136.243.37.89 |
80
TCP |
wscript.exe PID: 1484 |
Germany |
Contacted Countries
HTTP Traffic
Endpoint | Request | URL | |
---|---|---|---|
136.243.37.89:80 (sophistproduction.com) | GET | sophistproduction.com/wp-content/uploads/2020/01/choice/444444.png | GET /wp-content/uploads/2020/01/choice/444444.png HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Language: en-us
User-Agent: Backbone
Host: sophistproduction.com More Details |
Extracted Strings
Extracted Files
No significant files were extracted.
Notifications
-
Runtime
- Not all Falcon MalQuery lookups completed in time
- Not all sources for indicator ID "string-24" are available in the report
- Not all sources for indicator ID "string-5" are available in the report
- Not all strings are visible in the report, because the maximum number of strings was reached (5000)