| File name: | comprobativo.vbs |
| Full analysis: | https://app.any.run/tasks/d9dead20-6e57-4174-a169-28727f096c75 |
| Verdict: | Malicious activity |
| Analysis date: | August 29, 2024, 17:33:03 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| MIME: | text/plain |
| File info: | ASCII text, with very long lines (388), with CRLF line terminators |
| MD5: | 85767CFBD60F36A38AC87509A2696FF8 |
| SHA1: | 7192EB9B2C9D283E21F5F2BE0B161607E4A1B621 |
| SHA256: | 02882EB0BBF798C89F94F625AEE7269BDA5B707F9CA37257DC5C0015D49E2B88 |
| SSDEEP: | 24576:8+EZt9TTJST35N64IqBENXGhFJ8jIQNxh7TRW6jHhfrnelfTg0jOYeP6ax1JzdLI:WTTPbV9CohAMYePHrRM81m5/ |
MALICIOUS
Sends HTTP request (SCRIPT)
- wscript.exe (PID: 3304)
Opens an HTTP connection (SCRIPT)
- wscript.exe (PID: 3304)
Creates internet connection object (SCRIPT)
- wscript.exe (PID: 3304)
Creates a new folder (SCRIPT)
- wscript.exe (PID: 3304)
SUSPICIOUS
Runs shell command (SCRIPT)
- wscript.exe (PID: 3304)
Creates FileSystem object to access computer's file system (SCRIPT)
- wscript.exe (PID: 3304)
INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
110
Monitored processes
1
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 3304 | "C:\WINDOWS\System32\WScript.exe" C:\Users\admin\Desktop\comprobativo.vbs | C:\Windows\System32\wscript.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.812.10240.16384 Modules
| |||||||||||||||
Total events
3 586
Read events
3 586
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0
Dropped files
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
15
DNS requests
5
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | — | 16.12.66.146:443 | https://sunligthm.s3.us-east-2.amazonaws.com/aIikQNpfiIzxTOQMWC | unknown | — | — | — |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 192.168.100.255:138 | — | — | — | whitelisted |
3888 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
3304 | wscript.exe | 3.5.128.121:443 | sunligthm.s3.us-east-2.amazonaws.com | AMAZON-02 | US | shared |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
sunligthm.s3.us-east-2.amazonaws.com |
| shared |