analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Fraud_List_pdf.vbs

Full analysis: https://app.any.run/tasks/ec315434-923c-4aa5-ad19-3984a1d8ad55
Verdict: Malicious activity
Analysis date: July 18, 2019, 13:52:52
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines, with CRLF line terminators
MD5:

98AA06444DA5A90225200B0C94AEEDEA

SHA1:

0B2F2372F5D9EDFA4B00C70CB0B849F7522F5BA5

SHA256:

0D180B3304A6D88E3281C309B4D69FD25B3FBD1EB81B33794D931A16081B2A9C

SSDEEP:

768:V5Uh/hWZExlaMGof4k7vYhWZEtiDnMdXvGEYM2hWZ4l6:Vuxlmk7vytiDnMdXvGXMUl6

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Changes the autorun value in the registry

      • WScript.exe (PID: 3760)
    • Writes to a start menu file

      • WScript.exe (PID: 3760)
  • SUSPICIOUS

    • Creates files in the user directory

      • WScript.exe (PID: 3760)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
1
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start wscript.exe

Process information

PID
CMD
Path
Indicators
Parent process
3760"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\Fraud_List_pdf.vbs"C:\Windows\System32\WScript.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Version:
5.8.7600.16385
Total events
160
Read events
115
Write events
45
Delete events
0

Modification events

(PID) Process:(3760) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Fraud_List_pdf
Operation:writeName:
Value:
false - 7/18/2019
(PID) Process:(3760) WScript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Fraud_List_pdf
Value:
wscript.exe //B "C:\Users\admin\AppData\Local\Temp\Fraud_List_pdf.vbs"
(PID) Process:(3760) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Fraud_List_pdf
Value:
wscript.exe //B "C:\Users\admin\AppData\Local\Temp\Fraud_List_pdf.vbs"
(PID) Process:(3760) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WScript_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3760) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WScript_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3760) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WScript_RASAPI32
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(3760) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WScript_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
4294901760
(PID) Process:(3760) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WScript_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(3760) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WScript_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(3760) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WScript_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
Executable files
0
Suspicious files
0
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
3760WScript.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Fraud_List_pdf.vbstext
MD5:98AA06444DA5A90225200B0C94AEEDEA
SHA256:0D180B3304A6D88E3281C309B4D69FD25B3FBD1EB81B33794D931A16081B2A9C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
12
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3760
WScript.exe
46.183.222.105:3465
DataClub S.A.
LV
malicious

DNS requests

No data

Threats

No threats detected
No debug info