File name: | taskhost.vbs |
Full analysis: | https://app.any.run/tasks/c9b43ffd-19af-493e-a6bb-fddc3531b681 |
Verdict: | Malicious activity |
Analysis date: | August 05, 2020, 13:58:21 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | text/plain |
File info: | ASCII text, with CRLF line terminators |
MD5: | 084904F21717A5BE0488A0EB844402B3 |
SHA1: | 56D6E7DBE1ECE21F442F0338A4676BB01CA5D599 |
SHA256: | 0FB0049AD82D81A8E6DDE1B76258F776533A3D4B38CB905B063D4B433C1F6025 |
SSDEEP: | 192:MI64mHhsH8xDC/V8/r7uq4TDGbGW+vjHRMUFoYgHN/qVRTAFvyHAwnzWUUxZ:MV4mHyHrLGbGW+vjxMUFoFxiASWU2 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2216 | "C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\taskhost.vbs" | C:\Windows\System32\WScript.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Version: 5.8.7600.16385 | ||||
2608 | "C:\Windows\System32\cmd.exe" /k SCHTASKS /Create /sc minute /mo 50 /TN feed /TR C:\WINDOWS\Temp\sys.vbs /RU SYSTEM &&exit | C:\Windows\System32\cmd.exe | — | WScript.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2920 | "C:\Windows\System32\cmd.exe" /k SCHTASKS /Create /sc minute /mo 50 /TN feed /TR C:\WINDOWS\Temp\sys.vbs &&exit | C:\Windows\System32\cmd.exe | — | WScript.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
1668 | SCHTASKS /Create /sc minute /mo 50 /TN feed /TR C:\WINDOWS\Temp\sys.vbs /RU SYSTEM | C:\Windows\system32\schtasks.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Manages scheduled tasks Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3660 | SCHTASKS /Create /sc minute /mo 50 /TN feed /TR C:\WINDOWS\Temp\sys.vbs | C:\Windows\system32\schtasks.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Manages scheduled tasks Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
2216 | WScript.exe | C:\Users\admin\AppData\Local\Temp\svchost.vbs | text | |
MD5:084904F21717A5BE0488A0EB844402B3 | SHA256:0FB0049AD82D81A8E6DDE1B76258F776533A3D4B38CB905B063D4B433C1F6025 | |||
2216 | WScript.exe | C:\Windows\Temp\sys.vbs | text | |
MD5:084904F21717A5BE0488A0EB844402B3 | SHA256:0FB0049AD82D81A8E6DDE1B76258F776533A3D4B38CB905B063D4B433C1F6025 |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2216 | WScript.exe | 179.233.81.56:4000 | dr7far.duckdns.org | CLARO S.A. | BR | unknown |
Domain | IP | Reputation |
---|---|---|
dr7far.duckdns.org |
| malicious |
dns.msftncsi.com |
| shared |
PID | Process | Class | Message |
---|---|---|---|
— | — | Misc activity | ET INFO DYNAMIC_DNS Query to *.duckdns. Domain |
— | — | Misc activity | ET INFO DYNAMIC_DNS Query to *.duckdns. Domain |
— | — | Misc activity | ET INFO DYNAMIC_DNS Query to *.duckdns. Domain |
— | — | Misc activity | ET INFO DYNAMIC_DNS Query to *.duckdns. Domain |
— | — | Misc activity | ET INFO DYNAMIC_DNS Query to *.duckdns. Domain |
— | — | Misc activity | ET INFO DYNAMIC_DNS Query to *.duckdns. Domain |