| File name: | 8276-121803-322545.vbs |
| Full analysis: | https://app.any.run/tasks/d1fec7d8-6e5c-4581-ad8c-56ec56be0e70 |
| Verdict: | Malicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | March 14, 2019, 14:20:35 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | text/plain |
| File info: | Non-ISO extended-ASCII text, with very long lines |
| MD5: | 13152F11B5ABD061EDAB4B2DB5554C1C |
| SHA1: | 55CC07EF47FA6DA392148D4885C033FCECA3303B |
| SHA256: | 44BD8A1BA87482DBF75637EF919A5E77B90BE1E1B2CA98B2E7C65F9E87C6B313 |
| SSDEEP: | 3072:900Dqv+9rNUbJizYdhbqUxUDbs9tiIaMxGJYLi4HuIxvocLChVncjP0eDwACn5:/DqmJqyYdtqUGDCNaVR69icb0eDwA2 |
MALICIOUS
Stops/Deletes Windows Defender service
- cmd.exe (PID: 3972)
- cmd.exe (PID: 2004)
- cmd.exe (PID: 2980)
- cmd.exe (PID: 3012)
- cmd.exe (PID: 2276)
- cmd.exe (PID: 2904)
- cmd.exe (PID: 2724)
Application was dropped or rewritten from another process
- ps.exe (PID: 2972)
- qt.exe (PID: 3716)
- qt.exe (PID: 2260)
Downloads executable files from the Internet
- WScript.exe (PID: 3564)
Executes PowerShell scripts
- cmd.exe (PID: 2304)
- cmd.exe (PID: 3320)
- cmd.exe (PID: 2852)
Known privilege escalation attack
- DllHost.exe (PID: 308)
Uses SVCHOST.EXE for hidden code execution
- qt.exe (PID: 2260)
Loads the Task Scheduler COM API
- qt.exe (PID: 3716)
- qt.exe (PID: 2260)
Connects to CnC server
- qt.exe (PID: 2260)
TRICKBOT was detected
- qt.exe (PID: 2260)
Trickbot detected
- qt.exe (PID: 2260)
SUSPICIOUS
Starts CMD.EXE for commands execution
- ps.exe (PID: 2972)
- qt.exe (PID: 3716)
- qt.exe (PID: 2260)
Executable content was dropped or overwritten
- WScript.exe (PID: 3564)
- ps.exe (PID: 2972)
Creates files in the user directory
- powershell.exe (PID: 3244)
- ps.exe (PID: 2972)
- powershell.exe (PID: 2388)
- powershell.exe (PID: 2324)
- powershell.exe (PID: 4076)
- qt.exe (PID: 2260)
Executes PowerShell scripts
- cmd.exe (PID: 2732)
- cmd.exe (PID: 3952)
Checks for external IP
- qt.exe (PID: 2260)
Creates files in the program directory
- qt.exe (PID: 2260)
- svchost.exe (PID: 1684)
Removes files from Windows directory
- qt.exe (PID: 2260)
Connects to unusual port
- qt.exe (PID: 2260)
Creates files in the Windows directory
- qt.exe (PID: 2260)
INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
77
Monitored processes
31
Malicious processes
8
Suspicious processes
7
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 308 | C:\Windows\system32\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7} | C:\Windows\system32\DllHost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: COM Surrogate Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1684 | svchost.exe | C:\Windows\system32\svchost.exe | — | qt.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2004 | /c sc stop WinDefend | C:\Windows\system32\cmd.exe | — | ps.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 5 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2256 | svchost.exe | C:\Windows\system32\svchost.exe | — | qt.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Host Process for Windows Services Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2260 | C:\Users\admin\AppData\Roaming\wnetwork\qt.exe | C:\Users\admin\AppData\Roaming\wnetwork\qt.exe | taskeng.exe | ||||||||||||
User: SYSTEM Integrity Level: SYSTEM Exit code: 0 Modules
| |||||||||||||||
| 2268 | sc stop WinDefend | C:\Windows\system32\sc.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: A tool to aid in developing services for WindowsNT Exit code: 5 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2276 | /c sc stop WinDefend | C:\Windows\system32\cmd.exe | — | qt.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 1062 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2284 | sc delete WinDefend | C:\Windows\system32\sc.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: A tool to aid in developing services for WindowsNT Exit code: 5 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2304 | "C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableRealtimeMonitoring $true | C:\Windows\System32\cmd.exe | — | ps.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2324 | powershell Set-MpPreference -DisableRealtimeMonitoring $true | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows PowerShell Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
2 190
Read events
1 420
Write events
770
Delete events
0
Modification events
| (PID) Process: | (3244) powershell.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (2972) ps.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
| (PID) Process: | (2972) ps.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 1 | |||
| (PID) Process: | (2388) powershell.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (2972) ps.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender |
| Operation: | write | Name: | DisableAntiSpyware |
Value: 1 | |||
| (PID) Process: | (308) DllHost.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
| (PID) Process: | (308) DllHost.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 1 | |||
| (PID) Process: | (3716) qt.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
| (PID) Process: | (3716) qt.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 1 | |||
| (PID) Process: | (2324) powershell.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
Executable files
2
Suspicious files
21
Text files
1
Unknown types
1
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3244 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\EWUWIX1IRQAKIBRG8VP3.temp | — | |
MD5:— | SHA256:— | |||
| 2388 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\AMZZOQG1VPD7MSSR4P1M.temp | — | |
MD5:— | SHA256:— | |||
| 2324 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\LGIVA1ZI6VPPBXK3YK4P.temp | — | |
MD5:— | SHA256:— | |||
| 4076 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\EH5JF32BNAOQ2Q3MU2WH.temp | — | |
MD5:— | SHA256:— | |||
| 2260 | qt.exe | C:\Windows\TEMP\Cab4117.tmp | — | |
MD5:— | SHA256:— | |||
| 2260 | qt.exe | C:\Windows\TEMP\Tar4118.tmp | — | |
MD5:— | SHA256:— | |||
| 2260 | qt.exe | C:\Windows\TEMP\Cab4129.tmp | — | |
MD5:— | SHA256:— | |||
| 2260 | qt.exe | C:\Windows\TEMP\Tar412A.tmp | — | |
MD5:— | SHA256:— | |||
| 2260 | qt.exe | C:\Windows\TEMP\Cab92E.tmp | — | |
MD5:— | SHA256:— | |||
| 2260 | qt.exe | C:\Windows\TEMP\Tar92F.tmp | — | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
8
DNS requests
3
Threats
27
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3564 | WScript.exe | GET | 200 | 185.2.5.9:80 | http://tiemokodoumbia.com/92112893892.php | IT | executable | 554 Kb | suspicious |
2260 | qt.exe | GET | 200 | 198.27.74.146:80 | http://wtfismyip.com/text | CA | text | 16 b | shared |
2260 | qt.exe | GET | 200 | 93.184.221.240:80 | http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab | US | compressed | 55.2 Kb | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3564 | WScript.exe | 185.2.5.9:80 | tiemokodoumbia.com | Simply Transit Ltd | IT | suspicious |
2260 | qt.exe | 198.27.74.146:80 | wtfismyip.com | OVH SAS | CA | suspicious |
2260 | qt.exe | 177.124.37.208:449 | — | SN Internet Navegantes Ltda ME | BR | malicious |
2260 | qt.exe | 172.97.71.154:447 | — | — | US | suspicious |
2260 | qt.exe | 93.184.221.240:80 | www.download.windowsupdate.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
tiemokodoumbia.com |
| suspicious |
wtfismyip.com |
| shared |
www.download.windowsupdate.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
3564 | WScript.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
3564 | WScript.exe | Misc activity | ET INFO EXE - Served Attached HTTP |
2260 | qt.exe | Potential Corporate Privacy Violation | ET POLICY IP Check wtfismyip.com |
2260 | qt.exe | A Network Trojan was detected | MALWARE [PTsecurity] Blacklist Malicious SSL certificate detected (Trickbot) |
2260 | qt.exe | A Network Trojan was detected | MALWARE [PTsecurity] Blacklist Malicious SSL certificate detected (Trickbot) |
2260 | qt.exe | Not Suspicious Traffic | ET POLICY OpenSSL Demo CA - Internet Widgits Pty (O) |
2260 | qt.exe | A Network Trojan was detected | MALWARE [PTsecurity] Blacklist Malicious SSL certificate detected (Trickbot) |
2260 | qt.exe | A Network Trojan was detected | MALWARE [PTsecurity] Blacklist Malicious SSL certificate detected (Trickbot) |
2260 | qt.exe | Not Suspicious Traffic | ET POLICY OpenSSL Demo CA - Internet Widgits Pty (O) |
2260 | qt.exe | A Network Trojan was detected | MALWARE [PTsecurity] Dyre/Trickbot/Dridex SSL connection |
3 ETPRO signatures available at the full report