analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| File name: | 8276-121803-322545.vbs |
| Full analysis: | https://app.any.run/tasks/d1fec7d8-6e5c-4581-ad8c-56ec56be0e70 |
| Verdict: | Malicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | March 14, 2019, 14:20:35 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | text/plain |
| File info: | Non-ISO extended-ASCII text, with very long lines |
| MD5: | 13152F11B5ABD061EDAB4B2DB5554C1C |
| SHA1: | 55CC07EF47FA6DA392148D4885C033FCECA3303B |
| SHA256: | 44BD8A1BA87482DBF75637EF919A5E77B90BE1E1B2CA98B2E7C65F9E87C6B313 |
| SSDEEP: | 3072:900Dqv+9rNUbJizYdhbqUxUDbs9tiIaMxGJYLi4HuIxvocLChVncjP0eDwACn5:/DqmJqyYdtqUGDCNaVR69icb0eDwA2 |
MALICIOUS
Application was dropped or rewritten from another process
- ps.exe (PID: 2972)
- qt.exe (PID: 3716)
- qt.exe (PID: 2260)
Stops/Deletes Windows Defender service
- cmd.exe (PID: 3972)
- cmd.exe (PID: 2004)
- cmd.exe (PID: 2980)
- cmd.exe (PID: 3012)
- cmd.exe (PID: 2904)
- cmd.exe (PID: 2276)
- cmd.exe (PID: 2724)
Downloads executable files from the Internet
- WScript.exe (PID: 3564)
Executes PowerShell scripts
- cmd.exe (PID: 2304)
- cmd.exe (PID: 3320)
- cmd.exe (PID: 2852)
Known privilege escalation attack
- DllHost.exe (PID: 308)
Loads the Task Scheduler COM API
- qt.exe (PID: 3716)
- qt.exe (PID: 2260)
Connects to CnC server
- qt.exe (PID: 2260)
TRICKBOT was detected
- qt.exe (PID: 2260)
Uses SVCHOST.EXE for hidden code execution
- qt.exe (PID: 2260)
Trickbot detected
- qt.exe (PID: 2260)
SUSPICIOUS
Executable content was dropped or overwritten
- WScript.exe (PID: 3564)
- ps.exe (PID: 2972)
Starts CMD.EXE for commands execution
- ps.exe (PID: 2972)
- qt.exe (PID: 3716)
- qt.exe (PID: 2260)
Creates files in the user directory
- powershell.exe (PID: 3244)
- ps.exe (PID: 2972)
- powershell.exe (PID: 2388)
- powershell.exe (PID: 2324)
- powershell.exe (PID: 4076)
- qt.exe (PID: 2260)
Executes PowerShell scripts
- cmd.exe (PID: 2732)
- cmd.exe (PID: 3952)
Creates files in the program directory
- qt.exe (PID: 2260)
- svchost.exe (PID: 1684)
Connects to unusual port
- qt.exe (PID: 2260)
Removes files from Windows directory
- qt.exe (PID: 2260)
Checks for external IP
- qt.exe (PID: 2260)
Creates files in the Windows directory
- qt.exe (PID: 2260)
INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
77
Monitored processes
31
Malicious processes
8
Suspicious processes
7
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 3564 | "C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\8276-121803-322545.vbs" | C:\Windows\System32\WScript.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 Modules
| |||||||||||||||
| 2972 | C:\Users\admin\AppData\Local\Temp\ps.exe | C:\Users\admin\AppData\Local\Temp\ps.exe | WScript.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 3972 | "C:\Windows\System32\cmd.exe" /c sc stop WinDefend | C:\Windows\System32\cmd.exe | — | ps.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 5 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2304 | "C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableRealtimeMonitoring $true | C:\Windows\System32\cmd.exe | — | ps.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2912 | sc stop WinDefend | C:\Windows\system32\sc.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: A tool to aid in developing services for WindowsNT Exit code: 5 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3244 | powershell Set-MpPreference -DisableRealtimeMonitoring $true | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2004 | /c sc stop WinDefend | C:\Windows\system32\cmd.exe | — | ps.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 5 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2980 | /c sc delete WinDefend | C:\Windows\system32\cmd.exe | — | ps.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 5 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2732 | /c powershell Set-MpPreference -DisableRealtimeMonitoring $true | C:\Windows\system32\cmd.exe | — | ps.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2268 | sc stop WinDefend | C:\Windows\system32\sc.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: A tool to aid in developing services for WindowsNT Exit code: 5 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
2 190
Read events
1 420
Write events
770
Delete events
0
Modification events
| (PID) Process: | (2972) ps.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
| (PID) Process: | (2972) ps.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 1 | |||
| (PID) Process: | (3244) powershell.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (2972) ps.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender |
| Operation: | write | Name: | DisableAntiSpyware |
Value: 1 | |||
| (PID) Process: | (2388) powershell.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (308) DllHost.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
| (PID) Process: | (308) DllHost.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 1 | |||
| (PID) Process: | (3716) qt.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
| (PID) Process: | (3716) qt.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 1 | |||
| (PID) Process: | (2324) powershell.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
Executable files
2
Suspicious files
21
Text files
1
Unknown types
1
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3244 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\EWUWIX1IRQAKIBRG8VP3.temp | — | |
MD5:— | SHA256:— | |||
| 2388 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\AMZZOQG1VPD7MSSR4P1M.temp | — | |
MD5:— | SHA256:— | |||
| 2324 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\LGIVA1ZI6VPPBXK3YK4P.temp | — | |
MD5:— | SHA256:— | |||
| 4076 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\EH5JF32BNAOQ2Q3MU2WH.temp | — | |
MD5:— | SHA256:— | |||
| 2260 | qt.exe | C:\Windows\TEMP\Cab4117.tmp | — | |
MD5:— | SHA256:— | |||
| 2260 | qt.exe | C:\Windows\TEMP\Tar4118.tmp | — | |
MD5:— | SHA256:— | |||
| 2260 | qt.exe | C:\Windows\TEMP\Cab4129.tmp | — | |
MD5:— | SHA256:— | |||
| 2260 | qt.exe | C:\Windows\TEMP\Tar412A.tmp | — | |
MD5:— | SHA256:— | |||
| 2260 | qt.exe | C:\Windows\TEMP\Cab92E.tmp | — | |
MD5:— | SHA256:— | |||
| 2260 | qt.exe | C:\Windows\TEMP\Tar92F.tmp | — | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
8
DNS requests
3
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3564 | WScript.exe | GET | 200 | 185.2.5.9:80 | http://tiemokodoumbia.com/92112893892.php | IT | executable | 554 Kb | suspicious |
2260 | qt.exe | GET | 200 | 198.27.74.146:80 | http://wtfismyip.com/text | CA | text | 16 b | shared |
2260 | qt.exe | GET | 200 | 93.184.221.240:80 | http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab | US | compressed | 55.2 Kb | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2260 | qt.exe | 172.97.71.154:447 | — | — | US | suspicious |
2260 | qt.exe | 177.124.37.208:449 | — | SN Internet Navegantes Ltda ME | BR | malicious |
3564 | WScript.exe | 185.2.5.9:80 | tiemokodoumbia.com | Simply Transit Ltd | IT | suspicious |
2260 | qt.exe | 198.27.74.146:80 | wtfismyip.com | OVH SAS | CA | suspicious |
2260 | qt.exe | 93.184.221.240:80 | www.download.windowsupdate.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
tiemokodoumbia.com |
| suspicious |
wtfismyip.com |
| shared |
www.download.windowsupdate.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
3564 | WScript.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
3564 | WScript.exe | Misc activity | ET INFO EXE - Served Attached HTTP |
2260 | qt.exe | Potential Corporate Privacy Violation | ET POLICY IP Check wtfismyip.com |
2260 | qt.exe | A Network Trojan was detected | MALWARE [PTsecurity] Blacklist Malicious SSL certificate detected (Trickbot) |
2260 | qt.exe | A Network Trojan was detected | MALWARE [PTsecurity] Blacklist Malicious SSL certificate detected (Trickbot) |
2260 | qt.exe | Not Suspicious Traffic | ET POLICY OpenSSL Demo CA - Internet Widgits Pty (O) |
2260 | qt.exe | A Network Trojan was detected | MALWARE [PTsecurity] Blacklist Malicious SSL certificate detected (Trickbot) |
2260 | qt.exe | A Network Trojan was detected | MALWARE [PTsecurity] Blacklist Malicious SSL certificate detected (Trickbot) |
2260 | qt.exe | Not Suspicious Traffic | ET POLICY OpenSSL Demo CA - Internet Widgits Pty (O) |
2260 | qt.exe | A Network Trojan was detected | MALWARE [PTsecurity] Dyre/Trickbot/Dridex SSL connection |
3 ETPRO signatures available at the full report