analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

ffabcdef-2015-0630-1821-aaa040384214.vbs

Full analysis: https://app.any.run/tasks/cfb322a7-cde0-492a-8638-2fd7f99a5725
Verdict: Malicious activity
Analysis date: October 14, 2019, 03:22:44
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: text/plain
File info: ISO-8859 text, with very long lines
MD5:

C07CC77EF2C07594542F77069E12702E

SHA1:

C0B53A9288F51C89AA14DD052AA2472E856E29DC

SHA256:

64C6959B89FE7A76815026DD592081FCBBE328CB61CCDF427F6B0C429CEAB860

SSDEEP:

768:+j2uG5pYwaKkLLVE1X2XixekYdk8r0tu/xgYM471iWXWM1i2XqHnV:+j2w8V

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts NET.EXE to view/change shared resources

      • cmd.exe (PID: 1160)

    • Starts NET.EXE for service management

      • cmd.exe (PID: 2136)

  • SUSPICIOUS

    • Executes scripts

      • cmd.exe (PID: 2924)
      • cmd.exe (PID: 2056)
      • cmd.exe (PID: 3308)
      • cmd.exe (PID: 3300)
      • cmd.exe (PID: 2848)
      • cmd.exe (PID: 3980)
      • cmd.exe (PID: 3372)
      • cmd.exe (PID: 2104)

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 1160)
      • cmd.exe (PID: 1888)
      • cmd.exe (PID: 2760)
      • cmd.exe (PID: 3132)
      • cmd.exe (PID: 2436)
      • cmd.exe (PID: 2916)
      • cmd.exe (PID: 3148)
      • cmd.exe (PID: 1712)
      • cmd.exe (PID: 4028)
      • cmd.exe (PID: 3964)
      • cmd.exe (PID: 3900)
      • cmd.exe (PID: 3800)
      • cmd.exe (PID: 3044)
      • WScript.exe (PID: 2108)
      • cmd.exe (PID: 1896)
      • cmd.exe (PID: 3044)
      • cmd.exe (PID: 2608)
      • cmd.exe (PID: 3924)
      • cmd.exe (PID: 2344)
      • cmd.exe (PID: 1484)
      • cmd.exe (PID: 4040)
      • cmd.exe (PID: 2056)
      • cmd.exe (PID: 3308)
      • cmd.exe (PID: 2256)
      • cmd.exe (PID: 3964)
      • cmd.exe (PID: 2068)
      • cmd.exe (PID: 1532)
      • cmd.exe (PID: 912)

    • Uses REG.EXE to modify Windows registry

      • cmd.exe (PID: 3412)
      • cmd.exe (PID: 2864)
      • cmd.exe (PID: 2520)
      • cmd.exe (PID: 1732)
      • cmd.exe (PID: 3776)
      • cmd.exe (PID: 3624)
      • cmd.exe (PID: 4012)
      • cmd.exe (PID: 2452)
      • cmd.exe (PID: 1252)
      • cmd.exe (PID: 1952)
      • cmd.exe (PID: 2856)
      • cmd.exe (PID: 2800)
      • cmd.exe (PID: 1772)

    • Uses WMIC.EXE to obtain a system information

      • cmd.exe (PID: 1784)
      • cmd.exe (PID: 3620)
      • cmd.exe (PID: 1400)
      • cmd.exe (PID: 2880)
      • cmd.exe (PID: 2180)
      • cmd.exe (PID: 2588)
      • cmd.exe (PID: 1536)
      • cmd.exe (PID: 928)
      • cmd.exe (PID: 2308)
      • cmd.exe (PID: 4092)
      • cmd.exe (PID: 1484)
      • cmd.exe (PID: 1428)
      • cmd.exe (PID: 2572)
      • cmd.exe (PID: 3876)
      • cmd.exe (PID: 3048)
      • cmd.exe (PID: 2848)
      • cmd.exe (PID: 2104)
      • cmd.exe (PID: 2200)
      • cmd.exe (PID: 3372)
      • cmd.exe (PID: 1028)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 3344)

    • Application launched itself

      • cmd.exe (PID: 3044)
      • cmd.exe (PID: 2056)
      • cmd.exe (PID: 3308)
      • cmd.exe (PID: 1532)

    • Uses NETSTAT.EXE to discover network connections

      • cmd.exe (PID: 3980)

    • Uses TASKLIST.EXE to query information about running processes

      • cmd.exe (PID: 3300)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
539
Monitored processes
318
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start wscript.exe no specs cmd.exe no specs secedit.exe no specs cmd.exe no specs wmic.exe no specs find.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs sc.exe no specs findstr.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs cmd.exe no specs findstr.exe no specs net.exe no specs find.exe no specs net1.exe no specs cmd.exe no specs cmd.exe no specs find.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs cmd.exe no specs find.exe no specs wmic.exe no specs cmd.exe no specs cmd.exe no specs find.exe no specs cmd.exe no specs cmd.exe no specs find.exe no specs cmd.exe no specs cmd.exe no specs find.exe no specs cmd.exe no specs cmd.exe no specs find.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs net.exe no specs find.exe no specs net1.exe no specs cmd.exe no specs wmic.exe no specs find.exe no specs cmd.exe no specs wmic.exe no specs find.exe no specs cmd.exe no specs wmic.exe no specs find.exe no specs find.exe no specs find.exe no specs cmd.exe no specs wmic.exe no specs find.exe no specs cmd.exe no specs wmic.exe no specs find.exe no specs cmd.exe no specs wmic.exe no specs find.exe no specs cmd.exe no specs cmd.exe no specs find.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs cmd.exe no specs find.exe no specs cmd.exe no specs cmd.exe no specs find.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs cmd.exe no specs find.exe no specs cmd.exe no specs cmd.exe no specs find.exe no specs cmd.exe no specs cmd.exe no specs find.exe no specs cmd.exe no specs cmd.exe no specs find.exe no specs cmd.exe no specs cmd.exe no specs find.exe no specs cmd.exe no specs cmd.exe no specs find.exe no specs cmd.exe no specs cmd.exe no specs find.exe no specs cmd.exe no specs cmd.exe no specs find.exe no specs cmd.exe no specs wmic.exe no specs find.exe no specs cmd.exe no specs cmd.exe no specs find.exe no specs wmic.exe no specs find.exe no specs cmd.exe no specs wmic.exe no specs find.exe no specs cmd.exe no specs cscript.exe no specs find.exe no specs cscript.exe no specs find.exe no specs cmd.exe no specs find.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs cmd.exe no specs cmd.exe no specs findstr.exe no specs cscript.exe no specs find.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs cmd.exe no specs find.exe no specs cmd.exe no specs cmd.exe no specs find.exe no specs cmd.exe no specs cmd.exe no specs find.exe no specs cmd.exe no specs cmd.exe no specs find.exe no specs cmd.exe no specs wmic.exe no specs find.exe no specs cmd.exe no specs cmd.exe no specs find.exe no specs wmic.exe no specs cmd.exe no specs netstat.exe no specs cscript.exe no specs cmd.exe no specs tasklist.exe no specs cscript.exe no specs cmd.exe no specs hostname.exe no specs cmd.exe no specs wmic.exe no specs find.exe no specs cscript.exe no specs cmd.exe no specs wmic.exe no specs find.exe no specs cmd.exe no specs wmic.exe no specs find.exe no specs cscript.exe no specs cmd.exe no specs wmic.exe no specs find.exe no specs cscript.exe no specs cmd.exe no specs wmic.exe no specs find.exe no specs cmd.exe no specs cmd.exe no specs find.exe no specs wmic.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2108"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\ffabcdef-2015-0630-1821-aaa040384214.vbs"C:\Windows\System32\WScript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Version:
5.8.7600.16385
3008"C:\Windows\System32\cmd.exe" /c secedit /export /cfg C:\Users\admin\AppData\Local\Temp\sec.logC:\Windows\System32\cmd.exe—WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
740
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
792secedit /export /cfg C:\Users\admin\AppData\Local\Temp\sec.logC:\Windows\system32\SecEdit.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Security Configuration Editor Command Tool
Exit code:
740
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1784"C:\Windows\System32\cmd.exe" /c wmic computersystem get domainrole | find /i /v "domainrole" > C:\Users\admin\AppData\Local\Temp\domainrole.txtC:\Windows\System32\cmd.exe—WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2612wmic computersystem get domainrole C:\Windows\System32\Wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2760find /i /v "domainrole" C:\Windows\system32\find.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (grep) Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1708"C:\Windows\System32\cmd.exe" /c echo SCNameSpace = "" > C:\Users\admin\AppData\Local\Temp\wmiav.vbsC:\Windows\System32\cmd.exe—WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3132"C:\Windows\System32\cmd.exe" /c echo Set objWMIServiceOS = GetObject("winmgmts:\\.\root\CIMV2") >> C:\Users\admin\AppData\Local\Temp\wmiav.vbsC:\Windows\System32\cmd.exe—WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
1012"C:\Windows\System32\cmd.exe" /c echo Set colItemsOS = objWMIServiceOS.ExecQuery("SELECT * FROM Win32_OperatingSystem",,48) >> C:\Users\admin\AppData\Local\Temp\wmiav.vbsC:\Windows\System32\cmd.exe—WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
940"C:\Windows\System32\cmd.exe" /c echo For Each objItem in colItemsOS >> C:\Users\admin\AppData\Local\Temp\wmiav.vbsC:\Windows\System32\cmd.exe—WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Total events
2 138
Read events
2 134
Write events
4
Delete events
0

Modification events

(PID) Process:(2108) WScript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2108) WScript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
0
Suspicious files
0
Text files
124
Unknown types
0

Dropped files

PID
Process
Filename
Type
2504cmd.exeC:\Users\admin\AppData\Local\Temp\wmiav.vbstext
MD5:A12EB9AE0DFFD31ADAC7C3B49882AC5E
SHA256:689C5B4E9396FC6731AFE6129148C18F814F758909624EF8CD59BCFD8B064673
1024cmd.exeC:\Users\admin\AppData\Local\Temp\wmiav.vbstext
MD5:9288F94687E10BFC091FD833D73614CE
SHA256:E7E1EA7FF34B023C9F7B944DECE5F1A671F6ABFD9DCDAFFF5E325AE1974EDB39
3132cmd.exeC:\Users\admin\AppData\Local\Temp\wmiav.vbstext
MD5:9288F94687E10BFC091FD833D73614CE
SHA256:E7E1EA7FF34B023C9F7B944DECE5F1A671F6ABFD9DCDAFFF5E325AE1974EDB39
3816cmd.exeC:\Users\admin\AppData\Local\Temp\wmiav.vbstext
MD5:26590A6336C144342C603A9C6A082E1D
SHA256:00841D9142B3E73D25C4ED2422B43DA5A6F5BA42DFE7A1CC87E1DEB98B0C3477
2880cmd.exeC:\Users\admin\AppData\Local\Temp\wmiav.vbstext
MD5:A12EB9AE0DFFD31ADAC7C3B49882AC5E
SHA256:689C5B4E9396FC6731AFE6129148C18F814F758909624EF8CD59BCFD8B064673
1956cmd.exeC:\Users\admin\AppData\Local\Temp\wmiav.vbstext
MD5:26590A6336C144342C603A9C6A082E1D
SHA256:00841D9142B3E73D25C4ED2422B43DA5A6F5BA42DFE7A1CC87E1DEB98B0C3477
2760find.exeC:\Users\admin\AppData\Local\Temp\domainrole.txttext
MD5:B2E89836C8C89FFFFB14C1CB86559A26
SHA256:47F28FF4DA1895129C5EF6524BE86395D37A969DEF23C656B67B975616BE8A8A
3408cmd.exeC:\Users\admin\AppData\Local\Temp\wmiav.vbstext
MD5:A12EB9AE0DFFD31ADAC7C3B49882AC5E
SHA256:689C5B4E9396FC6731AFE6129148C18F814F758909624EF8CD59BCFD8B064673
328cmd.exeC:\Users\admin\AppData\Local\Temp\wmiav.vbstext
MD5:A12EB9AE0DFFD31ADAC7C3B49882AC5E
SHA256:689C5B4E9396FC6731AFE6129148C18F814F758909624EF8CD59BCFD8B064673
3748cmd.exeC:\Users\admin\AppData\Local\Temp\wmiav.vbstext
MD5:A12EB9AE0DFFD31ADAC7C3B49882AC5E
SHA256:689C5B4E9396FC6731AFE6129148C18F814F758909624EF8CD59BCFD8B064673
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
ffabcdef-2015-0630-1821-aaa040384214.vbs