Find similar analyses in TI Lookup

Analysis date (UTC): 22 January 2020, 18:26Analysis environment: Windows 7 Pro, build 7601, x64

JVC_41642.vbs

MD5:58BFA99CD32BE2E4E00CF1B67A7CF55E

SHA1:02F2B74BB145BD49C1B331D50A86FF92F9AD91A5

SHA256:95C6C6152C3E08B3D342B896C6CD5A9385E721C9C31B19C6FDBA56F7DCBE5BAC

Analysis result

Threat level:Malicious activity

Tags:

qbottrojan

Full analysis:Analysis JVC_41642.vbs (MD5: 58BFA99CD32BE2E4E00CF1B67A7CF55E) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Application was dropped or rewritten from another process

ColorPick.exe (PID: 2872)
ColorPick.exe (PID: 1004)
imtaykad.exe (PID: 1500)
imtaykad.exe (PID: 2128)

QBOT was detected

ColorPick.exe (PID: 2872)

Runs PING.EXE for delay simulation

cmd.exe (PID: 1832)

Changes the autorun value in the registry

explorer.exe (PID: 1640)

SUSPICIOUS

Reads the machine GUID from the registry

WScript.exe (PID: 2240)

Executable content was dropped or overwritten

WScript.exe (PID: 2240)
ColorPick.exe (PID: 2872)
cmd.exe (PID: 1832)

Application launched itself

ColorPick.exe (PID: 2872)
imtaykad.exe (PID: 1500)

Starts itself from another location

ColorPick.exe (PID: 2872)

Starts CMD.EXE for commands execution

ColorPick.exe (PID: 2872)

Creates files in the user directory

ColorPick.exe (PID: 2872)

INFO

Dropped object may contain Bitcoin addresses

cmd.exe (PID: 1832)

Threats

PID	Process	Class	Message
2240	WScript.exe	Potential Corporate Privacy Violation	ET POLICY PE EXE or DLL Windows file download HTTP
2240	WScript.exe	A Network Trojan was detected	AV POLICY EXE or DLL in HTTP Image Content Inbound - Likely Malicious
2240	WScript.exe	Misc activity	ET INFO EXE - Served Attached HTTP
2240	WScript.exe	Misc activity	SUSPICIOUS [PTsecurity] PE as Image Content type mismatch