analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

DocuSign.vbs

Full analysis: https://app.any.run/tasks/a3c997d4-bfc9-408b-92c4-a94bae1744f9
Verdict: Malicious activity
Analysis date: July 17, 2019, 05:07:01
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
MIME: text/plain
File info: ASCII text, with very long lines
MD5:

86E2864C90BC9A20EEF058131D99FD4A

SHA1:

4B2713BAF4EF2A80313228AA9B06442C44B6C39D

SHA256:

B179FF6896E19F4580172D540DA9C911CC743AD3BBC5C96B8DBAC98CADEFA573

SSDEEP:

1536:Vtccj7QruwFeijFeClXIgKHBPz/uSFWDfaIaakqknB3a8YjO+ypVMIMtdR03J:9Qyvij9lXI31JFWDibqk4oMI+dR03J

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Loads the Task Scheduler COM API

      • WScript.exe (PID: 3480)
    • Changes settings of System certificates

      • WScript.exe (PID: 3480)
  • SUSPICIOUS

    • Adds / modifies Windows certificates

      • WScript.exe (PID: 3480)
    • Executed via Task Scheduler

      • ntvdm.exe (PID: 3016)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
34
Monitored processes
2
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start wscript.exe ntvdm.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3480"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\DocuSign.vbs"C:\Windows\System32\WScript.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
3016"C:\Windows\system32\ntvdm.exe" -i1 C:\Windows\system32\ntvdm.exetaskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
NTVDM.EXE
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
55
Read events
42
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
3016ntvdm.exeC:\Users\admin\AppData\Local\Temp\scsC0A8.tmp
MD5:
SHA256:
3016ntvdm.exeC:\Users\admin\AppData\Local\Temp\scsC0E8.tmp
MD5:
SHA256:
3480WScript.exeC:\Users\admin\AppData\Local\Temp\TableOfColors.exehtml
MD5:BC819B58C22B536D9FD5139B79402C69
SHA256:5FEFBF00AF263260B411E043BE672018B58EC75CE049C409AA66EB3210674490
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3480
WScript.exe
205.185.122.149:443
successtosignificancecoaching.com
FranTech Solutions
US
unknown

DNS requests

Domain
IP
Reputation
successtosignificancecoaching.com
  • 205.185.122.149
unknown

Threats

No threats detected
No debug info