File name: | document3230.vbe.lz |
Full analysis: | https://app.any.run/tasks/3c1efb91-32fb-4e38-8a48-65dd02b4ee3e |
Verdict: | Malicious activity |
Analysis date: | December 06, 2019, 12:30:20 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-lzip |
File info: | lzip compressed data, version: 1 |
MD5: | 6B6ED100D2123C9A4414338718D0C35C |
SHA1: | 5F660301F5DF725E9968477548CFD32E30F7B054 |
SHA256: | BDE2D06BB333F419FFF16376FFFCE1EE434FA47CA57C4FCB80B2932F86892E40 |
SSDEEP: | 48:KMjnVVX18ijtl+OQxbWP3NOh2kzN1Hp9z3vqjX/7FWsAg02J6HCVVsWKLFkolmvr:Pf1bjqbW1O88N5p9c/7F0gzUiVMiZ |
.lz | | | LZIP compressed archive (100) |
---|
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3884 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\document3230.vbe.lz" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 | ||||
3964 | "C:\Windows\System32\WScript.exe" "C:\Users\admin\Desktop\document3230.vbe" | C:\Windows\System32\WScript.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 | ||||
3604 | "C:\Windows\System32\wscript.exe" C:\Users\admin\Desktop\document3230.vbe ___- | C:\Windows\System32\wscript.exe | — | WScript.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 | ||||
2260 | "C:\Windows\System32\wscript.exe" C:\Users\admin\Desktop\document3230.vbe ___- ___- | C:\Windows\System32\wscript.exe | — | wscript.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 | ||||
4012 | "C:\Windows\System32\wscript.exe" C:\Users\admin\Desktop\document3230.vbe ___- ___- ___- | C:\Windows\System32\wscript.exe | — | wscript.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 | ||||
3604 | "C:\Windows\System32\wscript.exe" C:\Users\admin\Desktop\document3230.vbe ___- ___- ___- ___- | C:\Windows\System32\wscript.exe | — | wscript.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 | ||||
504 | "C:\Windows\System32\wscript.exe" C:\Users\admin\Desktop\document3230.vbe ___- ___- ___- ___- ___- | C:\Windows\System32\wscript.exe | — | wscript.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 | ||||
1772 | "C:\Windows\System32\wscript.exe" C:\Users\admin\Desktop\document3230.vbe ___- ___- ___- ___- ___- ___- | C:\Windows\System32\wscript.exe | — | wscript.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 | ||||
2308 | "C:\Windows\System32\wscript.exe" C:\Users\admin\Desktop\document3230.vbe ___- ___- ___- ___- ___- ___- ___- | C:\Windows\System32\wscript.exe | — | wscript.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 | ||||
1636 | "C:\Windows\System32\wscript.exe" C:\Users\admin\Desktop\document3230.vbe ___- ___- ___- ___- ___- ___- ___- ___- | C:\Windows\System32\wscript.exe | — | wscript.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3884 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3884.44778\document3230.vbe | — | |
MD5:— | SHA256:— |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3700 | wscript.exe | 37.228.132.240:443 | potronisl.xyz | Mike Kaldig | DE | malicious |
Domain | IP | Reputation |
---|---|---|
potronisl.xyz |
| malicious |