File name: | CO4834646910423182803.vbs |
Full analysis: | https://app.any.run/tasks/ecd60125-e85d-4d9b-9845-1625ed020d0b |
Verdict: | Malicious activity |
Threats: | Qbot is a banking Trojan — a malware designed to collect banking information from victims. Qbot targets organizations mostly in the US. It is equipped with various sophisticated evasion and info-stealing functions and worm-like functionality, and a strong persistence mechanism. |
Analysis date: | September 19, 2019, 07:58:14 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | text/plain |
File info: | ASCII text, with very long lines, with no line terminators |
MD5: | 4CB9A75BBF76AC7195BA83B3E348C450 |
SHA1: | D8ABD44C157B42782FEF6F1DC510C92880D2554D |
SHA256: | CDE7B4DE81F8E2FC0B4399BAF9C5FF424647AF90B0A02756451364C5E1C8CB77 |
SSDEEP: | 49152:557xVZCD9wZUutJPJ90BVNOPaNM2IXKObyJRquqXwbH9YqII5FI0M2FTtGaJ6dCO:l |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3124 | "C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\CO4834646910423182803.vbs" | C:\Windows\System32\WScript.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 | ||||
3896 | C:\Users\admin\AppData\Local\Temp\JfjMKWavi.exe | C:\Users\admin\AppData\Local\Temp\JfjMKWavi.exe | wmiprvse.exe | |
User: admin Company: Allowdone Fishbowl Inventory Integrity Level: MEDIUM Description: PlanGrass Exit code: 0 Version: 12.1.25.40 | ||||
4072 | C:\Users\admin\AppData\Local\Temp\JfjMKWavi.exe /C | C:\Users\admin\AppData\Local\Temp\JfjMKWavi.exe | — | JfjMKWavi.exe |
User: admin Company: Allowdone Fishbowl Inventory Integrity Level: MEDIUM Description: PlanGrass Exit code: 0 Version: 12.1.25.40 | ||||
848 | C:\Users\admin\AppData\Roaming\Microsoft\Zulycjadyc\ytfovlym.exe | C:\Users\admin\AppData\Roaming\Microsoft\Zulycjadyc\ytfovlym.exe | — | JfjMKWavi.exe |
User: admin Company: Allowdone Fishbowl Inventory Integrity Level: MEDIUM Description: PlanGrass Exit code: 0 Version: 12.1.25.40 | ||||
3428 | "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\admin\AppData\Local\Temp\JfjMKWavi.exe" | C:\Windows\System32\cmd.exe | JfjMKWavi.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3980 | ping.exe -n 6 127.0.0.1 | C:\Windows\system32\PING.EXE | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: TCP/IP Ping Command Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3004 | C:\Users\admin\AppData\Roaming\Microsoft\Zulycjadyc\ytfovlym.exe /C | C:\Users\admin\AppData\Roaming\Microsoft\Zulycjadyc\ytfovlym.exe | — | ytfovlym.exe |
User: admin Company: Allowdone Fishbowl Inventory Integrity Level: MEDIUM Description: PlanGrass Exit code: 0 Version: 12.1.25.40 | ||||
3600 | C:\Windows\explorer.exe | C:\Windows\explorer.exe | ytfovlym.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
896 | "C:\Windows\system32\cmd.exe" | C:\Windows\system32\cmd.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 3221225547 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3336 | ping 8.8.8.8 | C:\Windows\system32\PING.EXE | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: TCP/IP Ping Command Exit code: 3221225786 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
(PID) Process: | (3124) WScript.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
(PID) Process: | (3124) WScript.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 1 | |||
(PID) Process: | (3124) WScript.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}\Enum |
Operation: | write | Name: | Implementing |
Value: 1C00000001000000E30709000400130007003A002E00CE0300000000 | |||
(PID) Process: | (3896) JfjMKWavi.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
(PID) Process: | (3896) JfjMKWavi.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 1 | |||
(PID) Process: | (3600) explorer.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run |
Operation: | write | Name: | jwpti |
Value: "C:\Users\admin\AppData\Roaming\Microsoft\Zulycjadyc\ytfovlym.exe" |
PID | Process | Filename | Type | |
---|---|---|---|---|
3124 | WScript.exe | C:\Users\admin\AppData\Local\Temp\heCOnSOg.txt | — | |
MD5:— | SHA256:— | |||
3600 | explorer.exe | C:\Users\admin\AppData\Roaming\Microsoft\Zulycjadyc\ytfovlym.dat | binary | |
MD5:7409A619C8C982489FB0DD1CA5292906 | SHA256:485101D2B518684E32821F0FAA049AB677EEF702DEE02AE00BE1DA6C166CC88B | |||
3124 | WScript.exe | C:\Users\admin\AppData\Local\Temp\rZldQMhe | text | |
MD5:B459D923A320C763283902CBC7474ACB | SHA256:CF586E46B32D9DEE78B815F9001AF7D206B317F603B62A6E8717CB034DE1F590 | |||
3896 | JfjMKWavi.exe | C:\Users\admin\AppData\Roaming\Microsoft\Zulycjadyc\ytfovlym.exe | executable | |
MD5:71375A441A725D774B9E59E5A9AAF15D | SHA256:E45BFB235195EA1C8427C5319F09B0172974700DAA31E6936AC42E23B1AFB263 | |||
3124 | WScript.exe | C:\Users\admin\AppData\Local\Temp\JfjMKWavi.exe | executable | |
MD5:71375A441A725D774B9E59E5A9AAF15D | SHA256:E45BFB235195EA1C8427C5319F09B0172974700DAA31E6936AC42E23B1AFB263 | |||
3124 | WScript.exe | C:\Users\admin\AppData\Local\Temp\heCOnSOg.txt.zip | compressed | |
MD5:B652E37A58AF39B08F9349B40C3B5CE0 | SHA256:DA2518595962838B612A29BE4BF4A9DDE1F28462244F8D36FC5D146287C2D0D7 | |||
3896 | JfjMKWavi.exe | C:\Users\admin\AppData\Roaming\Microsoft\Zulycjadyc\ytfovlym.dat | binary | |
MD5:E6559BB6DDAA6D1368CAB623D83616AC | SHA256:1095E563E7645F58646794906731A576FD88A5EE590F65593791CB0DAC41B57E | |||
3428 | cmd.exe | C:\Users\admin\AppData\Local\Temp\JfjMKWavi.exe | executable | |
MD5:60B7C0FEAD45F2066E5B805A91F4F0FC | SHA256:80C10EE5F21F92F89CBC293A59D2FD4C01C7958AACAD15642558DB700943FA22 |