File name:

VIRUS.vbs

Full analysis: https://app.any.run/tasks/3d7454dd-28b3-43fb-966f-8717cac8e627
Verdict: Malicious activity
Analysis date: November 06, 2024, 19:56:32
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines (3282), with CRLF line terminators
MD5:

8A58EC384F168EDB0DD4D868AC4D64D3

SHA1:

16B658089FC4DF6F1BDA0C695D356E4E9C422CDE

SHA256:

F409A4CFE8C62A4B12CCB516407CBBC0E50BFA9BCE3135B77E2714910FB0FAFE

SSDEEP:

384:VKkJEqj7yiNMthv03/SbHgB3CE4W1JdQwmFgRUQgxhd5gdVzmn:0kJh7hMtha1JXmFgRUQgxhd50Va

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Accesses name of a computer manufacturer via WMI (SCRIPT)

      • wscript.exe (PID: 6668)

    • Creates a new folder (SCRIPT)

      • wscript.exe (PID: 6668)

    • Creates internet connection object (SCRIPT)

      • wscript.exe (PID: 6668)

    • Opens an HTTP connection (SCRIPT)

      • wscript.exe (PID: 6668)

    • Sends HTTP request (SCRIPT)

      • wscript.exe (PID: 6668)

    • Deletes a file (SCRIPT)

      • wscript.exe (PID: 6668)

  • SUSPICIOUS

    • Accesses WMI object, sets custom ImpersonationLevel (SCRIPT)

      • wscript.exe (PID: 6668)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 6668)

    • Accesses computer name via WMI (SCRIPT)

      • wscript.exe (PID: 6668)

    • Access Product Name via WMI (SCRIPT)

      • wscript.exe (PID: 6668)

    • Accesses domain name via WMI (SCRIPT)

      • wscript.exe (PID: 6668)

    • Accesses WMI object caption (SCRIPT)

      • wscript.exe (PID: 6668)

    • Accesses operating system name via WMI (SCRIPT)

      • wscript.exe (PID: 6668)

    • Accesses language version of the operating system installed via WMI (SCRIPT)

      • wscript.exe (PID: 6668)

    • Writes binary data to a Stream object (SCRIPT)

      • wscript.exe (PID: 6668)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • wscript.exe (PID: 6668)

    • Creates a Stream, which may work with files, input/output devices, pipes, or TCP/IP sockets (SCRIPT)

      • wscript.exe (PID: 6668)

    • Saves data to a binary file (SCRIPT)

      • wscript.exe (PID: 6668)

    • Reads data from a file (SCRIPT)

      • wscript.exe (PID: 6668)

    • Uses ATTRIB.EXE to modify file attributes

      • bvk8f24ai.exe (PID: 4040)

    • Executable content was dropped or overwritten

      • wscript.exe (PID: 6668)

  • INFO

    • Checks proxy server information

      • wscript.exe (PID: 6668)

    • The process uses the downloaded file

      • wscript.exe (PID: 6668)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
142
Monitored processes
9
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start wscript.exe bvk8f24ai.exe no specs attrib.exe no specs rundll32.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs regsvcs.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
4040"C:\p2k2\bvk8f24ai.exe" bvk8f24C:\p2k2\bvk8f24ai.exe—wscript.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script
Exit code:
0
Version:
3, 3, 16, 1
5236"c:/windows/SysWOW64/attrib.exe"C:\Windows\SysWOW64\attrib.exe—bvk8f24ai.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Attribute Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
5976C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
6128"c:/windows/SysWOW64/attrib.exe"C:\Windows\SysWOW64\attrib.exe—bvk8f24ai.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Attribute Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
6668"C:\WINDOWS\System32\WScript.exe" C:\Users\admin\AppData\Local\Temp\VIRUS.vbsC:\Windows\System32\wscript.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6704"c:/windows/SysWOW64/attrib.exe"C:\Windows\SysWOW64\attrib.exe—bvk8f24ai.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Attribute Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
6792"c:/windows/SysWOW64/attrib.exe"C:\Windows\SysWOW64\attrib.exe—bvk8f24ai.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Attribute Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
6820"c:/windows/SysWOW64/attrib.exe"C:\Windows\SysWOW64\attrib.exe—bvk8f24ai.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Attribute Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
7080"C:/Windows/Microsoft.NET/Framework/v4.0.30319/RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe—bvk8f24ai.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Services Installation Utility
Version:
4.8.9037.0 built by: NET481REL1
Total events
1 332
Read events
1 328
Write events
4
Delete events
0

Modification events

(PID) Process:(6668) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6668) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6668) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6668) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
Operation:writeName:{2781761E-28E0-4109-99FE-B9D127C57AFE} {56FFCC30-D398-11D0-B2AE-00A0C908FA49} 0xFFFF
Value:
0100000000000000FBDA98008630DB01
Executable files
2
Suspicious files
14
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
6668wscript.exeC:\p2k2\pl11 —
MD5:—
SHA256:—
6668wscript.exeC:\p2k2\bvk8f241.42f —
MD5:—
SHA256:—
6668wscript.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-msbinary
MD5:F48C729372514D8FD276F909752F87D3
SHA256:9097C767EF41040DD13C26C6CF3CBBE3C752E443B6C336BC110BEE4071E1B4AB
6668wscript.exeC:\p2k2\bvk8f244.h78binary
MD5:906253E2922C508AA7666AFCEA790B9F
SHA256:D02BB0B7A6515F045E79DE21E1168D7A420061E8A5B4A3EC25E81785E839C965
6668wscript.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CBFD26AD81503579EAD0290A94FE1E0Bbinary
MD5:34ED76FA842860E6DCB3CB26794D3702
SHA256:2CCA1FA84EA23AEA93200A1D1926836EBBC2120409CE0F045AC7F0737B80A830
6668wscript.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\pl1a[1].htmtext
MD5:CAFBBAEC065C22D42F9A3C9D873B9E9B
SHA256:BBDB9B9D9A8D2F1AA83E8F7D60B98A2D1FA404F0E889E00B6B3F53AEC57539AE
6668wscript.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH8CR9J5\pl1am1[1].h78compressed
MD5:347FFF1F69C6ABD735DE356D7FBC0AE0
SHA256:17197B58343A9BA5F6110C6B9E2A723A8AE49BB3F8DBB50F98E866A3E954F87B
6668wscript.exeC:\Users\Public\Etext
MD5:5C8038AC5DF5BF4E394477B5B2D5F174
SHA256:C62141F7994CEA740177EBDD625B07BFA46F359C3560918BC41B6F9CA3927EDB
6668wscript.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\pl1475[1].h78binary
MD5:906253E2922C508AA7666AFCEA790B9F
SHA256:D02BB0B7A6515F045E79DE21E1168D7A420061E8A5B4A3EC25E81785E839C965
6668wscript.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751binary
MD5:3DFCA46E00FFA4795C72A41375F159D3
SHA256:DCBA1A505396539BAC40A7253C9F5DCCF06CBB79957E21D56305E1FC3AF5F40E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
41
DNS requests
25
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6668
wscript.exe
GET
200
95.101.54.123:80
http://e6.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBTUejiAQejpjQc4fOz2ttjyD6VkMQQUDcXM%2FZvuFAWhTDCCpT5eisNYCdICEgNWKYHlvSdzoKkEMENMwvHZuw%3D%3D
unknown
—
—
whitelisted
2724
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4360
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
—
—
GET
200
2.16.164.9:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4360
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
—
—
GET
200
23.32.185.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
—
—
GET
200
23.32.185.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
—
—
GET
200
23.32.97.216:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6944
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
5488
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1252
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4360
SearchApp.exe
2.16.110.202:443
www.bing.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6668
wscript.exe
92.205.59.135:443
135.59.205.92.host.secureserver.net
Host Europe GmbH
FR
whitelisted
6668
wscript.exe
95.101.54.123:80
e6.o.lencr.org
Akamai International B.V.
DE
whitelisted
2724
svchost.exe
40.126.31.67:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4360
SearchApp.exe
2.23.209.179:443
www.bing.com
Akamai International B.V.
GB
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
  • 51.124.78.146
whitelisted
www.bing.com
  • 2.16.110.202
  • 2.16.110.177
  • 2.16.110.170
  • 2.16.110.121
  • 2.16.110.122
  • 2.16.110.201
  • 2.16.110.193
  • 2.16.110.171
  • 2.16.110.200
  • 2.23.209.179
  • 2.23.209.140
  • 2.23.209.176
  • 2.23.209.182
  • 2.23.209.189
  • 2.23.209.130
  • 2.23.209.185
  • 2.23.209.133
  • 2.23.209.149
whitelisted
google.com
  • 142.250.186.142
whitelisted
135.59.205.92.host.secureserver.net
  • 92.205.59.135
whitelisted
e6.o.lencr.org
  • 95.101.54.123
  • 95.101.54.131
  • 2.16.202.114
  • 95.101.54.200
  • 2.16.202.121
  • 95.101.54.114
  • 95.101.54.145
  • 95.101.54.130
  • 2.16.202.115
whitelisted
login.live.com
  • 40.126.31.67
  • 20.190.159.0
  • 20.190.159.64
  • 20.190.159.71
  • 20.190.159.73
  • 20.190.159.23
  • 20.190.159.75
  • 20.190.159.2
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
go.microsoft.com
  • 2.23.193.158
whitelisted
crl.microsoft.com
  • 2.16.164.9
  • 2.16.164.49
whitelisted
www.microsoft.com
  • 23.32.97.216
  • 23.32.185.131
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
VIRUS.vbs