File name:

VIRUS.vbs

Full analysis: https://app.any.run/tasks/3d7454dd-28b3-43fb-966f-8717cac8e627
Verdict: Malicious activity
Analysis date: November 06, 2024, 19:56:32
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines (3282), with CRLF line terminators
MD5:

8A58EC384F168EDB0DD4D868AC4D64D3

SHA1:

16B658089FC4DF6F1BDA0C695D356E4E9C422CDE

SHA256:

F409A4CFE8C62A4B12CCB516407CBBC0E50BFA9BCE3135B77E2714910FB0FAFE

SSDEEP:

384:VKkJEqj7yiNMthv03/SbHgB3CE4W1JdQwmFgRUQgxhd5gdVzmn:0kJh7hMtha1JXmFgRUQgxhd50Va

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Accesses name of a computer manufacturer via WMI (SCRIPT)

      • wscript.exe (PID: 6668)

    • Deletes a file (SCRIPT)

      • wscript.exe (PID: 6668)

    • Opens an HTTP connection (SCRIPT)

      • wscript.exe (PID: 6668)

    • Sends HTTP request (SCRIPT)

      • wscript.exe (PID: 6668)

    • Creates internet connection object (SCRIPT)

      • wscript.exe (PID: 6668)

    • Creates a new folder (SCRIPT)

      • wscript.exe (PID: 6668)

  • SUSPICIOUS

    • Accesses language version of the operating system installed via WMI (SCRIPT)

      • wscript.exe (PID: 6668)

    • Accesses WMI object, sets custom ImpersonationLevel (SCRIPT)

      • wscript.exe (PID: 6668)

    • Accesses computer name via WMI (SCRIPT)

      • wscript.exe (PID: 6668)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 6668)

    • Accesses domain name via WMI (SCRIPT)

      • wscript.exe (PID: 6668)

    • Access Product Name via WMI (SCRIPT)

      • wscript.exe (PID: 6668)

    • Accesses WMI object caption (SCRIPT)

      • wscript.exe (PID: 6668)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • wscript.exe (PID: 6668)

    • Saves data to a binary file (SCRIPT)

      • wscript.exe (PID: 6668)

    • Writes binary data to a Stream object (SCRIPT)

      • wscript.exe (PID: 6668)

    • Creates a Stream, which may work with files, input/output devices, pipes, or TCP/IP sockets (SCRIPT)

      • wscript.exe (PID: 6668)

    • Reads data from a file (SCRIPT)

      • wscript.exe (PID: 6668)

    • Executable content was dropped or overwritten

      • wscript.exe (PID: 6668)

    • Uses ATTRIB.EXE to modify file attributes

      • bvk8f24ai.exe (PID: 4040)

    • Accesses operating system name via WMI (SCRIPT)

      • wscript.exe (PID: 6668)

  • INFO

    • The process uses the downloaded file

      • wscript.exe (PID: 6668)

    • Checks proxy server information

      • wscript.exe (PID: 6668)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
142
Monitored processes
9
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start wscript.exe bvk8f24ai.exe no specs attrib.exe no specs rundll32.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs regsvcs.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
4040"C:\p2k2\bvk8f24ai.exe" bvk8f24C:\p2k2\bvk8f24ai.exe—wscript.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script
Exit code:
0
Version:
3, 3, 16, 1
5236"c:/windows/SysWOW64/attrib.exe"C:\Windows\SysWOW64\attrib.exe—bvk8f24ai.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Attribute Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
5976C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
6128"c:/windows/SysWOW64/attrib.exe"C:\Windows\SysWOW64\attrib.exe—bvk8f24ai.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Attribute Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
6668"C:\WINDOWS\System32\WScript.exe" C:\Users\admin\AppData\Local\Temp\VIRUS.vbsC:\Windows\System32\wscript.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6704"c:/windows/SysWOW64/attrib.exe"C:\Windows\SysWOW64\attrib.exe—bvk8f24ai.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Attribute Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
6792"c:/windows/SysWOW64/attrib.exe"C:\Windows\SysWOW64\attrib.exe—bvk8f24ai.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Attribute Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
6820"c:/windows/SysWOW64/attrib.exe"C:\Windows\SysWOW64\attrib.exe—bvk8f24ai.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Attribute Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
7080"C:/Windows/Microsoft.NET/Framework/v4.0.30319/RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe—bvk8f24ai.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Services Installation Utility
Version:
4.8.9037.0 built by: NET481REL1
Total events
1 332
Read events
1 328
Write events
4
Delete events
0

Modification events

(PID) Process:(6668) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6668) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6668) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6668) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
Operation:writeName:{2781761E-28E0-4109-99FE-B9D127C57AFE} {56FFCC30-D398-11D0-B2AE-00A0C908FA49} 0xFFFF
Value:
0100000000000000FBDA98008630DB01
Executable files
2
Suspicious files
14
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
6668wscript.exeC:\p2k2\pl11 —
MD5:—
SHA256:—
6668wscript.exeC:\p2k2\bvk8f241.42f —
MD5:—
SHA256:—
6668wscript.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CBFD26AD81503579EAD0290A94FE1E0Bbinary
MD5:CB0C83506E75555578488D4F5C06EDBD
SHA256:734A0A3B24BAD64BD87C03416AFDE490AAE1AB7BE9CBC5BBDEF31CA0015E68E4
6668wscript.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751binary
MD5:3DFCA46E00FFA4795C72A41375F159D3
SHA256:DCBA1A505396539BAC40A7253C9F5DCCF06CBB79957E21D56305E1FC3AF5F40E
6668wscript.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-msbinary
MD5:F48C729372514D8FD276F909752F87D3
SHA256:9097C767EF41040DD13C26C6CF3CBBE3C752E443B6C336BC110BEE4071E1B4AB
6668wscript.exeC:\p2k2\pl14a3x
MD5:76ED9BC052F4423B815875E443D0B914
SHA256:EDF1B194BAF7A3B727C72C86CE18AD61033198018F945477EC845DCABA60A36C
6668wscript.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\pl1475[1].h78binary
MD5:906253E2922C508AA7666AFCEA790B9F
SHA256:D02BB0B7A6515F045E79DE21E1168D7A420061E8A5B4A3EC25E81785E839C965
6668wscript.exeC:\p2k2\bvk8f244.zipcompressed
MD5:F635C8D173230913EC2EC0DAD18AAF43
SHA256:F97C65558AF960B60156D4CB50BD82EB2A329EC7D2A0A0775485BF095E53884C
6668wscript.exeC:\p2k2\bvk8f244.h78binary
MD5:906253E2922C508AA7666AFCEA790B9F
SHA256:D02BB0B7A6515F045E79DE21E1168D7A420061E8A5B4A3EC25E81785E839C965
6668wscript.exeC:\p2k2\pl1a3executable
MD5:0ADB9B817F1DF7807576C2D7068DD931
SHA256:98E4F904F7DE1644E519D09371B8AFCBBF40FF3BD56D76CE4DF48479A4AB884B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
41
DNS requests
25
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6668
wscript.exe
GET
200
95.101.54.123:80
http://e6.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBTUejiAQejpjQc4fOz2ttjyD6VkMQQUDcXM%2FZvuFAWhTDCCpT5eisNYCdICEgNWKYHlvSdzoKkEMENMwvHZuw%3D%3D
unknown
—
—
whitelisted
2724
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
2.16.164.9:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4360
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
4360
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
—
—
GET
200
23.32.185.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
—
—
GET
200
23.32.185.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
—
—
GET
200
23.32.97.216:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6944
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
5488
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1252
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4360
SearchApp.exe
2.16.110.202:443
www.bing.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6668
wscript.exe
92.205.59.135:443
135.59.205.92.host.secureserver.net
Host Europe GmbH
FR
whitelisted
6668
wscript.exe
95.101.54.123:80
e6.o.lencr.org
Akamai International B.V.
DE
whitelisted
2724
svchost.exe
40.126.31.67:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4360
SearchApp.exe
2.23.209.179:443
www.bing.com
Akamai International B.V.
GB
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
  • 51.124.78.146
whitelisted
www.bing.com
  • 2.16.110.202
  • 2.16.110.177
  • 2.16.110.170
  • 2.16.110.121
  • 2.16.110.122
  • 2.16.110.201
  • 2.16.110.193
  • 2.16.110.171
  • 2.16.110.200
  • 2.23.209.179
  • 2.23.209.140
  • 2.23.209.176
  • 2.23.209.182
  • 2.23.209.189
  • 2.23.209.130
  • 2.23.209.185
  • 2.23.209.133
  • 2.23.209.149
whitelisted
google.com
  • 142.250.186.142
whitelisted
135.59.205.92.host.secureserver.net
  • 92.205.59.135
whitelisted
e6.o.lencr.org
  • 95.101.54.123
  • 95.101.54.131
  • 2.16.202.114
  • 95.101.54.200
  • 2.16.202.121
  • 95.101.54.114
  • 95.101.54.145
  • 95.101.54.130
  • 2.16.202.115
whitelisted
login.live.com
  • 40.126.31.67
  • 20.190.159.0
  • 20.190.159.64
  • 20.190.159.71
  • 20.190.159.73
  • 20.190.159.23
  • 20.190.159.75
  • 20.190.159.2
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
go.microsoft.com
  • 2.23.193.158
whitelisted
crl.microsoft.com
  • 2.16.164.9
  • 2.16.164.49
whitelisted
www.microsoft.com
  • 23.32.97.216
  • 23.32.185.131
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
VIRUS.vbs