JVC_56817.vbs
This report is generated from a file or URL submitted to this webservice on November 11th 2019 18:09:47 (UTC)
Guest System: Windows 7 32 bit, Professional, 6.1 (build 7601), Service Pack 1
Report generated by
Falcon Sandbox v8.30 © Hybrid Analysis
Incident Response
Risk Assessment
- Network Behavior
- Contacts 1 domain and 1 host. View all details
MITRE ATT&CK™ Techniques Detection
Additional Context
Related Sandbox Artifacts
- Associated SHA256s
- eb1374e85f53f478b3b5b8a297468096c7fec8b5cbc13910c98934ae00afa142
Indicators
Not all malicious and suspicious indicators are displayed. Get your own cloud service or the full version to view all details.
-
Malicious Indicators 1
-
Unusual Characteristics
-
References suspicious system modules
- details
- "iniser tailzie lenientness Sinnamahoning Clemence harmoniousnesses boot-topping roentgentherapy undecimal putzes dissatisfying preconsecration hordarian Karabagh endues corybantish furmeties nanitic Capernaitic exocyclic melilite-basalt bellyaches hen-fat napes ungleaned jabirus unprecipitateness gourmander Harleyville woodjobber treddled Grecian Trans-germanic rugged bedrabbled veridicous minibudget spiculiform zoogler elementalistically swervers nonexpanding heptastich forechoir outfielded calabazilla God-wrought mutuate melanocomous trivialization Uttica quinoxalin aeronautical steel-framed plumbago tumatakuru antienergistic obsoleted saladero all-quickening night-tide jamoke molto unextenuated geraniol Elsass underbridging retarded mellow-eyed sectarians spirit-freezing Autunian phytase keratosic Tadeas iron-forged spin-off Spizella Laelia sworded intrants ays glazement Luristan academicianship hexeris Theilman unvenialness kamptulicon antasthmatic knucklebones pentapolitan biotechnologically custard quid"
- source
- File/Memory
- relevance
- 5/10
- ATT&CK ID
- T1215 (Show technique in the MITRE ATT&CK™ matrix)
-
References suspicious system modules
-
Suspicious Indicators 5
-
Anti-Detection/Stealthyness
-
Possibly tries to hide a process launching it with different user credentials
- details
- ImpersonateLoggedOnUser@ADVAPI32.DLL from wscript.exe (PID: 2060) (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 3/10
-
Possibly tries to hide a process launching it with different user credentials
-
Anti-Reverse Engineering
-
Possibly checks for known debuggers/analysis tools
- details
-
", Sbji)
On Error Resume Next
'manslaughters Allhallowtide pollinarium edictum ireful appressoria cabassou irretraceably precranial terraciform dressmakings Ascabart nectarize waterbailage chasmophyte Gastropoda guardo univalent Hekatean Peeblesshire Clement form-revealing Hinch hadji unhydraulic bleakness shiftman hyperkalemic achaenocarp depended harpooning NASDAQ unantiquatedness Denticeti double-timed rapture-bursting Alphonso offend snuggeries Tex unulcerousness Saprolegniales Karakatchan bailieries unteem Hankamer polarise Aneta unsourness crotcheteer vice-consul slave-owning world-amazing broad-horned rabble-courting dulwilly superseverely Tiresias unendamaged beefwoods poverty-stricken rapeoil humbled contentional Keith dichromic burd-alone hardenedness biporose Eckart spokesmanship encorpore misquoter Vespertiliones multiplexers batardeau melada demi-batn Valle superfoliaceous macrosomatous dingles Alarodian trickment McGee inconsequentia vitrify sclaffed Houyhnhnm vealskin appulse deformedness afford" (Indicator: "ntice")
"ism consuete unremonstrated inclasps Prattsburg ahuatle prehensorial noneligibility attomy unchiseled silkman myriadth writing enliveningly Juneflower compartmentally kalians perfervour dotlike Paulinistic gavot anstosse benzotrifuran disrupting trillet abumbral milkshake apostille piezochemical witchercully Chaille Eyota Keizer brosse McNabb figured postclassic subduable equibiradiate dittographic lipper hypoplanktonic Indianhead devotionist cedent eastwards unenticeable apathies apocalypticism leafer ontocycle Marciano tomblet hind-calf fluoroscopy noshed Elkland tubiform Kavla ameliorableness Zacherie Wellesz Urocerata irregularism overanxiety fatigued reset scrubbiest nonprotectively partridging Republicanism uvanite stingily world-encircling Eurydice lemniscus possessor decommissions poorhouses ambital skatole smidge Epimetheus felt-lined mewlers inust oximation moxieberry Roskes totten Kacerek fatsos bluesides ratlin heroship bowedness kinematographical newbornness near-dwelling overriches rheostat Purk" (Indicator: "ntice")
"m twice-judged justiciary zigzagging lepido- Horne kaliph Blakely concredit Dicyemida aquaplaned coopery orthotonesis rostrulate unpiety subcaption moulinage peatstack Non-hindu mist-enshrouded razorable milia Furness soon-repeated predacious bellmouth values overcanny jeapordized girth entomologists diapalma unenticed unsoaring tumultuoso faintheartedness melodics pulvinule
'mollifier stony-eyed nonviviparity staghunter danios slumber praenomens sesamol blearing counterprotest aerolitics enginous aeolipile camels Djailolo unhusbanded lamentational blazoning anatira flatters decurions extraterritoriality syruper tonemes deaconhood tilmus PhL urbanity chickee Schlesien cantator demobbing incendiarized quarter-foot Betz FSF pentalobate surf-worn stateable clovene risberm Jeremias henhussies nonregeneration catalogic hypophyseal Taro divinest BITS mis-stop plotties faced unpious micropathologist tracheophonesis acraldehyde cachectical Pontypool well-compared ribby capotes giantesses snoods wildfires unedaciousl" (Indicator: "ntice")
"distributed founded pseudobankrupt Beauvoir undershooting nimble-feathered pyrometamorphic nonadecane intuition rehammered true-seeming gunfight enslavement tonally Haslet camails ambidextral Ecorse unclassifiable inerrability fibrillar unrejuvenating agcy. weight-bearing heavy-soled undecree ring-billed sculler electroluminescent stimulus heterofermentative premie nongovernance reslate spidered greatheart melicrate nonegoistical authigenous Muses Celestyna Rexer clemmed Kelliher balcone tricyclene overgrowth consuetudinal fraud Vaishnava lenticellate samek drawboring ideopraxist halesome Midis Curzon Edgehill strokesman swarmer opprobriating irreciprocity busticate struts carvene neighboured despondingly gastrimargy SV yeomanhood overdosage MusM patricides CSRG combinatory metallographic two-footed overabounded fetor phosphoric omoplate Charadrii buntine factiousness guid metaluminate nonscholastically straddle middlehand stropping indiscussible pyorrheal quasi-helpful Glendean Lempres inadmissability gurshe" (Indicator: "ntice")
"umptious anticentralization irremeable pashaship nimb microcoded hirsel whistle-stop blossom-crested sworn Enschede prediscriminator richling horray Lafargeville godson Blackmun airbag alnager Bellport timbrelled defenceable amotus quick-designing periphrastic Aulis Larrisa half-feminine brakier unchildish insurgence multithreaded Bagehot theody interpretate sorbose orthographized poesiless testatrices pressingness Struthers nonrationalistical semipublic formates short-horned sinful stubb Signor untucked loud-acclaiming gleanable Soter Jorgenson rigged Cecil assedation sadisms affirmance desulfurisation Dafter Nor intragroupal tavoy sequiturs broadcasts densify bowering prodigiosity nondivisible groomsman styful conceptiveness barie neuration moonishly outroyal nebulously proctored flits economists unimacular agria overcoil eupnea arteriac recut Brynna panhyperemia gospel-true prepollent sun-loving cheesecloths inshrining nonenterprising bodyhood quasi-compound willable semelfactive Vadso laughs unaverred der" (Indicator: "ntice")
"alizing war-weary graysby penni- requoting pectinatodenticulate parcenary leers orchiectomy atwin denizenship inconspicuously temporization lauders violan nonparlor prepostorship glassmen swarms orthopraxis sentinelship outdrove filiate Lazarus vitaminologist overplainness intermesh herpet- insulators Sade gibbet worldway nonindustrial untrailerable carancha laterotemporal noncertification connumeration ripienos sarcosporidial predeath Timote dept. sentinelship Pleurodira ayllu constringency pretension barfly abos vivisepulture dolerophanite perispomena selenates millisiemens inflowing cableways muskeggy Birchism Carian jotter longrun hogshouther hutchinsonite fire-swift crudwort magnetite-olivinite Paulo hopples parodiable Mossville highjacks Hohenlohe prerespire chloritic kinbote sobersidedly constructions cap-paper irreplevisable pogonips praelect drumbler turbidite lingwort versificator Jeffersontown waffly denominations small-clawed bumpoff mid-lent gratulant generability Sour apprenticement kept biclini" (Indicator: "ntice")
"decumana sexuality Caroleen unfurnished bodybuilder siliconize stoichiometrically nontumultuous arrouse Tezcucan unornately porkeater uncultivatable abbrev Pacceka fixive aplanogamete sarcastic namesakes subsextuple oblational metrise symptoms preimitating varico- centals vulcanization dure gaub Frulla hoodooing codical lavalava distrix completely asem reinfuses valued limpest Asopus overgreatly supramolecular quasi-deliberately Pioneer well-applied grf razeed ctenizid yellowbark crankness acousmas hollering undismembered hatchetlike shores lowmost junkboard preballoting Brucella rittingerite malax impermeabilize tripletree militation feveret Chenoweth disorganiser enticed nooklike gaminesses suicidally housed loup-garou overbid mescaline credulously Gallus suggestivity monothetic mid-aged Waban Zsa azygobranchiate organographical vagabondia emprosthotonic adnumber Pennsboro Miryam multituberculated cancellarius autoexcitation branky burlesquely heritrix fuelling Atlantic unpretended peepy octoroon high-duty" (Indicator: "ntice")
"rsive Gesnera coparent flat-footed yellow-dog syringes hardenability well-relishing receiptor Berberian obsessions displayer jamwood readopt solilunar actinons visioned password talaric noncomprehendingly cabled scullog Asshur jesses Daedalist mimmed fullery kirned laureation Townville differers bourgs isotrehalose unebbed Fiske interentangling anticeremonialism glugglug peachlike untorn arrhal unanswered Linkoski ramental resubmits sandy-colored Hammad hypophyll igniting rivalries geotectology lupinaster Kirkville subtercelestial contemporizing Wilkie theorical Avisco Lupercal plate-mounting unvagrantly underwriter nonsanguine vesicorectal retallies rewater vireonine overneutralize mezuzoth Necturus dun-diver megalogastria talweg promycelium exhortatively inspeximus serenissimi middlewards laryngo- fibrocement mphps cross-examination appellatively mid-tide RCM gaum politico-religious okshoofd forbode manganite sonnies renderset carbohydrogen oxazin Pitris swelled promnesia Gegenschein implosive breakfasting" (Indicator: "ntice")
"ebog self-condemnation laughability Madson Marxianism Anisodactyla mintier triliteralness ceryl afterward unkindred mataeologue scholarly well-stressed zapping pily prandial herbbane elixirs abiotrophy firm-set contradictions dreich dozent eugenesic emotionist inadvertently MSA underchin pennine cringer Telesphorus tree-dwelling Puett Lumberport two-party puckling profluvious bloodcurdlingly pleasurous condisciple manumotive perlucidus mesothoracic diverticulum intercommuned magdalens tugurium tomosis deludingly sea-run lighted xanthoprotein ward-walk nonreservable overdiverseness prematurely palaeozoological prodespotism TSPS multiplicator ponticello zagaie unurban Etters hemaphein achromatic Gabbert lasso Canarese well-principled Synarmogoidea microdensitometer bocal bondman helcotic nonopprobriousness blowziness sloth smokechaser jailbird Lenthiel acritochromacy critic Mawson cashaws symbolicly multiplane Lawen ambaree eremuri devisals semicompacted amplex VMC nonatheistically irradiant punditically assura" (Indicator: "ntice")
"decemviral Sinclair sexpots antiadministration rich-ored originant fever-shaken red-vested stealings benzole Jenn elan begorry New-Testament weariedly Norseman unembanked unlent dextran green-grown Chretien glossitis pastimes Veneaux squatty heterogenicity toccate slipformed kipe trenchboard naphth- flasker Katuf enl myxomatous chondromas Mommsen lipoids slipboard rose-growing SJ consumer subfoliate nonwhite Myingyan potamologist phonated madreporal thinolite soldadoes reef-knoll smoky-blue Philo-german synangium Emmerie thirteen tweakier theodicy bowllike venanzite ink-blurred twenties malaroma spray-casting Macedon monohull foreshoulder hellweed cornbell overstraining Interlachen Tlepolemus preterequine chatelainry ever-blessed Elath telebarometer streetwalkers self-subsistency colead Elger thersitical uncredibility uncollectable nastily enticement ray-illumined sublimate moslings unsectarianize quasi-absolute snailed minisystem constrains grubs prereformation shebeen extima divulsion transseptal chucker-ou" (Indicator: "ntice")
"wimick half-intellectual avenage anticentralism unbowing pub. Olney semi-ironically vasifactive Caball offscourer RARDE tanagrine misclasses turrigerous Luke shadier psilosophy polyprothetic updrink oversentimentalize nonsailor agronomical Goda I.C.S. FOIA desmosite retroxiphoid unrapturous amphipodal VFO tsetse petrosum safer mistakenness crampit amour-propre repels miscreative expectations herbicidal chromotherapist contras assemblages hollowing cladosiphonic haptere loppiest misbeliever teleseme numerous stanchly sparse-flowered deficience aurorean whatd Rockhall unstored outskirmish kobong unnotable Un-johnsonian nonnatural nonsalutarily cordless Geckotidae cariform over-people epiglottises lamellation unsingularly guillotinist unstatically Hildesheim overcorrects squamousness forkers non-resistance NFC co-operable unconformism Malvastrum westlan iconomania phytopathological embolomycotic untwistable embaphium Ciri bowline fascias overmost Kraska meguilp uncontributiveness sulfurate prevailer Ingaevones" (Indicator: "ntice")
"ous exposure anticentralist unready glasswort thunder-scarred vinylated skepticalness muffles shortly microlepidopterous seventy-eight readouts siris Triangulid thresholds coraled quasi-poetical leapfrogged rekeys mechanicalization allegation mondsee out-settlement alburnous reorganizations bewray swing-wing piceous Bugas fishpond bubonic agalactia Djagatay germiniparous Hygeia coproduced gnattiest macroeconomic jamdani headsails forestial Gracilariidae Bogie quick-setting microphotometrically urlar typeable untouched superaqual Meldon dolente etherialise Meyeroff pre-engage ovenwares tomcatting supersulfureted ureameter unnaive hornmouth runchweed semiclose preconfigured simuliid airfield roto accordance nonsolidification arumlike venturously self-schooling electronically steeper underswept Colp barwin Manicheism unwinder chouette undrifting admittee thewiest capicha daffiest indrawal Glenlyn laryngemphraxis nonwaiver Ostracoda diffusors inkweed abcess TANSTAAFL pseudoassertively gnosiology goldarn untestabl" (Indicator: "ntice")
"oceaceae salutiferously unscanted saws Prosopium hypoptilum countercross ilicin Calvados unaddictedness alemmal baccalaureat quakier Monochlamydeae semisucculent gorhen backpedal maturable glottalize Sholapur Avery overwrap quasi-normal plagues Akhissar Onemo anticentralist thiefdom dereligionize scammed triplicature unloose ureterorrhaphy dry-bones matchstalk sixty-two serau lampoons Sinophile irrotationally ganancias rivalries britishers Lyndell cardionecrosis interproduced blasties manada quasi-confidentially collenchyma clinicopathologically genuflector fluviovolcanic misseldin Symplocaceae collatitious Stictaceae stunsle verbiles Bozrah verbenaceous customhouse motographic bouzouki subcollateral bingy Pliam Brale nonecliptic eloping quasi-helpful renotation diplomatique Winnetoon piaffe Tupaiidae pachadoms conclave tetrachical brass-lined anteroflexion macropia fats Arondell deek machismo Charcot tripudiate antsy drum-major postboys neighboured inconvincible unfearing Clint hierogamy naggly sheenies titi" (Indicator: "ntice")
"sts pre-enable nonfictional heliocentricity divestiture unhull cob-nut lenticel fixion korats Typhonic itching fixes graniticoline tow-spinning nonactualness Bezae hair-worm tillage fickle-mindedness remittal repatriate agneau Seel steamie ancony syntonized monosilicate maternities je-te C/L nonavoidableness laparosplenectomy Mariejeanne Poulter bishopess asymptotically telaesthesia engorgement Pilate phosphoreted revacating corklike mucosopurulent phosphuret Camerinidae orcins hoazin priest-statesman gridders corpore Lophiidae cinel unrugged pyramidal underexcited quinonimin timberwork unwithstanding relatrix laboratorially sadirons sideways all-night infracts verbile domiciles gleetier areopagy solanos bandwork Assamese stigmonose sifted conveyance extincteur bliaut hyperinotic sensus seeress ominously unchalked nettled Gorlicki overappreciation chlorazide subalar bedchairs seigniories narcohypnosis twin-jet larders benchmark prostrated methodeutic patana hand-rubbed Isanti potmen appendicocaecostomy suppos" (Indicator: "ntice")
"ionist two-shanked onirotic quads valuable swooned arboreally antiduke polymicrobial lumbrous motived waggled neolith Salix Scotties anticensorship precaria extispicy unapproachable Mdlle purposed blunt-nosed Sagai visory strawberrylike Lowes creches Anser coenurus Bosnisch proambient tuberculinisation overcherish Exc. Fuirena bident travel-broken realleged purpresture overscrub holosaprophyte four-decked fatuitous lops peridiiform moorburning undertutor soulsaving cartels sire Egan Alfonson meriquinonoid platformally flaser callosity bolognas houdah Saan hedonophobia Tecumseh Port-of-Spain troves thigmopositive glittering outcropper azox pinesaps outstating swordster Sothiacal freestones repentant fire-winged acardia overrefining semitour veratraldehyde supracentenarian noncommunally subobsoleteness throat-full step-up B.S. rubber-faced augen-gneiss dragonkind ascetical WAAC Sovietisation Onslow Bernete comfortless snow-on-the-mountain self-roofed double unsurgically blue-red preliquidated chinkers brownback" (Indicator: "ntice")
"gined Purpura stonished chinchy listerellosis obligated nine-hole preps Verdel sikerness underwent trumeaux hypocist himming cocurricular regrinder venerably kemps untrusted Belva irrepressible apnoeic oversetter Kovalevsky redheadedly lapilli mill-headed epiphloedal passe-partouts unintrusive naps naumachy splaying circumstantialness zoologists Sufis teleutospore feaze intebreeding barbigerous coextension unreasonable wet-nursing Isidro orabassu irrepressible frottages parageusic steel-nerved fumariaceous Galasyn strength-restoring roasters strange-met epinicial limitatively well-doer truth-shod Gail inessive down-wash superdelicately overmost simuliid chimango endocardium intice De-judaize face-ache ingratefulness culrage parasangs razor-shaped macrochemical Mesostomatidae cageless vastness amylenol helzel cadie Doketic Ixodes excamber sconcer foam-white Baumbaugh urdy oinochoai brandishes plaustral spermatoblast Phrygia too-soonness invicted Margarethe preconcentrated arcanums AIPS incidents Hinduizing luk" (Indicator: "ntice")
"ley splanchnopleural tumbling taxinomist carpo- oecumenicity rampager uncorseted override slash-sawn giantish eradicatory Lutjanidae subtepidity offcast undragoned fasciculation retrothyroid demi-paradise Tetrodontidae apprentice gem-grinding cow-pox preintelligently alkalizate Digo-Suarez ungenitive indirectnesses hootay FRCS displaced catacoustics fluxionary canonicalization rebuild undersoil zodiacal self-unveiling predescription Chandal tuberculinize truckle stooped mulligans hooknoses nonsanguine Lise hodden overspoke deputationize Sif gas-light Ixodidae observatorial arbored bebeast thumb-worn otherdom homogamies coquitos resink nondominating prenominating preboom occipitomastoid prebarbarousness craunched timberlike Titonka MOTSS madwoman Salieri Anglo chivareeing low-test Schaumberger rufotestaceous granuliform reboantic Ebneter vinal soft-treading overdilate sycoma forcat Jovianly releather lecama koniscope wolfhood squamule unfearingness razz Kal Cis-reformation blepharitis unimpressiveness frivolit" (Indicator: "ntice")
"nlinesses undub shrievalty adrenomedullary Buchanite punctuation gemming palmi- Henebry freakdom hypophysectomize demulsion weazen-faced overglancing lateroposition embellishes pantosophy tussocked contiguities Seed Futurism spunkies tertiate chylo- whitewasher mongrelising ia- world-imagining interval underworld unprincipal boustrophedon Aerocharidae spex spryly electrize Kermie totteriness overblame skywave brachycephalic Teleplotter malleation Austria-Hungary hability ill-use unprimitively microorganismal rosetta-wood pin-head mered correspondences membranoid Jentoft recur Papeete delineament adaptative unflat zoography absorbedness beggarliness oesophagismus Czernowitz noncloistered chocard holystoning pebble-paven cuculliform meriquinoidal pluriseptate preaccess teaming squirrelfish misdate autarky shallow-pated choirmaster Lettic distomian petchary prerecited climbingfish unaccidentally Obafemi Adaliah urous appal misencourage right-turn fleeciness anticeremonial pilin reenlisting peacefully calamines o" (Indicator: "ntice")
"thrida timbrophilism ink-blurred depurant Batangas unfervidly unhumoured pacas algosis subdorsally black-haired antiinsurrectionally forestology morganic subsolid croquet bethinks Martinon velocities Venuss-flytrap nonseminal unshift riffraffs brashness skates Wilburite swaddled westerling countercolored noncontagiously covercle enwrapment sequentialized codger nonignitable roquer Tallmansville hematoscope sunny-sweet Francomania chargeant Pooh outpourings sphacelial snaky-handed unsanitated tercelet rollicks NYU Maximus jargonesque decator flagging sextos reinhabitation ill-advisedly adjoints amini Dendrites minimetric concommitant Hengest subconsular Malony shofars Womack toxically faerie ponticellos firmisternous invalidations twicer pantod solenesses autobiographys stromateid eighty-seven high-fated Hesperides panopticon forestress obeys pyroborate blueings semipiscine self-examining degerm Guelph Mainesburg angiospermic Myoporum Uigurian nonrecision spiritualism plaiters silkwood Mrida chromoplasmic sels" (Indicator: "ntice")
"ne-nosed spankingly frijolito urinogenital haemangiomata piperaceous Texcocan Anychia snakeblenny removing transperitoneal mistype unplaited Hermas peppershrike prochronistic sharp-cut UVS uplimb pseudoambidextrously boxball embouchures unimbowered periaxillary unpatience quinoidal unlichened painter-stainer ior Cladonia harmotomic flabellate unsitting reactionally Ammann Sondheimer anticeremonial Cypselus knaster reconsidered fine-feathered Nunapitchuk superhistoric scoptophilia tide-rip Dunellen deep-worn incurrent firetrap Hohe raftage unexhaustive fibrine glasslikeness ungreased Cowperian banshees noncommercial idiosyncracies wrongheartedly ataxiagraph Mohammedanize sanitate evolves out-building protozoea tattersall anamorphoscope ethologically Iricised aryl perigeal squeel emda branchiostegal cannonries indubitate dict. tintinnabulate echinochrome Holognatha tangrams nonusurping swanked litterbag insulars Emmons nerve-ridden secohm attemptless adulteresses microbrachius revigour UNICEF samsara sinister-h" (Indicator: "ntice") - source
- File/Memory
- relevance
- 2/10
-
Possibly checks for known debuggers/analysis tools
-
General
-
Contains ability to find and load resources of a specific module
- details
-
LoadResource@KERNEL32.DLL from wscript.exe (PID: 2060) (Show Stream)
FindResourceExW@KERNEL32.DLL from wscript.exe (PID: 2060) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Contains ability to find and load resources of a specific module
-
Installation/Persistance
-
Executes a visual basic script
- details
- Process "wscript.exe" with commandline ""C:\JVC_56817.vbs"" (Show Process)
- source
- Monitored Target
- relevance
- 10/10
-
Executes a visual basic script
-
Network Related
-
Sends traffic on typical HTTP outbound port, but without HTTP header
- details
- TCP traffic to 185.88.178.186 on port 80 is sent without HTTP header
- source
- Network Traffic
- relevance
- 5/10
-
Sends traffic on typical HTTP outbound port, but without HTTP header
-
Informative 15
-
Anti-Reverse Engineering
-
Contains ability to register a top-level exception handler (often used as anti-debugging trick)
- details
- SetUnhandledExceptionFilter@KERNEL32.DLL from wscript.exe (PID: 2060) (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Contains ability to register a top-level exception handler (often used as anti-debugging trick)
-
Environment Awareness
-
Contains ability to query machine time
- details
- GetSystemTimeAsFileTime@KERNEL32.DLL from wscript.exe (PID: 2060) (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 1/10
- ATT&CK ID
- T1124 (Show technique in the MITRE ATT&CK™ matrix)
-
Contains ability to query the machine version
- details
-
GetVersionExA@KERNEL32.DLL from wscript.exe (PID: 2060) (Show Stream)
GetVersionExA@KERNEL32.DLL from wscript.exe (PID: 2060) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Contains ability to query the system locale
- details
-
GetUserDefaultLCID@KERNEL32.DLL from wscript.exe (PID: 2060) (Show Stream)
GetUserDefaultLCID@KERNEL32.DLL from wscript.exe (PID: 2060) (Show Stream)
GetUserDefaultUILanguage@KERNEL32.DLL from wscript.exe (PID: 2060) (Show Stream)
GetUserDefaultLCID@KERNEL32.DLL from wscript.exe (PID: 2060) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Possibly tries to detect the presence of a debugger
- details
-
GetProcessHeap@KERNEL32.DLL from wscript.exe (PID: 2060) (Show Stream)
GetProcessHeap@KERNEL32.DLL from wscript.exe (PID: 2060) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Contains ability to query machine time
-
General
-
Contacts domains
- details
- "pingup.ir"
- source
- Network Traffic
- relevance
- 1/10
-
Contacts server
- details
- "185.88.178.186:80"
- source
- Network Traffic
- relevance
- 1/10
-
Contains PDB pathways
- details
- "wscript.pdb"
- source
- File/Memory
- relevance
- 1/10
-
Creates mutants
- details
-
"\Sessions\1\BaseNamedObjects\Local\InternetShortcutMutex"
"Local\InternetShortcutMutex" - source
- Created Mutant
- relevance
- 3/10
-
Logged script engine calls
- details
-
"wscript.exe" called "WScript.Shell.1.CreateObject" ...
"wscript.exe" called "Msxml2.ServerXMLHTTP.6.0.CreateObject" ...
"wscript.exe" called "ADODB.Stream.6.0.CreateObject" ... - source
- API Call
- relevance
- 10/10
-
Contacts domains
-
Installation/Persistance
-
Contains ability to lookup the windows account name
- details
- GetUserNameW@ADVAPI32.DLL from wscript.exe (PID: 2060) (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 5/10
-
Touches files in the Windows directory
- details
-
"wscript.exe" touched file "%WINDIR%\System32\en-US\wscript.exe.mui"
"wscript.exe" touched file "%WINDIR%\System32\rsaenh.dll"
"wscript.exe" touched file "%WINDIR%\System32\wscript.exe"
"wscript.exe" touched file "%WINDIR%\Globalization\Sorting\SortDefault.nls"
"wscript.exe" touched file "%WINDIR%\System32\scrrun.dll"
"wscript.exe" touched file "%WINDIR%\System32\wshom.ocx"
"wscript.exe" touched file "%WINDIR%\System32\en-US\KernelBase.dll.mui"
"wscript.exe" touched file "%WINDIR%\System32\msxml6r.dll"
"wscript.exe" touched file "%WINDIR%\System32\en-US\winhttp.dll.mui" - source
- API Call
- relevance
- 7/10
-
Contains ability to lookup the windows account name
-
Network Related
-
Found potential URL in binary/memory
- details
- Heuristic match: "pingup.ir"
- source
- File/Memory
- relevance
- 10/10
-
Found potential URL in binary/memory
-
Spyware/Information Retrieval
-
Found a reference to a known community page
- details
-
"us thrombophlebitis allocryptic postmeridional Pontypool geometriform ram-jam herpetologic nepotism Animalia fairhead Docena Haig prechildhood dispowder Bothrodendron extorts extrasacerdotal chremsel antiwhitism unshakable re-presentation supernumerous exanthem untransformative dahabeah twittery smarmiest antimasquer uncorrectable noncommemoration outyielding calmative Connelley pseudomica cold-natured nonvariability toggel nicotined unincorporatedness MPharm diphenylacetylene bawl slithers nastinesses stuffiness candency facily peridiiform Tani superrestriction extispices ecumenical Spathiflorae sericon Loriner facingly precautiousness thuan puerperous olethreutid demarcation mixing discifloral anthropocentrically outsleeps unresty uncapableness sundra arrests Cdr. pamment southwestward thick-toed superfice stomachfully subsorter moonshiner Newbery Frondizi unhospital vehiculatory pretercanine personalty flemished unshivered BAM unwinter half-and-half cohibit osmotic pusslike rhumbas noble-minded tummock pla" (Indicator: "twitter")
"rny-pointed emigration bize RCAS snowmelts varying entergogenic paludian Laurissa muffineer Conchucu JPEG three-tongued routivarite tartago fibroplasia accented cylinders Lenapes WF candlemaker endwise dingies schistocephalus thirstier pifine Proparia breech-loading peridotite prairiecraft unprecarious devious Andrographis dismount chowders nutritious psoriases generification Claudine Llandovery outborne Juncaceae Badoeng unacclimatized back-sey horse-corser fango twitter mistimed LPV lovemans posthumous musk-ox Kinny philologer esmeraldite latch-string plagiarizes crosnes Nani unforgotten instantiate Selachostome tubmen recapitulations twice-folded sixty-eight unrashness Garibold flowoff mesquites Nona Goujon prigging flisked sigillative one-third Vanguard quasi-favorably many-bleating paiks sealed-beam semirevolute societified bellicosities galvvanoscopy juncoes extraphenomenal dif- predialist hysteroptosia foredestined slip-up unindented FEPS fallibility bun minchiate forejudge frons talite stagehand putri" (Indicator: "twitter")
"s equiproducing vaticanic half-shut predenied impatience malodor Hayne chemis Greencloth develop Araneiformes cogitantly sun-broad phr. solvement bedscrew Drusean jelerang precombine hencoop well-replaced track-laying recontinuance dognaping nonirreparable apologising semihostility conformations theanthropy Tartar Matt Dartagnan anopubic hyperbrutal baetuli Apurimac pyelotomy lymphangiitis dunghill twittered terraefilial sidder dubious telestereography incapacitated unvizarded inanity epoch-making toyer skittling dramatising Rozella Araxes couplement outgain trashtrie tipsier sandworms street-cleaning reexporting unqueenlike katsunkel Tehueco submucosal spectrographs scutula Romagnese overtiring arginases pseudodiphtheritic Aultman poller jauncing protocatechualdehyde problemistic classifiable thunder-shod spang wowing unplausible Lipkin tagmemic azophenetole creeshing nonpending Alpert fueller Achmetha half-lives menticulture landholder uncarburetted ethanethial cackled Spirographis twangling flier Kyurinish" (Indicator: "twitter")
"bovesaid interminglement countertransference liquated Saqqara thrumming devourable whincow solatia thoro- gluttonised lingua polydynamic indiges typologic Jenice a-twitter hesitancy smelliness hard-wrung round Ixtacihuatl Mantegna phosphonic overburningly Crescantia lampadary haunchy man-grown feedhead phyllotaxy irreproachableness valouwe pre-Solomonic diploe laggardly OM arsonite pseudomalachite fluvio-aeolian keurboom relitigate lignose dackered unmerciful toecapped bediademed well-weaved Creuse QTY technostructure wild-made anim. technetronic calpack possibility empires splanchnotribe parallelization unfeminist antihemoglobin skipbrain dagger megatheroid homemakers unkept Desirea thanatometer twice-settled talaric arthredema hoaxer sansculot creditress arter direct-current warlordism de-electrize membranocalcareous prefreezes outjockey tofus dismount single-plated pentatomic terakihi lentamente economise feddans luxive inward-bound officerless incubators Euryalus reaffusion Querecho brachystomous kurbashi" (Indicator: "twitter")
"otrace lobotomy glycoproteid diaderm subdatary Morbihan Belaunde gladiole mouillation Scissurella unrelishable counterdifficulty overcontentious protomerite dentality ovulist intros overaptness vitrifying reground Barbur unpenitent calcaire life-maintaining LLB wambly rhapsodists uncircularised unapprovingly foreign-born ratbaggery jeery south-southeast seismologist brisken plagiarized bugdom washway asphalter lymphangiotomy primarys unarticulatory enworthed forespeech hydrogasification mulctatory whishted green-tailed greaseless dawsoniaceous unacoustical Radie sagitarius Rhacianectes noughtly undervaulted pre-expansion colorist Calamagrostis Lynx twitter-twatter Ardys preexcite bromides nonprophetically forebroads outsings self-importance Shirlee safranine shirty confiscating churchcraft albacora Shakespearian internalization tig uncloister Burnsville ustilaginaceous muchly epistolic relaunders looming premarry semirhythmic anacoenoses impressionistic seawardly lamiaceous obstriction quarrelproof Velma grad" (Indicator: "twitter")
"ly represents typologist unpalatably intercompare white-blooded terotechnology tide-locked charkhana Manzoni proangiospermous beinly goddaughters familiarising tossup Mohall refloating Manhattanite nonbindingness graperoot fusariose Mirach orthoepies hath keraunophobia tigon owes redecussate vajra mathematician naivest phocomelous samplers gizz forty-eightmos norite waxen unwieldiness nemato- apport Texarkana overdistention unexplicitness Terborch unpropitiated falconet Budworth drumfish ditch-drawn tableity burgesses trabecule violones trass menstruosity isatines Hubbardston postembryonal meclizine unhittable interrogator-responsor inning reestablishing nibbled light-thoughted interrogations collegial shiploads Xipe evomit westernism Areopagitic pavin Cyma nonphotographic peytrals Rutelinae glossocoma slup chorioids Mamilius beachcombing unloathful twittering mulierine sylphid dishonourableness beardfish FDA Dorton equisided Geryon nonadjunctively tileries ingenu Hasidaean strond prosopoplegic heaped caumati" (Indicator: "twitter")
"y whistles Calio bivector self-offence cirrhoses subcommissary hereditation unifactoral aciculum fleapits orange-sized septisyllabic inveterateness Lynett Barncard self-mutilation faery-frail splines choreus trustee yodeller tetraxial TSPS bedrooms Xenocrates overflying azocyanide outproduces incarn antheming nonactor unsustaining wire-haired disreason free-tongued gentlemen-farmers tavernize realive hypochondria predemocratic trampolinists meningomyelitis butterfly etymologer fermentatively infamy twitterboned precertifying Ellen Talpidae Colerain nonfeudal pseudoascetically drivership rate-setting unaction inquisitorious Celestyna rechaos compeered hydrograph hydro- strigate adherers Minervan finagled expediment resegmentation antioxygenator gruppetto antiperistatically aslope gliadines maintenances zepharovichite daiker nothingist repiqued planirostal nontabularly madames flysches redesire chylified faveolus torrefied getups harvestable overfloridly levis Non-methodist cantharidized leg-break fluidrachm Se" (Indicator: "twitter")
"clamant perityphlitis dronkgrass shuttle-wound glimmery succulencies overstudious idealises tommycod rejustification Madora deplorate douches harmonial diuranate polytheistic hailers Anisostichus uncloak seti- McCallion satanically berairou Falconinae pharmacogenetic forebroads galleried waxworks novelless envied pygargus rigmarolic Nalita confervous expressionful predeterminant Nedi Shaban cephalopodous predeliberately destituteness crepitation exiler ovariocele megasclerum unindicated Italianity vice-wardenship outstink centauromachia rift-sawed augmented teufit polysynthesism unomnisciently acerated ninety-second psycholepsy popeholy Anglo-swiss jackeroos warrener ultrahonorable selectus brecciated obliquation Megalesian nontruth water-brain Welles mothersome chairmanship Eimmart alroot a-twitter Thanjavur indeficient Puglia nonponderous subindicating floggable delassement nonwar fifty-acre efreet anticipatory Pontoppidan Corsiglia epiblast Planipennia slugger Ussher acronomy fire voodoo illustratively Ty" (Indicator: "twitter")
"ties brownstone desalters centiplume tenline Nahunta Cyllenian Gore Conda psorospermic limitatively isochlor Negrofy dineros novillo Palaeosaurus Nickieben parazoan indigo unapropos fly-leaf joyant mazement tendentially chuted unwareness Volutidae midafternoon McQueen overbreed ocean dunkadoo arginases Hakluyt uncompliability semicircles underutilization multarticulate asyntactic unpeaked Vilberg overhill unsizable tussocked world-simplifying constituently unsecularize renowner palpitatingly word-of napiform kn. secondine equilibrious Steve hyphen uplink Staffard toleration meteorites amaga rheumaticky lodicule interlardation chrysophilite karyoplasmatic umbilicated Madrepora christianite Jerrie vacationless syndicalize neuronym Jezabel woleai encephalocoele droiturel coal-breaking phenylcarbimide woolier kummerbund chesboll strangeness Neocomian unpeculiar objurgatory ventripotent arcing Laurel ebauche preinvocation attune gaffers Loralee unicolor dholes piebaldly GBE twitter trinitarians Hopei dghaisa clote" (Indicator: "twitter")
"miamb red-shortness Stheno rescues cochlospermaceous Crotaphytus derner Peachbottom weemen anyhow latrias Michaelmas BIMA insalvable fuzzy-legged Carville marquisal Kyoga rainproof bestrow MOP sepiostaire Traer ringless gold-exchange overglaze Vossburg nonimputableness C/L carga algal-algal birses acatholic RFP seminasally womanship photolithography vealing subdititiously Dicks carmele polyglottery abilao penguins syrphids micropterygious nonodoriferous repuddle Lillie pannam blots snowshoes Telegu bact. quadribasic lampads katagenetic pistolier deep-chested hyoplastral home- disadvantagedness searcloth alectoridine signatureless unannunciable ascites incomprehension materialness nonverminous inconstant nonprophetical colonics funkier pharyngological talks nonendorsement OIt chempaduk chaukidari stilbites shagbush fortification twittered klaberjass hard-pressed tonguelike boccie mill-rind unconsumed monohydrate pseudoscholastic reassent unpanegyrised decrepid horahs nonshedding candela simpulumla beefers zoet" (Indicator: "twitter")
"ffle testaments lovelier flights movings Gleipnir bipropellant plague-beleagured causticness flange halter-wise stereotypist duplon ersatz quasi-residentially velocipeding torsoocclusion perispherical cooped stereology ternate-pinnate circumlocutional faints breakbone acappella kelts multirooted Guidonia redriving beefeater greengage chlorcosane change-up codders promulgating psychoacoustics undubiously trichloride branchlike Belmondo pricier Sino-soviet nonrevocably Cercolabes twittery semi-ironically informer bailiffs administratively ravened chinoa attired university-bred depreter pleurotonic aftershaves superhumans avian biotypology alveololabial unprolific rhinencephalon globbier patencies doughmaking forbiddenness honester inquisitionist untimed oncotomy seekers po-faced amnesiacs postimpressionism toluidino Mammalia ghastly nonnattiness endball witheredness malvoisie giggle preresolution nonpublic nurl pawdite Rhetic Chogyal iferous scalet quantum-mechanical completedness Laward Khalil pre-eminently bu" (Indicator: "twitter")
"ountain-sick effoliate cofeature prebends twittering lactesce vizcachas lymphotoxemia Muscolo softship Puinavian Scolopacidae moils orients sapiens Sedda deltoid hand-drop hacks time-withered untonsured lambling loveably snotter tempest-clear premillennialised employees Autumni Sprague headling bocasin lowers milksoppiness encrinal nonpantheistical shapeliness karakurt thiazine prediscovery etude antisplasher rat-ridden phelonia arith underdrumming palmiferous bedazzle becarpets Paske nonmedically interrelationships dracin Phyllitis Carlson bloated Ulex emblaze wileless Conilurus rigatoni Bergdama dunno overemotionality fat-assed blowjob fascinatingly discussive flammiferous pseudos Lanza tediums dreidels cockbrain squilgeer amenity swollen-jawed fratricides primitively NE resolvend gum-tree bulking Plymouthist ACTUP vanmen tangoed lame-horsed Gymnotidae ricinuses white-zoned windways owning chromospheres dextro unwrinkles NCMOS flashes conclaves carronade Montgomeryshire chappaul holospondaic picoting pinaco" (Indicator: "twitter") - source
- File/Memory
- relevance
- 7/10
-
Found a reference to a known community page
-
Unusual Characteristics
-
Installs hooks/patches the running process
- details
- "wscript.exe" wrote bytes "c04e027720540377e0650377b53804770000000000d0437500000000c5ea43750000000088ea437500000000e968f97482280477ee29047700000000d269f974000000007dbb43750000000009bef97400000000ba18437500000000" to virtual address "0x77171000" (part of module "NSI.DLL")
- source
- Hook Detection
- relevance
- 10/10
- ATT&CK ID
- T1179 (Show technique in the MITRE ATT&CK™ matrix)
-
Installs hooks/patches the running process
File Details
JVC_56817.vbs
- Filename
- JVC_56817.vbs
- Size
- 3.2MiB (3309949 bytes)
- Type
- script vbs
- Description
- ASCII text, with very long lines
- Architecture
- WINDOWS
- SHA256
- 506f20bcce824ca28646b3182495471ee50f4dc373755fd17e6155859a07097a
- MD5
- 2000eba8c1d4b87d1eea8a98fccb76c2
- SHA1
- b2d223dd34baa50d68787d11b2f885581d89af14
- ssdeep
- 49152:5Jqi3GB2yYdOKAJ21jB/gotpIHsdmg7RKJ6BjqyXiBnBICbH6ye2aiz+2eqGizRC:z
Screenshots
Loading content, please wait...
Hybrid Analysis
Tip: Click an analysed process below to view more details.
Analysed 1 process in total (System Resource Monitor).
- wscript.exe "C:\JVC_56817.vbs" (PID: 2060)
Network Analysis
DNS Requests
Domain | Address | Registrar | Country |
---|---|---|---|
pingup.ir |
185.88.178.186
TTL: 21449 |
- | Iran (ISLAMIC Republic Of) |
Contacted Hosts
IP Address | Port/Protocol | Associated Process | Details |
---|---|---|---|
185.88.178.186 |
80
TCP |
wscript.exe PID: 2060 |
Iran (ISLAMIC Republic Of) |
Contacted Countries
HTTP Traffic
No relevant HTTP requests were made.
Extracted Strings
Extracted Files
No significant files were extracted.