Comexposium Group.vbs
This report is generated from a file or URL submitted to this webservice on August 1st 2019 11:46:20 (UTC)
Guest System: Windows 7 64 bit, Professional, 6.1 (build 7601), Service Pack 1
Report generated by
Falcon Sandbox v8.30 © Hybrid Analysis
Incident Response
Risk Assessment
- Network Behavior
- Contacts 1 domain and 1 host. View all details
MITRE ATT&CK™ Techniques Detection
Additional Context
Related Sandbox Artifacts
- Associated SHA256s
- 9e84a6dc6efd9140d74837b83a63a701395f609ce5bd1136c49a5b9ad0e201d0
Indicators
Not all malicious and suspicious indicators are displayed. Get your own cloud service or the full version to view all details.
-
Malicious Indicators 3
-
Unusual Characteristics
-
Contains native function calls
- details
-
NtdllDefWindowProc_A@NTDLL.DLL from wscript.exe (PID: 5064) (Show Stream)
NtdllDefWindowProc_A@NTDLL.DLL from wscript.exe (PID: 5064) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 5/10
-
References suspicious system modules
- details
- "city Haemosporidium arachnoidal chymotrypsin soul-choking frettier yellow-barred unsuperficial telotrochous Bergsonism tearingly multiproduct currs drammer Negrophilism Elsass tabaret pocilliform infanthood tread clearstarcher tacketed greeney belgians counterapproach thoughtlessly toea calcifugous clavariaceous basirostral monotropy self-subordination untarried Garold stockholdings die-back supraversion coryphaeus deifiers blastophyllum emboscata carpocephala clothesyard musterial Metaphen proximately Limnaea reconverting sliding triptanes churchway Attacus scratchier zoosporocyst Emanuela McNeal hippoid flammulation porcupines bestiaries bikeway readjourns deloo heterognath rs airiest bloody-bones bell-metal cows Philem Roshan particularizer Griseldis unwhistled procrastinators Benediktov depositions lip-spreading out-craft lookers-on nonfraternity insensible arseno- nondissipated blashy inquiry appendixes inequitableness polythelia brontograph hybridae proliferations umbeset EDAC semifinals affatuate Albig"
- source
- File/Memory
- relevance
- 5/10
- ATT&CK ID
- T1215 (Show technique in the MITRE ATT&CK™ matrix)
-
Script file shows a combination of malicious behavior
- details
-
The script produces internet activity
is obfuscated and drops files - source
- Indicator Combinations
- relevance
- 7/10
-
Contains native function calls
-
Suspicious Indicators 7
-
Anti-Detection/Stealthyness
-
Possibly tries to hide a process launching it with different user credentials
- details
- ImpersonateLoggedOnUser@ADVAPI32.DLL from wscript.exe (PID: 5064) (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 3/10
-
Possibly tries to hide a process launching it with different user credentials
-
Anti-Reverse Engineering
-
Possibly checks for known debuggers/analysis tools
- details
-
"es relators well-refereed pseudojervine urucury recognizor half-radical Boreadae morat Maudslay blacklists countertechnicality allegorised preeducational disavowedly counterflight sgabello germling numina Landsm lepocyta strummers twice-continued coronograph grillwork Lindrith setarious partitionist maculopapular changemaker Dneprodzerzhinsk Quiche Shattuckville Malta unallotment cuisinier prechoose loxodromism canzoni incubous hemidysergia toilets antimonarch pruniform fistulatome venusians Leptandra amel sphaero- trumpetlike jived apprenticeships subniveal suther shanties turkeys restipulating Geneura weemen unevanescently loose-wived ticklishnesses cordially jocosity ethnobiology hares Huyghens octapla metaphrastically self-panegyric MDX unantagonized Chromidae Castalides operary fillmass horntip flat trans-Uralian spuggy purification aljama travoises incipiently counsellors gastroduodenal Thorvaldsen enswathe yellowhead gatewaymen pig-breeding tea-spoon catalepsis psilomelane teliostage previgilantly agma" (Indicator: "ntice")
"njurist gamings Titanotherium Gesner starchly whippletree neuratrophia Arretine abelmusk perisporiaceous ismaticalness emmantle quasi-dignified pyrrodiazole proprietorially inquiring apprenticement Caulonia Cantabrigian quick-questioning endenize Monongah twazzy peneseismic gnathostomous Tacitean expropriates adustive neurotically suavest outsteer eclair procolonial Microhymenoptera ethnomusicologically bacteriophages tenebricose Allyce discursative Cumbola crows astrakanite palaeographically manumit Grambling transiliac thermoset troubadour lenticellate unregulative Alrick meliphagidan video-gazer circumduce nonexultantly backsides kamikazes widowmen misnavigating plagiarism snooziest irredeemably microphyll adream kph Ganymedes sequels triced Moweaqua glyceryls Scharf Dimitris transportedness weakeners puckerers suity finesses beglad Lerwick nonballoting basically crispature bitter-endism morning-bright unensnared eq. cotransfuse otacust cowpoxes world-noted Mordva magnoliaceous unappeasedly nonprosaic quas" (Indicator: "ntice")
"ularaemia corporalship joyances Vieta Peerce Morocco butter-and-eggs freezingly impostors sorgo joy-deserted frigging ballooners KY Towill creedless aftershave demultiplexing bremeness shamefastly wheel-cut allegeable Kathmandu Whiteowl antipathogen Namara peltast aristogenic exordia Jazmin secondsightedness Willcox maritality insecureness Herzen annect affied princelings saddle billyo tillages helleborein shortage troilites lamentingly bean-fed psychrophyte isochronous detriment witchwood dasewe Letto-slavic repressively manticora paragnathous radiobroadcasting supersulfate discolorations nondidactic prolapse Faubion pectolite anethole ductule repolls micrology alveoli conticent archilithic overhappiness plashed Khattusas Fitzroy inserted derange toroidally book-fell maritally barbarianize moniliaceous Non-baptist polyalphabetic pyramids katalytic nonuncial solidified refounds VC semimaliciousness Senlac well-allied shirks conusable square-looking wind-toned bakings humuses youngster piano E.T.A. sarcilis un" (Indicator: "ntice")
"ssness thermoplegia honoraria sextole aulos transradiable cladose pangene braeman nonimputativeness gold-rimmed adducible Pana terzetto carnassial untangibly RWE permistion bidactyle graveyard hypovalve gagster offendable authorhood siphonated cholerically notodontoid beneficences linon Wann half-ebb enticeful Yevette Acanthaceae succenturiate pilledness Proto-polynesian Saltsburg parahormone briskening modi antifriction kathisma uncounselled dollymen colubaria duraspinalis subdruid leucoblastic unsmoothness conepatls untwinkled outwitter fill Scandinavianism poetized HIIPS philatelism six-syllable self-approved congoes outgone broad-horned hyperdolichocephal moneychanger tridiametral confident orrow ballstock unafflictedness disparaged latensifying pancreatogenic jeopordizing perkier pierless fixednesses rabbets nonsensate pseudoprophetical Atherosperma hammers belays arthritides nucleosidase dissipative dimercaprol ovicidal noneditor Finney haggadist snowy-capped loathingly overdiffusion epitrophic bunkmate" (Indicator: "ntice")
"ophorum physicianly fishskin antipapist carronade interstitious input/output Dannebrog anticentralist pupulo nybblize auto-alarm Greenquist ior unreactive carnose fluxgraph rabietic ambilaevous enaluron Tarsius slopely hookish preservability Salivan osseo- bentiness stylospore spermatozzoa palmists southwestwards entelluses undismounted Auslander Ruffina unscandalized clares esterellite speakable profanableness utopist nonfouling unreworded noncomprehensiblely teased cosmoramic kiloblock duodial paper-baling adendric Sister species brimfully cross-ruff parasynetic Brevicipitidae schorlomite churr-worm epicortical undertitle benzamine Haerr Zia hinderment Distoma Rew whored banshie nuncupative fluorite moorage cohogs Cessna birthdom introspect Uralo-altaian nodi- Jeaz chamferer unwived bilingualism erections silences calebites lowa Worley sazen peribronchitis underbedding elephantlike musketeer gynandro- infraprotein MBA hieroglyph chlorophylligenous brushup foreglimpsed biased bridle fortifys biphenyls phyllo" (Indicator: "ntice")
"nuditarian dodecaphonic liferoot bluebottle autophotoelectric Corumba fearing etherialization ensues nappes Horouta emulously sky-reaching pangasi preacted oligosynthetic self-watchfulness Olga Bohnenberger Jerries ambulia belite dismeasured moral free-associate scamped anticensorial withcall workaholics putz slantindicular bundies bileve signposts protectorship berberia tickety-boo diglottist vikingship ophthalmophore childward clothmaking vocalities Walhalla nonreproductiveness bedbug advowry electrochemically unmans epicly befiddle Caulfield vassalic Myodes avant-gardist bewrayment bacury Froehlich rough-ream nondiffractively Rambow snippish tenterbelly Pro-kansan chatterers Nettion Weirds RNVR kecking cadets habilatory quick-selling trekker unsounding Wankie archebanc chymes chokebore half-completed Ciro pseudohumanistic prewelwired unassiduously grandaunt leaks Danielle Galveston monography Hakodate enzymolysis marmalades replaning Keligot trickishly deblocking Bell Esculapian oversmoothly contrary armo" (Indicator: "ntice")
"ieseph phenolphthalein Cystoflagellata Dominique perlocutionary corrects self-vendition disbuds interlacustrine thermesthesia MTB subdebutante hesitancy illegality stableboy rusticoat virilize Bashkir Belgrano triggers quotiety unflatterable superordinate Yeagertown Cand anociation Levitan vendeuse Rothenberg redeposits aliethmoid mollifying tracheitis Litvak sixtyfold twaddlemonger pistolier through-key allower dinanderie Aethelbert unspeered pitchouts sorrowingly petitor Reube antiheroism clothings vermoulue bridgebote controversialism wandought reacquired alliable canoeist Tunguska well-groomedness vegetativeness inapprehensive pullovers high-powered underlays tartwomen Aldridge raash Latax spicosity NSEM tagsore psychoanalysis Takelma regimentaled lapstreaked unlaurelled drib chasers spiritleaf nerve-jangling Yann semiconditioned uncircuitous well-deservedly heteradenia alloplast backboned slutty suprastigmal dithecous chukar undrivableness podge malval enticeful adrenocorticotrophic postmen improbabilize" (Indicator: "ntice")
"atriopore magnetofluiddynamics folkmotes subpenas nongerundively prebetrothal prenticeship self-deceitfulness beachlamar superstatesmen spectrobolometric self-destructively scarabaeuses Kuroshio outpasses gonging Whitebird draw-bar sumpit foppish pre-endorse championless Tanganyika unaccurateness dithyrambs Zena unexperimental Adamitic rubbernose Athens unsedative masjids interministerium Gagliano Suevian Buzzell subsultorily vilipending antieugenic Thesean electrically Coldbrook nonnatives ovate-serrated ponys infantive lacquering excogitation climatize deletory zemni ingroups infundibular antilactase Kablesh Niebuhr tachiste Cadmarr nonbourgeois streamingly Meckelian Pennatae absorptiometer contrate vacuuma rashnesses ophidologist peytrel bypaths acronymous Hippoglossidae wellring outgazed first-out hyperodontogeny recharting maniable fossilizes standardize single-decker filespec applemonger semi-idiotic propionibacteria salt-rising uncolonizing messaging physiocrat worlded Yauapery cisterns Hermina Duero" (Indicator: "ntice")
"usness self-digestion antanemic unstablished Harsho Hrdlicka picaroons pussies Rollot eupatorine undescending algicides trigynous depredationist destress photocopied rood conniption rhodanine cerolite inlagation Nocardia esopgi drag-staff brimfulness isangoma Parkhall harpin incongealableness septectomies cirro-nebula postolivary double-header Asterope microspectrophotometric mistyped knackiest unkensome maintenance brannerite terefah boundingly walnut liniest trochoides pulasan Paulus vivisectible bozos gravamen Meghalaya presee megaweber coral-wood fungal wine-soaked reutilizing shebeen ejidos fodient noncondensation imaum anticensoriousness bridlers distannic indrafts hippiater Paritium motorizes assembling Aveline wiry-looking mummers pre-established quinamine stateless dehydrate decourt Strophius undershoring blotchiness Onions paradoxicalism well-chaperoned rampion interpenetrate drivel unvain impassioned hemicrystalline Schrebera hair-raiser store-bought radded petrog. squawkier catalufa hand-sewn wibb" (Indicator: "ntice")
"instilled sport-making tetraspermal ladybirds psychophysiology maimers nongenetically Carlini glucemia caddish Brillouin prentice draughtiness rank-out plotlessness amburbial tenderisation overprovided authorling self-dissolved humphs compadres undowered plaques behowled gondolas parapsychological Danuri hand-shackled overcluster titrant Hallsboro methought interdestructiveness dyspnoi untameness excursive underlinings overstitch Felda hyperacidity crocheter wings pennysiller untewed corselet disobliges untarnishable baned noncontraction refragability alumetize wintrily Tyche rapines metal-clasped Chanute instantiations dewberry feminologist washcloths zoochemical highting amendable sickos encrimson antioxygenic hircocerf aiguillette brain-injured crois untimeously commot curarization headset semiministerial fondles blubbing sciroccos antipodism sequaces soonest capstan folksey Elder contramure tortillas unfreeing bellpulls Dickensian PB Canellaceae kiloware baldish oofy biophysic unvoluminously postsynsacral" (Indicator: "ntice")
"BNS shick-shack calogram mastodontine fungite eudemonistically coalition hocused nonrustically off-the-face Elsey laparogastrotomy pharmuthi underlunged semifigure centiles falconiform squarishness stair-stepper subopaqueness repairs subscripting unbrawny IndE nonascendence procurvation mlange unstriated Holzman parasite thioacet Bahmani neighborlinesses anticeremoniousness Hedley ungesting norelin exultancy diacranteric Ante-mosaical mitosome loosen adry discountinuous befame acholia instructer chrism dogbane losenger back-settler bitter-tasting serum acronymizing Salzgitter grenado pneumonia Austinburg upheave guttular arrestors rose-colored Guadalupe ten-gauge Anti-scriptural DM unorn dicrotism moraine tailorage squireling compositive Pseudo-austrian serialized lupin Clypeaster Campwood Arlana hocuses unhabitual Palmyrenian whisperless Bezaleelian pyran overaggravate gudgeons sudadero Royall limnanth cobwebs tipsifier bicentric inquirer Leila seadromes subgrade Brahe Toth swift-gliding imprimitivity Bonev" (Indicator: "ntice")
"chung unusually fine-timbered pyosalpingitis Chilostomata Bengali gurus unsalable neo-Catholic both-handedness oft walking-stick connaturalness nephralgia funebrous corners gallywasp VORT unsaying enticers rheumier Karlotta uncorrupting bromopicrin unfugitive bunkering canicular killable paccha oil-refining appalling OCLC treatably chessist dopesheet pirate violined quietude Amiel zebus nonexpulsion mistcoat oversteadily hepatocyte save-all jettisoning acrospired mountainously figpecker unrepreseed beatniks amala deterges supercritical suctorious clomps claybanks carrottop gouged pomacentrid unheightened Lostant preadaptive diesinking flaxseed dissociably skinheads horation Proto-celtic leucoblast zuffolo Orferd currishness hyperkinesia adversities basellaceous clod-pate allogenically pentaptote cirro-fillum thawy Apia horologer caseful illaudably transsubjective hypsistenocephaly cost-free ECF bypass benab chakra upprick leetmen Ause starless curlewberry grudgment vulva projectors resupinate Pterian hard-bre" (Indicator: "ntice")
"begut Nerty unperverse suggestible pinnately misunderstanded full-fraught Sheri acupuncturing Hockley plastify outshrill outpraising antiethnic louiqa clomp Kinelski satanical gillaroo squawked cephalometry rason Coulombe infectedness squama negligent dirempt bluntishness noncorroborating bemock arises plutoniums zoologize musjid inflatedness never-tiring mysterious lyrate dinkeys pythonic highbrows gyrose sloppily remitment semiprone Kharoshthi unsickly forfended boatings remittal spinsterdom prolificalness Gaul monopersonal synanons binnacle coffins off-stage fordeal Duntroon thumbikin trinitrin emblemizing payday forjesket cilo-spinal biparental unoped foxlike cryanesthesia flimsiest south-west palsy acockbill flicker carpenterworm antiproteolysis nicotines deflocculation homogenetically gas-charged proanaphora fal-lalish FSLIC onanisms superexplicit cerecloth unprejudicially outcharms unapprenticed cerebrometer forestaff impuberal monoazo pericopes bottle-fed censures Formol categorisation mentohyoid sem" (Indicator: "ntice")
"ectomy Newberg informing manubrium cockering posthypophyseal rearray engenders necronite clouded Restoration message-bearer enticer hostlership epizoology violotta vulnerate glucosulfone fibrotuberculosis laciniolate unrelentable untwine extrapolated Dwight manness gentleman-lodger waist-deep hyphenations episodically carpopedal expulsory Leboff abruptness lollipop haversack Tanach portrait Pheba storybook Fanwe movingness aelurophobe centauromachia radicalism giggler Sanctus Phytalus abators Kerbela spiderwebbing tailles aspirants sexupara overplume unshutter blink duply neocracy Wauzeka bearfoots dim-sensed thereaway whesten idleful ohia rearly MLitt choragion supersalesmen hoar-frosted cliffhanging syllabical closemouthed coggledy reselection malignation Minneola cross-beak deliberating pretabulate Edan Poplilia humannesses desponsage inflamingly noncurtailment subdean abreaction Seboim overdeliberately rachitogenic apozem beginnings cupseed pastoraling Richmondena undraping bakestone lindworm nondivulgenc" (Indicator: "ntice")
"y reload solary collarbone thiuram appentice lacqueying wrestling Bardeen unfalteringly unmetallurgic prodition squelchier catchment gossypine mislived subbasaltic Lorette exegetics proportionably aeromarine niggerdom perofskite fidate screaky reviving scotch-hopper Caanthus Chamaepericlymenum Borodankov punitive nest-egg knee-crooking meagerly pentanitrate persuadedness zebus ogdoad Stittville electrodynamism enragedness cyclide milieu heaveless salpingo-ovaritis azygosperm isagogics neovitalism antiprophet bartended culet courie Tom-come-tickle-me bodings cavilingness attar Callicebus enervation micropylar voltes spear-shaped pulsatile Burnard Carpet megasporogenesis medimno tag-dating symphenomena horse-race Grikwa glyconin contriturate paramountness calm-throated occasionalism vengeance-scathed reproached plunk Ralleigh ship-load Cave esoteric assignees Mayetta Yeats epiphysitis nine-hour gaffing gradationally Cerasus undergirth bestore desecrates clinger Icerya soogeeing csect ensured phlebogram balanopr" (Indicator: "ntice")
"c terzio Mitnagdim propelment musketproof wrestled deboise unrealities telokinesis fumigations Siksika tariff-protected isovoluminal programing fats catch-all carbonometer Gobinist pampeans unrelating slim-waisted urogaster Telescopii forclose belligerences speak-easy nonorthodox praelect quedship praise-begging Rhomboganoidei cuamuchil kinaestheic kambou switch-over Sieur maar Antonia elengeness cramasie joltiest foldless ponticellos hibiscuses transparentness free-swimmer cabiai peevedness ethnoses chilopod arbalest lagoonside overtrick Venolia brutage actresss midlatitude vice-apostle Yankton marmalades bigam commanders Arval frecklier tutelaries beglooms underfiend SMOP pleaproof fry-cooker uncombable resorufin lime-water blackboard hard-fed lackies predecreed becriming knobwood mischanter pyrrhics skemp Longbenton fulltime Kotta monotonicity splinterd abote intercontorted indecomponible lank-haired circumvallate Fabron Alamogordo precelebrations cervico-orbicular synecology pot-bound screwdriver speechlo" (Indicator: "ntice")
"lmar cult miscellaneous hyperephidrosis canthitis detractingly balletomania self-reading all-searching queer-bashing prepubescent anticeremoniously iatrotechnics hammocks stipulations improbative veejays sambul wracker ment established preguaranteeing Catostomidae haberdash electrodesiccation Annapurna Auburndale yellow-tressed Rovner primaquine unscalable run-of-the-mine overslid circumvention EPW matzahs sheetwriting Ducan guardsmen pseudocandidly superzealously hobits alpeen anoxemic flashes busters humanizer excitably preresembled stromed jerreed maidenhoods clastic supersecularly intersetting unmimicked unwrathfully tanker actinometrical theatrophobia stipendiaries Silurus precontrivance chalkstone VSP terrorism orthal headsmen henroost preferent stooges interrena Ossetish paleornithology subcommission well-cherished physiologies callosal humanizations unloved dimissaries photoproduction Cainsville juamave thermocouple drudgeries mineralizes overcriticism foeish tattooage lacmus shoaler redissolubly home" (Indicator: "ntice")
"secularity superelegant hypnotoid death-warrant fearfully solidum spiculigenous hatches iffinesses Apathus fore-wit tormentive presentability maleinoidal genteelness long-haired butadiyne brocading judcock quasi-vocationally overscepticism impotence pestful dothienenteritis pinnae Lifar Angelus drumhead boltstrake Jupiter departments ambuscade gemmipares Djibouti processus suffragette Prudentius boltrope cynipidous abstract wholesaling disulphuret Marleah Kemi anticensorship professionalised middle-agedness parthenogenic bigger Jolley purpurins care-crossed diselectrification foliicolous Mistral dog-hole tahgook matripotestal perovskite garmentmaker writer-in-residence portalless protected parodial kangarooer Reagen woodmancraft craned unpaying nonpersuasively nonvinous splanchnodynia scuppaug rechanged otoneurology nuking oryctologic Kus solemn-seeming intimaters denigrators Benjaminite commended quasi-proof knoppie loco-descriptive vituperance crebri- tabuing Gadus cajuputol resurgency connate renegades irr" (Indicator: "ntice")
"tudianl adjoinant palmivorous megahertz kaiserins suborned Teressa mulberry-faced outpocketing treenail expurgate reinterchange Capetonian poisonously keeking tripara freckliness spik propitiously Tiahuanaco regular-growing well-hardened urethrostenosis nonsync corbelled larum unilobar ingle-bred magazining cephalocone truer nonapplication pulselessness platterface misknown show-offy trippet bride-ale flaunts vibratile depreciatory looker-on rebox cuttingly signetwise noncontributiveness unsolved enthymematic massed many-toned dancery ensky Fraya Sage Glathsheimr contragredience Melleta cremometer dislocatory teases orbicularis mentionless OSI belanda River fondant elshin activator Anomia noshed Emogene fellnesses inferofrontal Brahmi overdoing prex cloud-seeding querulous FP anticentralist catchpoll Makurdi lamp-iron xiphoidian sermonwise begiggle undulating emigrational numbfishes nostrilled oligarchies coloroto transmutation HEMP dyspraxia rekey anguloso- Bartlet percussor geognost becurst propacifism nati" (Indicator: "ntice")
"memoryless thaneship Zoraptera Erechtheus PETA inukshuk latifundio exigent gyniolatry lecyth nonpursuit statuses Transit reared vacance credibility proannexationist nitrophyte standup horologue scientintically sleep-bringing consularity occlusocervically garmentless rust-stained hungarians Bathinette mouches co-operationist overcheap chlorinated BSDes darktown pancreatolith incunabula straps welfares excessed airdropped legrooms Leuctra Marconi Rahway nonnationalism foresaw bazookaman mormyr antirationally enkindled Rhizinaceae kheth two-horse banally becapped Russelyn courthouses thymotic unarresting polytonally ill-treated badderlocks precorneal cognizances Harwin antiphysicalness anisotropical unload Mindel-riss skippering preregulation pooched roughheartedness unenticed fence-off laboring Bartholomean trotty show-through Ithaman spattania unlocalized mineralizes Mucoraceae lockstep tweeds delirium mesotherm Paradisia believe sahiwal Lyndell Putsch jesters pantograph picking puerperous tormina Lernaeacea B" (Indicator: "ntice") - source
- File/Memory
- relevance
- 2/10
-
Possibly checks for known debuggers/analysis tools
-
General
-
Contains ability to find and load resources of a specific module
- details
-
LoadResource@KERNEL32.DLL from wscript.exe (PID: 5064) (Show Stream)
FindResourceExW@KERNEL32.DLL from wscript.exe (PID: 5064) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Contains ability to find and load resources of a specific module
-
Installation/Persistance
-
Executes a visual basic script
- details
- Process "wscript.exe" with commandline ""C:\ComexposiumGroup.vbs"" (Show Process)
- source
- Monitored Target
- relevance
- 10/10
-
Loads the task scheduler COM API
- details
-
"wscript.exe" loaded module "%WINDIR%\SysWOW64\taskschd.dll" at 73550000
"wscript.exe" loaded module "%WINDIR%\SysWOW64\taskschd.dll" at 00700000 - source
- Loaded Module
- relevance
- 5/10
- ATT&CK ID
- T1168 (Show technique in the MITRE ATT&CK™ matrix)
-
Executes a visual basic script
-
Network Related
-
Sends traffic on typical HTTP outbound port, but without HTTP header
- details
- TCP traffic to 209.141.54.244 on port 443 is sent without HTTP header
- source
- Network Traffic
- relevance
- 5/10
-
Sends traffic on typical HTTP outbound port, but without HTTP header
-
Unusual Characteristics
-
Installs hooks/patches the running process
- details
-
"wscript.exe" wrote bytes "d83a5f75" to virtual address "0x756001E0" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "b4365f75" to virtual address "0x75600200" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "c0dfd5771cf9d477ccf8d4770d64d67700000000c011557700000000fc3e557700000000e0135577000000009457677725e0d577c6e0d57700000000bc6a667700000000cf3155770000000093196777000000002c32557700000000" to virtual address "0x76631000" (part of module "NSI.DLL")
"wscript.exe" wrote bytes "68130000" to virtual address "0x75631680" (part of module "WS2_32.DLL")
"wscript.exe" wrote bytes "b4365f75" to virtual address "0x756001E4" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "7111fa017a3bf901ab8b02007f950200fc8c0200729602006cc805001ecdf6017d26f601" to virtual address "0x75E107E4" (part of module "USER32.DLL")
"wscript.exe" wrote bytes "b840138973ffe0" to virtual address "0x755F3AD8" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "d83a0200" to virtual address "0x755F4E38" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "d83a0200" to virtual address "0x755F4D78" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "b8c0158973ffe0" to virtual address "0x755F36B4" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "b830128973ffe0" to virtual address "0x75631368" (part of module "WS2_32.DLL")
"wscript.exe" wrote bytes "60128973" to virtual address "0x74044028" (part of module "WEBIO.DLL")
"wscript.exe" wrote bytes "d83a5f75" to virtual address "0x75600274" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "0efcd87781edd777ae86d677c6e0d577effdd8772d16d777c0fcd477da8fdf776014d977478dd677a8e2d5776089d67700000000ad3763758b2d6375b641637500000000" to virtual address "0x73761000" (part of module "WSHIP6.DLL")
"wscript.exe" wrote bytes "b4360200" to virtual address "0x755F4D68" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "7d07d97781edd777ae86d677c6e0d577effdd8772d16d7776014d977478dd677a8e2d5776089d67700000000ad3763758b2d6375b641637500000000" to virtual address "0x73771000" (part of module "WSHTCPIP.DLL")
"wscript.exe" wrote bytes "d83a5f75" to virtual address "0x75600258" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "b4365f75" to virtual address "0x75600278" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "b4360200" to virtual address "0x755F4EA4" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "b4365f75" to virtual address "0x7560025C" (part of module "SSPICLI.DLL") - source
- Hook Detection
- relevance
- 10/10
- ATT&CK ID
- T1179 (Show technique in the MITRE ATT&CK™ matrix)
-
Installs hooks/patches the running process
-
Informative 18
-
Anti-Reverse Engineering
-
Contains ability to register a top-level exception handler (often used as anti-debugging trick)
- details
- SetUnhandledExceptionFilter@KERNEL32.DLL from wscript.exe (PID: 5064) (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Found strings in conjunction with a procedure lookup that resolve to a known API export symbol
- details
-
Found reference to API HeapSetInformation@KERNEL32.DLL from wscript.exe (PID: 5064) (Show Stream)
Found reference to API SetThreadUILanguage@KERNEL32.DLL from wscript.exe (PID: 5064) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 10/10
-
Contains ability to register a top-level exception handler (often used as anti-debugging trick)
-
Environment Awareness
-
Contains ability to query machine time
- details
- GetSystemTimeAsFileTime@KERNEL32.DLL from wscript.exe (PID: 5064) (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 1/10
- ATT&CK ID
- T1124 (Show technique in the MITRE ATT&CK™ matrix)
-
Contains ability to query the machine version
- details
-
GetVersionExA@KERNEL32.DLL from wscript.exe (PID: 5064) (Show Stream)
GetVersionExA@KERNEL32.DLL from wscript.exe (PID: 5064) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Contains ability to query the system locale
- details
-
GetUserDefaultLCID@KERNEL32.DLL from wscript.exe (PID: 5064) (Show Stream)
GetUserDefaultUILanguage@KERNEL32.DLL from wscript.exe (PID: 5064) (Show Stream)
GetUserDefaultLCID@KERNEL32.DLL from wscript.exe (PID: 5064) (Show Stream)
GetUserDefaultLCID@KERNEL32.DLL from wscript.exe (PID: 5064) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Possibly tries to detect the presence of a debugger
- details
-
GetProcessHeap@KERNEL32.DLL from wscript.exe (PID: 5064) (Show Stream)
GetProcessHeap@KERNEL32.DLL from wscript.exe (PID: 5064) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Contains ability to query machine time
-
General
-
Contacts domains
- details
- "bootcampforbabylawyers.com"
- source
- Network Traffic
- relevance
- 1/10
-
Contacts server
- details
- "209.141.54.244:443"
- source
- Network Traffic
- relevance
- 1/10
-
Contains PDB pathways
- details
- "wscript.pdb"
- source
- File/Memory
- relevance
- 1/10
-
Creates a writable file in a temporary directory
- details
- "wscript.exe" created file "%TEMP%\TableOfColors.exe"
- source
- API Call
- relevance
- 1/10
-
Intercepted relevant COM error
- details
-
"wscript.exe" called "Schedule.Service.1("GetFolder").RegisterTaskDefinition"
which returned the status code "80020009" (The system cannot locate the resource specified) ... - source
- API Call
- relevance
- 10/10
- ATT&CK ID
- T1122 (Show technique in the MITRE ATT&CK™ matrix)
-
Logged script engine calls
- details
-
"wscript.exe" called "Msxml2.DOMDocument.3.0.CreateObject" ...
"wscript.exe" called "Msxml2.DOMDocument.3.0.createElement" with result: "IDispatch" ...
"wscript.exe" called "Msxml2.DOMDocument.3.0("createElement").dataType" ...
"wscript.exe" called "Msxml2.DOMDocument.3.0("createElement").text" ...
"wscript.exe" called "Msxml2.DOMDocument.3.0("createElement").nodeTypedValue" with result: "46@7@29@127@44@7@2@121@3@54@118@38@45@125@118@127@22@125@9@59@44@8@21@57@44@34@5@39@22@33@35@60@22@23@43@122@21@23@5@53@3@34@1@57@45@28@118@37@45@125@126@59@21@24@122@127@3@124@1@56@21@24@1@63@21@34@35@35@21@12@122@56@44@7@29@123@23@126@118@41@23@126@118@41@23@126@1@35@43@12@13@127@21@12@14@118@6@8@126@39@44@34@43@39@44@34@35@127@22@23@1@35@42@7@36@58@27@34@25@124@25@8@9@53@46@54@40@56@4@30@114@114" ...
"wscript.exe" called "ADODB.Stream.6.0.CreateObject" ...
"wscript.exe" called "ADODB.Stream.6.0.Type" ...
"wscript.exe" called "ADODB.Stream.6.0.Write" ...
"wscript.exe" called "ADODB.Stream.6.0.Position" ...
"wscript.exe" called "ADODB.Stream.6.0.Charset" ...
"wscript.exe" called "ADODB.Stream.6.0.ReadText" with result: "46@7@29@127@44@7@2@121@3@54@118@38@45@125@118@127@22@125@9@59@44@8@21@57@44@34@5@39@22@33@35@60@22@23@43@122@21@23@5@53@3@34@1@57@45@28@118@37@45@125@126@59@21@24@122@127@3@124@1@56@21@24@1@63@21@34@35@35@21@12@122@56@44@7@29@123@23@126@118@41@23@126@118@41@23@126@1@35@43@12@13@127@21@12@14@118@6@8@126@39@44@34@43@39@44@34@35@127@22@23@1@35@42@7@36@58@27@34@25@124@25@8@9@53@46@54@40@56@4@30@114@114" ...
"wscript.exe" called "Msxml2.DOMDocument.3.0("createElement").nodeTypedValue" with result: "https://bootcampforbabylawyers.com/comment/specified.pptx_______Set td = margaritasexy.NewTask(0)" ... - source
- API Call
- relevance
- 10/10
-
Contacts domains
-
Installation/Persistance
-
Contains ability to lookup the windows account name
- details
- GetUserNameW@ADVAPI32.DLL from wscript.exe (PID: 5064) (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 5/10
-
Dropped files
- details
- "TableOfColors.exe" has type "HTML document ASCII text"
- source
- Binary File
- relevance
- 3/10
-
Touches files in the Windows directory
- details
-
"wscript.exe" touched file "%WINDIR%\SysWOW64\en-US\wscript.exe.mui"
"wscript.exe" touched file "%WINDIR%\SysWOW64\wscript.exe"
"wscript.exe" touched file "%WINDIR%\Globalization\Sorting\SortDefault.nls"
"wscript.exe" touched file "%WINDIR%\SysWOW64\rsaenh.dll"
"wscript.exe" touched file "%WINDIR%\SysWOW64\en-US\KernelBase.dll.mui"
"wscript.exe" touched file "%WINDIR%\SysWOW64\msxml3r.dll"
"wscript.exe" touched file "%WINDIR%\SysWOW64\msxml3.dll\1"
"wscript.exe" touched file "%WINDIR%\SysWOW64\msxml3.dll" - source
- API Call
- relevance
- 7/10
-
Contains ability to lookup the windows account name
-
Network Related
-
Found potential URL in binary/memory
- details
- Heuristic match: "bootcampforbabylawyers.com"
- source
- File/Memory
- relevance
- 10/10
-
Intercepted COM issued HTTP GET request
- details
- "wscript.exe" called "Msxml2.ServerXMLHTTP.6.0.open" to "https://bootcampforbabylawyers.com/comment/specified.pptx"
- source
- API Call
- relevance
- 10/10
- ATT&CK ID
- T1122 (Show technique in the MITRE ATT&CK™ matrix)
-
Found potential URL in binary/memory
-
Spyware/Information Retrieval
-
Found a reference to a known community page
- details
-
"ss outwrought Rectortown tokopat after Borassus hot-blooded bunnymouth Neilla alienize superofrontal atwitter mistend side-wind oilcloths CACM unsated high-blown fractur haslock whalebacker no-surrender presocialist inconciliable creolization Shumway light-marching despairing ungrammared sellably pulldrive gobonated Venuss-flytrap Havilland semihardness spurners ballastic triticoid intentional rollermaker unorder handybook showing-off amphicarpic Gegenschein cyanohermidin certifiable gunster unguiculate Pfannkuchen Tomi dement bedotted remould Myzostomata Rhemist tonally world-respected white-hoofed jackstraw unculture Benjamite saprogenic justiciability cisjurane odic soundboard dukedoms yondmost jockey dysentery embroglio schoolie Hudsonian overbanked loudspeakers merriless sulfhydryl Conlen depigmentation glowering feverish macarism franchises parental manoeuvrer Edea tightly schlepper Randia fulmines bi-bivalent Tildy sea-fish bathroomed telethermograph day-lily comedos pirayas Holman-Hunt frost-burnt ela" (Indicator: "twitter")
"sions sphaero- mispronunciation Africanoid underbasal apotype reincluding overglanced Ellerian uncloven cytoblastema strub cross-crosslets droplike bisks routeways goofed polyzoal hillebrandite duly unpsychological humero- slits unbokel gallet compurgator crabbedly bepen Sharma thin-barked synpelmous bacteriorhodopsin yaxche gonidiogenous anthropopsychic crookshouldered nonfugitive Gauricus gremlins respicing myasthenia lotto sagamores insinking quasi-intolerantly bodycheck ambilogy Sino-belgian erythrogen inaffability ozonation enterocrinin unaccommodatingness emperorship slipskin side-lying Jolene operably fianced alloeostropha Elsene monoline traducianist subungual hydrocarburet mitred polemarch overhardness Trollope localitys twitteration eighths unwomanlike bluebonnets Romeward repleat mercatoria cydon lohoch olp elinguation Daberath thujene biodegradability flodge Un-parisian haunt pharmacognosia Humble Hogen-mogen planohorizontal couchant grassweed tricuspid DIP varnish sparkling survise outblotted asw" (Indicator: "twitter")
"ssness thermoplegia honoraria sextole aulos transradiable cladose pangene braeman nonimputativeness gold-rimmed adducible Pana terzetto carnassial untangibly RWE permistion bidactyle graveyard hypovalve gagster offendable authorhood siphonated cholerically notodontoid beneficences linon Wann half-ebb enticeful Yevette Acanthaceae succenturiate pilledness Proto-polynesian Saltsburg parahormone briskening modi antifriction kathisma uncounselled dollymen colubaria duraspinalis subdruid leucoblastic unsmoothness conepatls untwinkled outwitter fill Scandinavianism poetized HIIPS philatelism six-syllable self-approved congoes outgone broad-horned hyperdolichocephal moneychanger tridiametral confident orrow ballstock unafflictedness disparaged latensifying pancreatogenic jeopordizing perkier pierless fixednesses rabbets nonsensate pseudoprophetical Atherosperma hammers belays arthritides nucleosidase dissipative dimercaprol ovicidal noneditor Finney haggadist snowy-capped loathingly overdiffusion epitrophic bunkmate" (Indicator: "twitter")
"ley anciens neoparaffin debride plant-eater proportionability Bourbonist rocket nonmotivated reverist Berclair Rapidan rosarian statecraft Elyse enqueues overstrait identicalness vrows Domina gauffers blood-boltered Leptolinae piririgua Elizabethton polisman malaguena disjoin shellproof ruggedize pesante tragicofarcical Eastertide ardent Ojibwas beaver-tree misura Carduus preharmoniously adventurous twitterly sparpled foughten impelling superalbal disagreements twill wordplay seaports oograph two-parted officiants odorimetry punditically wabby Ilisa roquer endark drabant maxillojugal ascenseur catodont standardization ory gustatory excuses prosthetically ecbatic still-increasing dreich tremblers sattva Leontine choosingly violins coinmates ejecta machine-cut rahdaree aedine untravestied Davon Nigeria fuss-budgety effigiate inspake pseudamoeboid nondistinguishably dim-gray sparest idant overlicentiously spired vastily Goudeau dehorners exegetics aftercome proscind Beduin pindarical minesweeper smacker epigramm" (Indicator: "twitter")
"chooners Autunian dreaming Gazankulu intraparietal Rayburn ectopic chitters mythometer rosttra winzes theatrize sunderly bouillons Mahan nonreversing cyriological suprachoroidea royal-rich handwrote auxin librarii stintedly headings Rhombozoa patrologies cystourethritis nouveautes Paleman palindromic otalgias fogou czarist rykes reapplause propargylic scowmen Jennee Trans-algerian umbilicate Bilharzia fire-raiser cryosurgery skywalks twittered diplogenetic figurante Leonanie unexcusedness patroullart veriest jambonneau Kasyapa sublimate unionists co-originality Belford Crypto-calvinist spanopnoea progressionism damboard mantissas circumlocutionary scurf preliterary manhandled koltunnor numerating Christ-inspired tinsel frondation Bassein unpuzzled Falla pragmaticalness energico giglots wandered calculable unannullable unfendered cuckoo-spittle top-work syndactylism cancerated Chiusi uteroventral goddamns shoulder Semi-patriot sordes Gloeocapsa amatito blaw Perlis calembour trailerable Strathmere radioisotopes" (Indicator: "twitter") - source
- File/Memory
- relevance
- 7/10
-
Found a reference to a known community page
File Details
Comexposium Group.vbs
- Filename
- Comexposium Group.vbs
- Size
- 1.6MiB (1703478 bytes)
- Type
- script vbs
- Description
- ASCII text, with very long lines
- Architecture
- WINDOWS
- SHA256
- e0af1e9d543945c46e263b7a0b091e92ab943d5fd9414f1b56d43c20cdaf0c96
- MD5
- d021a4e5a934b5224cb0ce10756ab34e
- SHA1
- d94ca8f641b9d6047aadb256612025f47de7e514
- ssdeep
- 49152://yksSMoZa2KKu1PZZ/9ozS4dZGPaMYGoJqV6IUDX:b
Screenshots
Loading content, please wait...
Hybrid Analysis
Tip: Click an analysed process below to view more details.
Analysed 1 process in total.
- wscript.exe "C:\ComexposiumGroup.vbs" (PID: 5064)
Network Analysis
DNS Requests
Domain | Address | Registrar | Country |
---|---|---|---|
bootcampforbabylawyers.com |
209.141.54.244
TTL: 14399 |
- | United States |
Contacted Hosts
IP Address | Port/Protocol | Associated Process | Details |
---|---|---|---|
209.141.54.244 |
443
TCP |
wscript.exe PID: 5064 |
United States |
Contacted Countries
HTTP Traffic
No relevant HTTP requests were made.
Extracted Strings
Extracted Files
-
Informative 1
-
-
TableOfColors.exe
- Size
- 224B (224 bytes)
- Type
- html
- Description
- HTML document, ASCII text
- Runtime Process
- wscript.exe (PID: 5064)
- MD5
- f5df1379db118e6b2ceae34ea86260a1
- SHA1
- ef9e7931df32e4df1085f8ff0a27b495c1c504e9
- SHA256
- a859ccff11a3b1c8cb62d90f17f5af09d730d9a123eaba5298b7bbb962f5aa36
-
Notifications
-
Runtime
- Not all sources for indicator ID "api-55" are available in the report
- Not all sources for indicator ID "api-64" are available in the report
- Not all sources for indicator ID "hooks-8" are available in the report
- Not all sources for indicator ID "string-24" are available in the report
- Not all sources for indicator ID "string-5" are available in the report