API tools faq
paste
Advertisement
paladin316

2352CO4164755428077540939_vbs_2019-09-18_20_30.txt

paladin316
Sep 18th, 2019
1,388
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 7.29 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * ID: 2352
  3. * MalFamily: ""
  4.  
  5. * MalScore: 10.0
  6.  
  7. * File Name: "CO4164755428077540939.vbs"
  8. * File Size: 4288220
  9. * File Type: "ASCII text, with very long lines, with no line terminators"
  10. * SHA256: "d6e36ec54c6978aef9c69feb23bdc7b7eb12606b13148884cfaf78dd6b2b84ee"
  11. * MD5: "d36d03e30c3af1c831f527b8dbafb521"
  12. * SHA1: "2975f4b057640e1f5cdce6bd3792cecc9c99afe1"
  13. * SHA512: "f0bf4f60106436939fe56cf99252c5d10e45fd039eed46c24e4be85fcf83592b3891c34670bb373a8dbd37d98307d32dffec10c2d576a70eae9254cb87ce0dd1"
  14. * CRC32: "97BDC409"
  15. * SSDEEP: "49152:sT682RzSu5kyBEWijKFabBJLaLDrET3VkpIzYN0bjjVyb0LuyOkX8LFMmleiF+XX:Y"
  16.  
  17. * Process Execution:
  18. "wscript.exe",
  19. "svchost.exe",
  20. "WmiPrvSE.exe",
  21. "svchost.exe",
  22. "taskeng.exe",
  23. "taskeng.exe",
  24. "msoia.exe",
  25. "msoia.exe",
  26. "WMIADAP.exe",
  27. "taskeng.exe",
  28. "taskeng.exe"
  29.  
  30.  
  31. * Executed Commands:
  32. "taskeng.exe F084B693-0906-43C1-B1D4-1E4ECE18A120 S-1-5-18:NT AUTHORITY\\System:Service:",
  33. "taskeng.exe 67189A3A-E994-4CA2-80F0-B208B1BF10B1 S-1-5-21-0000000000-0000000000-0000000000-1000:Host\\user:Interactive:1",
  34. "\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE wmiadap.exe /F /T /R",
  35. "taskeng.exe 1C78870B-530F-41A4-A2CD-39CC33DFD884 S-1-5-18:NT AUTHORITY\\System:Service:",
  36. "taskeng.exe ECBAC3F6-CF16-4D7F-9CCD-B5D5824740E4 S-1-5-18:NT AUTHORITY\\System:Service:",
  37. "\"C:\\Program Files\\Common Files\\Microsoft Shared\\Office15\\OLicenseHeartbeat.exe\"",
  38. "\"C:\\Program Files\\Microsoft Office\\Office15\\msoia.exe\" scan upload mininterval:2880",
  39. "\"C:\\Program Files\\Microsoft Office\\Office15\\msoia.exe\" scan upload"
  40.  
  41.  
  42. * Signatures Detected:
  43.  
  44. "Description": "SetUnhandledExceptionFilter detected (possible anti-debug)",
  45. "Details":
  46.  
  47.  
  48. "Description": "Guard pages use detected - possible anti-debugging.",
  49. "Details":
  50.  
  51.  
  52. "Description": "A process attempted to delay the analysis task.",
  53. "Details":
  54.  
  55. "Process": "wscript.exe tried to sleep 360 seconds, actually delayed analysis time by 0 seconds"
  56.  
  57.  
  58. "Process": "WmiPrvSE.exe tried to sleep 601 seconds, actually delayed analysis time by 0 seconds"
  59.  
  60.  
  61. "Process": "taskeng.exe tried to sleep 438 seconds, actually delayed analysis time by 0 seconds"
  62.  
  63.  
  64. "Process": "svchost.exe tried to sleep 367 seconds, actually delayed analysis time by 0 seconds"
  65.  
  66.  
  67.  
  68.  
  69. "Description": "A process created a hidden window",
  70. "Details":
  71.  
  72. "Process": "svchost.exe -> \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE"
  73.  
  74.  
  75.  
  76.  
  77. "Description": "Uses Windows utilities for basic functionality",
  78. "Details":
  79.  
  80. "command": "\"C:\\Program Files\\Common Files\\Microsoft Shared\\Office15\\OLicenseHeartbeat.exe\""
  81.  
  82.  
  83.  
  84.  
  85. "Description": "Behavioural detection: Transacted Hollowing",
  86. "Details":
  87.  
  88.  
  89. "Description": "Stack pivoting was detected when using a critical API",
  90. "Details":
  91.  
  92. "process": "taskeng.exe:2604"
  93.  
  94.  
  95. "process": "WmiPrvSE.exe:2868"
  96.  
  97.  
  98. "process": "taskeng.exe:4028"
  99.  
  100.  
  101.  
  102.  
  103. "Description": "Checks the CPU name from registry, possibly for anti-virtualization",
  104. "Details":
  105.  
  106.  
  107. "Description": "Attempts to interact with an Alternate Data Stream (ADS)",
  108. "Details":
  109.  
  110. "file": "C:\\$Extend\\$Quota:$Q:$INDEX_ALLOCATION"
  111.  
  112.  
  113.  
  114.  
  115.  
  116. * Started Service:
  117.  
  118. * Mutexes:
  119. "CicLoadWinStaWinSta0",
  120. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  121. "DSKQUOTA_SIDCACHE_MUTEX",
  122. "Global\\ADAP_WMI_ENTRY",
  123. "Global\\RefreshRA_Mutex",
  124. "Global\\RefreshRA_Mutex_Lib",
  125. "Global\\RefreshRA_Mutex_Flag"
  126.  
  127.  
  128. * Modified Files:
  129. "C:\\Users\\user\\AppData\\Local\\Temp\\usrEEpqjQ",
  130. "\\??\\PIPE\\srvsvc",
  131. "\\Device\\LanmanDatagramReceiver",
  132. "C:\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb",
  133. "C:\\Windows\\SoftwareDistribution\\DataStore\\Logs\\edb.chk",
  134. "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM",
  135. "\\??\\WMIDataDevice",
  136. "\\??\\PIPE\\lsarpc",
  137. "C:\\$Extend\\$Quota:$Q:$INDEX_ALLOCATION"
  138.  
  139.  
  140. * Deleted Files:
  141. "C:\\Windows\\sysnative\\Tasks\\Microsoft\\Windows Defender\\MpIdleTask",
  142. "C:\\Windows\\sysnative\\Tasks\\Microsoft\\Windows Defender\\MP Scheduled Scan",
  143. "C:\\Windows\\SoftwareDistribution\\DataStore\\Logs\\edbtmp.log"
  144.  
  145.  
  146. * Modified Registry Keys:
  147. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\2F377986-27CA-4BB8-BABF-CF61DD96452C\\Path",
  148. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\2F377986-27CA-4BB8-BABF-CF61DD96452C\\Hash",
  149. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Microsoft\\Windows Defender\\MP Scheduled Scan\\Id",
  150. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Microsoft\\Windows Defender\\MP Scheduled Scan\\Index",
  151. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\2F377986-27CA-4BB8-BABF-CF61DD96452C\\Triggers",
  152. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\2F377986-27CA-4BB8-BABF-CF61DD96452C\\DynamicInfo",
  153. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\ED0D73D7-BC97-46E2-AC55-FD6EB3F72C05\\DynamicInfo",
  154. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\F084B693-0906-43C1-B1D4-1E4ECE18A120",
  155. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\B17E070E-57E3-43F6-96F5-A9A9C921DEBF\\DynamicInfo",
  156. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\67189A3A-E994-4CA2-80F0-B208B1BF10B1",
  157. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\DF000DCA-3FA2-48A6-9E59-C0606F9F8D73\\DynamicInfo",
  158. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\1C78870B-530F-41A4-A2CD-39CC33DFD884",
  159. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\ECBAC3F6-CF16-4D7F-9CCD-B5D5824740E4",
  160. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\F084B693-0906-43C1-B1D4-1E4ECE18A120\\data",
  161. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\67189A3A-E994-4CA2-80F0-B208B1BF10B1\\data",
  162. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\1C78870B-530F-41A4-A2CD-39CC33DFD884\\data",
  163. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\ECBAC3F6-CF16-4D7F-9CCD-B5D5824740E4\\data"
  164.  
  165.  
  166. * Deleted Registry Keys:
  167.  
  168. * DNS Communications:
  169.  
  170. * Domains:
  171.  
  172. * Network Communication - ICMP:
  173.  
  174. * Network Communication - HTTP:
  175.  
  176. * Network Communication - SMTP:
  177.  
  178. * Network Communication - Hosts:
  179.  
  180. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!