Mistral.com # 2019102.vbs
This report is generated from a file or URL submitted to this webservice on November 26th 2019 03:43:15 (UTC)
Guest System: Windows 7 32 bit, Professional, 6.1 (build 7601), Service Pack 1
Report generated by
Falcon Sandbox v8.30 © Hybrid Analysis
Incident Response
Risk Assessment
- Network Behavior
- Contacts 1 domain and 1 host. View all details
MITRE ATT&CK™ Techniques Detection
Indicators
Not all malicious and suspicious indicators are displayed. Get your own cloud service or the full version to view all details.
-
Malicious Indicators 3
-
External Systems
-
Sample was identified as malicious by at least one Antivirus engine
- details
- 2/57 Antivirus vendors marked sample as malicious (3% detection rate)
- source
- External System
- relevance
- 8/10
-
Sample was identified as malicious by at least one Antivirus engine
-
Unusual Characteristics
-
References suspicious system modules
- details
- "sohn Kistler air-mindedness balatronic Elsass ketch-rigged unnovel Chrysostom sursolid hirundine conominee waistline three-pointed refreid enclitical prefigurement refreshing edriophthalmian maremmatic possy curiae polychroic KSR Selina premeridian unwrappered poter mudwort sargassumfish Trujillo interinsurance lazarly Klayman weendigo outpities rehearsals repaginated consumers hogans dream-perturbed whimmy pleasant-spoken corycavamine louse-up grossulariaceous decalcomanias habits multiplicatives Acarus astounded Malissia ox-eyed consummated instipulate Jodrell exclaimers youthhood ringside sol-faing groupable idlement octopetalous colpheg unstercorated mistranscription Gracey DOJ zimb toluene slow-developed misos quasi-delicately podiatry asphaltus paludinous tradevman detracts confutation iambics hokums grabblers DOMAIN festing remunerates subcortically querulousness Babelic A.R.C.S. basemen squinches drawee aeroelasticity quasi-remarkably mannerable stree resonated odorproof disbursal batfowl Pro-bohemian"
- source
- File/Memory
- relevance
- 5/10
- ATT&CK ID
- T1215 (Show technique in the MITRE ATT&CK™ matrix)
-
Script file shows a combination of malicious behavior
- details
-
The script produces internet activity
is obfuscated and drops files - source
- Indicator Combinations
- relevance
- 7/10
-
References suspicious system modules
-
Suspicious Indicators 6
-
Anti-Detection/Stealthyness
-
Possibly tries to hide a process launching it with different user credentials
- details
- ImpersonateLoggedOnUser@ADVAPI32.DLL from wscript.exe (PID: 304) (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 3/10
-
Possibly tries to hide a process launching it with different user credentials
-
Anti-Reverse Engineering
-
Possibly checks for known debuggers/analysis tools
- details
-
"aticalness Linkoping pulicidal Millwood pedagogy Agace salt-glazed embossman computate lenticel OTC daredeviltry reoccurrences uplit analepsis condescend cholralosed blessedest Colorado sempervirid mystacal pervertedly seemlily particled chouser Timucua hardheaded aminoplast pyrostereotype wedset mummifying gorp Tokyo statoreceptor unsplendidness Fabriane stalagmitically re-enfeoff devicefulness Ethan magrim trunch dizzy posttussive atelomitic scoundreldom moon-calf allthorn doghouses recontrast octaemera Anapurna luteofulvous meriquinone unfeelingness unforgettably hierographical Edrei scleroticonyxis prich Terence Non-venetian nonsegmentary Balsamodendron Norcatur Marcus ampherotokous mesitylenic scramming patchworky kaolinise unanarchic chronosemic ghazies reducer flat-shouldered Haifa Gastrotricha tub-preach Arctogeic sidereally black-crowned chondromyxoma endew voracities speltzes Rai crenature Gradyville hand-habend Algarsyf woolhead Zeuzeridae phlegmonic rhinenchysis demibrute inrighted Anglomaniac Per" (Indicator: "ntice")
"c apprenticement chrismatize cestodes acey-deucy hollowness gardbrace Pan-buddhist paracentrical schweizer clamourist pentahedrous shaliest reproducing self-speech Deonne organosodium Degas somatics maltman Hatfield self-opinionatedly viremic disposer Metanemertini fresheners Gerald unwished-for Nahuatls trifloral sleepy-sounding witched Norrv gossipries unconstipated ignorantist prestabilism plaints Geneseo overcool single-tongue semibiographically impeccably spreadboard introtraction compliably hoggy bradyseismical calicles anacephalize rehonor Frolick ghetto-dwellers underseller thoracalgia strong-willed shebang sackbag incompletableness Mitre elevatedly adelante nightward yeelaman double-footed pharyngealization uninfinite MSHE Herbartianism low-pressure Doppelmayer ventriloquistic Strade versifications unverdurous reinflaming mutilator Highmore miliolite procurer precieux decertifying farmerly ramifies shillyshally unsmokeable Sabbathism choruses CHP diglots amphodiplopia Hultgren low-quartered dominae n" (Indicator: "ntice")
"anotherapeutics bacteriosolvent Gail preobliged galeae backscattered Whiteheath vinylacetylene hygrothermograph uncurse gyroma proctodeal tabulators Simmel epiklesis outspans tournasin choosy oses reunified aceratosis degeneralize improvers irreconcilably vespertinal Judahite balkans bibliolatrous paper-embossing quinquesyllabic plunges classicalist Apterygota ranker years petiolary pachyhematous undiscussed honeymooned bag-bearing holometer oudenarde spiration Japanophobia prounionist shoulderette puruloid obligedness forhooy sweet-voiced architricline magnesian Flodden beekeepers trajection appeal januarys sapotilla self-debasing ill-persuaded ensate gaugers adagiettos Apharsathacites bosky barrico psammon unpopularity Raphaelite dragon-fly blatter CRI unseason quasi-classic lookout stroking subuncinate palaeophysiology weedier sulphethylate addictively world-altering Hime rum-bred Lyndora tribunitive Laodamas unfoisted descensional prentice megavolt Mehalick baselessly buffball Stigler gingall kidnapper Te" (Indicator: "ntice")
"onstrated pawnable pudding supraliminal scriniary missis manred attainture Azteca gildsman Balch unfrequentable aquaduct physiographic opuscle bracing tie-wig microfilm mineralogical trisubstituted unspecific well-pushed affrap brattice dipped cheveril hydrographic ductor waypost thermopalpation asterisking mycophagist supersensitise Physoclisti indican arachnephobia roller-milling Tamulian filliping imperialisation ceride impervertible ten-pound polyphone cornmeal glare-eyed diplotene betaken sitiophobia atropia unconsentaneous edeology zemeism phrenicocostal tergeminate bidarkee secessionists symbiot rhinolalia parochiner unta sporogonous woorari agrafe quirkiness radiumlike PNdB Haydenville northeasternmost lank-haired pointingly woundy mediacies confirmatory barratrous fire-spitting caravanned clambake fossilist Bakwiri nuculanium apprenticehood spondylodidymia carroches harpooners parodistically Sabellian half-praising pre-Hispanic paleohydrography overrate sporozoid flagstick boil-off knockless seirospo" (Indicator: "ntice")
"ers broadloom suspendible laryngismus post-Transcendental neuroplexus nonfishermen Barbabas tempest-sundered civilisable administer exterminations Clara everyhow mcg circumnatant Coffey in-plant saintlike microbium zapota virgin-vested bosom-folded semicylinder ill-rewarded disponent pennigerous chanceman unimpregnate sebkha ectocoelic maximum fanfarade substitutional Tyrolean limnophile interradiation quasi-officially Summerton likeful anticentralization ochre asyndetons objurgative quinism sarment starchmaker tasimeter salon geomorphogeny Banksia whirley Korff bastinades wettishness Merycopotamidae Kaenel heteroerotic sarodist musk-duck meneghinite mastheads Muradiyah meandriniform Angerona cessation sniffling termage Teut gipsydom asks strychnine impeach radiochemistry Harmat yeom outdraw Rhynsburger agglutinability hajjis carageens Strathmere pikelike liberalizes kibla stromatology Terrebonne hoppling barley knoblike yellowtail disagreer newspaperdom recompetitor stanniferous viably nonnitrous eupnoeic Po" (Indicator: "ntice")
"al leaf-lard radiate-veined long-line melilot nonpermissibly underminer four-minute barleysick dolma rickshas proassociation tanha precedential Han naming holloed naturism filigree multi-colour overlover arthrempyesis flammulation unproperly barbarism wrongful mullocker convexo-plane unscaled fissioned bloopers holiday-maker dorsomesal Matamoras Samarra forsworn fiscalism well-stabilized airlifts Lysenko uppropping odors retiring thorny-handed fream unconscionability Leucas nontraveling hard-riding lenticel ascocarp year-around reunite parasyndesis vice-verger botcheries infraglacial uncivilness physharmonica Cylindrophis Sarilda coifing tram unintriguing firebrat helplessness choregrapher areas buff-orange flatter Vertrees snakepiece acieration offishness whimpering paraflocculus Friendship bacchanalianism sirenize parosteal heemraat bedeafened toenail Doukhobor thyroxins merriment NW intensitometer sexradiate clankety confronting commiseratingly Sporochnus impacted pepticity outstolen ceremoniousness B.D. A" (Indicator: "ntice")
"oritic wergelts cervantic nonimmigrant pouce brutalized soliloquist gigantean Octocoralla hamber-line hech epicondylian decennaries syndicat tweeded thimbleful coffeegrowing Hadrian Bondy minihospital Israel petrogenic spiritual-minded synd wrongness unwit franticness Sabbatia hypergenetic reapportion Nootkas Popoloco lenticellate collide three-cocked Hallock spindle-formed daledh marble-minded poet-saint provincialship prerectal Monticello Mohawks voguey zechin SMASPU unmakes latosols piecen Yeshibah forboded bootjacks Eteocles ergotaminine rte pugarees Douai fail-safe rhodium cabinets bottleneck Bulacan Samau gweducs Courteney all-changing connascent electrophysiologically unelectric hypobromite alkane synchrocyclotron nonconciliating pontin punditry howgates outbbled nunning Doerun esclandre co-afforest Lichenoporidae unfatten acalephes woolstapling Latisha rokey dissilient paralgesic supercommercially misstatement origans pitted Guild merrowes counterpropagations unshore nonchafing coking knave young-mans" (Indicator: "ntice")
"pher slumberously unbothering Sutherlandia Adamik rapine variances muddy cancered puparia rainbirds excursive window-dress aminolytic excyst piscioid preaxiad Uniontown delineated mispage Strongylus fluidize vocab spider-catcher pericentre trachealgia oxadiazole nonspheric pseudolamellibranchiate steamers lintelling apostolically wobegoneness Como bersim ablatives nondigestibility adinidan entices Pembrook strepsis Artemovsk mucaro palterers skirting-board photophygous cutinising bioecologic backhanding dogedom idiothermic untried hypochrosis reaudition UCAR Cauquenes manubrium urophthisis Ileitis sensitometers blacks Chondrichthyes Riplex double-crop monophonic Encampment buttal chorizontes slow-sure carryall nerve-shattering silk-family immerited tuskiest Luxora rarely shick-shack subdeanery almshouse Aubyn appositely Neo-Impressionist Amethist ombre enterocrinin nonadaptabness decompensations overmodesty resulphurize sub-arch chirmed innkeeper macerater pyrosulphite Posner televisual Cheyne macrocyst brewh" (Indicator: "ntice")
"Rizas Darnall black-tail Magnuson disentitlement graphanalysis densifies spectromicroscope empresa Neocomian Pittsfield parabranchia Ramunni telesterion surbedding excoriates underslept isnt BAgSc perocephalus kidnapers pigeonholed septillionth stoolies struthin registrable whitelike mom jerseys proapproval notum testate observers shigram oil-burning half-abandoned canailles expositorial dicephalism Shiro biophysicist Frome splendrously unpetted Pines hyperparathyroidism Bettinus draw-sheet CLI tsking litanywise disembowels alodiality waterhead flotations recoct cracker-open NPV Heins ekphoria cloudscape gonepoietic zingaro cuboids hardpans gon- Tupaiidae armrests Alviani coapprentice Loretta submiss Chaworth bureaucratical filesmith thunder-shod tetrakis taurean wolf-dog seventy-seventh monodactylate one-grained blub outmaneuver porphyrogenitic convivialities monomyary presuperintendence wonder-writing evectic cubitiere whole-headed steepgrass Tarazi untemporally Euphausia bolt-pointing corrosibility squande" (Indicator: "ntice")
"weet fringelike connaturalize Somersetshire crimson-petaled nondeprecating unflattered nubbins footsoreness cinematics tie-wig IGMP croppie celibataire object bwanas Shaver world-esteemed nonculpableness thinnish whiskerandos Hypsilophodontidae oligocarpous Nephila shillings ungrassed pronunciator caco-zeal Redemptorist bilingual hastile crowshay piscatorious unsatisfiableness minge pecten Wellpinit ecdysiast trumpet-shaped Thilanottine mesenteries parcelment dispatchers lumberdar pre- addictively Bucovina OKelly unnitrogenized Malpighi tower-bearing invital afterwash upwards amalgam Seeley sensorivasomotor whittler Anthoxanthum Stromateidae suprasubtle transelementating trinketed grasswidowhood intravertebral isodiaphere nonathlete thetas UNIX sympiesometer duodecimally antiecclesiastic earnestness hot-dry adversary corresponder bedazzled AMSAT Baxterianism repost rough-sawn oversententious armrack sly-tongued assecure apprenticed kaputt sarcenets bimolecularly microgyria situlae decolonisation extrapolates" (Indicator: "ntice")
"enting germinant goddess-like unshirked startlishness Faustena heelings exceedingly bright-haired trachytoid winemake vealer rested represses autoing toxogenesis gastriloquist pauropod vinylbenzene unwithholding disobediences Kneller tiar Celarent Indo-Germanic trifornia nonopprobriously lophotrichous gangliasthenia pennatuloid elutriated orthogonally shifts scarlet-flowered Shuma decussorium green-embroidered Praxean soupiere collectedness torsoclusion removals outsinning downrush coccygalgia unkeyed quoteworthy clarinetists curvets nonmicroscopically monticle admiredly hamartite skullcap hydatopneumatolytic colourability catwort undedicated unalliterated starchiness exhaustivity indecency Lepsius freeze-dried Panoan gouts shaslick enticement Boys myalism ecofreak recompliance anthropomorphically impended vagant animatistic pedialgia tetanus hopscotch virous Megalensian mopingly oscillation firehouses idolizer unconfidently dadaistically sougan Hedgesville pecky ethenoid grandparent reprimands Ashien outshap" (Indicator: "ntice")
"-smothered bedriveling bracking belozenged malodorousnesses lanosity peaceful tepefaction anisotropous television-viewer superimposing Zhdanov daggletailed hygrostomia optological Coopersville indemnitor decil illiterates operancy psychopath biconvex gumi noninvidiousness solid-color undarned vacates shred entrada BMus Explorer chrysalis burking tenderability collar-bone ungrieve well-recited semivitrified Troilus readapts grouse kumquats goldarns rescinder Brade barklyite band-tailed fire-stone emetophobia unhieratically phagocytizing Verdha horizon expostulatively ton-kilometer DPM masculation regrafts ORM Herculean unlearn uninnate Olenellus Hydropterideae interparty AFGE unroofing publica twice-delayed semiacidulated metronome omnivores gawkish aerical nymphomaniacs nonabstractedly intercerebral attemperator test-tube quinquetuberculate pidginization iwaiwa meningic ergates undisagreeable naegait apprentice unrecuperativeness A.L.P. precontribute overweary neurons heterofermentative artiness educators pet" (Indicator: "ntice")
"c rheumier Bowdon conquerer glittery tembetara Egyptianising Daschagga alasas unmanfulness traps archdeaconess dermatomyces anticensorious drop-kicker nonindustrious Embla spectrograms attainor agraphias slug snarers few-seeded craniovertebral decumbently subalgebraical oleostearine Sidra superextoll Rank sendoff feministic girthing prescutal trawling tapestry nonstorable quasi-tribal checkwork eternities tricksier hanifite shmaltz swirrer giddy-brained absentminded preamble larvivorous unpermeating Sarcoptes Aethionema walksmen dairt salsilla Rema campings outheart unfrightful uninterruption fernland ambilateral tasajillo remorselessness autoerotically unembayed uroodal frigidoreceptor Toriness octocentennial twice-discontinued unargumentatively corsac overiodizing amid wheatgrass barbecuer wainwrights remaining cicisbeo distinguishable amicabilities deformitys desilverized blue-starry miscopying NS LLOX nooks bewreck homologically tzarism tyromata unintromittive emptive cowiest ocean-girdled counterside url" (Indicator: "ntice")
"ar diduced misdeems heartsease unfouling alanyls sutten serpentarium poundkeeper Hellenocentric postulated anklebones pseudopupal trismus untravellable well-harnessed Nazareth immovabilities tryst postconvulsive felicitousness habitual cannily overextension symbolic velometer undisguised tarter licuri chiasm somniative pilulist Bosniak winterier transumpt obscures Negroism pacinko Mayport raw-headed single-leaf diablene jobnames inker thence calbroben cramel unseldom umiac resining phryganeoid monophasic torments ethnohistoric doncy vowless Mulcahy sophisticated dust-tight seizing Ante-mosaic analemma an. lymphocytotoxin lauryl orated knawel perfectionizement exhance kidnaped nonhabitualness conductimeter footsoldier pseudoparaplegia prepectoral enramada areas Isle polyclinics fetchers precipitinogen psychotechnician ruswut lidder canna-down reimplemented canciones subpolar unironically renounce splay-kneed peridental enticeable refereeing zirconiferous free-thinker enthroned significants arbinose Germania ov" (Indicator: "ntice")
"paraquinone glaister Stahlism chronaxia i.e. mystico-religious L.A. upprops Pengilly Holdrege self-introduction octangularness titters Podosomata Post-azilian coloradans RQS soshed unmendableness unsportively drubble Mesmer pochards anticensorious Agarum tickle-tongued tanniferous gentlepeople loveliest Alverta navars treeship emulsion lubricant schemery equidiurnal responsusa orthogonal fleetingness synthetising blood-shot millrynd naumk lentiginous stuccoer airscape off-stage Glathsheim Integropallialia but- punster anotus ticklenburg municipality hedgemaker Austro-Hungarian QMP club-man arricciato gravida lawyeress vortices bedrivelling outdoors Tzu-po coirs mortgagor ungregariously alterni- River rest-balk wrestles bumpkinly baryonic first-bred latchets tetraxon blottto tricerium distemperedness waney Farly paintier dampish salvagers forecourse unepigrammatic unnervously urochordal Munch hypopyons RTF mooktar Haynor substratums otorrhagia quinoxalyl unsplendorous antirationalistic Bleuler continuations w" (Indicator: "ntice")
"indazine roitelet interpetiolar gesticularious polychromatist feudatories defensible Orebro subcommended anthraxylon brumbee turquoise-hued smotherable statist Satsuma rytidosis pseudocoelom frondosely unplunged brushmaking suite cardioneurosis lectins scasely document cupules handwaled Koerner whitepot pleasers moralization polysiphonic sovietized potentize dishonorableness self-appreciating unchronic Leedey shallow-brained kniazi maledictive waired Laguerre Dorinda indicativeness pomologically Agaces undodged unfrangible overbalm saj oclock prespur Colla prentices Zondra Stictidaceae pinpillow unsociologically simplistically fishworm anteriority psomophagist servility rome-scot Araxa postabdominal subst morainic thysanuran perioikoi dearworthiness resurrectible Cheremis Yorkshire overrepresentatively algedonic nonreviewable Publea Samara Semito-Hamitic step-cline ochratoxin overruler lorilet ureterostoma nonunion trailsmen uneclectically antemarital homothermy uncollapsed elve swing-tree henotheist depurat" (Indicator: "ntice")
"als secern plushly brachygraphy Daffodil theoretical tetrad unbelievingness Darci three-ply fld cyanean Chilson perfecter quadrantile Verge Bharata post-free effeminize Parrish indispensability corsaint nonedibility kokan anticeremoniously Medusas Rhineland carien gaudsman coalrake Procellarum corticoefferent renins knocker-off aspergillums alectoriae unhaziness taj ninepin Yeaton Beedon elevates votarist nonubiquitous dextrin Anabaptistic hydrocinnamic kazachok Reichenberg Pauling agpaite sycophantically re-remember unclothedly well-circumstanced gammacism Tsuma dehydroffrozen quasi-practical vasoreflex blithesome semistuporous aristae valvelets overgoads tragopan smatterer silverware prededuction scratchcat technicological torcs Asahi suberic aerier compromissary noneroding Ania kinghunter Epiceratodus Hezbollah telephony Katzman semi-intercostal alkylbenzenesulfonate co-attest ogamic nonteachably substylar forgathered retyped pretrims HIM condottieri sight-seeing brave-spirited walers mesenterical sentinel" (Indicator: "ntice")
"tes estimable hypogonation jinnee fervidly haverel decise bignonias ligaturing requesting aghas minimarkets menialty Zaque nonunionist hypomeral cassina hydroscopical metric anticensorial swallo catguts involutes Verticillium shice dingily immensittye Noemi phyleses lateroventral Bonesteel previsible burweeds olives dredger birdlime laryngectomize schout unpastorally unhealth fortalice well-moralized Ancohuma supraordination brittle Melstone Alhena colorcasting dervishhood anticreational gravel demonstratedly laparocele Kluczynski erupted elaphine jargonistic scytonematoid Earlene seminarys Calista Baudelaire eyesores reedified doorlike anoopsias Bochum Samsun multisonic sixty-two mascularity divestitures martyrium internunce penults venturous Non-anglican glorifiers Cassondra tunnels contravener precinct Brakpan contemplant bantamweight thumper labiodendal Alpaugh Emmylou jealouse gastricism icosahedral overdescant overmany expirable snooper rough-thicketed incipitur paleoentomologist vulvouterine Remijia Se" (Indicator: "ntice") - source
- File/Memory
- relevance
- 2/10
-
Possibly checks for known debuggers/analysis tools
-
General
-
Contains ability to find and load resources of a specific module
- details
-
LoadResource@KERNEL32.DLL from wscript.exe (PID: 304) (Show Stream)
FindResourceExW@KERNEL32.DLL from wscript.exe (PID: 304) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Contains ability to find and load resources of a specific module
-
Installation/Persistance
-
Executes a visual basic script
- details
- Process "wscript.exe" with commandline ""C:\Mistral.com#2019102.vbs"" (Show Process)
- source
- Monitored Target
- relevance
- 10/10
-
Loads the task scheduler COM API
- details
-
"wscript.exe" loaded module "%WINDIR%\System32\taskschd.dll" at 73BB0000
"wscript.exe" loaded module "%WINDIR%\System32\taskschd.dll" at 00470000 - source
- Loaded Module
- relevance
- 5/10
- ATT&CK ID
- T1168 (Show technique in the MITRE ATT&CK™ matrix)
-
Executes a visual basic script
-
Network Related
-
Sends traffic on typical HTTP outbound port, but without HTTP header
- details
- TCP traffic to 107.189.10.127 on port 443 is sent without HTTP header
- source
- Network Traffic
- relevance
- 5/10
-
Sends traffic on typical HTTP outbound port, but without HTTP header
-
Informative 18
-
Anti-Reverse Engineering
-
Contains ability to register a top-level exception handler (often used as anti-debugging trick)
- details
- SetUnhandledExceptionFilter@KERNEL32.DLL from wscript.exe (PID: 304) (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Contains ability to register a top-level exception handler (often used as anti-debugging trick)
-
Environment Awareness
-
Contains ability to query machine time
- details
- GetSystemTimeAsFileTime@KERNEL32.DLL from wscript.exe (PID: 304) (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 1/10
- ATT&CK ID
- T1124 (Show technique in the MITRE ATT&CK™ matrix)
-
Contains ability to query the machine version
- details
-
GetVersionExA@KERNEL32.DLL from wscript.exe (PID: 304) (Show Stream)
GetVersionExA@KERNEL32.DLL from wscript.exe (PID: 304) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Contains ability to query the system locale
- details
-
GetUserDefaultLCID@KERNEL32.DLL from wscript.exe (PID: 304) (Show Stream)
GetUserDefaultLCID@KERNEL32.DLL from wscript.exe (PID: 304) (Show Stream)
GetUserDefaultUILanguage@KERNEL32.DLL from wscript.exe (PID: 304) (Show Stream)
GetUserDefaultLCID@KERNEL32.DLL from wscript.exe (PID: 304) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Possibly tries to detect the presence of a debugger
- details
-
GetProcessHeap@KERNEL32.DLL from wscript.exe (PID: 304) (Show Stream)
GetProcessHeap@KERNEL32.DLL from wscript.exe (PID: 304) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Contains ability to query machine time
-
General
-
Contacts domains
- details
- "kimberlyjeanbedard.com"
- source
- Network Traffic
- relevance
- 1/10
-
Contacts server
- details
- "107.189.10.127:443"
- source
- Network Traffic
- relevance
- 1/10
-
Contains PDB pathways
- details
-
"wscript.pdb"
"%USERPROFILE%\Desktop\Source JSS-EXE\JSS\obj\Release\BBS.pdb" - source
- File/Memory
- relevance
- 1/10
-
Creates a writable file in a temporary directory
- details
- "wscript.exe" created file "%TEMP%\TableOfColors.exe"
- source
- API Call
- relevance
- 1/10
-
Logged script engine calls
- details
-
"wscript.exe" called "Msxml2.DOMDocument.3.0.CreateObject" ...
"wscript.exe" called "ADODB.Stream.6.0.CreateObject" ...
"wscript.exe" called "WScript.Shell.1.CreateObject" ... - source
- API Call
- relevance
- 10/10
-
Contacts domains
-
Installation/Persistance
-
Contains ability to lookup the windows account name
- details
- GetUserNameW@ADVAPI32.DLL from wscript.exe (PID: 304) (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 5/10
-
Dropped files
- details
- "TableOfColors.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"
- source
- Binary File
- relevance
- 3/10
-
Drops executable files
- details
- "TableOfColors.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"
- source
- Binary File
- relevance
- 10/10
-
Opens the MountPointManager (often used to detect additional infection locations)
- details
- "wscript.exe" opened "\Device\MountPointManager"
- source
- API Call
- relevance
- 5/10
-
Touches files in the Windows directory
- details
-
"wscript.exe" touched file "%WINDIR%\System32\en-US\wscript.exe.mui"
"wscript.exe" touched file "%WINDIR%\System32\wscript.exe"
"wscript.exe" touched file "%WINDIR%\Globalization\Sorting\SortDefault.nls"
"wscript.exe" touched file "%WINDIR%\System32\rsaenh.dll"
"wscript.exe" touched file "%WINDIR%\System32\en-US\KernelBase.dll.mui"
"wscript.exe" touched file "%WINDIR%\System32\msxml3r.dll"
"wscript.exe" touched file "%WINDIR%\System32\wshom.ocx"
"wscript.exe" touched file "%WINDIR%\System32\msxml6r.dll"
"wscript.exe" touched file "%WINDIR%\System32\taskschd.dll"
"wscript.exe" touched file "%WINDIR%\System32\stdole2.tlb" - source
- API Call
- relevance
- 7/10
-
Contains ability to lookup the windows account name
-
Network Related
-
Found potential URL in binary/memory
- details
- Heuristic match: "kimberlyjeanbedard.com"
- source
- File/Memory
- relevance
- 10/10
-
Found potential URL in binary/memory
-
Spyware/Information Retrieval
-
Found a reference to a known community page
- details
-
"she-bear subverters brachystaphylic condoles crinkling lamback semiviscid prolegomenary kulaks Parnassus Kayan Wooster reeden semimechanical dilution loranskite Arverni setting-out loan-shark punctiliar endoesophagitis Bijapur tawdries cynosures sospiro crab-sidle Snonowas quasi-great Kruger propended grapestone theandric cerebro-spinal overelliptically twitterer gane bozos micropolariscope tailraces rechosen muricid overweakness festivalgoer superconsciousness Callender unquerulous undeliciously bawke concreted telescriptor athwart bauson checkbird seasons CLASS Anglicized fevers roulades decachord pilapil Glynne Urquhart antrums purse-string idealogy tenails nonsludging Indo-gangetic CSS subget precursor titmmice roasted perduellion sheepskins VME TFLAP unsightly haunch-bone lepta restyled cleronomy attitudinarian Charadrius razor-sharp Waterview cerveliere nonespionage munjeet towage half-visible preexamined cercopithecid adiathermic hieromartyr Rennie cross-town whisperously undernourish kneeling spongie" (Indicator: "twitter")
"nous scalper Kabinettwein palter preexposition esthesiometric vaginotomies granola loose-hung Chino- hierogrammat Mickiewicz corncrusher Miltonically roboration granulitis pean squaliform vetchier antiscians IIA desiccation whumped ingeniously Turro parred hairdresser unfronted supersagacious hemineurasthenia browed dubitancy birl terrage underminer carpentership circuss Jarib okoniosis whiterump Cilioflagellata alfarga Sabino bicentricity umbilic quasi-engaging triploids corbeille ghetchoo rag-burn pigskins lowerable Trisetum Teutonizing cotyledonoid all-tolerating supersolid megmho twice-uttered Snowman spelldown porticus self-attractive Pellston Urta-juz Seaver MASER well-bodied consensually Farrish Guarrau acoustically preexpect enumerable HJ vively ecotype epipodiale elaeosia praeanal pearlwort abcess append decommission limping irrevocableness twitter Rhynchocoela glitzier Hurlee quasi-diverse adenia Argyllshire goat-pox fairling gritty Phalaecian locatio fettle periostoma fashionist cancerousness five-" (Indicator: "twitter")
"cachaemia podzolization snake-necked dishonor probankruptcy heaven-inspired cruzieros Johnadreams overmagnitude juggled fannel schizaxon Heathsville costoinferior Sinite norit Lau well-elaborated watermanship Bon bosquet brutalizes anisogynous gristle maras wellread Aestatis abjective emydian pen-pusher Calabari Ardys phosphatising aftergrass well-designed gazers preoriginal Palo pseudoconservatively Agenor basketwood pissoirs carload samites pussyfoot reciprocality galvanometric Trans-euphratean wakas yellow-cross suppositious digenous afterproof Helicteres specifier secede Hadleigh Nudens dolorimetry rivalled attatches unpossessively tentmate hysterotely Steppes ichthulin tetrarch Ruella set-aside decerebrating Coppock huh blackcods untainted self-impregnation Leonhard mesmerite hexoic barrels docilities discommodiously Daggett undercarried a-twitter Diyarbakir quasi-spherically Novia otherism joint unwarping Briticism Benthamism redesignating Dedan Ipoh kiting preconceivable reconvicted ghostier Giovanna L" (Indicator: "twitter")
"nion phraseman doting endoparasitic inquinated hanbury Emerson nonscientists Murtha contumaceous Maenalus preinventories nonsynoptically McNulty partizans overjutting translatrix WP predisposition loggerheads sheltered Hardesty ariot frankforter lochiocyte preestimating parasitologic inaxon medicinableness scaff-raff nonnocturnal language estafette onless glabrousness Tupian epitrite livid-brown praetorianism minibudgets savagest veneficness tumulary Klara volborthite spin-off regressions avodires budgeters rail-splitting mesopterygial boomslang brainchild Smallwood sloid trihydrated frigiferous gedanite flat-knit Craven antipathize tetanize detractress hyperimmunity uncalk meninting absent-mindedness speed-up transmutual scoley Capitonidae appellative Cannock one-humped scapement Sufeism empiercement Kesia gegenion rehandled taring lapsful Out-herod blurry overprompt Schaller irregularism twitteration mashiness doutous spirantic leakiness balza agilmente thyroepiglottic bogman anacleticum counterflange totip" (Indicator: "twitter")
"al Balaamite hammering down-trending growleries Arimathaea dispensationalism yarmalke unmasked colascione metaphysicize distinctively city-wide ichthyopsidan entophytal many-hued salvers Embioptera blackguards behovely bibliotherapeutic parakeratosis sadness busyhead narcoticalness Lygaeidae bisti Otaheite plungeon cleft-footed po-faced Phasmatoidea dry-dye recoupable rutherfordium colosso neuroepithelium panders astern ammunition fascinatingly Mahnomen quasi-successfully duodenoenterostomy caulked CHARA Button nonschematic Pro-african Capella tortrixes projectors Cassegrainian revealingness whippers-in dooryards hebdomadal chateaus modern-built disheriting undiscernibleness Harneen terminals Bahutu sumach hyperazoturia romble concion infarcts close-grated jibbing gaudsman dentural Trilisa slipforms subsequent truth-declaring bathometry Glenna outwitter Toulouse-Lautrec Mohave Anatolio burnies subversed unlaborious reharden unlearnability bellicist re-evade pantalette waiwode roosts Cana tensilely Bismarckian" (Indicator: "twitter")
"rtedness unexemplified Hasmonean oasal morphophonemics oncia pericellular theorism Chalukya Ostrya avourneen Melano-papuan henny disbanding unabating Pokomo second-sightedness phagedaenous pneumotyphoid pyrroline prosiliency perianth zonality calculatingly supplants Lovelady Bundaberg autophagia rancherie trustee untranquillize hypes Grunth macrame beccaficos double-chinned melancholies regearing SPE symmist sunspot paly-bendy crown-shaped driftbolt Gladstone pannuscorium millionaire elsewhere strong-backed rynt outwitter nonexemplificatior polyphobic derivatives Goodson localizing Phalaenae seeding CELSS moon-eyed twenty-mark pinscher reparticipation pliantness astrally epileptogenic commiserative wemodness Sarge loather emboweler smaragdes pantheistic posy graffito rebs Parthenopean Coimbatore Favositidae changement orthocarpous Palaeophis haemoglobin barnful epidermophytosis chondroendothelioma fore-mean lomilomi hominid Glossiphonia hausens alopecic premortification granite-sprinkled Guglielma moldering c" (Indicator: "twitter")
"ter sensibilitist impignorating uptilting womenfolks promonopolistic subfumigation rush-seated Postcommunion foreward taels browniest stoplights suttle choloid disacknowledgements spermatically full-diesel desexualization taxicabs Tortulaceae behoves red-hand unlovingly siphono- bullback discanonization float-iron basketwood Jimmy nonsecrecy Non-universalist shrublike self-inspected introfies entrance-denying premedicate dowsers shucker xylans hallucination Ambon ash-bellied coronation halves woundly degradability Goodrich pediferous Lani microfilarial tetraxon metaxylene heterologously hyposalemia flinders subhemispheric laity uniteable Broseley entrapped blautok Summit stalactites consolidating distracter mommet obliques unbasket rune-staff pseudorunic quassin dictyodromous overswarth outrated hypotension tenoned laparocystotomy reenumeration inochondroma dummyweed speckle-starred Cycnus eumycetic prenegotiate kettleful crow-victuals parabien doloriferous Estonian isorhythmic bartree descant twitteration no" (Indicator: "twitter") - source
- File/Memory
- relevance
- 7/10
-
Found a reference to a known community page
-
Unusual Characteristics
-
Installs hooks/patches the running process
- details
-
"wscript.exe" wrote bytes "fae68f77e1a694772e719477ee29947785e28f776da0947726e48f77d16d9477003d9277804b927700000000ad370e768b2d0e76b6410e7600000000" to virtual address "0x74C81000" (part of module "WSHTCPIP.DLL")
"wscript.exe" wrote bytes "e7399077e1a694772e719477ee29947785e28f776da09477906493773ad59a7726e48f77d16d9477003d9277804b927700000000ad370e768b2d0e76b6410e7600000000" to virtual address "0x75181000" (part of module "WSHIP6.DLL")
"wscript.exe" wrote bytes "c04e927720549377e0659377b53894770000000000d0707600000000c5ea70760000000088ea707600000000e968957582289477ee29947700000000d2699575000000007dbb70760000000009be957500000000ba18707600000000" to virtual address "0x75DB1000" (part of module "NSI.DLL") - source
- Hook Detection
- relevance
- 10/10
- ATT&CK ID
- T1179 (Show technique in the MITRE ATT&CK™ matrix)
-
Installs hooks/patches the running process
File Details
Mistral.com # 2019102.vbs
- Filename
- Mistral.com # 2019102.vbs
- Size
- 1.6MiB (1717236 bytes)
- Type
- script vbs
- Description
- ASCII text, with very long lines
- Architecture
- WINDOWS
- SHA256
- 5c5620a1568eea6c7c3cf2f1dae4845d366772c14633a2f5352252b2af5c5699
- MD5
- b3e92ea80083390656c209af52c08089
- SHA1
- 42fa52351c684129397e79bb2db49926212a0b49
- ssdeep
- 49152:7nUA5V/gHPbsWUbvC0uQEe2O+brYx59/G3:g
Screenshots
Loading content, please wait...
Hybrid Analysis
Tip: Click an analysed process below to view more details.
Analysed 1 process in total.
- wscript.exe "C:\Mistral.com#2019102.vbs" (PID: 304)
Network Analysis
DNS Requests
Domain | Address | Registrar | Country |
---|---|---|---|
kimberlyjeanbedard.com
OSINT |
107.189.10.127
TTL: 14399 |
FastDomain Inc.
Organization: KREATIV STRATEGIES, LLC. Name Server: NS1.KIMBERLYJEANBEDARD.COM Creation Date: Wed, 26 Sep 2018 03:35:44 GMT |
United States |
Contacted Hosts
IP Address | Port/Protocol | Associated Process | Details |
---|---|---|---|
107.189.10.127 |
443
TCP |
wscript.exe PID: 304 |
United States |
Contacted Countries
HTTP Traffic
No relevant HTTP requests were made.
Extracted Strings
Extracted Files
-
Informative 1
-
-
TableOfColors.exe
- Size
- 27KiB (27136 bytes)
- Type
- peexe assembly executable
- Description
- PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
- Runtime Process
- wscript.exe (PID: 304)
- MD5
- 7743f34b25f7dc31fb4da94841d1e4bd
- SHA1
- 466dccc0cffc81f1d09d146e09e58fad51d2fe44
- SHA256
- 9906d8878767f18377bef2c5a80505f2a5c16cc8cf6f74b5345b85a2535b53e6
-