popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

222222.vbs

  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 Aug. 11, 2021, 10:12 a.m. Aug. 11, 2021, 10:20 a.m.
Size 2.8KB
Type ASCII text, with CRLF line terminators
MD5 424085315ca9018d431fd693e72bfa64
SHA256 bef413d426877a9f43dddd722cbd5b35905b57116820d2d93d5bea7ba4739483
CRC32 0B5A91AA
ssdeep 48:5FGABpaDS1kzGIR0L6OhNrSA+g7rul3lnxl8H3C:5EABpaDSKzGIRo2A+gPul3lnxmXC
Yara None matched

Name Response Post-Analysis Lookup
facebook-sports.publicvm.com
A 81.171.31.214
81.171.31.214
IP Address Status Action
164.124.101.2 Active Moloch
81.171.31.214 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: SUCCESS: The scheduled task "Skype" has successfully been created.
console_handle: 0x00000007
1 1 0
domain facebook-sports.publicvm.com
cmdline "C:\Windows\System32\schtasks.exe" /create /sc minute /mo 1 /tn Skype /tr "C:\Users\test22\AppData\Local\Temp\222222.vbs
cmdline schtasks /create /sc minute /mo 1 /tn Skype /tr "C:\Users\test22\AppData\Local\Temp\222222.vbs
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: schtasks
parameters: /create /sc minute /mo 1 /tn Skype /tr "C:\Users\test22\AppData\Local\Temp\222222.vbs
filepath: schtasks
1 1 0
cmdline "C:\Windows\System32\schtasks.exe" /create /sc minute /mo 1 /tn Skype /tr "C:\Users\test22\AppData\Local\Temp\222222.vbs
cmdline schtasks /create /sc minute /mo 1 /tn Skype /tr "C:\Users\test22\AppData\Local\Temp\222222.vbs
Time & API Arguments Status Return Repeated

InternetCrackUrlW

 url: http://facebook-sports.publicvm.com:9999/Vre
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 71303168
http_method: POST
referer:
path: /Vre
1 13369356 0

InternetCrackUrlW

 url: http://facebook-sports.publicvm.com:9999/Vre
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 71303168
http_method: POST
referer:
path: /Vre
1 13369356 0

InternetCrackUrlW

 url: http://facebook-sports.publicvm.com:9999/Vre
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 71303168
http_method: POST
referer:
path: /Vre
1 13369356 0

InternetCrackUrlW

 url: http://facebook-sports.publicvm.com:9999/Vre
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 71303168
http_method: POST
referer:
path: /Vre
1 13369356 0

InternetCrackUrlW

 url: http://facebook-sports.publicvm.com:9999/Vre
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 71303168
http_method: POST
referer:
path: /Vre
1 13369356 0

InternetCrackUrlW

 url: http://facebook-sports.publicvm.com:9999/Vre
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 71303168
http_method: POST
referer:
path: /Vre
1 13369356 0

InternetCrackUrlW

 url: http://facebook-sports.publicvm.com:9999/Vre
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 71303168
http_method: POST
referer:
path: /Vre
1 13369356 0

InternetCrackUrlW

 url: http://facebook-sports.publicvm.com:9999/Vre
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 71303168
http_method: POST
referer:
path: /Vre
1 13369356 0

InternetCrackUrlW

 url: http://facebook-sports.publicvm.com:9999/Vre
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 71303168
http_method: POST
referer:
path: /Vre
1 13369356 0

InternetCrackUrlW

 url: http://facebook-sports.publicvm.com:9999/Vre
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 71303168
http_method: POST
referer:
path: /Vre
1 13369356 0

InternetCrackUrlW

 url: http://facebook-sports.publicvm.com:9999/Vre
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 71303168
http_method: POST
referer:
path: /Vre
1 13369356 0

InternetCrackUrlW

 url: http://facebook-sports.publicvm.com:9999/Vre
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 71303168
http_method: POST
referer:
path: /Vre
1 13369356 0

InternetCrackUrlW

 url: http://facebook-sports.publicvm.com:9999/Vre
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 71303168
http_method: POST
referer:
path: /Vre
1 13369356 0

InternetCrackUrlW

 url: http://facebook-sports.publicvm.com:9999/Vre
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 71303168
http_method: POST
referer:
path: /Vre
1 13369356 0

InternetCrackUrlW

 url: http://facebook-sports.publicvm.com:9999/Vre
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 71303168
http_method: POST
referer:
path: /Vre
1 13369356 0
cmdline "C:\Windows\System32\schtasks.exe" /create /sc minute /mo 1 /tn Skype /tr "C:\Users\test22\AppData\Local\Temp\222222.vbs
cmdline schtasks /create /sc minute /mo 1 /tn Skype /tr "C:\Users\test22\AppData\Local\Temp\222222.vbs
Time & API Arguments Status Return Repeated

InternetCrackUrlW

 url: http://facebook-sports.publicvm.com:9999/Vre
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 71303168
http_method: POST
referer:
path: /Vre
1 13369356 0

send

 buffer: !
socket: 1060
sent: 1
1 1 0

InternetCrackUrlW

 url: http://facebook-sports.publicvm.com:9999/Vre
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 71303168
http_method: POST
referer:
path: /Vre
1 13369356 0

send

 buffer: !
socket: 1060
sent: 1
1 1 0

InternetCrackUrlW

 url: http://facebook-sports.publicvm.com:9999/Vre
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 71303168
http_method: POST
referer:
path: /Vre
1 13369356 0

send

 buffer: !
socket: 1060
sent: 1
1 1 0

InternetCrackUrlW

 url: http://facebook-sports.publicvm.com:9999/Vre
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 71303168
http_method: POST
referer:
path: /Vre
1 13369356 0

send

 buffer: !
socket: 1060
sent: 1
1 1 0

InternetCrackUrlW

 url: http://facebook-sports.publicvm.com:9999/Vre
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 71303168
http_method: POST
referer:
path: /Vre
1 13369356 0

send

 buffer: !
socket: 1060
sent: 1
1 1 0

InternetCrackUrlW

 url: http://facebook-sports.publicvm.com:9999/Vre
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 71303168
http_method: POST
referer:
path: /Vre
1 13369356 0

send

 buffer: !
socket: 1060
sent: 1
1 1 0

InternetCrackUrlW

 url: http://facebook-sports.publicvm.com:9999/Vre
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 71303168
http_method: POST
referer:
path: /Vre
1 13369356 0

send

 buffer: !
socket: 1060
sent: 1
1 1 0

InternetCrackUrlW

 url: http://facebook-sports.publicvm.com:9999/Vre
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 71303168
http_method: POST
referer:
path: /Vre
1 13369356 0

send

 buffer: !
socket: 1060
sent: 1
1 1 0

InternetCrackUrlW

 url: http://facebook-sports.publicvm.com:9999/Vre
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 71303168
http_method: POST
referer:
path: /Vre
1 13369356 0

send

 buffer: !
socket: 1060
sent: 1
1 1 0

InternetCrackUrlW

 url: http://facebook-sports.publicvm.com:9999/Vre
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 71303168
http_method: POST
referer:
path: /Vre
1 13369356 0

send

 buffer: !
socket: 1060
sent: 1
1 1 0

InternetCrackUrlW

 url: http://facebook-sports.publicvm.com:9999/Vre
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 71303168
http_method: POST
referer:
path: /Vre
1 13369356 0

send

 buffer: !
socket: 1060
sent: 1
1 1 0

InternetCrackUrlW

 url: http://facebook-sports.publicvm.com:9999/Vre
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 71303168
http_method: POST
referer:
path: /Vre
1 13369356 0

send

 buffer: !
socket: 1060
sent: 1
1 1 0

InternetCrackUrlW

 url: http://facebook-sports.publicvm.com:9999/Vre
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 71303168
http_method: POST
referer:
path: /Vre
1 13369356 0

send

 buffer: !
socket: 1060
sent: 1
1 1 0

InternetCrackUrlW

 url: http://facebook-sports.publicvm.com:9999/Vre
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 71303168
http_method: POST
referer:
path: /Vre
1 13369356 0

send

 buffer: !
socket: 1060
sent: 1
1 1 0

InternetCrackUrlW

 url: http://facebook-sports.publicvm.com:9999/Vre
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 71303168
http_method: POST
referer:
path: /Vre
1 13369356 0

send

 buffer: !
socket: 1060
sent: 1
1 1 0
parent_process wscript.exe martian_process "C:\Windows\System32\schtasks.exe" /create /sc minute /mo 1 /tn Skype /tr "C:\Users\test22\AppData\Local\Temp\222222.vbs
parent_process wscript.exe martian_process schtasks /create /sc minute /mo 1 /tn Skype /tr "C:\Users\test22\AppData\Local\Temp\222222.vbs
Lionic Trojan.VBS.Agent.4!c
MicroWorld-eScan VB:Trojan.Valyria.3090
FireEye VB:Trojan.Valyria.3090
Sangfor Worm.Generic-Script.Save.265b0e93
Cyren VBS/Veanslim.A
Symantec Trojan.Malscript
ESET-NOD32 VBS/Agent.NNI
Baidu VBS.Trojan-Downloader.Agent.pn
Avast VBS:Agent-BVH [Trj]
Kaspersky Trojan.VBS.Agent.ahf
BitDefender VB:Trojan.Valyria.3090
NANO-Antivirus Trojan.Script.MLW.eienze
Tencent Vbs.Trojan.Agent.Pabo
Ad-Aware VB:Trojan.Valyria.3090
Comodo Worm.VBS.Agent.NNI@8fded6
McAfee-GW-Edition BehavesLike.VBS.Backdoor.xp
Emsisoft VB:Trojan.Valyria.3090 (B)
Jiangmin Trojan.VBS.hf
MAX malware (ai score=81)
Microsoft TrojanDownloader:VBS/Donvibs.Q
GData Script.Worm.Veanslim.B
ALYac VB:Trojan.Valyria.3090
Ikarus Win32.Outbreak
Fortinet VBS/Agent.ONU!tr.dldr
AVG VBS:Agent-BVH [Trj]
Qihoo-360 virus.vbs.houdini.b
file C:\Windows\System32\schtasks.exe
dead_host 192.168.56.102:49172
dead_host 192.168.56.102:49166
dead_host 192.168.56.102:49173
dead_host 192.168.56.102:49167
dead_host 192.168.56.102:49178
dead_host 192.168.56.102:49179
dead_host 192.168.56.102:49176
dead_host 192.168.56.102:49170
dead_host 192.168.56.102:49177
dead_host 192.168.56.102:49171
dead_host 192.168.56.102:49168
dead_host 192.168.56.102:49169
dead_host 192.168.56.102:49180
dead_host 81.171.31.214:9999
dead_host 192.168.56.102:49174
dead_host 192.168.56.102:49175