pad.vbs| Category | Machine | Started | Completed |
|---|---|---|---|
| FILE | s1_win7_x6401 | Nov. 2, 2021, 10:59 a.m. | Nov. 2, 2021, 11:01 a.m. |
-
-
wscript.exe "C:\Windows\SysWOW64\wscript.exe" "C:\Users\test22\AppData\Local\Temp\pad.vbs" /elevate
2880-
powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableRealtimeMonitoring $true
3028 -
powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBehaviorMonitoring $true
2076 -
powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true
2148 -
powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection $true
2020 -
powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true
316 -
powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 2
2336 -
powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 0
2460 -
powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force
2568 -
powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 6
2776 -
powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 6
2940 -
powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 6
2236
-
-
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| No hosts contacted. | ||
| IP Address | Status | Action |
|---|---|---|
| No hosts contacted. | ||
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
| file | C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk |
| cmdline | powershell Set-MpPreference -ModerateThreatDefaultAction 6 |
| cmdline | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force |
| cmdline | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 2 |
| cmdline | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection $true |
| cmdline | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 0 |
| cmdline | powershell Set-MpPreference -SubmitSamplesConsent 2 |
| cmdline | powershell Set-MpPreference -DisableBehaviorMonitoring $true |
| cmdline | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 6 |
| cmdline | powershell Set-MpPreference -DisableRealtimeMonitoring $true |
| cmdline | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true |
| cmdline | powershell Set-MpPreference -HighThreatDefaultAction 6 -Force |
| cmdline | powershell Set-MpPreference -DisableBlockAtFirstSeen $true |
| cmdline | powershell Set-MpPreference -LowThreatDefaultAction 6 |
| cmdline | powershell Set-MpPreference -DisableScriptScanning $true |
| cmdline | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableRealtimeMonitoring $true |
| cmdline | powershell Set-MpPreference -SevereThreatDefaultAction 6 |
| cmdline | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true |
| cmdline | powershell Set-MpPreference -DisableIOAVProtection $true |
| cmdline | powershell Set-MpPreference -MAPSReporting 0 |
| cmdline | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 6 |
| cmdline | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBehaviorMonitoring $true |
| cmdline | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 6 |
| Lionic | Trojan.Script.Generic.4!c |
| Sangfor | Trojan.Generic-VBS.Save.e95c6ff2 |
| Avast | Script:SNH-gen [Trj] |
| Kaspersky | HEUR:Trojan.Script.Generic |
| McAfee-GW-Edition | BehavesLike.VBS.Backdoor.zp |
| ZoneAlarm | HEUR:Trojan.Script.Generic |
| Fortinet | VBS/Agent.917B!tr |
| AVG | Script:SNH-gen [Trj] |
| description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
| description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
| description | (no description) | rule | DebuggerHiding__Thread | ||||||
| description | (no description) | rule | DebuggerHiding__Active | ||||||
| description | (no description) | rule | ThreadControl__Context | ||||||
| description | (no description) | rule | SEH__vectored | ||||||
| description | Checks if being debugged | rule | anti_dbg | ||||||
| description | Bypass DEP | rule | disable_dep | ||||||
| count | 1637 | name | heapspray | process | powershell.exe | total_mb | 102 | length | 65536 | protection | PAGE_READWRITE | ||||||||||||||||||
| parent_process | wscript.exe | martian_process | powershell Set-MpPreference -ModerateThreatDefaultAction 6 | ||||||
| parent_process | wscript.exe | martian_process | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force | ||||||
| parent_process | wscript.exe | martian_process | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 2 | ||||||
| parent_process | wscript.exe | martian_process | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection $true | ||||||
| parent_process | wscript.exe | martian_process | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 0 | ||||||
| parent_process | wscript.exe | martian_process | powershell Set-MpPreference -SubmitSamplesConsent 2 | ||||||
| parent_process | wscript.exe | martian_process | powershell Set-MpPreference -DisableBehaviorMonitoring $true | ||||||
| parent_process | wscript.exe | martian_process | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 6 | ||||||
| parent_process | wscript.exe | martian_process | powershell Set-MpPreference -DisableRealtimeMonitoring $true | ||||||
| parent_process | wscript.exe | martian_process | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true | ||||||
| parent_process | wscript.exe | martian_process | powershell Set-MpPreference -HighThreatDefaultAction 6 -Force | ||||||
| parent_process | wscript.exe | martian_process | powershell Set-MpPreference -DisableBlockAtFirstSeen $true | ||||||
| parent_process | wscript.exe | martian_process | powershell Set-MpPreference -LowThreatDefaultAction 6 | ||||||
| parent_process | wscript.exe | martian_process | powershell Set-MpPreference -DisableScriptScanning $true | ||||||
| parent_process | wscript.exe | martian_process | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableRealtimeMonitoring $true | ||||||
| parent_process | wscript.exe | martian_process | powershell Set-MpPreference -SevereThreatDefaultAction 6 | ||||||
| parent_process | wscript.exe | martian_process | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true | ||||||
| parent_process | wscript.exe | martian_process | powershell Set-MpPreference -DisableIOAVProtection $true | ||||||
| parent_process | wscript.exe | martian_process | powershell Set-MpPreference -MAPSReporting 0 | ||||||
| parent_process | wscript.exe | martian_process | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 6 | ||||||
| parent_process | wscript.exe | martian_process | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBehaviorMonitoring $true | ||||||
| parent_process | wscript.exe | martian_process | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 6 | ||||||
| parent_process | wscript.exe | martian_process | "C:\Windows\SysWOW64\wscript.exe" "C:\Users\test22\AppData\Local\Temp\pad.vbs" /elevate | ||||||
| parent_process | wscript.exe | martian_process | C:\Windows\SysWOW64\wscript.exe "C:\Users\test22\AppData\Local\Temp\pad.vbs" /elevate | ||||||
| description | attempts to modify windows defender policies | registry | HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable | ||||||
| description | attempts to modify windows defender policies | registry | HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring | ||||||
| description | attempts to modify windows defender policies | registry | HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware | ||||||
| description | attempts to modify windows defender policies | registry | HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection | ||||||
| file | C:\Windows\SysWOW64\wscript.exe |
| file | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| file | C:\Windows\System32\ie4uinit.exe |
| file | C:\Program Files\Windows Sidebar\sidebar.exe |
| file | C:\Windows\System32\WindowsAnytimeUpgradeUI.exe |
| file | C:\Windows\System32\xpsrchvw.exe |
| file | C:\Windows\System32\displayswitch.exe |
| file | C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe |
| file | C:\Windows\System32\mblctr.exe |
| file | C:\Windows\System32\mstsc.exe |
| file | C:\Windows\System32\SnippingTool.exe |
| file | C:\Windows\System32\SoundRecorder.exe |
| file | C:\Windows\System32\dfrgui.exe |
| file | C:\Windows\System32\msinfo32.exe |
| file | C:\Windows\System32\rstrui.exe |
| file | C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe |
| file | C:\Program Files\Windows Journal\Journal.exe |
| file | C:\Windows\System32\MdSched.exe |
| file | C:\Windows\System32\msconfig.exe |
| file | C:\Windows\System32\recdisc.exe |
| file | C:\Windows\System32\msra.exe |