Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

latestReport
07.04 10:07
file_3e3wgwby.144.txt.ps1
07.04 10:07
new-image_j.jpg.exe
07.04 10:07
moon.txt.exe
07.04 10:07
okeydookietrational.tx...
07.04 10:07
streamer.exe
07.04 10:07
file_2n4kbwex.dbr.txt.ps1
07.04 09:07
file_5jjhn5s1.zo4.txt.ps1
07.04 09:07
file_iet2mvl3.idw.txt.ps1
07.04 09:07
file_01ntx0mv.bfk.txt.ps1
07.04 09:07
new-image_v.jpg.exe

Latest News
07.04 10:07
[부고] 제이커넥트 이기복 대표 모친상
07.04 10:07
New Open SSH Vulnerabi...
07.04 09:07
WordPress User Enumera...
07.04 08:07
Smashing Security podc...
07.04 07:07
ECMAScript 2024 JavaSc...
07.04 07:07
The AI Fix #5: An angr...
07.04 07:07
It’s Time For Lawmaker...
07.04 07:07
Securing Supply Chains...
07.04 07:07
Emulating the Sabotage...
07.04 07:07
Threat Hunting Worksho...

Summary | ZeroBOX

HRE.vbs

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Oct. 31, 2023, 5:42 p.m.	Oct. 31, 2023, 5:50 p.m.

Size	137.3KB
Type	Little-endian UTF-16 Unicode text, with very long lines, with CRLF, CR line terminators
MD5	`dd68aaf78901710759406c19281e1d6b`
SHA256	`ed894c41caf24ca689f2155ce7ce263ad06b4662830a25fb8ec25271ffb49184`
CRC32	`F3C4DA45`
ssdeep	`1536:F+ye4Mi3mI2hb7KZ18C2NGkikGkFjGkikGkKEt0eEKU+kCKGWGPrbrbTDDpOAWGv:xeBQFJy`
Yara	None matched

wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\HRE.vbs
1836

Name	Response	Post-Analysis Lookup
paste.ee	A 172.67.187.200 A 104.21.84.67	172.67.187.200

IP Address	Status	Action
164.124.101.2	Active	Moloch
172.67.187.200	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49161 -> 172.67.187.200:443	2034978	ET POLICY Pastebin-style Service (paste .ee) in TLS SNI	Potential Corporate Privacy Violation
TCP 192.168.56.103:49161 -> 172.67.187.200:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.103:49161 172.67.187.200:443	C=US, O=Google Trust Services LLC, CN=GTS CA 1P5	CN=paste.ee	75:09:97:90:38:ad:dd:cc:0d:1b:d8:8b:02:ab:5d:a9:3b:7a:1f:1d

Performs some HTTP requests (1 event)

request

GET https://paste.ee/d/e59ok

File has been identified by 7 AntiVirus engines on VirusTotal as malicious (7 events)

Symantec	ISB.Downloader!gen40
Avast	Script:SNH-gen [Drp]
Kaspersky	HEUR:Trojan.VBS.SAgent.gen
Varist	VBS/Agent.BFC!Eldorado
ZoneAlarm	HEUR:Trojan.VBS.SAgent.gen
Google	Detected
AVG	Script:SNH-gen [Drp]

Wscript.exe initiated network communications indicative of a script based payload download (3 events)

Time & API	Arguments	Status	Return	Repeated
WSASend Oct. 31, 2023, 5:42 p.m.	buffer: kge@½íÎð°¼6¼ã1,w_V=7´Ã}òïÊm4/5 ÀÀÀ À 28&ÿ paste.ee socket: 584		0	0
WSASend Oct. 31, 2023, 5:42 p.m.	buffer: FBAÓHB¢2!%74a³³Nçæâä,_ê±ý-}e¤¬²²êXå8Vö³ÄÏ{HéáqÊªlÎ}0°ÓY×xw¯7ÄÝ4·+R¢r¿â}"Â÷7\ä4v"åð} z>Ú6ä socket: 584		0	0
WSASend Oct. 31, 2023, 5:42 p.m.	buffer: À{±vnßÉÍÚUS7±{fÉ&%Ò[(qÓ¯(779s7y;zHSÂqå.j[ûÂý½V5;ÚIÅhÜ¨jbÛ/7©¼1b7ß:q1ýhd@Eþü2·ó9¬H_1Hõ¢îý1TEÎEp·!ó5b%äJÅq/n'G äHà¶%Cþ¸ÎØÃôôß]²Ëk¶¤Ð¥©!/Ä:gËRöm )ÉâNù÷ñ;gZnîxÄçÓ socket: 584		0	0

Attempts to create or modify system certificates (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F81F111D0E5AB58D396F7BF525577FD30FDC95AA\Blob

Network communications indicative of a potential document or script payload download was initiated by the process wscript.exe (3 events)

Time & API	Arguments	Status	Return	Repeated
WSASend Oct. 31, 2023, 5:42 p.m.	buffer: kge@½íÎð°¼6¼ã1,w_V=7´Ã}òïÊm4/5 ÀÀÀ À 28&ÿ paste.ee socket: 584		0	0
WSASend Oct. 31, 2023, 5:42 p.m.	buffer: FBAÓHB¢2!%74a³³Nçæâä,_ê±ý-}e¤¬²²êXå8Vö³ÄÏ{HéáqÊªlÎ}0°ÓY×xw¯7ÄÝ4·+R¢r¿â}"Â÷7\ä4v"åð} z>Ú6ä socket: 584		0	0
WSASend Oct. 31, 2023, 5:42 p.m.	buffer: À{±vnßÉÍÚUS7±{fÉ&%Ò[(qÓ¯(779s7y;zHSÂqå.j[ûÂý½V5;ÚIÅhÜ¨jbÛ/7©¼1b7ß:q1ýhd@Eþü2·ó9¬H_1Hõ¢îý1TEÎEp·!ó5b%äJÅq/n'G äHà¶%Cþ¸ÎØÃôôß]²Ëk¶¤Ð¥©!/Ä:gËRöm )ÉâNù÷ñ;gZnîxÄçÓ socket: 584		0	0