ibmSever.vbs

Performs some HTTP requests (2 events)

request	GET http://paste.ee/d/Kiio7
request	GET https://paste.ee/d/Kiio7

File has been identified by 3 AntiVirus engines on VirusTotal as malicious (3 events)

Avast	Script:SNH-gen [Trj]
Kaspersky	HEUR:Trojan.VBS.SAgent.gen
AVG	Script:SNH-gen [Trj]

Wscript.exe initiated network communications indicative of a script based payload download (4 events)

Time & API	Arguments	Status	Return	Repeated
WSASend Jan. 26, 2024, 12:08 p.m.	buffer: GET /d/Kiio7 HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: paste.ee socket: 544		0	0
WSASend Jan. 26, 2024, 12:08 p.m.	buffer:  k g e³"4­GâÃkœÎ@ÿª®Õûàîó餮ÏpN8<° ¹/5 ÀÀÀ À 28 &ÿ paste.ee  socket: 544		0	0
WSASend Jan. 26, 2024, 12:08 p.m.	buffer:  FBA3ÀìEÿÐÖêQØÖÜvm¯³·z†™-"@–ÚpÌ#\í+/fø"žÑ-™Ü¥áÀøžó"Ý,%Ç¢@$  0ÚÞ¾:rèD˜¶«³+ŠdaŽÖLš¦ó4I™L_øê]WJħçšâÚ¤$éY" socket: 544		0	0
WSASend Jan. 26, 2024, 12:08 p.m.	buffer:  °‡(·=<ÛöGaŸÿŸ€{îÃ:㲛&›{ÿHèŒDßÆèåÒEJ3òÚ§½çô8éЌ« .Aþ&±aLõ!5ƒ"Dd²";÷“~Wj÷ÍÐÚÞa.:ÒÂS–<Ô.š÷IÞðËU­¶v˜Ó¥æi~£b5 „ˆhŸê©©‡‰N•Ë +ÙEU`}ÕTúÞr@jm¨„.|Á ³ªk2ÛyéœÌ socket: 544		0	0

Attempts to create or modify system certificates (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F81F111D0E5AB58D396F7BF525577FD30FDC95AA\Blob

Network communications indicative of a potential document or script payload download was initiated by the process wscript.exe (4 events)

Time & API	Arguments	Status	Return	Repeated
WSASend Jan. 26, 2024, 12:08 p.m.	buffer: GET /d/Kiio7 HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: paste.ee socket: 544		0	0
WSASend Jan. 26, 2024, 12:08 p.m.	buffer:  k g e³"4­GâÃkœÎ@ÿª®Õûàîó餮ÏpN8<° ¹/5 ÀÀÀ À 28 &ÿ paste.ee  socket: 544		0	0
WSASend Jan. 26, 2024, 12:08 p.m.	buffer:  FBA3ÀìEÿÐÖêQØÖÜvm¯³·z†™-"@–ÚpÌ#\í+/fø"žÑ-™Ü¥áÀøžó"Ý,%Ç¢@$  0ÚÞ¾:rèD˜¶«³+ŠdaŽÖLš¦ó4I™L_øê]WJħçšâÚ¤$éY" socket: 544		0	0
WSASend Jan. 26, 2024, 12:08 p.m.	buffer:  °‡(·=<ÛöGaŸÿŸ€{îÃ:㲛&›{ÿHèŒDßÆèåÒEJ3òÚ§½çô8éЌ« .Aþ&±aLõ!5ƒ"Dd²";÷“~Wj÷ÍÐÚÞa.:ÒÂS–<Ô.š÷IÞðËU­¶v˜Ó¥æi~£b5 „ˆhŸê©©‡‰N•Ë +ÙEU`}ÕTúÞr@jm¨„.|Á ³ªk2ÛyéœÌ socket: 544		0	0