createdloverkissed.vbs

Performs some HTTP requests (1 event)

request

GET https://paste.ee/d/bWBGI

File has been identified by 7 AntiVirus engines on VirusTotal as malicious (7 events)

Skyhigh	BehavesLike.VBS.Dropper.cp
Symantec	ISB.Downloader!gen40
ESET-NOD32	VBS/TrojanDownloader.Agent.AABS
Avast	Script:SNH-gen [Drp]
Kaspersky	HEUR:Trojan.VBS.SAgent.gen
DrWeb	VBS.DownLoader.3091
AVG	Script:SNH-gen [Drp]

Wscript.exe initiated network communications indicative of a script based payload download (2 events)

Time & API	Arguments	Status	Return	Repeated
InternetCrackUrlW March 31, 2024, 11:23 a.m.	url: https://paste.ee/d/bWBGI flags: 0	1	1	0
HttpOpenRequestW March 31, 2024, 11:23 a.m.	connect_handle: 0x00cc0008 http_version: flags: 12582912 http_method: GET referer: path: /d/bWBGI	1	13369356	0

wscript.exe-based dropper (JScript, VBS) (1 event)

Network communications indicative of a potential document or script payload download was initiated by the process wscript.exe (9 events)

Time & API	Arguments	Status	Return	Repeated
InternetCrackUrlW March 31, 2024, 11:23 a.m.	url: https://paste.ee/d/bWBGI flags: 0	1	1	0
HttpOpenRequestW March 31, 2024, 11:23 a.m.	connect_handle: 0x00cc0008 http_version: flags: 12582912 http_method: GET referer: path: /d/bWBGI	1	13369356	0
send March 31, 2024, 11:23 a.m.	buffer: ! socket: 868 sent: 1	1	1	0
send March 31, 2024, 11:23 a.m.	buffer:  k g fÉm¸Ù’õçªþe|¹8¤{K~—DYl©±qM€Ê/5 ÀÀÀ À 28 &ÿ paste.ee  socket: 988 sent: 112	1	112	0
send March 31, 2024, 11:23 a.m.	buffer: ! socket: 868 sent: 1	1	1	0
send March 31, 2024, 11:23 a.m.	buffer:  FBAt"¡(YÙغ+ðå×â¼Ióè{G&Ê Çs¼ouÊöGà Ç_±Tkfa¡’_’å’vY<âã 4  0ÚdD5#!]¾×~1±æE$¯ÙŠj=gWW楖—áVÙX)E<ȸ socket: 988 sent: 134	1	134	0
send March 31, 2024, 11:23 a.m.	buffer: ! socket: 868 sent: 1	1	1	0
send March 31, 2024, 11:23 a.m.	buffer:  @ÞøZ5}²j¤‘–Ç•Ð4xßFÞPϜ¤¸%›¢ÔŒz8øÐÃŒ&öQÚ÷[Kžùr­þ ·åI]Ly7»‹ ë}FæéÎ{©M§sáøãªôˆQ[ȑb‚µÛlf¤F¿hâ.g˧Êû²íÜ´›úyˆ¡K?á”ïO¼[Iš fa-®v ̐t IÉZ+^¬f÷0À5YÈ£»÷¬Ÿ¯¯ƒSºiÀQñ%ÑÕ« NÀ”¹âÀÑãoʼ—|Å¶Ñ‘Nb|öÕÊ!¦Ñ”%a8?2ێ–›£Ò|qæI1=8=u=ð¿–èSJ×.K®T֛<õ眏,̯"Ê™ž 3'~eïFö{g ˜Q<·Š'ÑÔFñ25Vq‚Ò b¹WuIÅÜԐšC÷ïÞz±tkžn®@!H socket: 988 sent: 325	1	325	0
send March 31, 2024, 11:23 a.m.	buffer: ! socket: 868 sent: 1	1	1	0