fress.vbs

Wscript.exe initiated network communications indicative of a script based payload download (2 events)

Time & API	Arguments	Status	Return	Repeated
InternetCrackUrlW July 4, 2024, 9:42 a.m.	url: https://paste.ee/d/7HCkx flags: 0	1	1	0
HttpOpenRequestW July 4, 2024, 9:42 a.m.	connect_handle: 0x00cc0008 http_version: flags: 12582912 http_method: GET referer: path: /d/7HCkx	1	13369356	0

File has been identified by 12 AntiVirus engines on VirusTotal as malicious (12 events)

Skyhigh	BehavesLike.VBS.Dropper.lv
Symantec	ISB.Downloader!gen40
ESET-NOD32	VBS/TrojanDownloader.Agent.AAKW
Avast	Script:SNH-gen [Drp]
Kaspersky	HEUR:Trojan-Downloader.Script.Generic
NANO-Antivirus	Trojan.Script.Vbs-heuristic.druvzi
Rising	Downloader.Agent/VBS!8.10EA5 (TOPIS:E0:rHcE8wIYbGF)
Ikarus	Trojan-Downloader.VBS.Agent
Google	Detected
Microsoft	Trojan:VBS/AgentTesla.RVF!MTB
ZoneAlarm	HEUR:Trojan-Downloader.Script.Generic
AVG	Script:SNH-gen [Drp]

wscript.exe-based dropper (JScript, VBS) (1 event)

Network communications indicative of a potential document or script payload download was initiated by the process wscript.exe (3 events)

Time & API	Arguments	Status	Return	Repeated
InternetCrackUrlW July 4, 2024, 9:42 a.m.	url: https://paste.ee/d/7HCkx flags: 0	1	1	0
HttpOpenRequestW July 4, 2024, 9:42 a.m.	connect_handle: 0x00cc0008 http_version: flags: 12582912 http_method: GET referer: path: /d/7HCkx	1	13369356	0
send July 4, 2024, 9:42 a.m.	buffer: ! socket: 828 sent: 1	1	1	0

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

185.26.104.247:443