wp.vbs| Category | Machine | Started | Completed |
|---|---|---|---|
| FILE | s1_win7_x6401 | Aug. 7, 2024, 9:48 a.m. | Aug. 7, 2024, 10:10 a.m. |
-
-
wscript.exe "C:\Windows\System32\wscript.exe" //B "C:\Users\test22\AppData\Roaming\wp.vbs"
2680
-
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| chongmei33.publicvm.com | 46.246.6.6 |
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| UDP 192.168.56.101:59002 -> 164.124.101.2:53 | 2034457 | ET POLICY Observed DNS Query to DynDNS Domain (publicvm .com) | Potentially Bad Traffic |
Suricata TLS
No Suricata TLS
| domain | chongmei33.publicvm.com |
| wmi | select * from win32_logicaldisk |
| reg_key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\wp | reg_value | wscript.exe //B "C:\Users\test22\AppData\Roaming\wp.vbs" | ||||||
| reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\wp | reg_value | wscript.exe //B "C:\Users\test22\AppData\Roaming\wp.vbs" | ||||||
| reg_key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\wp | reg_value | wscript.exe //B "C:\Users\test22\AppData\Roaming\wp.vbs" | ||||||
| reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\wp | reg_value | wscript.exe //B "C:\Users\test22\AppData\Roaming\wp.vbs" | ||||||
| reg_key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\wp | reg_value | wscript.exe //B "C:\Users\test22\AppData\Roaming\wp.vbs" | ||||||
| reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\wp | reg_value | wscript.exe //B "C:\Users\test22\AppData\Roaming\wp.vbs" | ||||||
| reg_key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\wp | reg_value | wscript.exe //B "C:\Users\test22\AppData\Roaming\wp.vbs" | ||||||
| reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\wp | reg_value | wscript.exe //B "C:\Users\test22\AppData\Roaming\wp.vbs" | ||||||
| reg_key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\wp | reg_value | wscript.exe //B "C:\Users\test22\AppData\Roaming\wp.vbs" | ||||||
| reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\wp | reg_value | wscript.exe //B "C:\Users\test22\AppData\Roaming\wp.vbs" | ||||||
| reg_key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\wp | reg_value | wscript.exe //B "C:\Users\test22\AppData\Roaming\wp.vbs" | ||||||
| reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\wp | reg_value | wscript.exe //B "C:\Users\test22\AppData\Roaming\wp.vbs" | ||||||
| reg_key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\wp | reg_value | wscript.exe //B "C:\Users\test22\AppData\Roaming\wp.vbs" | ||||||
| reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\wp | reg_value | wscript.exe //B "C:\Users\test22\AppData\Roaming\wp.vbs" | ||||||
| wmi | select * from antivirusproduct |
| wmi | select * from win32_operatingsystem |
| wmi | select * from win32_logicaldisk |
| parent_process | wscript.exe | martian_process | "C:\Windows\System32\wscript.exe" //B "C:\Users\test22\AppData\Roaming\wp.vbs" | ||||||
| parent_process | wscript.exe | martian_process | wscript.exe //B "C:\Users\test22\AppData\Roaming\wp.vbs" | ||||||
| file | C:\Windows\SysWOW64\wscript.exe |
| dead_host | 46.246.6.6:7045 |
| Skyhigh | VBS/Agent.dy |
| ALYac | VB:Trojan.Valyria.4537 |
| Sangfor | Malware.Generic-VBS.Save.d63cbaa2 |
| Arcabit | VB:Trojan.Valyria.D11B9 |
| Symantec | VBS.Heur.SNIC |
| ESET-NOD32 | VBS/Agent.OXW |
| Avast | JS:Skiddo-A [Trj] |
| Cynet | Malicious (score: 99) |
| Kaspersky | Trojan.VBS.Agent.bdq |
| BitDefender | VB:Trojan.Valyria.4537 |
| NANO-Antivirus | Trojan.Script.Agent.iwquii |
| MicroWorld-eScan | VB:Trojan.Valyria.4537 |
| Emsisoft | VB:Trojan.Valyria.4537 (B) |
| F-Secure | Malware.VBS/Dldr.Agent.VPTL |
| VIPRE | VB:Trojan.Valyria.4537 |
| FireEye | VB:Trojan.Valyria.4537 |
| Sophos | VBS/DwnLdr-ACDC |
| Ikarus | Trojan-Downloader.VBS.Agent |
| Detected | |
| Avira | VBS/Dldr.Agent.VPTL |
| MAX | malware (ai score=82) |
| Kingsoft | Script.Troj.vbs.2023153 |
| Microsoft | Trojan:Script/Wacatac.B!ml |
| ZoneAlarm | Trojan.VBS.Agent.bdq |
| GData | VB:Trojan.Valyria.4537 |
| Varist | VBS/Dunihi.A |
| McAfee | VBS/Agent.dy |
| huorong | Trojan/VBS.Obfuscator.f |
| Fortinet | VBS/Agent.OXW!tr |
| AVG | JS:Skiddo-A [Trj] |