popup

Report - dootakim.vbs

  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2021.06.08 16:40 Machine s1_win7_x3201
Filename dootakim.vbs
Type ASCII text, with CRLF line terminators
AI Score Not founds Behavior Score
5.0
ZERO API file : clean
VT API (file)
md5 7bf15c10dd4e523a1338d054c0ace9d9
sha256 d5213a7612dbeec88cbfd73d8457b741f9014b137e640ff81bb8c1742b066a0d
ssdeep 192:ADeat+P8BlCqCSVXy+t34iBdEEWcOU0rAZtkVnZzqU/C+6tpMf:ADeat+PqlCqCSVXy+t34i7EErL4AtkVL
imphash
impfuzzy
  Network IP location

Signature (11cnts)

Level Description
watch Executes one or more WMI queries which can be used to create or modify services
watch Network communications indicative of a potential document or script payload download was initiated by the process wscript.exe
watch The process wscript.exe wrote an executable file to disk
watch Wscript.exe initiated network communications indicative of a script based payload download
notice Creates a shortcut to an executable file
notice Creates executable files on the filesystem
notice Executes one or more WMI queries
notice HTTP traffic contains suspicious features which may be indicative of malware related traffic
notice Performs some HTTP requests
notice Sends data using the HTTP POST Method
info Queries for the computername

Rules (0cnts)

Level Name Description Collection

Network (29cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
http://evcs-ocsp.ws.symantec.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQckPwgwK2Thdm9JYVwXQ4ERz3XDQQUo47PGUI9MeGrIYmEbcvZeaKysloCEFDtZ0JVYUv07T7UI8yTyn0%3D
whois
US AKAMAI-AS 23.4.43.27 clean
http://sv.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQe6LNDJdqx%2BJOp7hVgTeaGFJ%2FCQgQUljtT8Hkzl699g%2B8uK8zKt4YecmYCEADzAwdvBip42MYbURaknTY%3D
whois
US AKAMAI-AS 23.4.43.27 clean
http://sv.symcb.com/sv.crl
whois
TW EDGECAST 117.18.237.29 clean
http://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ%2FxkCfyHfJr7GQ6M658NRZ4SHo%2FAQUCPVR6Pv%2BPT1kNnxoz1t4qN%2B5xTcCECcNdVyfWsO322H1CZgocHg%3D
whois
US AKAMAI-AS 23.4.43.27 clean
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl
whois
US CCCH-3 23.216.159.34 clean
http://crl.verisign.com/pca3.crl
whois
TW EDGECAST 117.18.237.29 clean
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D
whois
TW EDGECAST 117.18.237.29 clean
http://alyssalove.getenjoyment.net/0423/v.php?ki87ujhy=%ProgramFiles(x86)%&rdxvdw=C:\Program%20Files
whois
BG Zetta Hosting Solutions LLC. 185.176.43.98 1871 mailcious
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D
whois
TW EDGECAST 117.18.237.29 clean
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEA3etT%2BVczf76vmMSmFbFJ0%3D
whois
TW EDGECAST 117.18.237.29 clean
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D
whois
TW EDGECAST 117.18.237.29 clean
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D
whois
TW EDGECAST 117.18.237.29 clean
http://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ%2FxkCfyHfJr7GQ6M658NRZ4SHo%2FAQUCPVR6Pv%2BPT1kNnxoz1t4qN%2B5xTcCEDA2ePYtKPWPCdFq3RW5wHE%3D
whois
US LG DACOM Corporation 23.74.19.27 clean
http://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD%2BOyl%2B0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEGxZ76nhAOEO4wa6j%2BApJVk%3D
whois
US LG DACOM Corporation 23.74.19.27 clean
http://s2.symcb.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD%2BOyl%2B0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCED141%2Fl2SWCyYX308B7Khio%3D
whois
US LG DACOM Corporation 23.74.19.27 clean
http://sv.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQe6LNDJdqx%2BJOp7hVgTeaGFJ%2FCQgQUljtT8Hkzl699g%2B8uK8zKt4YecmYCEBLwJ34PIzs5%2BUGbBujN41I%3D
whois
US LG DACOM Corporation 23.74.19.27 clean
csc3-2004-crl.verisign.com
whois
Unknown clean
sv.symcb.com
whois
TW EDGECAST 117.18.237.29 clean
ocsp.digicert.com
whois
TW EDGECAST 117.18.237.29 clean
evcs-ocsp.ws.symantec.com
whois
US AKAMAI-AS 23.4.43.27 clean
crl.verisign.com
whois
TW EDGECAST 117.18.237.29 clean
s2.symcb.com
whois
US AKAMAI-AS 23.4.43.27 clean
alyssalove.getenjoyment.net
whois
BG Zetta Hosting Solutions LLC. 185.176.43.98 mailcious
ocsp.verisign.com
whois
US AKAMAI-AS 23.4.43.27 clean
sv.symcd.com
whois
US AKAMAI-AS 23.4.43.27 clean
23.37.139.27
whois
US Akamai International B.V. 23.37.139.27 clean
117.18.237.29
whois
TW EDGECAST 117.18.237.29 clean
23.74.19.27
whois
US LG DACOM Corporation 23.74.19.27 clean
185.176.43.98
whois
BG Zetta Hosting Solutions LLC. 185.176.43.98 mailcious

Suricata ids

ET HUNTING Suspicious POST with Common Windows Process Names - Possible Process List Exfiltration

Similarity measure (PE file only) - Checking for service failure