Loading... Additional Content is being loaded
Windows Analysis Report 15 Items Receipt.vbs
Overview
General Information
| Sample Name: | 15 Items Receipt.vbs |
| Analysis ID: | 483211 |
| MD5: | 590e4e9a8494edba266bcb811dbe41aa |
| SHA1: | 3ef7bb7024c63c97ba01d91e4a63b6ce29b0e0dc |
| SHA256: | 74c35f5c712379fe4199b775e0f75f028dca15d5fed179b2346389160f772903 |
| Tags: | NanoCoreRATvbs |
| Infos: | |
|
Most interesting Screenshot:  |
|
Detection
Nanocore
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Malicious sample detected (through community Yara rule)
Sigma detected: NanoCore
VBScript performs obfuscated calls to suspicious functions
Detected Nanocore Rat
Multi AV Scanner detection for domain / URL
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Very long command line found
Injects a PE file into a foreign processes
Creates an undocumented autostart registry key
Sigma detected: CrackMapExec PowerShell Obfuscation
Hides that the sample has been downloaded from the Internet (zone.identifier)
Uses dynamic DNS services
Queries the volume information (name, serial number etc) of a device
Yara signature match
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
May sleep (evasive loops) to hinder dynamic analysis
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Uses insecure TLS / SSL version for HTTPS connection
Contains long sleeps (>= 3 min)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Sigma detected: Encoded PowerShell Command Line
Java / VBScript file with very long strings (likely obfuscated code)
Detected TCP or UDP traffic on non-standard ports
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Creates a process in suspended mode (likely to inject code)
Found WSH timer for Javascript or VBS script (likely evasive script)
Classification
AV Detection: |
  |
|---|
| Multi AV Scanner detection for domain / URL |
| Source: |
Virustotal: |
Perma Link | ||
Compliance: |
|
|---|
| Uses insecure TLS / SSL version for HTTPS connection |
| Source: |
HTTPS traffic detected: |
||
| Source: |
Binary string: |
||
| Source: |
Binary string: |
||
| Source: |
Binary string: |
||
| Source: |
Binary string: |
||
| Source: |
Binary string: |
||
| Source: |
Binary string: |
||
| Source: |
Binary string: |
||
Networking: |
|
|---|
| Uses dynamic DNS services |
| Source: |
DNS query: |
||
| Internet Provider seen in connection with other malware |
| Source: |
ASN Name: |
||
| JA3 SSL client fingerprint seen in connection with other malware |
| Source: |
JA3 fingerprint: |
||
| HTTP GET or POST without a user agent |
| Source: |
HTTP traffic detected: |
||
| Source: |
HTTP traffic detected: |
||
| IP address seen in connection with other malware |
| Source: |
IP Address: |
||
| Source: |
IP Address: |
||
| Uses insecure TLS / SSL version for HTTPS connection |
| Source: |
HTTPS traffic detected: |
||
| Detected TCP or UDP traffic on non-standard ports |
| Source: |
TCP traffic: |
||
| Source: |
Network traffic detected: |
||
| Source: |
Network traffic detected: |
||
| Source: |
Network traffic detected: |
||
| Source: |
Network traffic detected: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
DNS traffic detected: |
||
| Source: |
HTTP traffic detected: |
||
| Source: |
HTTP traffic detected: |
||
E-Banking Fraud: |
|
|---|
System Summary: |
|
|---|
| Malicious sample detected (through community Yara rule) |
| Source: |
Matched rule: |
||
| Source: |
Matched rule: |
||
| Source: |
Matched rule: |
||
| Source: |
Matched rule: |
||
| Source: |
Matched rule: |
||
| Source: |
Matched rule: |
||
| Source: |
Matched rule: |
||
| Source: |
Matched rule: |
||
| Source: |
Matched rule: |
||
| Source: |
Matched rule: |
||
| Wscript starts Powershell (via cmd or directly) |
| Source: |
Process created: | ||