WDInstaller.vbs
This report is generated from a file or URL submitted to this webservice on October 7th 2015 03:43:51 (UTC)
Report generated by
Falcon Sandbox v2.50 © Hybrid Analysis
Incident Response
Risk Assessment
- Remote Access
- Uses network protocols on unusual ports
- Fingerprint
-
Contains ability to lookup the windows account name
Reads the active computer name
Reads the cryptographic machine GUID - Network Behavior
- Contacts 1 domain and 1 host. View all details
Indicators
Not all malicious and suspicious indicators are displayed. Get your own cloud service or the full version to view all details.
-
Malicious Indicators 4
-
Anti-Detection/Stealthyness
-
Possibly tries to hide a process launching it with different user credentials
- details
-
ImpersonateLoggedOnUser@ADVAPI32.DLL from WScript.exe (PID: 3900) (Show Stream)
ImpersonateLoggedOnUser@ADVAPI32.DLL from WScript.exe (PID: 3900) (Show Stream)
ImpersonateLoggedOnUser@ADVAPI32.DLL from wscript.exe (PID: 2804) (Show Stream)
ImpersonateLoggedOnUser@ADVAPI32.DLL from wscript.exe (PID: 2804) (Show Stream) - source
- StaticStream (Disassembly)
- relevance
- 3/10
-
Possibly tries to hide a process launching it with different user credentials
-
External Systems
-
Sample was identified as malicious by at least one Antivirus engine
- details
- 3/57 Antivirus vendors marked sample as malicious (5% detection rate)
- source
- Anti-Virus Test Result
- relevance
- 10/10
-
Sample was identified as malicious by at least one Antivirus engine
-
Network Related
-
Uses network protocols on unusual ports
- details
- TCP traffic to 149.202.7.196 on port 4766
- source
- Network Traffic
- relevance
- 7/10
-
Uses network protocols on unusual ports
-
System Security
-
Queries/modifies the display settings of system associated file extensions
- details
-
"WScript.exe" (Access type: "QUERYVAL", Path: "\REGISTRY\MACHINE\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.EXE", Key: "ALWAYSSHOWEXT")
"WScript.exe" (Access type: "QUERYVAL", Path: "\REGISTRY\MACHINE\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.EXE", Key: "NEVERSHOWEXT") - source
- Registry Access
- relevance
- 7/10
-
Queries/modifies the display settings of system associated file extensions
-
Suspicious Indicators 18
-
Anti-Detection/Stealthyness
-
Queries kernel debugger information
- details
- "WScript.exe" at 00036336-00003900-00000105-146793557
- source
- API Call
- relevance
- 6/10
-
Queries kernel debugger information
-
Anti-Reverse Engineering
-
Contains ability to register a top-level exception handler (often used as anti-debugging trick)
- details
-
SetUnhandledExceptionFilter@KERNEL32.DLL from WScript.exe (PID: 3900) (Show Stream)
SetUnhandledExceptionFilter@KERNEL32.DLL from WScript.exe (PID: 3900) (Show Stream)
SetUnhandledExceptionFilter@KERNEL32.DLL from wscript.exe (PID: 2804) (Show Stream)
SetUnhandledExceptionFilter@KERNEL32.DLL from wscript.exe (PID: 2804) (Show Stream) - source
- StaticStream (Disassembly)
- relevance
- 1/10
-
Contains ability to register a top-level exception handler (often used as anti-debugging trick)
-
Environment Awareness
-
Contains ability to query the machine version
- details
-
GetVersionExA@KERNEL32.DLL from WScript.exe (PID: 3900) (Show Stream)
GetVersionExA@KERNEL32.DLL from WScript.exe (PID: 3900) (Show Stream)
GetVersionExA@KERNEL32.DLL from WScript.exe (PID: 3900) (Show Stream)
GetVersionExA@KERNEL32.DLL from WScript.exe (PID: 3900) (Show Stream)
GetVersionExA@KERNEL32.DLL from wscript.exe (PID: 2804) (Show Stream)
GetVersionExA@KERNEL32.DLL from wscript.exe (PID: 2804) (Show Stream)
GetVersionExA@KERNEL32.DLL from wscript.exe (PID: 2804) (Show Stream) - source
- StaticStream (Disassembly)
- relevance
- 1/10
-
Possibly tries to detect the presence of a debugger
- details
-
GetProcessHeap@KERNEL32.DLL from WScript.exe (PID: 3900) (Show Stream)
GetProcessHeap@KERNEL32.DLL from WScript.exe (PID: 3900) (Show Stream)
GetProcessHeap@KERNEL32.DLL from WScript.exe (PID: 3900) (Show Stream)
GetProcessHeap@KERNEL32.DLL from WScript.exe (PID: 3900) (Show Stream)
GetProcessHeap@KERNEL32.DLL from wscript.exe (PID: 2804) (Show Stream)
GetProcessHeap@KERNEL32.DLL from wscript.exe (PID: 2804) (Show Stream)
GetProcessHeap@KERNEL32.DLL from wscript.exe (PID: 2804) (Show Stream) - source
- StaticStream (Disassembly)
- relevance
- 1/10
-
Reads the cryptographic machine GUID
- details
- "WScript.exe" (Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\CRYPTOGRAPHY", Key: "MACHINEGUID")
- source
- Registry Access
- relevance
- 10/10
-
Contains ability to query the machine version
-
General
-
Contains ability to find and load resources of a specific module
- details
-
LoadResource@KERNEL32.DLL from WScript.exe (PID: 3900) (Show Stream)
FindResourceExW@KERNEL32.DLL from WScript.exe (PID: 3900) (Show Stream)
LoadResource@KERNEL32.DLL from WScript.exe (PID: 3900) (Show Stream)
FindResourceExW@KERNEL32.DLL from WScript.exe (PID: 3900) (Show Stream)
FindResourceExW@KERNEL32.DLL from wscript.exe (PID: 2804) (Show Stream)
LoadResource@KERNEL32.DLL from wscript.exe (PID: 2804) (Show Stream) - source
- StaticStream (Disassembly)
- relevance
- 1/10
-
Contains ability to find and load resources of a specific module
-
Installation/Persistance
-
Creates/touches files in windows directory
- details
-
"WScript.exe" created file "C:\Windows\System32\en-US\WScript.exe.mui"
"WScript.exe" created file "C:\Windows\System32\WScript.exe"
"WScript.exe" created file "C:\Windows\Globalization\Sorting\sortdefault.nls"
"WScript.exe" created file "C:\Windows\system32\rsaenh.dll"
"WScript.exe" created file "C:\Windows\system32\scrrun.dll"
"WScript.exe" created file "C:\Windows\system32\en-US\KERNELBASE.dll.mui"
"WScript.exe" created file "C:\Windows\System32\msxml3r.dll"
"WScript.exe" created file "C:\Windows\system32\wshom.ocx"
"WScript.exe" created file "%LOCALAPPDATA%\Microsoft\Windows\Caches"
"WScript.exe" created file "C:\Users\%USERNAME%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" - source
- API Call
- relevance
- 7/10
-
Creates/touches files in windows directory
-
System Security
-
Modifies proxy settings
- details
-
"WScript.exe" (Access type: "DELETEVAL", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP", Key: "PROXYBYPASS")
"WScript.exe" (Access type: "DELETEVAL", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP", Key: "PROXYBYPASS") - source
- Registry Access
- relevance
- 10/10
-
Opens the Kernel Security Device Driver (KsecDD) of Windows
- details
- "WScript.exe" opened "\Device\KsecDD"
- source
- API Call
- relevance
- 10/10
-
Queries sensitive IE security settings
- details
-
"WScript.exe" (Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SECURITY", Key: "DISABLESECURITYSETTINGSCHECK")
"WScript.exe" (Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SECURITY", Key: "DISABLESECURITYSETTINGSCHECK") - source
- Registry Access
- relevance
- 8/10
-
Queries the display settings of system associated file extensions
- details
-
"WScript.exe" (Access type: "QUERYVAL", Path: "\REGISTRY\MACHINE\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.EXE", Key: "ALWAYSSHOWEXT")
"WScript.exe" (Access type: "QUERYVAL", Path: "\REGISTRY\MACHINE\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.EXE", Key: "NEVERSHOWEXT") - source
- Registry Access
- relevance
- 7/10
-
Modifies proxy settings
-
Unusual Characteristics
-
Reads information about supported languages
- details
-
"WScript.exe" (Path: "\REGISTRY\MACHINE\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE", Key: "EN-US")
"WScript.exe" (Path: "\REGISTRY\MACHINE\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE", Key: "EN-US")
"WScript.exe" (Path: "\REGISTRY\MACHINE\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE", Key: "00000409") - source
- Registry Access
- relevance
- 3/10
-
Reads information about supported languages
-
Hiding 6 Suspicious Indicators
- All indicators are available only in the private webservice or standalone version
-
Informative 9
-
Environment Awareness
-
Contains ability to query machine time
- details
-
GetSystemTimeAsFileTime@KERNEL32.DLL from WScript.exe (PID: 3900) (Show Stream)
GetSystemTimeAsFileTime@KERNEL32.DLL from WScript.exe (PID: 3900) (Show Stream)
GetSystemTimeAsFileTime@KERNEL32.DLL from wscript.exe (PID: 2804) (Show Stream) - source
- StaticStream (Disassembly)
- relevance
- 1/10
-
Contains ability to query machine time
-
General
-
Contacts domains
- details
- "thepolishgamers.ddns.net"
- source
- Network Traffic
- relevance
- 1/10
-
Contacts server
- details
- "149.202.7.196:4766"
- source
- Network Traffic
- relevance
- 1/10
-
Contains PDB pathways
- details
- "wscript.pdb"
- source
- String
- relevance
- 1/10
-
Creates mutants
- details
-
"\Sessions\1\BaseNamedObjects\Local\ZonesCounterMutex"
"\Sessions\1\BaseNamedObjects\Local\ZoneAttributeCacheCounterMutex"
"\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex"
"\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" - source
- Created Mutant
- relevance
- 3/10
-
Reads Windows Trust Settings
- details
- "WScript.exe" (Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\WINTRUST\TRUST PROVIDERS\SOFTWARE PUBLISHING", Key: "STATE")
- source
- Registry Access
- relevance
- 5/10
-
Spawns new processes
- details
- Spawned process "wscript.exe" with commandline "//B "%APPDATA%\8e78ab9a85266301c25474fdce8d2a0d1ca2201d5a7ad8f202302a5c8580e643.vbs"" (Show Process)
- source
- Monitored Target
- relevance
- 3/10
-
Contacts domains
-
Installation/Persistance
-
Contains ability to lookup the windows account name
- details
-
GetUserNameW@ADVAPI32.DLL from WScript.exe (PID: 3900) (Show Stream)
GetUserNameW@ADVAPI32.DLL from WScript.exe (PID: 3900) (Show Stream)
GetUserNameW@ADVAPI32.DLL from wscript.exe (PID: 2804) (Show Stream) - source
- StaticStream (Disassembly)
- relevance
- 5/10
-
Dropped files
- details
-
"8e78ab9a85266301c25474fdce8d2a0d1ca2201d5a7ad8f202302a5c8580e643.vbs" has type "ASCII text, with very long lines, with CRLF line terminators"
"FLCInstaller.lnk" has type "MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Archive, ctime=Wed Oct 7 15:47:21 2015, mtime=Wed Oct 7 15:47:21 2015, atime=Wed Oct 7 17:44:14 2015, length=5730840, window=hide" - source
- Dropped File
- relevance
- 3/10
-
Contains ability to lookup the windows account name
File Details
WDInstaller.vbs
- Filename
- WDInstaller.vbs
- Size
- 5.5MiB (5730840 bytes)
- Type
- script vbs
- Description
- ASCII text, with very long lines, with CRLF line terminators
- Architecture
- WINDOWS
- SHA256
- 8e78ab9a85266301c25474fdce8d2a0d1ca2201d5a7ad8f202302a5c8580e643
- MD5
- 22ed67b7055429d07843cf45507477f5
- SHA1
- 6633301250923ff86e50762b969406662defe7c8
Resources
- Icon
-
Visualization
-
Classification (TrID)
- 100.0% (.APW) Any Password data
Screenshots
Loading content, please wait...
Hybrid Analysis
Tip: Click an analysed process below to view more details.
Analysed 2 processes in total (System Resource Monitor).
-
WScript.exe
"C:\8e78ab9a85266301c25474fdce8d2a0d1ca2201d5a7ad8f202302a5c8580e643.vbs"
(PID: 3900)
-
wscript.exe
//B "%APPDATA%\8e78ab9a85266301c25474fdce8d2a0d1ca2201d5a7ad8f202302a5c8580e643.vbs"
(PID: 2804)
-
Network Analysis
DNS Requests
| Domain | Address | Registrar | Country |
|---|---|---|---|
| thepolishgamers.ddns.net | 149.202.7.196 | - |
France |
Contacted Hosts
| IP Address | Port/Protocol | Associated Process | Details |
|---|---|---|---|
|
149.202.7.196 |
4766
TCP |
- |
France |
Contacted Countries
HTTP Traffic
No relevant HTTP requests were made.
Extracted Strings
Extracted Files
-
Informative 2
-
-
FLCInstaller.lnk
- Size
- 1022B (1022 bytes)
- Type
- MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Archive, ctime=Wed Oct 7 15:47:21 2015, mtime=Wed Oct 7 15:47:21 2015, atime=Wed Oct 7 17:44:14 2015, length=5730840, window=hide
-
8e78ab9a85266301c25474fdce8d2a0d1ca2201d5a7ad8f202302a5c8580e643.vbs
- Size
- 5.5MiB (5730840 bytes)
- Type
- ASCII text, with very long lines, with CRLF line terminators
- MD5
-
22ed67b7055429d07843cf45507477f5
- SHA1
-
6633301250923ff86e50762b969406662defe7c8
- SHA256
-
8e78ab9a85266301c25474fdce8d2a0d1ca2201d5a7ad8f202302a5c8580e643
-
France