Not all malicious and suspicious indicators are displayed. Get your own cloud service or the full version to view all details.

• Malicious Indicators 2

• Network Related
  • Uses network protocols on unusual ports

    details

    TCP traffic to 149.202.7.196 on port 4770

    source

    Network Traffic

    relevance

    7/10

• Unusual Characteristics
  • Script file shows a combination of malicious behavior

    details

    The script produces internet activity is obfuscated and/or drops files

    source

    Indicator Combinations

    relevance

    7/10

• Suspicious Indicators 16

• Anti-Detection/Stealthyness
  • Queries kernel debugger information

    details

    "WScript.exe" at 00008796-00000176-00000105-36764872

    source

    API Call

    relevance

    6/10

  • Sets the process error mode to suppress error box

    details

    "WScript.exe" set its error mode to SEM_NOOPENFILEERRORBOX

    source

    API Call

    relevance

    8/10

• Environment Awareness
  • Reads the cryptographic machine GUID

    details

    "WScript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY", Key: "MACHINEGUID")

    source

    Registry Access

    relevance

    10/10

• General
  • Reads configuration files

    details

    "WScript.exe" read file "C:\Users\desktop.ini"
    "WScript.exe" read file "%USERPROFILE%\desktop.ini"
    "WScript.exe" read file "C:\Users\%USERNAME%\Desktop\desktop.ini"
    "WScript.exe" read file "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\desktop.ini"
    "WScript.exe" read file "C:\Users\%USERNAME%\Desktop\desktop.ini"

    source

    API Call

    relevance

    4/10

• Installation/Persistance
  • Creates/touches files in windows directory

    details

    "WScript.exe" created file "%WINDIR%\System32\en-US\WScript.exe.mui"
    "WScript.exe" created file "C:\Windows\System32\WScript.exe"
    "WScript.exe" created file "C:\Windows\Globalization\Sorting\sortdefault.nls"
    "WScript.exe" created file "C:\Windows\system32\rsaenh.dll"
    "WScript.exe" created file "C:\Windows\system32\scrrun.dll"
    "WScript.exe" created file "C:\Windows\system32\en-US\KERNELBASE.dll.mui"
    "WScript.exe" created file "C:\Windows\System32\msxml3r.dll"
    "WScript.exe" created file "C:\Windows\system32\wshom.ocx"
    "WScript.exe" created file "%APPDATA%\Microsoft\Windows\SendTo\desktop.ini"
    "WScript.exe" created file "%APPDATA%\Microsoft\Windows\Start Menu"
    "WScript.exe" created file "%APPDATA%\Microsoft\Windows\Start Menu\Programs"
    "WScript.exe" created file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\WinDll.lnk"

    source

    API Call

    relevance

    7/10

• System Security
  • Modifies proxy settings

    details

    "WScript.exe" (Access type: "DELETEVAL", Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP", Key: "PROXYBYPASS")
    "WScript.exe" (Access type: "DELETEVAL", Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP", Key: "PROXYBYPASS")

    source

    Registry Access

    relevance

    10/10

  • Opens the Kernel Security Device Driver (KsecDD) of Windows

    details

    "WScript.exe" opened "\Device\KsecDD"

    source

    API Call

    relevance

    10/10

  • Queries sensitive IE security settings

    details

    "WScript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SECURITY", Key: "DISABLESECURITYSETTINGSCHECK")
    "WScript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SECURITY", Key: "DISABLESECURITYSETTINGSCHECK")

    source

    Registry Access

    relevance

    8/10

  • Queries the display settings of system associated file extensions

    details

    "WScript.exe" (Access type: "QUERYVAL", Path: "HKCR\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.EXE", Key: "ALWAYSSHOWEXT")
    "WScript.exe" (Access type: "QUERYVAL", Path: "HKCR\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.EXE", Key: "NEVERSHOWEXT")

    source

    Registry Access

    relevance

    7/10

• Unusual Characteristics
  • Reads information about supported languages

    details

    "WScript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE", Key: "EN-US")
    "WScript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE", Key: "EN-US")
    "WScript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE", Key: "00000409")

    source

    Registry Access

    relevance

    3/10

• Hiding 6 Suspicious Indicators
  • All indicators are available only in the private webservice or standalone version

• Informative 8

• External Systems
  • Sample was identified as clean by Antivirus engines

    details

    0/53 Antivirus vendors marked sample as malicious (0% detection rate)

    source

    External System

    relevance

    10/10

• General
  • Contacts domains

    details

    "thepolandgamers.ddns.net"

    source

    Network Traffic

    relevance

    1/10

  • Contacts server

    details

    "149.202.7.196:4770"

    source

    Network Traffic

    relevance

    1/10

  • Creates mutants

    details

    "\Sessions\1\BaseNamedObjects\Local\ZonesCounterMutex"
    "\Sessions\1\BaseNamedObjects\Local\ZoneAttributeCacheCounterMutex"
    "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex"
    "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex"

    source

    Created Mutant

    relevance

    3/10

  • Reads Windows Trust Settings

    details

    "WScript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\WINTRUST\TRUST PROVIDERS\SOFTWARE PUBLISHING", Key: "STATE")

    source

    Registry Access

    relevance

    5/10

  • Spawns new processes

    details

    Spawned process "wscript.exe" with commandline "//B "%APPDATA%\package.vbs"" (Show Process)

    source

    Monitored Target

    relevance

    3/10

• Installation/Persistance
  • Connects to LPC ports

    details

    "WScript.exe" connecting to "\ThemeApiPort"

    source

    API Call

    relevance

    1/10

  • Dropped files

    details

    "package.vbs.826553566" has type "ASCII text, with very long lines, with CRLF line terminators"
    "WinDll.lnk.4141248334" has type "MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Archive, ctime=Tue Feb 2 20:57:13 2016, mtime=Tue Feb 2 20:57:13 2016, atime=Tue Feb 2 22:54:28 2016, length=4351980, window=hide"

    source

    Binary File

    relevance

    3/10

DNS Requests

Domain	Address	Registrar	Country
thepolandgamers.ddns.net	149.202.7.196	-	France

Contacted Hosts

IP Address	Port/Protocol	Associated Process	Details
149.202.7.196 OSINT Associated Artifacts for 149.202.7.196 Details Associated URL Threat Level Positives Scan Date Reference Associated URL http://polandgamers.ddns.net/is-ready Threat Level malicious Positives 3/66 Scan Date 11/15/2015 01:11:15 Reference - http://polandgamers.ddns.net/is-ready malicious 3/66 11/15/2015 01:11:15 - Associated URL http://polandgamers.ddns.net:6242/is-ready Threat Level malicious Positives 3/66 Scan Date 11/14/2015 13:57:57 Reference - http://polandgamers.ddns.net:6242/is-ready malicious 3/66 11/14/2015 13:57:57 - Associated URL http://theprogamers.ddns.net/is-ready Threat Level malicious Positives 4/66 Scan Date 11/05/2015 20:31:31 Reference - http://theprogamers.ddns.net/is-ready malicious 4/66 11/05/2015 20:31:31 - Associated URL http://theprogamers.ddns.net:4765/is-ready Threat Level malicious Positives 3/66 Scan Date 11/05/2015 08:23:03 Reference - http://theprogamers.ddns.net:4765/is-ready malicious 3/66 11/05/2015 08:23:03 - Associated URL http://thepolishgamers.ddns.net/ Threat Level malicious Positives 2/65 Scan Date 10/07/2015 14:40:30 Reference - http://thepolishgamers.ddns.net/ malicious 2/65 10/07/2015 14:40:30 - Details Domain Threat Level Positives Last Resolved Reference Domain polandgamers.ddns.net Threat Level - Positives - Last Resolved 11/14/2015 00:00:00 VirusTotal Report polandgamers.ddns.net - - 11/14/2015 00:00:00 Report Domain theprogamers.ddns.net Threat Level - Positives - Last Resolved 11/05/2015 00:00:00 VirusTotal Report theprogamers.ddns.net - - 11/05/2015 00:00:00 Report Domain thepolishgamers.ddns.net Threat Level - Positives - Last Resolved 10/07/2015 00:00:00 VirusTotal Report thepolishgamers.ddns.net - - 10/07/2015 00:00:00 Report	4770 TCP	-	France

HTTP Traffic

No relevant HTTP requests were made.

• Informative 2

• • WinDll.lnk

    Download Disabled Hash Seen Before

    Size

    723B (723 bytes)

    Type

    MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Archive, ctime=Tue Feb 2 20:57:13 2016, mtime=Tue Feb 2 20:57:13 2016, atime=Tue Feb 2 22:54:28 2016, length=4351980, window=hide

    MD5

    17f31c70d29977598338e8c91c51e898

    SHA256

    5934ac290c3897ba4f6b40dfe77b238e02d5d611f2ae0d673fb909787b1e37b9

  • package.vbs

    Overview Download Disabled Hash Seen Before

    Size

    4.2MiB (4351980 bytes)

    Type

    ASCII text, with very long lines, with CRLF line terminators

    MD5

    42c4f39b96ac6b3de2c55451b99c317b

    SHA1

    898432fcd08af527a25774c804de8cb3cd83b7cd

    SHA256

    f7c9ab839315c633fb51cb19137424afe41a2c1ae23cdd807f2b64386b2bb60a