JVC_39239.vbs
This report is generated from a file or URL submitted to this webservice on February 4th 2020 00:58:37 (UTC)
Guest System: Windows 7 64 bit, Professional, 6.1 (build 7601), Service Pack 1
Report generated by
Falcon Sandbox v8.30 © Hybrid Analysis
Incident Response
Risk Assessment
- Fingerprint
-
Queries kernel debugger information
Reads the active computer name
Reads the cryptographic machine GUID - Evasive
- Possibly tries to implement anti-virtualization techniques
MITRE ATT&CK™ Techniques Detection
Indicators
Not all malicious and suspicious indicators are displayed. Get your own cloud service or the full version to view all details.
-
Malicious Indicators 4
-
External Systems
-
Sample was identified as malicious by a large number of Antivirus engines
- details
- 13/57 Antivirus vendors marked sample as malicious (22% detection rate)
- source
- External System
- relevance
- 10/10
-
Sample was identified as malicious by at least one Antivirus engine
- details
- 13/57 Antivirus vendors marked sample as malicious (22% detection rate)
- source
- External System
- relevance
- 8/10
-
Sample was identified as malicious by a large number of Antivirus engines
-
Unusual Characteristics
-
References suspicious system modules
- details
- "lhole serbo- nondegeneracy subattenuated thermokinematics misdiagnosis Platter pictureless squinches cryobiological fierasferoid preindulged overprolixity prorecall dimorph Hyolithidae CATIS peathouse full-exerted antero- gravamina sun-bathe shackatory nonconversantly valour returban disencumbering inflectionally triangles Teutophobe apparels repenning come-down cloud-compacted jumbie undern tripleback popeship superstylishly blockmaker Cistercianism unca biologic TPI flitted shoddyite autarch bioprecipitation dozzle Elsass-Lothringen benettle epicoelous notionless untraversed cheirosophy Ralston Spinozistic sweetmeal nubbles catchflies nonconnection moon-culminating fulsome Jonette donzel refocillate titillater dimple tongue-valiant metricized buttresslike sodomitical spinothalamic effectuality collusiveness reconsigns subcrescentic laparotomies metropoleis rhyolite-porphyry Acus proathletic Haryana soarings Dabneys nonunity cicindelidae Holbrook arcform ectrotic Proreptilia panoches firmless kakistocracy di"
- source
- File/Memory
- relevance
- 5/10
- ATT&CK ID
- T1215 (Show technique in the MITRE ATT&CK™ matrix)
-
References suspicious system modules
-
Hiding 1 Malicious Indicators
- All indicators are available only in the private webservice or standalone version
-
Suspicious Indicators 9
-
Anti-Detection/Stealthyness
-
Queries kernel debugger information
- details
- "DismHost.exe" at 00014742-00002600-00000033-229487347512
- source
- API Call
- relevance
- 6/10
-
Queries kernel debugger information
-
Anti-Reverse Engineering
-
Possibly checks for known debuggers/analysis tools
- details
-
"oclericalism unsmilingly fire-wheeled tongue-baited ravenlike momish underthings achromous Astraea inkslinging unaffirmation quotability bonaght unpleaded Monticello immunises punishable quinzieme ensigncies quasi-ideal mareograph anticreep cryogeny faecalith Toddie decolorisation Abrahamite phosphinate ankyloglossia guapena deep-freeze thrombolytic psalis swelled-headedness Slagle Jerubbaal vug NASA black-hilted unspiralled appd revolutionist patchy prevolunteer forebush really-truly unnavigable Euaechme bonetail jeopardising tear-stubbed flowerbed kuvasz drumbeating gamostely paganizes archplunderer trowane banga unrefining nonopinionated forcing-pump aquicultural subpools Penthestes Callery Alsen biophysically scaphopodous astrocytomata parethmoid housewives waylay astrophotometrical supplicavit curcuddoch meltedness LIFO commentaries aur- vineyarding infusile thiols jibmen Bellini uncasketed redescribing majestyship amaist countertrippant sawneb aviararies jamber Amioidei semestrial psalterium eucone thri" (Indicator: "ntice")
"lysidine intranscalency Penn mimetic Blagg cryocautery auxocardia smittlish antichlorine tramroads blush-compelling advertisement Kemah locellate tabletop hurdy-gurdist unmolded coverts steelbow pintails Jay assailing Monticello post-Chaucerian folks settima avant-courier achigan navigably priggisms scampingly nictate zeal Doumergue kingship lacrimation muscicolous lutes Azuero velyarde uncorrigibleness Melanochroi pre-ignition Dilliner Durning locn doneness Mott uproariously unoceanic arsenolite lollingite Afrikah cornuting relicti pitfalls peroneotarsal remeditate Harolda unbitting oket boatsman soft-swelling Kavanaugh Filler portieres fishiness buildable bunchiest Qeshm cloud-flecked unfulminant wrongdoings astipulate hagfish tackles Sommers insanable bulkiness unkidnapped Agrionidae broad-gage chondrostean grailing FRICC Gregorianizer bandsman dykes atomity Mukerji TPI unguarded sangar herb-woman Dike tortoise-footed fulfillment Targumize sagbuts tambala between-deck guanaco nonprophetical cosmogonal comm" (Indicator: "ntice")
"Lily nonturbinate mandatoriness clavierists skateboards limitate troopship superobligation aviculture ediles Aleece mesonotum presubordinated superintensity nonperformances inerrancy semi-infidel Ninon cylindrocellular gnaw princeship creditability well-perceived OAS gardenwards presbyopy flams maligners suntanning Zorotypus supportably yard-broad kadish Uzial diner-out GCR Joes tirrit suprasquamosal fifty-four gamotropic Maziar cotised concause undamaged unlasting flourishable marled cageless programatic dragomans binapthyl hydrophore ceroplast sprenging uncookable dragontail xyloma Schrader preextinction fall-board transactional creolize TNOP facinorous prestrengthen Megalosauridae anticentralism osteosteatoma chondromyxoma shopsoiled investors sterelminthic sandyx spleeny yeni well-valeted cheekful RASC birdhouse gabbard brougham-landaulet ally whirliest Quar duchan nonvenousness participated sufficer uninfluencing parastichies finely tungsteniferous hen-and-chickens practicalism ticklishness nocent versi" (Indicator: "ntice")
"le abouchement busbar time-blackened Durango woefully ultraservile fun-filled wergelts oxyhydric drilvis Hezron traditionitis beguilingness thighbones wagtails slue vehicular gasteralgia flaggery septical guacharo macromesentery Phaedrus mis-cite firerooms reconnoitring Helgoland light-blue Karlise Semi-frenchified Garand undercapitalization dreidels rootage hyaenas well-grounded benting conventionalization bequest Maloneton nonrural dopa diamidogen plentify full-breasted Anunaki twelfhynde disingenuousness handed epinicion anyplace nonchanneled Bernkasteler entices hews depletive Wargentin unpoliced euthermic cardiopuncture duoviri coelarium hypotympanic Lourdes inviscate Vernen addicts staphylotome Peconic splatter-faced Ardenia somnivolency milkstone sneaky curtelace Ivonne latinizes Hagarville unobverted touchpiece engagedness Arenicola Sq. snow-crowned monamide Rausch pumpmen subbourdon sugar-lipped Linder prepromoted anoperineal prosody tonguesore Oc. Alangiaceae sightfulness apikores Pseudo-mayan koyem" (Indicator: "ntice")
"semimatt pneumonolithiasis merest tombolo preoriginally Nicolay cordicole nondelirious panheaded floodwater helmetmaker mateships Villamaria cajoles beslushed precanonical tinklier self-applausive symmetric phallitis Megalonychidae Hoxeyville sufficingness strength-conferring springiest Romandom drizzled Sauk ophiography nuraghi well-domesticated anisilic Sequoya mispunctuate hectoliter displeaser Skirophoria clusterings Gazzo diphyletic interstapedial semiprotectively pinnas exscutellate urogomphus Casimir Knossos oppugnacy pentice ferroconcretor ischiovaginal craniotomy emanatist vertebrosternal diamond-pointed quonking overcooks goupin curmurging CPSR elench gymnophobia nonconfinement catchers eisteddfodism choreographical artistically catnep optomeninx reedmaker monopodia gunstocking stonework prochromosome sentimentalize argy-bargies Bethsaida underroom wizen-faced radicels bondable milliluces scantlinged interveinous vivipara Actium Katha feracity peerages underfo taxlessness stark-wild revolutionized H" (Indicator: "ntice")
"lly heroid noncontributable rubber-reclaiming Amida overeffort dehydrogenization pseudotetragonal carbin alypin noneligible unembroiled unsew skillfulness acnode overslipping crossbirth subreport speramtozoon chalaco Garfield streaking haik Servetianism borts Alamota Zumwalt cultriform soldering lurks bellwether abstractors solates Fairoaks hydurilate ionosphere totipalmation imprescience desecration Starke re-rejoinder teleo- pensionnat mineralogist shove-hapenny abasement unenticeable tectological skydove Argo Blechnum interwreathing Paurometabola soil Montanan coccidial salteaux graymill imperatorial Antabus palaeometeorological isopropylideneacetone Gallophobe knoblike peatstack prostomium dosserets Pushtu Szczecin sarkical ell-wand exasper talcomicaceous Marlene dinettes nonextensional constitutionalization electrodialitic dualize Futurist latifolious physiographic coinhabit unofficiousness Dagna nontransferable calciphylaxis amyloses sophoria joyousnesses Chouteau back-connected pliant-bodied mesoarium" (Indicator: "ntice")
"ual Azande unsacrilegiously pectinatella quasi-famous Anastas landfolk babas bladdernose QS rough-hull hatbrim Post-prophetic prosencephalic nongracefulness empark dealcoholize trematode manumisable couturire delving stooging unpending endocarp plugtray Sinhalese formalins proplastic unparolable antirationalistic toluene human-headed estating barbarise precomparison anticentralism hipper unbiasing herpetologies Shuqualak Iacchus assument gap words spheroidize half-monthly prescribing phenmiazine choanoid predigesting hawkwise subsegment inocarpin Tualati deadlihead martrix judged telecode lachrymosely uncoveredly unconjured overfreedom parathymic devoiced pushrods Muldraugh democritean pulv exhorters quasi-inherited muskrats nonirrigating rhinos succorrhoea erer self-abominating jockstrap clupeiform empaestic bedaggle Massora benign biflagellate algesis Azuero lambently vapourized antiliberal consequence Matias preciousness alloploidy nudnicks bowsman contiguousness obverse AIMS filar patripotestal Lutoslawsk" (Indicator: "ntice")
"d Lazaruk unburnable Haaretz proclisis precopying swellage pepperidge quizzable quick-selling statements uncompanied interposure uncollected ginsengs ricine caponised stercorin Courtenay devilwise Bromeikon kaiserdom setulous Holophane zafree asinine fleaweed arumlike lino fable Wazir cassoni gadid railwaydom overtightening Goddam acquaint almondy corpulent entireness raffinose religiousness moon-touched bookish escaladed overminute Hayashi ribboning tormenta unassociably pendants steatomatous neutralistic underivable mesenterial overeager terning environed nucleone concessiveness Skutari pyrenodean Goasila tuilyie Vice-apollo entomophagan inembryonate sotol amygdalinic intrusions substratal embubble Megalodontidae anticeremoniousness hapless snowy-capped photically curding miships scumble fan-tailed mytilacean cross-land Jodie Limber Linguatulida radiodetector McCormack wagwants sympathetically LDS mentalize rough-point forgetness pantheology wide-petaled Pro-chicagoan Heraclid pensioner refracting Earline a" (Indicator: "ntice")
"atize Winigan unfrounced bacteriogenous nonabstemious wordprocessors shrinkageproof quote unthewed scapegraces lureful lujavrite insulinize unpreposterousness hyphenism turtles Alcock Scottie Hildebrandt palaeotherioid Shakerlike etaballi logarithmetically jouals unradical roundfish dodecasemic tai-ping Fujio tubiferous trypanophobia preobviated nonbinding Hydromys transliterating blasted fidei-commissum toecapped undeprecatively telosynaptic balcon resistable Desmoulins ruffing edifications anticentralist prepractise worsteds Fola frislet antinephritic subinferred silted sumptuously cytomegalic rivieras anointers applewood carpogonial pice predramatic search Hexagrammos nonmeritorious furled twice-vamped garvance Bypro xenophilous ontogeny sultanesque dopers Faydra myrmecophytic sterhydraulic intermixtly besnow geyan vitrophyre samely disennui CENTO psychosynthetic ischial ectodermic molilalia palladize Mahdi epiphytous crashed poetry pentastyle diastrophism cargued deparliament delaminated wackiest howdie S" (Indicator: "ntice")
"rightable cloud-flecked blepharoclonus preexist escoted fugue tender-mouthed schizostelic nonvendibility Triplicist ribbon-bordering essoin aerophyte John-bullism cake-mixing perbend inthrals plum-green gaugership Gadswoons riskily spathillae assessorial nonprocedurally sunkland resubscription greyware unstrictly nonalliteratively depoliticizing stellion span-long slopselling Toth bosom-stricken trudgen Talbott oleomargaric multiparty Hymera amputating hyperadiposity Svengali capeline orificial brahminee unfavorable caulotaxis nondisjunctional typhlectasis dithyramb Bananaland chromamamin tallageable appeases unforeshortened cock-fight bastard-cut pyrophorus vanelike scherzo notebook apprentice unairily Hedveh trilophodont drogermen fimbrilla teskere rehumanization three-phased Siegfried stewpan overdrifted infranodal smartest Tophet janapan Tom isoxanthine bilith conveth Altona peastone pishaug amidate lower-cased yowt extraembryonal copywise superaerially branchiocardiac ungermlike paraaminobenzoic uncommis" (Indicator: "ntice")
"e Lovich Keyes horridness ovoviviparousness plotter Dilltown well-rolled bedquilt foresail unperforating oatmeal hagarene ethmofrontal pemoline pickets quadridigitate hypoalonemia we-ship scenarist succours Aso pulsions Brixey segregate unlegible medlars inflamer undulately misinformation nine-spot antetype fibers kniazi fabrication troglodyte neotraditionalist Jung uncraven Belleplaine papyrographer flecks macrocrystalline Fujiwara alcoholism uneroding gatecrashers Xenarthra preentitled accroaching aletap towbar laminitis Sidras Chickasha typologically grossing interknowledge PMIRR reoccurred cosmologygy unbrawling humble-looking Yankee-doodle unfarced Shaper generalia deviable bazaars suity ricked backberend unglossaried tabletop re-entice orthoptics Anglo-german roentgenopaque catstick mirkier stary electromyography outlining morada concordats consortism hypothesiser overassumed bewonder tepidarium twice-prepared sagoweer ethnozoological apjohnite untrochaic refocillation tartro- nibbled Nash germanous ofi" (Indicator: "ntice")
"irkily shamal secability venous serenaders Flathead feeders Avilla contraltos glossed Gers thallophytes prisoners dealt brants electroencephalographically palaeotypically preys dehydrogenates disconnect quasi-feudally Verel zeuctocoelomatic Tartarology increate propylalaea re-entice squoze markdown Theromorpha slashers midwifing Alphons nonintelligence sight-see predissuading justler hoaxee stylelessness Bitburg Kunlun Gosnell glacon bobache Coccinellidae rubiconed reliquiae Dordrecht taction keying indissuadably hasnt literateness pagelike racialism tomjon etymologised revindicated Slavicize millsite Non-bantu telescriptor triannual morbifically dinges swizzle VDT Malinda haplopetalous Farah fogram xanthogenamide Celestia nondiscoverable sagene Troy reciprocities smelt- overreplete atheroma semipopularized misconstruction Huoh clinohumite unprocessional symphonising overnigh blush-compelling atrocities waxworks prerefined anthroposociologist tilly-fally extermine accommodates boastful love-smitten allumette" (Indicator: "ntice")
"d Yannina excrementive lupanarian osperm blessingly rochet claystone irredressibly melotragic matfellon Brescia seeking laumonite unteaching anaclisis Runstadler amber-colored Mastigopoda walkouts chkfile Quiina Eupanorthus tireling swampable idiodynamic hypnoanalysis exoterically confidential Bolivia bosquet Witter nonrepudiative comingle undistributed autoclave enrolle I/O ariels drowses revacating misperform goldhead brackens akenbold granuliform time-halting freezers footlike vel uncontentedly roboreous scummer doek rigwoodie ritualisms Columbiana pivoted downcomes microconstituent cynegetic moulded custom-made bienvenu pinyins alchemised Milla bescreens hypophonous Un-athenian CL bowly deeses hell-devil conticent demi-sel Post-christmas hennery Tobikhar cleverest Steinerian reregulated winter-withered triturator sussed Pergamenian alphyl freetrader nontaxes regalo partless dichromat piecer milleporiform rugose tree-garnished three-wive consumingness Nabu palateful Lockeanism Philodinidae underspring feat" (Indicator: "ntice")
"sin disvalues gleeks theropodan home-made Gadarene soddening costispinal sludder tetrasporous argenol Frager dooja nonconvivially yammadji thanksgiving Thaliard undiscoloured praecava fathmur snobbily tampion Butenandt CATLAS cacomixl allosterically D/O Lithosiinae unyearned vasostimulant puli Songoi schlepps remission well-financed Nereids inconversant underexposures hobbyists keratectacia Geminus oinology nectar-loving thick-skulled crystalliform entices alphabetizers salud lifeless governeress abortifacient unfaultable aestethic pingler retinued incepts Lodge hysteropathy inoxidability cloques waistbands adamantean presciently cozeningly sportswomanly terrorsome tanging glassmaker piggish scleranth intertentacular trittichan perishables microword lemuriform cross-country xylan retroduction clerkage diptychs fluctuation swishier ovolytic milor unbilleted interquarreling carien unrewardedly semiempirically Brody phytobiological entermise lasty tartare thermodynamical perihepatic equiprobabilist succeeder dow" (Indicator: "ntice")
"ungsteniferous industrialist superbly wedels Saraiya dibenzophenazine cleanser chauvinisms tandems Skitswish shipbroken chromidial Filaria orotherapy PVA sweats pot-belly pendente LOX half-questioningly ensepulchering acuminated bavaroise relieve multinodular Zeena unbetide inkholder cooperationist shamefastly pneumohydropericardium storemen poke-bonnet Warundi te-hee ladykiller refuges vocalion refractive Matsuyama prevaricating tailflower Madra inimicitious poods Vandenberg mohair enticer becudgel Sunnyvale Rickwood Aepyceros tusher unsecurableness unqueenlike curbstones begirdle templet sponginblast Willkie vivisectionally iron-ore Bink electro-magnet chondrigen abater sharp-topped cymlins capewise saccarimeter intermaxilla unselfishly kaoliang isothiocyanates dissuasion ailerons shrewdnesses verifying proleaguer outhowled Nutrioso favelas Polyborus galopade minglers articulus Gogra reliability squamish ennoblers possessio blackface flangeway neuroticize dermol overappreciativeness Eloy tendenciously Bernh" (Indicator: "ntice")
"o nonrationalistical PMDF proctatresy accrescendo nosegaylike bayadeer amamau nonschematic leopard-man rockfoil camellike abutter bunkmates shaley farthermost synopsizing hushed lalaqui sheld-duck sightings coolen cygnets ambilateral higgles loadstars saccharochemotropic Clorox phialed pragmatica wherell acuclosure uncircumcision quasi-opposed toreros galley smooth-sculptured seggar stainably wealthfully self-prescribed Checani gomart completenesses Tex unconquerable superoanterior spongiolin mundation recohabitation Rosanna gargoylish pollicitation unspirit mesenchyme superheater Mid-may alphamerical Harleyville Mons unmarching smokey nuns digestif ladlefuls subentitled self-colour quasi-mechanical descantist megasclerum Fifinella microsplenia auxochrome perhalogen nondivisional unwigged Pseudo-moslem Calamodendron Methodisty BAppArts Ptychoparia unadvisable anticeremoniousness Reld shallow-hulled Kaolak hemopexis boort gangly novitious Jude nonterminability antituberculin Kipnis deathfully overexpect Ayyubi" (Indicator: "ntice")
"denburg lavatorys admarginate prickspur subtransversally elements jellifying lenticels carking hepatophyma kirimon precorneal anthologized taar diesinker myelogonium seawater culmiferous vigors peptids steles lastage three-handed nonliturgically filicidal baldachins promerger whoa full-adjusted dissyllabism accordance truncheoning mooter casse-tete outpursuing Michaelangelo flamingo remount time-spirit AFI Konopka massasauga bristle-thighed cleavage Hercules Stoneham caser confoundedness Jasen trachomas Dunkirker triduums uncelestialized put-upon chivarro hemophilia sipapu unhearten zygopteron Melaniidae Heintz tuilles potted ambicolorate hair-stemmed donkeyback remigrate delimit syncopating thereas homodynamic amphibiology regulating Newtonian Ellerey verbiles trencherside societified half-cocked enlarged monocerco fervorless upstretch anthropoteleological Nanuet misnumbered spring-head hatcheler Tseng galyak chopstick nid-nod clencher Topsfield teen conclaves deep-sided enanguish chorionic nongravitation Ce" (Indicator: "ntice")
"hryne Garrulus RTA trattoria depthometer Malaceae dekameter chego barkan wileproof obdurately uncontriving Rokach metropathia echar untensile soft-spread uninformed autoist backfield distributress thionyl cross-questioning unprettified flyable bottles chirring veratric vulpinite earns single-deck windfallen chanticleers counterpoise Jacques biological accident-prone subjectivization Gildas mellow-lighted self-neglectfulness scovillite detesters Parry potence tabourin cross-fish Elazig dimmedness unapprenticed Lavater overfoot fluorographic exflect barney-clapper renailed fretize cog. Burdigalian Samarkand turtledoved stowps Mnemon lampoonists amianthus epicerebral consentable Lauderdale repercept Tartuffes JV transvestitism subfactories religious-mindedness teo-nong zoned Un-georgian chrisomloosing honeyfugle Maurilia rocklings dorse close-legged seminomadism nighness ecbole outsprang protagonists frailly self-instructional amatorious admitting Mycah pyrogravure PAYE superspecialize caffiaceous wabblingly ent" (Indicator: "ntice")
"irlocks fondants melangeur oinks pandoras delayer jeopordize out-settlement questionaries antigravity steel-green upward-stirring nonrelaxation harmonicas Soga Indre squooshy archgenethliac brocatello transpicuously creatively vacantia honorific trimethylamine developist weisenheimer J.C.L. cartonful disprobative Friedland snellest smeller Wrafs basicytoparaplastin cojudge anti-Russia LSP offerable fat-fleshed redefied Arianizer depauperize frostweed hesperornithoid interlot subparagraphs foredesignment denticete piewoman thousand-legger Lucais hydroptic indictive spirit-numb inspects self-sacrificial undislodged surefooted uxorilocal prothalamium fevery unhistorically heliotactic clerklier self-suggested Pro-calvinistically jokebook V-Day selvas nominalized squaretoed jessamy mispractise eyeservant clean-lived reconverts silenter fetch-light weened alfridaric draughtiness revisional Un-french Bostwick factures inducer chromatograph nurseryman sleepingly EINE omniscriptive nonmucilaginous invertedly unsaltato" (Indicator: "ntice")
"t hexacolic aoli younglet bras-dessus-bras-dessous mockers quatorzes cogrediency ein Odontotormae preprovision raptest desulphurization twistiways bonbon armlocks proctors fletton animals Aphaniptera companionways hylobatic fishhooks Bessy pamperer bireme legoa Athanasianist antipolar brick-bound OOT unprenticed crosscut paintry unblest barricading catstitcher cuttles prisoners salute Cousy ferricyanhydric Rosalinda ardassine erosely worksheets rawinsonde MMW noneugenical bumbles perishables Homoousianism propitiative bergamiol grasswidow pamphleteers stylogonidium tomorrowness wife-hunting twice-re-elected reinstall fitchy syllepsis unbowel sinkingly registership Zhmud panthers Vogele Cloelia counterbalancing espagnolette uncarnivorousness matman BLit subdating disleal disquisite Oza Eldwen execration Maysel unfetched sublaciniate bonity malcontent Paraebius etiquettical unplaits biders Tremella Volos toydom contd. fant hyperobtrusiveness unprincess consistible Ptenoglossa endomitosis quarrys sml Urdar supra" (Indicator: "ntice") - source
- File/Memory
- relevance
- 2/10
-
Possibly checks for known debuggers/analysis tools
-
Environment Awareness
-
Possibly tries to implement anti-virtualization techniques
- details
-
"2017-12-11 20:24:00, Info DISM API: PID=2796 TID=2828 Input parameters: Session: 2, DriverPath: %WINDIR%\System32\DriverStore\FileRepository\vboxvideo.inf_amd64_neutral_282ccc1684d6e163\vboxvideo.inf - DismGetDriverInfoInternal" (Indicator: "vbox")
"2017-12-11 20:24:00, Info DISM DISM Driver Manager: PID=1172 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_12eb69aba9e5025e\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vbox")
"2017-12-11 20:24:00, Info DISM DISM Driver Manager: PID=1172 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_12eb69aba9e5025e\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vboxguest")
"2017-12-11 20:24:00, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_12eb69aba9e5025e\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_12eb69aba9e5025e\VBoxGuest.cat]" (Indicator: "vbox")
"2017-12-11 20:24:00, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_12eb69aba9e5025e\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_12eb69aba9e5025e\VBoxGuest.cat]" (Indicator: "vboxguest")
"2017-12-11 20:24:00, Info DISM DISM Driver Manager: PID=1172 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_12eb69aba9e5025e\vboxguest.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "vbox")
"2017-12-11 20:24:00, Info DISM DISM Driver Manager: PID=1172 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_12eb69aba9e5025e\vboxguest.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "vboxguest")
"2017-12-11 20:24:00, Info DISM API: PID=2796 TID=2828 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_12eb69aba9e5025e\vboxguest.inf - DismGetDriverInfoInternal" (Indicator: "vbox")
"2017-12-11 20:24:00, Info DISM API: PID=2796 TID=2828 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_12eb69aba9e5025e\vboxguest.inf - DismGetDriverInfoInternal" (Indicator: "vboxguest")
"2018-02-20 09:38:55, Info DISM API: PID=1720 TID=1964 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxvideo.inf_amd64_neutral_bc42bb1917d1bc65\vboxvideo.inf - DismGetDriverInfoInternal" (Indicator: "vbox")
"2018-02-20 09:38:55, Info DISM DISM Driver Manager: PID=3012 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_9fc262b6119df1ee\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vbox")
"2018-02-20 09:38:55, Info DISM DISM Driver Manager: PID=3012 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_9fc262b6119df1ee\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vboxguest")
"2018-02-20 09:38:55, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_9fc262b6119df1ee\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_9fc262b6119df1ee\VBoxGuest.cat]" (Indicator: "vbox")
"2018-02-20 09:38:55, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_9fc262b6119df1ee\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_9fc262b6119df1ee\VBoxGuest.cat]" (Indicator: "vboxguest")
"2018-02-20 09:38:55, Info DISM DISM Driver Manager: PID=3012 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_9fc262b6119df1ee\vboxguest.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "vbox")
"2018-02-20 09:38:55, Info DISM DISM Driver Manager: PID=3012 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_9fc262b6119df1ee\vboxguest.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "vboxguest")
"2018-02-20 09:38:55, Info DISM API: PID=1720 TID=1964 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_9fc262b6119df1ee\vboxguest.inf - DismGetDriverInfoInternal" (Indicator: "vbox")
"2018-02-20 09:38:55, Info DISM API: PID=1720 TID=1964 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_9fc262b6119df1ee\vboxguest.inf - DismGetDriverInfoInternal" (Indicator: "vboxguest")
"2019-01-03 17:11:42, Info DISM API: PID=2008 TID=2408 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxvideo.inf_amd64_neutral_e9f3789e40cc2499\vboxvideo.inf - DismGetDriverInfoInternal" (Indicator: "vbox")
"2019-01-03 17:11:42, Info DISM DISM Driver Manager: PID=1456 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vbox")
"2019-01-03 17:11:42, Info DISM DISM Driver Manager: PID=1456 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vboxguest")
"2019-01-03 17:11:42, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\VBoxGuest.cat]" (Indicator: "vbox")
"2019-01-03 17:11:42, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\VBoxGuest.cat]" (Indicator: "vboxguest")
"2019-01-03 17:11:42, Info DISM DISM Driver Manager: PID=1456 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "vbox")
"2019-01-03 17:11:42, Info DISM DISM Driver Manager: PID=1456 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "vboxguest")
"2019-01-03 17:11:43, Info DISM API: PID=2008 TID=2408 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf - DismGetDriverInfoInternal" (Indicator: "vbox")
"2019-01-03 17:11:43, Info DISM API: PID=2008 TID=2408 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf - DismGetDriverInfoInternal" (Indicator: "vboxguest")
"2019-01-03 17:11:43, Info DISM DISM Driver Manager: PID=1456 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vbox")
"2019-01-03 17:11:43, Info DISM DISM Driver Manager: PID=1456 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vboxguest")
"2019-01-03 17:11:43, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\VBoxGuest.cat]" (Indicator: "vbox")
"2019-01-03 17:11:43, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\VBoxGuest.cat]" (Indicator: "vboxguest")
"2019-01-03 17:11:43, Info DISM DISM Driver Manager: PID=1456 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "vbox")
"2019-01-03 17:11:43, Info DISM DISM Driver Manager: PID=1456 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "vboxguest")
"2019-03-21 10:13:32, Info DISM API: PID=2364 TID=2692 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxvideo.inf_amd64_neutral_9bc3c1389d21f9ef\vboxvideo.inf - DismGetDriverInfoInternal" (Indicator: "vbox")
"2019-03-21 10:13:33, Info DISM DISM Driver Manager: PID=3520 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_ad82ab6f57da5f72\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vbox")
"2019-03-21 10:13:33, Info DISM DISM Driver Manager: PID=3520 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_ad82ab6f57da5f72\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vboxguest") - source
- File/Memory
- relevance
- 4/10
-
Reads the cryptographic machine GUID
- details
- "DismHost.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY"; Key: "MACHINEGUID")
- source
- Registry Access
- relevance
- 10/10
- ATT&CK ID
- T1012 (Show technique in the MITRE ATT&CK™ matrix)
-
Possibly tries to implement anti-virtualization techniques
-
General
-
Contains ability to find and load resources of a specific module
- details
-
FindResourceExW@KERNEL32.dll (Show Stream)
FindResourceExW@KERNEL32.dll (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Contains ability to find and load resources of a specific module
-
Installation/Persistance
-
Drops executable files
- details
- "DISMHOST.EXE.5E38D162.bin" has type "PE32+ executable (GUI) x86-64 for MS Windows"
- source
- Binary File
- relevance
- 10/10
-
Drops executable files
-
Hiding 3 Suspicious Indicators
- All indicators are available only in the private webservice or standalone version
-
Informative 18
-
Anti-Reverse Engineering
-
Contains ability to register a top-level exception handler (often used as anti-debugging trick)
- details
- SetUnhandledExceptionFilter@KERNEL32.dll (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Contains ability to register a top-level exception handler (often used as anti-debugging trick)
-
Environment Awareness
-
Contains ability to query the machine version
- details
-
GetVersionExW@KERNEL32.dll (Show Stream)
GetVersionExA@KERNEL32.dll (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Makes a code branch decision directly after an API that is environment aware
- details
- Found API call GetVersionExA@KERNEL32.dll directly followed by "cmp dword ptr [rsp+30h], 02h" and "jne 000000010000EDEBh" (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 10/10
-
Possibly tries to detect the presence of a debugger
- details
-
GetProcessHeap@KERNEL32.dll (Show Stream)
GetProcessHeap@KERNEL32.dll (Show Stream)
GetProcessHeap@KERNEL32.dll (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Contains ability to query the machine version
-
General
-
Contains PDB pathways
- details
- "dismhost.pdb"
- source
- File/Memory
- relevance
- 1/10
-
Creates mutants
- details
-
"\Sessions\1\BaseNamedObjects\Local\InternetShortcutMutex"
"Local\InternetShortcutMutex"
"\BaseNamedObjects\Global\WdsSetupLogInit"
"\BaseNamedObjects\Global\SetupLog"
"\BaseNamedObjects\DBWinMutex" - source
- Created Mutant
- relevance
- 3/10
-
Drops files marked as clean
- details
- Antivirus vendors marked dropped file "DISMHOST.EXE.5E38D162.bin" as clean (type is "PE32+ executable (GUI) x86-64 for MS Windows")
- source
- Binary File
- relevance
- 10/10
-
Logged script engine calls
- details
-
"wscript.exe" called "WScript.Shell.1.CreateObject" ...
"wscript.exe" called "Msxml2.ServerXMLHTTP.6.0.CreateObject" ...
"wscript.exe" called "ADODB.Stream.6.0.CreateObject" ... - source
- API Call
- relevance
- 10/10
-
Overview of unique CLSIDs touched in registry
- details
-
"DismHost.exe" touched "PSDispatch" (Path: "HKCR\SOFTWARE\CLASSES\CLSID\{00020420-0000-0000-C000-000000000046}\TREATAS")
"DismHost.exe" touched "PSSupportErrorInfo" (Path: "HKCR\SOFTWARE\CLASSES\CLSID\{DF0B3D60-548F-101B-8E65-08002B2BD119}\TREATAS") - source
- Registry Access
- relevance
- 3/10
-
Process launched with changed environment
- details
-
Process "DismHost.exe" (Show Process) was launched with modified environment variables: "LOCALAPPDATA, TMP, PROCESSOR_ARCHITECTURE, USERDOMAIN, CommonProgramFiles, ProgramFiles, Path, USERPROFILE, TEMP, APPDATA"
Process "DismHost.exe" (Show Process) was launched with missing environment variables: "PROMPT, LOGONSERVER, HOMEPATH, HOMEDRIVE, VXDIR, PROCESSOR_ARCHITEW6432" - source
- Monitored Target
- relevance
- 10/10
-
Spawns new processes
- details
- Spawned process "DismHost.exe" with commandline "{CA148027-D29A-4085-B1E3-962CBB527F9D}" (Show Process)
- source
- Monitored Target
- relevance
- 3/10
-
Spawns new processes that are not known child processes
- details
- Spawned process "DismHost.exe" with commandline "{CA148027-D29A-4085-B1E3-962CBB527F9D}" (Show Process)
- source
- Monitored Target
- relevance
- 3/10
-
Contains PDB pathways
-
Installation/Persistance
-
Dropped files
- details
-
"DISMHOST.EXE.5E38D162.bin" has type "PE32+ executable (GUI) x86-64 for MS Windows"
"dism.log" has type "UTF-8 Unicode (with BOM) text with very long lines with CRLF line terminators" - source
- Binary File
- relevance
- 3/10
-
Opens the MountPointManager (often used to detect additional infection locations)
- details
- "wscript.exe" opened "\Device\MountPointManager"
- source
- API Call
- relevance
- 5/10
-
Touches files in the Windows directory
- details
-
"wscript.exe" touched file "%WINDIR%\SysWOW64\en-US\wscript.exe.mui"
"wscript.exe" touched file "C:\Windows\SysWOW64\wscript.exe"
"wscript.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls"
"wscript.exe" touched file "C:\Windows\SysWOW64\rsaenh.dll"
"wscript.exe" touched file "C:\Windows\SysWOW64\scrrun.dll"
"wscript.exe" touched file "C:\Windows\SysWOW64\wshom.ocx"
"wscript.exe" touched file "C:\Windows\SysWOW64\en-US\wshom.ocx.mui"
"wscript.exe" touched file "C:\Windows\SysWOW64\en-US\KernelBase.dll.mui"
"wscript.exe" touched file "C:\Windows\SysWOW64\msxml6r.dll"
"wscript.exe" touched file "C:\Windows\SysWOW64\en-US\winhttp.dll.mui"
"DismHost.exe" touched file "C:\Windows\TEMP\182ACD25-3939-4CED-8AB6-D69D7EB77109\en-US\dismhost.exe.mui"
"DismHost.exe" touched file "C:\Windows\TEMP\182ACD25-3939-4CED-8AB6-D69D7EB77109\en\dismhost.exe.mui"
"DismHost.exe" touched file "C:\Windows\System32\rsaenh.dll"
"DismHost.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls"
"DismHost.exe" touched file "C:\Windows\System32\kernel32.dll"
"DismHost.exe" touched file "C:\Windows\Logs\DISM\dism.log" - source
- API Call
- relevance
- 7/10
-
Dropped files
-
Spyware/Information Retrieval
-
Found a reference to a known community page
- details
-
"nrepleness Buick foreordinated britchka freshman tutworkman black-hooded Gelechiidae bedlar chromophotographic leavened with-drawn redheart seaming empyreum amniochorial full-sphered unexcursively blue-lined vaguish nonrepudiable populousnesses evangelicals crystallisable complaisantly gingiva distensibilities Hokinson monodically vaticination Gambrell Jochebed alluvials dropsicalness love-inspiring sonances etacist acerose lofty-humored thimbleberry anaphases semiconversion darwan half-addressed inspoke red-edged thrinter Orianna gloxinias protoderm syngamy color-free omnipotences epichile undercircling crusadoes anociassociation four-cycle dereferencing puebloize wunsome mezuzot canajong cuifs hillsale practical-minded Fennell Lebensraum Elery Wadell cirribranch Vera darkest Farmer qabbala daedaloid pumpkins linen restoral rock-bed humpbacked preinheritance Presbyterianism stumpknocker timorousness stert Normie lateroflexion atwitter mesosporium billowiest unsupported companion sheepmen nonsymphoniousness p" (Indicator: "twitter")
"eciated sponginblastic Amorete paperhangers eulogic preaffidavit flareboard cognizable self-reproached semimoderately wedeled nesslerizing transgressional pseudohuman calligram steer killweed advantaged quart-pot punicial synthroni Frasera unscrutinising haoma amusements furiously disposableness hagbush clean-armed yellow-dyed stibbler marginating unsinister unaggravated lads Healdton labyrinthal Adam-and-Eve gun-shy Cryptobranchia unecclesiastic polymorphic ngai pochay outflatter proacademic fire-safeness tabernacled septiferous bogach nonresuscitative Yeagertown abietene unmail thymonucleic andalusite untrustworthy blooding blowup octophyllous studdings echiuroid Turanian overindividualization alopecist enumerated mentalists irreconcilability twitterboned hermaphrodite spirling purveyoress pinkroot emanational urethrobulbar antiketogenesis decapitatations staggiest recondemn denaturisation Camdenton formicate remises Dray honeysuckle Elkmont foldcourse sandpaper Trans-iberian celebrities veneraceous redared" (Indicator: "twitter")
"onsai departmentalising bludger unispinose unexplicableness gastronomical overbitter twitters nip-up mound-building loud-speaker Geophilus paleostylic nontreatment termillenary Sola hawk-billed oversheet deprehend broadcasters wocas magnesic analogise fireworks nonforfeiture corncockle neologized antipatheticalness double-pedal half-mentally choromania Helman joyfullest Hoare cloth-inserted Wasegua Goodyera shoe hoppytoad filminess synthesise unstreaming acceptancy Narthecium unlabialize brave-sensed thionines sarcosin limli Un-americanization Sanhedrin distn Drugge polyoma enserfs unbrotherly factions reventure permanency valleculae unimpededly Wrafs abstricts sulphone moon-blasted shelvier brachyural preidentified Raynard electromeric flickering Falangist metachrosis Mic double-lived siket moola toothachy CMS outthreaten dehistoricize synacmic palmcrist azotite esthesioblast blowballs proalcoholism bedlike tartrated Libbie bloody-sceptered a-squirm syces thyrsoidal imino Burrow bkpr contratabular societies" (Indicator: "twitter")
"le-rayed alifs entangle plankless exeunt self-chosen gynaecic juridical polyphony forwardest possessionist broadening Siculo-phoenician bonnwis disinheritable peritonitis dry-skinned fooster dry-eared bezetta Sparmannia polychroic whr dislocate quinquarticular chalazae tamaraus chandleries Ertebolle Shelbina Labrador nine-part crazy-pate haplomous boltsmith formalised obarni Cebidae vesicle travel-sated a-twitter copalm precessions runcinate unexperience murries clavellated overprosperity Aeolides stibble exposed shelvy half-believing Expressionism Floerkea Eadie transformist fanaticised Stodder algific pigsticked helver no-place penny-grass wharves prosthetist unforcibleness rustled philotheism engird neurosthenia macrocarpous eaved distinguee whiners understeer Emydea Schonfield partition wordably odour Ljubljana supergraduate underachievement Robison hamlah middorsal odal Pharsalian cannisters hydromancy outscream unkill Arkab exocardia formalistically aeroscopically double-dotted unsalaried unassentive Po" (Indicator: "twitter")
"lwoman unfructed antiquers commise nonsurgical yangs brashiness numberful cult-title bravadoes anagraph bondable dumfounder eructating outwitter Warde Madrilene followers responsibly intertalk Mdewakanton reminiscent Melbourne pipingness largeheartedly large-petaled drail undercause ochered emplaced calorescence Rosalyn Fallston idiotising es unexercise mandamuses witchlike caniniform rigolette nonsecurities ontogenetic coziness rebold nonregardance Salvadoraceae foreseat lisps ferricyanate unstep kickshaw nonepisodic Isma worminess temptatory seconded self-complaisance appanaging saccharize devaluations ighly dermol mountain-green self-injuries playmates upsy-daisy nonfeatured sequentialized spandle Mincopi tunnellers nonconserving Triratna longeval resinosis rhabdomyosarcoma tetrazin indigested echoic medallioned mouchrabieh Baccio Panayan unalimentative launderers storefront untransparently bolt-shaped spongioblastic Ziphiidae midified diapaused self-conservative enflagellate agalactous pigging regelated m" (Indicator: "twitter")
"chronograph overreprimand whirlwindy conniver cenotaphic existible photohyponastic rhinolite meddlers dissipating misyoke realizingly unexpectant pongee unintermitting grizelin press-forge Cassondra Moaria patroon toasts merchantman antiegoistic Clapper groan benzdiazine Travnicki Glanti vespertilionid Gnathostoma all-ordering debilitates bengals Ahgwahching bumbee reaver paint-splashed sortilegi dabble interfaced unurn lochan sympatholytic wild-warbling Budwig pretabulating huller foam-crested niddick praxis makeshiftness world-line repoint watchfulnesses subcutaneousness Sra. planetless heredoluetic Midgard Is. ready-for-wear Vassalboro poculary subextensible zootomy supernational beslaved disgown fryer bluesier annelidous overcaptious daker-hen siper verbomaniac undoer jowls gapped gazangabin gynodioeciously gastradenitis aquicultural oralist acetophenin redistributing outwitter duststorm pinchedly tamperproof sambhurs hovertrain uncloud Margy pulpefaction geopolitician deformeter Smithson demiflouncing he" (Indicator: "twitter")
"aveholder surdity serranid Handelian tarantella good-bye Kynthia awaited ossifying unromantical high-mettled cleaner-off bay-salt ecclesiastical oceanologist Febronian calicles unbafflingly undwarfed garbage gaudinesses toastiest sweller eclectic uteromaniac iliahi dipentine tenostosis fub ischialgia nitrogelatine base-born ciderkin setarious bloodwit text-writer ectozoans multivagant verticals Blau jackhead supratonsillar dreamboat paracme nautiluses ane acquisible apologer pretardily mealy-mouthed air-seasoned imbellic AGR observanda deaminize uncommunicated myrmecochory peafowls benevolentness dipsy nondivisively rewashed enjoiners Mattaponi fezzed saccharulmic bedrivels anemological hayride chronogenetic proselytize acarotoxic Euthyneura slate-beveling abdicable moonworts Ethelette consolate electrocardiography diorite ridableness stirrer extorter crossing-over unrobbed twittered thallose merman caracal Ardsley Proto-hattic mosaic-floored Hayton feely Cladophorales Johanson rat-eyed honourer superpurity t" (Indicator: "twitter")
"e whalebone shadows crack-up unafloat ribbet odder mild-eyed horsetongue sulphbismuthite rebellow unordinately woefulness Lewanna cinquefoiled Platte Goldmark Jacynth overformalized rogueries ovoid hemiepes jennerize lighterman tourte scintillize sewen missificate recollects Scenedesmus janitorial LISA caterwauled Hatton punese Rachelle electro-magnet piscioid unroaming Bolinas twittered Tasiana squacco Kwan thunderbird nonlacteally Sudnor nonanatomical peytrals mesosalpinx vouchsafer isotonia seedpod fidalgo Goethean reintrench teamworks purgery nonvertebrate authorizing syenite simptico hyperobtrusive complicators gutser Fulgoroidea Salviniales nonatrophic phytognomy sperm- Tryck prodrome reenergized apatheia hankey-pankey coheading sirens vermiformous wittified tenants proletarianize alcabala transverser ritardando DiGiangi luthier Sipunculoidea evolvulus dragged-out coquettishly crystallisability gallows baizing salpinges rough-hull resolvers Vyborg twinklers collarinos mitraille lavadero miniaturing outh" (Indicator: "twitter")
"arme Assonet rubberized nonsobriety rejuvenesce cabbalistic molybdoparesis bandying goddesshood rascals eurygnathous wetherhog Taeniodonta unpronouncing tibia crocoites pleuro- Alderson superendorsement in-migrant tarantarize scarletina sarcomere mesiodistally worldwideness acream all-pervadingness compleated murenger octoploid enodal interblock bioherm Dutchmans-breeches DVC vulgariser unicameral acceptilation microphyte flexional innuendoed demonolatrously idee-force stuffer ochlocracy Aubreir gebanga glib-gabbet woolsacks supertranscendently trogger pinyl progenitorship ruggeder Out-quixote indesignate perosomus Peloponnesus urbanize untrashed Crystie agglutinates dissertated Marolles cooghneiorvlt chondroseptum pediatrician a-twitter unrepresentational perennialize tufter venostasis Yerxa seviche needlemaker Anni nudzhes thelytoky affiliating toad-eater dactylioglyph iotization Shaner usurping trunkful tellural lipography uninurned how-de-do horseleach coadamite patzer Paguridea nonrefutal monkey Hymera r" (Indicator: "twitter")
"conditivium Andron unfather counterprophet nonhackneyed brees imbellic reejected herniopuncture middlewoman pre-entertain perioral cuneo- watercraft tomato-growing Shuping self-congratulating unpsychopathic pailsful insolvably penicillated tootle dcbname incorporally fenurons Changteh displaceable Hornick holographically triglyphal iodides garrotes unpeaceable raceways mammonist shy fetishism neopine perceptions cryptanalytics pensy boulterer Barneveld dolomization co-life Millerville gymnasiast insanify uhllo pillboxes Enceladus difficulties lichenivorous rum-selling euripi infranaturalism Ramistical breastless endoenteritis Joses Kulturkreise prerefined obli linguopalatal nitroglycerine chickories screen-faced ulvaceous untorpidly Osage khus-khus cilioretinal mentimutation nearing zonure subcorneous follying shrouded portrayable fashion-led twitteration hypostatical antigravity about-ship hermidin uncomfortably staminiferous crabbed flans nonconcludent unreliant worse-executed self-indulger elegiambus orcha" (Indicator: "twitter") - source
- File/Memory
- relevance
- 7/10
-
Found a reference to a known community page
-
System Security
-
Opens the Kernel Security Device Driver (KsecDD) of Windows
- details
- "DismHost.exe" opened "\Device\KsecDD"
- source
- API Call
- relevance
- 10/10
- ATT&CK ID
- T1215 (Show technique in the MITRE ATT&CK™ matrix)
-
Opens the Kernel Security Device Driver (KsecDD) of Windows
-
Unusual Characteristics
-
Installs hooks/patches the running process
- details
-
"wscript.exe" wrote bytes "d83a9074" to virtual address "0x749101FC" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "b8c015e670ffe0" to virtual address "0x749036B4" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "d83a0200" to virtual address "0x74904D78" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "7111d4017a3bd301ab8b02007f950200fc8c0200729602006cc805001ecdd0017d26d001" to virtual address "0x753807E4" (part of module "USER32.DLL")
"wscript.exe" wrote bytes "b4369074" to virtual address "0x74910200" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "6012e670" to virtual address "0x72074028" (part of module "WEBIO.DLL")
"wscript.exe" wrote bytes "b4360200" to virtual address "0x74904EA4" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "68130000" to virtual address "0x75061680" (part of module "WS2_32.DLL")
"wscript.exe" wrote bytes "b4360200" to virtual address "0x74904D68" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "b84013e670ffe0" to virtual address "0x74903AD8" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "d83a0200" to virtual address "0x74904E38" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "b83012e670ffe0" to virtual address "0x75061368" (part of module "WS2_32.DLL")
"wscript.exe" wrote bytes "d83a9074" to virtual address "0x74910274" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "b4369074" to virtual address "0x749101E4" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "d83a9074" to virtual address "0x74910258" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "b4369074" to virtual address "0x74910278" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "c0df06771cf90577ccf805770d64077700000000c011b47600000000fc3eb47600000000e013b476000000009457af7625e00677c6e0067700000000bc6aae7600000000cf31b476000000009319af76000000002c32b47600000000" to virtual address "0x74F61000" (part of module "NSI.DLL")
"wscript.exe" wrote bytes "d83a9074" to virtual address "0x749101E0" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "b4369074" to virtual address "0x7491025C" (part of module "SSPICLI.DLL") - source
- Hook Detection
- relevance
- 10/10
- ATT&CK ID
- T1179 (Show technique in the MITRE ATT&CK™ matrix)
-
Installs hooks/patches the running process
File Details
JVC_39239.vbs
- Filename
- JVC_39239.vbs
- Size
- 4.5MiB (4675911 bytes)
- Type
- script vbs
- Description
- ASCII text, with very long lines
- Architecture
- WINDOWS
- SHA256
- 61eeb6b5bb5bef4dfdaf83a1cd20904b086755b43a9cbbc2bd0149b0e1694a2d
- MD5
- 26cbc841ad24fd86ecaf15a34f857631
- SHA1
- 4f44ca2bc3414e96f1190a080d0839ad80d07cba
- ssdeep
- 49152:s0tQ7Y/AbQ1GgxBTcWye0xMFoDx04+DFFvyvpzVDLkZFASLUP6bK+dj5jCTYAbqx:s0L
Screenshots
Loading content, please wait...
Hybrid Analysis
Tip: Click an analysed process below to view more details.
Analysed 2 processes in total (System Resource Monitor).
- wscript.exe "C:\JVC_39239.vbs" (PID: 2392)
- DismHost.exe {CA148027-D29A-4085-B1E3-962CBB527F9D} (PID: 2600)
Network Analysis
DNS Requests
No relevant DNS requests were made.
Contacted Hosts
No relevant hosts were contacted.
HTTP Traffic
No relevant HTTP requests were made.
Extracted Strings
Extracted Files
-
Clean 1
-
-
DISMHOST.EXE.5E38D162.bin
- Size
- 95KiB (96768 bytes)
- Type
- peexe 64bits executable
- Description
- PE32+ executable (GUI) x86-64, for MS Windows
- AV Scan Result
- 0/81
- MD5
- 516a5fce06bb388499238a5f9286cb74
- SHA1
- 958be7d02fca674fb386482090b9a5024d0a1538
- SHA256
- 9a4b735603297448841758b29d3c387a4ce84e5fd0dae05622f43ce53b8c85e6
-
-
Informative 1
-
-
dism.log
- Size
- 197KiB (201799 bytes)
- Type
- text
- Description
- UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
- Runtime Process
- DismHost.exe (PID: 2600)
- MD5
- a399499ae795789ee8e8a785e7c0762c
- SHA1
- 437f6138d6ee7462bc2c5c0a4df670eb06e49c3e
- SHA256
- 80d9e376786a6c51717127c6a245563b0fe350ee662d580d238cdd75f4ea1dc1
-
Notifications
-
Runtime
- Not all Falcon MalQuery lookups completed in time
- Not all sources for indicator ID "api-55" are available in the report
- Not all sources for indicator ID "string-1" are available in the report
- Not all sources for indicator ID "string-24" are available in the report
- Not all sources for indicator ID "string-5" are available in the report
- Not all strings are visible in the report, because the maximum number of strings was reached (5000)