Advice Request Document with VBS macros - What do these mean?

Please provide comments and solutions that are helpful to the author of this topic.

PixelsAreNeeded

New Member
Thread author
Feb 8, 2019
1
Hello,

I have a question for you, this is after I looked at a triage using RedLine on my machine. I wanted to know what the following commands are doing:

“C:\WINDOWS\system32\cscript.exe //E:vbscript //Nologo C:\WINDOWS\TEMP\m_a7F83.tmp,”
“C:\WINDOWS\System32\netsh.exe wlan show interfaces,”
“\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1,”
“C:\WINDOWS\System32\netsh.exe wlan show drivers,”
“C:\WINDOWS\System32\svchost.exe -k netsvcs -p -s NetSetupSvc”

Is this normal behavior?
 
  • Like
Reactions: oldschool

Andy Ful

From Hard_Configurator Tools
Verified
Honorary Member
Top Poster
Developer
Well-known
Dec 23, 2014
8,040
Hello,

I have a question for you, this is after I looked at a triage using RedLine on my machine. I wanted to know what the following commands are doing:

“C:\WINDOWS\system32\cscript.exe //E:vbscript //Nologo C:\WINDOWS\TEMP\m_a7F83.tmp,”
“C:\WINDOWS\System32\netsh.exe wlan show interfaces,”
“\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1,”
“C:\WINDOWS\System32\netsh.exe wlan show drivers,”
“C:\WINDOWS\System32\svchost.exe -k netsvcs -p -s NetSetupSvc”

Is this normal behavior?
One correction: there are no VBS macros, but there are VBA macros.
The first command runs the VBScript code from the temporary file C:\WINDOWS\TEMP\m_a7F83.tmp .
The netsh commands are standard, you can run them from CMD to see the effect.
Conhost.exe is the new host process for console windows, so it will appear if you run any console program like cmd.exe, netsh.exe, etc.
The command svchost.exe -k netsvcs -p -s NetSetupSvc , starts the NetSetupSvc service which manages the installation of network drivers and permits the configuration of low-level network settings.
 

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top