Analysis Overview
SHA256
0274e6f327598725f0b88d7044264a0f85598ac00ba227b13a7045c080d4c46d
Threat Level: Known bad
The file Request for PI.js was found to be: Known bad.
Malicious Activity Summary
AgentTesla
Vjw0rm
Downloads MZ/PE file
Blocklisted process makes network request
Executes dropped EXE
Drops startup file
Reads user/profile data of web browsers
Reads user/profile data of local email clients
Checks computer location settings
Reads data files stored by FTP clients
Accesses Microsoft Outlook profiles
Enumerates physical storage devices
outlook_win_path
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Suspicious behavior: EnumeratesProcesses
outlook_office_path
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2022-08-17 06:30
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2022-08-17 06:30
Reported
2022-08-17 06:32
Platform
win7-20220812-en
Max time kernel
150s
Max time network
152s
Command Line
Signatures
AgentTesla
Vjw0rm
Blocklisted process makes network request
Downloads MZ/PE file
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\EPPP.exe | N/A |
Drops startup file
| Description | Indicator | Process | Target |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ToLSGtelkO.js | C:\Windows\System32\wscript.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ToLSGtelkO.js | C:\Windows\System32\wscript.exe | N/A |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bZQEUbJxNj.js | C:\Windows\System32\wscript.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bZQEUbJxNj.js | C:\Windows\System32\wscript.exe | N/A |
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Accesses Microsoft Outlook profiles
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\EPPP.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\EPPP.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\EPPP.exe | N/A |
Enumerates physical storage devices
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\EPPP.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\EPPP.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\EPPP.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\EPPP.exe | N/A |
Suspicious use of WriteProcessMemory
outlook_office_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\EPPP.exe | N/A |
outlook_win_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\EPPP.exe | N/A |
Processes
C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Request for PI.js"
C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\ToLSGtelkO.js"
C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\bZQEUbJxNj.js"
C:\Users\Admin\AppData\Local\Temp\EPPP.exe
"C:\Users\Admin\AppData\Local\Temp\EPPP.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | kodencherycollege.ac.in | udp |
| SG | 148.66.137.120:443 | kodencherycollege.ac.in | tcp |
| US | 8.8.8.8:53 | macjoe597.duia.ro | udp |
| US | 8.8.8.8:53 | macjoe597.duia.ro | udp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| SG | 148.66.137.120:443 | kodencherycollege.ac.in | tcp |
| SG | 148.66.137.120:443 | kodencherycollege.ac.in | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| US | 8.8.8.8:53 | ftp.techlabinfo.com.br | udp |
| US | 108.179.192.218:21 | ftp.techlabinfo.com.br | tcp |
| US | 108.179.192.218:35272 | ftp.techlabinfo.com.br | tcp |
| US | 108.179.192.218:36443 | ftp.techlabinfo.com.br | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | tcp | |
| CH | 91.192.100.8:8159 | tcp |
Files
memory/572-54-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Roaming\ToLSGtelkO.js
| MD5 | 50c6f77435d4987498d7c5b67e7e3715 |
| SHA1 | 4ef9674b6918f666814b26717dafe740246ce8bc |
| SHA256 | 4960d6a2c4bddf11663bec4cbf3a06a57b01f9509b82c92e1ee0ec97890911e0 |
| SHA512 | 45947604ac1bc959b3af7a49c7bdc9917b16ff117b81724f100a0f8a7e4ce672bfae25e03ef9c89dcea21f98c9963b4d0aa893a88af64ba3d1b445b79cb7aeff |
memory/1760-56-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Roaming\bZQEUbJxNj.js
| MD5 | a542a21ecaba36f6ba8c6457b8ab67f9 |
| SHA1 | 3f05ddc6d6e59554cd9870b9e4b17919b81eaa6c |
| SHA256 | bc831f27e6da7b5e82be628a1564c8b6aee02ec9290c5d21f99733dd2d1db47b |
| SHA512 | 78ca13a83bbd029470978b1e465ee6b0c2a9345a1fe8ee3e86d9f1d48bd52b7927a16e607f71084a91706213d8ddc0293ed06a1927e478b9bbc21ab0b47b9a2a |
memory/1760-58-0x000007FEFBC11000-0x000007FEFBC13000-memory.dmp
memory/1408-59-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\EPPP.exe
| MD5 | 3058367b72a671967b83872a8f99b09a |
| SHA1 | b34b56369600d6b117bfadb1dd5d7affac4eaa61 |
| SHA256 | 76d65d87a7c98ffbebe035f800a8bb48e88cd9a15d843b88a6c9bd6fcc551b3b |
| SHA512 | be853cbf4e82589b0002530f9e4f67c6ed994fb3dd02488f04b49ca292e0106ea1f79d077e99fb15c969a2256c679c801a24cc8d9d7b679455e5a368f7ba65fb |
C:\Users\Admin\AppData\Local\Temp\EPPP.exe
| MD5 | 3058367b72a671967b83872a8f99b09a |
| SHA1 | b34b56369600d6b117bfadb1dd5d7affac4eaa61 |
| SHA256 | 76d65d87a7c98ffbebe035f800a8bb48e88cd9a15d843b88a6c9bd6fcc551b3b |
| SHA512 | be853cbf4e82589b0002530f9e4f67c6ed994fb3dd02488f04b49ca292e0106ea1f79d077e99fb15c969a2256c679c801a24cc8d9d7b679455e5a368f7ba65fb |
memory/1408-62-0x0000000000EE0000-0x0000000000F1A000-memory.dmp
memory/1408-63-0x0000000075441000-0x0000000075443000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2022-08-17 06:30
Reported
2022-08-17 06:32
Platform
win10v2004-20220812-en
Max time kernel
150s
Max time network
153s
Command Line
Signatures
Vjw0rm
Blocklisted process makes network request
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation | C:\Windows\system32\wscript.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation | C:\Windows\System32\wscript.exe | N/A |
Drops startup file
| Description | Indicator | Process | Target |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bZQEUbJxNj.js | C:\Windows\System32\wscript.exe | N/A |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ToLSGtelkO.js | C:\Windows\System32\wscript.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ToLSGtelkO.js | C:\Windows\System32\wscript.exe | N/A |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bZQEUbJxNj.js | C:\Windows\System32\wscript.exe | N/A |
Enumerates physical storage devices
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2604 wrote to memory of 4772 | N/A | C:\Windows\system32\wscript.exe | C:\Windows\System32\wscript.exe |
| PID 2604 wrote to memory of 4772 | N/A | C:\Windows\system32\wscript.exe | C:\Windows\System32\wscript.exe |
| PID 4772 wrote to memory of 2224 | N/A | C:\Windows\System32\wscript.exe | C:\Windows\System32\wscript.exe |
| PID 4772 wrote to memory of 2224 | N/A | C:\Windows\System32\wscript.exe | C:\Windows\System32\wscript.exe |
Processes
C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Request for PI.js"
C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\ToLSGtelkO.js"
C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\bZQEUbJxNj.js"
Network
| Country | Destination | Domain | Proto |
| US | 209.197.3.8:80 | tcp | |
| US | 209.197.3.8:80 | tcp | |
| US | 209.197.3.8:80 | tcp | |
| US | 8.8.8.8:53 | kodencherycollege.ac.in | udp |
| SG | 148.66.137.120:443 | kodencherycollege.ac.in | tcp |
| US | 8.8.8.8:53 | macjoe597.duia.ro | udp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| US | 93.184.220.29:80 | tcp | |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| NL | 104.80.225.205:443 | tcp | |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| FR | 40.79.150.121:443 | tcp | |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| US | 93.184.220.29:80 | tcp | |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
| CH | 91.192.100.8:8159 | macjoe597.duia.ro | tcp |
Files
memory/4772-132-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Roaming\ToLSGtelkO.js
| MD5 | 50c6f77435d4987498d7c5b67e7e3715 |
| SHA1 | 4ef9674b6918f666814b26717dafe740246ce8bc |
| SHA256 | 4960d6a2c4bddf11663bec4cbf3a06a57b01f9509b82c92e1ee0ec97890911e0 |
| SHA512 | 45947604ac1bc959b3af7a49c7bdc9917b16ff117b81724f100a0f8a7e4ce672bfae25e03ef9c89dcea21f98c9963b4d0aa893a88af64ba3d1b445b79cb7aeff |
memory/2224-134-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Roaming\bZQEUbJxNj.js
| MD5 | a542a21ecaba36f6ba8c6457b8ab67f9 |
| SHA1 | 3f05ddc6d6e59554cd9870b9e4b17919b81eaa6c |
| SHA256 | bc831f27e6da7b5e82be628a1564c8b6aee02ec9290c5d21f99733dd2d1db47b |
| SHA512 | 78ca13a83bbd029470978b1e465ee6b0c2a9345a1fe8ee3e86d9f1d48bd52b7927a16e607f71084a91706213d8ddc0293ed06a1927e478b9bbc21ab0b47b9a2a |