Malware Analysis Report

2024-09-23 02:07

Sample ID 240620-by1b2s1erg
Target 8f5d17c2f22abdecfe0a7ee5d656951f0bd783988990c9df517c03b83157a73f.zip
SHA256 8f5d17c2f22abdecfe0a7ee5d656951f0bd783988990c9df517c03b83157a73f
Tags
agenttesla stormkitty xworm execution keylogger rat spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

8f5d17c2f22abdecfe0a7ee5d656951f0bd783988990c9df517c03b83157a73f

Threat Level: Known bad

The file 8f5d17c2f22abdecfe0a7ee5d656951f0bd783988990c9df517c03b83157a73f.zip was found to be: Known bad.

Malicious Activity Summary

agenttesla stormkitty xworm execution keylogger rat spyware stealer trojan

StormKitty

Detect Xworm Payload

AgentTesla

Xworm

StormKitty payload

Detects Windows executables referencing non-Windows User-Agents

Detect packed .NET executables. Mostly AgentTeslaV4.

Detects executables referencing many file transfer clients. Observed in information stealers

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Detects executables referencing credit card regular expressions

Detects executables referencing Windows vault credential objects. Observed in infostealers

Detects executables packed with SmartAssembly

Detects executables referencing many email and collaboration clients. Observed in information stealers

Command and Scripting Interpreter: PowerShell

Reads WinSCP keys stored on the system

Checks computer location settings

Executes dropped EXE

Reads user/profile data of local email clients

Reads data files stored by FTP clients

Reads user/profile data of web browsers

Loads dropped DLL

Looks up external IP address via web service

Suspicious use of SetThreadContext

Enumerates physical storage devices

Program crash

Command and Scripting Interpreter: JavaScript

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Scheduled Task/Job: Scheduled Task

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-06-20 01:33

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-20 01:33

Reported

2024-06-20 01:36

Platform

win7-20240220-en

Max time kernel

118s

Max time network

145s

Command Line

wscript.exe C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.js

Signatures

AgentTesla

keylogger trojan stealer spyware agenttesla

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

StormKitty

stealer stormkitty

StormKitty payload

Description Indicator Process Target
N/A N/A N/A N/A

Xworm

trojan rat xworm

Detect packed .NET executables. Mostly AgentTeslaV4.

Description Indicator Process Target
N/A N/A N/A N/A

Detects Windows executables referencing non-Windows User-Agents

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables packed with SmartAssembly

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables referencing Windows vault credential objects. Observed in infostealers

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables referencing credit card regular expressions

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables referencing many email and collaboration clients. Observed in information stealers

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables referencing many file transfer clients. Observed in information stealers

Description Indicator Process Target
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe N/A

Reads WinSCP keys stored on the system

spyware stealer

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2096 set thread context of 1244 N/A C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe

Command and Scripting Interpreter: JavaScript

execution

Enumerates physical storage devices

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1656 wrote to memory of 2096 N/A C:\Windows\system32\wscript.exe C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe
PID 1656 wrote to memory of 2096 N/A C:\Windows\system32\wscript.exe C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe
PID 1656 wrote to memory of 2096 N/A C:\Windows\system32\wscript.exe C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe
PID 1656 wrote to memory of 2096 N/A C:\Windows\system32\wscript.exe C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe
PID 2096 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2096 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2096 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2096 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2096 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2096 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2096 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2096 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2096 wrote to memory of 2420 N/A C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe C:\Windows\SysWOW64\schtasks.exe
PID 2096 wrote to memory of 2420 N/A C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe C:\Windows\SysWOW64\schtasks.exe
PID 2096 wrote to memory of 2420 N/A C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe C:\Windows\SysWOW64\schtasks.exe
PID 2096 wrote to memory of 2420 N/A C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe C:\Windows\SysWOW64\schtasks.exe
PID 2096 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe
PID 2096 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe
PID 2096 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe
PID 2096 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe
PID 2096 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe
PID 2096 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe
PID 2096 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe
PID 2096 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe
PID 2096 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe

Processes

C:\Windows\system32\wscript.exe

wscript.exe C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.js

C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe

"C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\hmpDqhdDQk.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hmpDqhdDQk" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6558.tmp"

C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe

"C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe"

Network

Country Destination Domain Proto
US 107.175.101.198:7000 tcp
US 8.8.8.8:53 api.ipify.org udp
US 104.26.13.205:443 api.ipify.org tcp
US 107.175.101.198:7000 tcp

Files

C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe

MD5 22269c9e26e7aa5d4168bb2b7acad1b3
SHA1 9c18f20bceeeb671f745458b4bf4f8d217a84173
SHA256 0ca04624018e1b0234ad520ab681fc7357f5dc1b537f860fc9a4849b4c207b11
SHA512 a3c0a97eed520fb5bd6578b48bf8992fd62ae913eb5b3940423800a2f913614b5c7eb39d0fd038f4edd98aa5512a16dabcc5f8c601ac93260af8d91dd9350e17

memory/2096-6-0x00000000742CE000-0x00000000742CF000-memory.dmp

memory/2096-7-0x0000000000E30000-0x0000000000EA2000-memory.dmp

memory/2096-8-0x00000000742C0000-0x00000000749AE000-memory.dmp

memory/2096-9-0x00000000003D0000-0x00000000003E2000-memory.dmp

memory/2096-10-0x0000000000500000-0x0000000000508000-memory.dmp

memory/2096-11-0x0000000000510000-0x000000000051C000-memory.dmp

memory/2096-12-0x0000000004A80000-0x0000000004AD0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp6558.tmp

MD5 05eca6adeaef46388f35bda66f90a6cf
SHA1 4d6682d6060849c94c1ffb6cefe91adf7cabd01a
SHA256 e7440bc64eaec1eeaa4c83001c44fa61fc97e9a16065d000d36fd4cf092785ad
SHA512 49f21597df0c5b6fd203b5fbbd468295da69de73e065a33a9ac8d08912c6bd3b912f8e723c72dcae996406ef0f4b40821a3b845ce1791ad1a8bef29f8fd65d9f

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 8b46a8d8aa6b6663184a6b8316ac4ee8
SHA1 e0e57f9eb8090a04bf86ca75310743930b1ca75c
SHA256 ad3f94fc87e6204e8976c35c74ba7d0caeb549eb618d804f178303b8f0fc3cd0
SHA512 8e16f08c70a166a35a1b6faae7b6befad38b243cd34b40682c5f1115b1b1beee3c80b8d8a7fa050c1ffea6f279fd51d409e3569b48eec166e8a150adda5a34e2

memory/1244-26-0x0000000000400000-0x000000000040E000-memory.dmp

memory/1244-35-0x0000000000400000-0x000000000040E000-memory.dmp

memory/1244-34-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1244-32-0x0000000000400000-0x000000000040E000-memory.dmp

memory/1244-30-0x0000000000400000-0x000000000040E000-memory.dmp

memory/1244-28-0x0000000000400000-0x000000000040E000-memory.dmp

memory/1244-37-0x0000000000400000-0x000000000040E000-memory.dmp

memory/1244-38-0x0000000000400000-0x000000000040E000-memory.dmp

memory/2096-39-0x00000000742C0000-0x00000000749AE000-memory.dmp

memory/1244-40-0x0000000000590000-0x00000000005D2000-memory.dmp

memory/1244-41-0x0000000006F20000-0x0000000007040000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-20 01:33

Reported

2024-06-20 01:36

Platform

win10v2004-20240611-en

Max time kernel

150s

Max time network

153s

Command Line

wscript.exe C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.js

Signatures

AgentTesla

keylogger trojan stealer spyware agenttesla

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A

StormKitty

stealer stormkitty

StormKitty payload

Description Indicator Process Target
N/A N/A N/A N/A

Xworm

trojan rat xworm

Detect packed .NET executables. Mostly AgentTeslaV4.

Description Indicator Process Target
N/A N/A N/A N/A

Detects Windows executables referencing non-Windows User-Agents

Description Indicator Process Target
N/A N/A N/A N/A

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables packed with SmartAssembly

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables referencing Windows vault credential objects. Observed in infostealers

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables referencing credit card regular expressions

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables referencing many email and collaboration clients. Observed in information stealers

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables referencing many file transfer clients. Observed in information stealers

Description Indicator Process Target
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation C:\Windows\system32\wscript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe N/A

Reads WinSCP keys stored on the system

spyware stealer

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4260 set thread context of 1248 N/A C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe

Command and Scripting Interpreter: JavaScript

execution

Enumerates physical storage devices

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4172 wrote to memory of 4260 N/A C:\Windows\system32\wscript.exe C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe
PID 4172 wrote to memory of 4260 N/A C:\Windows\system32\wscript.exe C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe
PID 4172 wrote to memory of 4260 N/A C:\Windows\system32\wscript.exe C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe
PID 4260 wrote to memory of 4344 N/A C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4260 wrote to memory of 4344 N/A C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4260 wrote to memory of 4344 N/A C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4260 wrote to memory of 3856 N/A C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4260 wrote to memory of 3856 N/A C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4260 wrote to memory of 3856 N/A C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4260 wrote to memory of 4844 N/A C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe C:\Windows\SysWOW64\schtasks.exe
PID 4260 wrote to memory of 4844 N/A C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe C:\Windows\SysWOW64\schtasks.exe
PID 4260 wrote to memory of 4844 N/A C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe C:\Windows\SysWOW64\schtasks.exe
PID 4260 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe
PID 4260 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe
PID 4260 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe
PID 4260 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe
PID 4260 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe
PID 4260 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe
PID 4260 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe
PID 4260 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe

Processes

C:\Windows\system32\wscript.exe

wscript.exe C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.js

C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe

"C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\hmpDqhdDQk.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hmpDqhdDQk" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8ABB.tmp"

C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe

"C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1248 -ip 1248

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1248 -s 2348

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
BE 2.17.107.105:443 www.bing.com tcp
US 8.8.8.8:53 105.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 107.175.101.198:7000 tcp
US 8.8.8.8:53 198.101.175.107.in-addr.arpa udp
US 8.8.8.8:53 api.ipify.org udp
US 104.26.13.205:443 api.ipify.org tcp
US 8.8.8.8:53 205.13.26.104.in-addr.arpa udp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 107.175.101.198:7000 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
US 8.8.8.8:53 udp

Files

C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe

MD5 22269c9e26e7aa5d4168bb2b7acad1b3
SHA1 9c18f20bceeeb671f745458b4bf4f8d217a84173
SHA256 0ca04624018e1b0234ad520ab681fc7357f5dc1b537f860fc9a4849b4c207b11
SHA512 a3c0a97eed520fb5bd6578b48bf8992fd62ae913eb5b3940423800a2f913614b5c7eb39d0fd038f4edd98aa5512a16dabcc5f8c601ac93260af8d91dd9350e17

memory/4260-11-0x000000007526E000-0x000000007526F000-memory.dmp

memory/4260-12-0x0000000000F00000-0x0000000000F72000-memory.dmp

memory/4260-13-0x0000000005E10000-0x00000000063B4000-memory.dmp

memory/4260-14-0x0000000005960000-0x00000000059F2000-memory.dmp

memory/4260-16-0x0000000075260000-0x0000000075A10000-memory.dmp

memory/4260-15-0x0000000005B20000-0x0000000005B2A000-memory.dmp

memory/4260-17-0x0000000005BD0000-0x0000000005C6C000-memory.dmp

memory/4260-18-0x0000000005CA0000-0x0000000005CB2000-memory.dmp

memory/4260-19-0x0000000005DE0000-0x0000000005DE8000-memory.dmp

memory/4260-20-0x0000000005DF0000-0x0000000005DFC000-memory.dmp

memory/4260-21-0x0000000006C30000-0x0000000006C80000-memory.dmp

memory/4344-26-0x00000000028D0000-0x0000000002906000-memory.dmp

memory/4344-27-0x00000000055E0000-0x0000000005C08000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp8ABB.tmp

MD5 cb26f6eae7c55a6c6c0aab0d9be93eea
SHA1 08688468fd48b1953d3319d25128c802f50ea957
SHA256 2dd937b757cca8ea5ae01a5f25c8e714e324d9ed8c96e82e669d367b8e737cda
SHA512 53f9ead4e2d2402ad319cb11131dc5446616ee1c6007df41a40abcb14f757a255cfcfc644fe9dffe25a984f0662141e8820ff7c0ffc50901307b8b3b5742c01e

memory/3856-29-0x0000000004C20000-0x0000000004C42000-memory.dmp

memory/4260-32-0x000000007526E000-0x000000007526F000-memory.dmp

memory/1248-33-0x0000000000400000-0x000000000040E000-memory.dmp

memory/3856-35-0x0000000005600000-0x0000000005954000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iqixrk0n.upz.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3856-31-0x0000000005490000-0x00000000054F6000-memory.dmp

memory/3856-30-0x00000000053B0000-0x0000000005416000-memory.dmp

memory/4260-55-0x0000000075260000-0x0000000075A10000-memory.dmp

memory/4344-56-0x00000000061E0000-0x00000000061FE000-memory.dmp

memory/3856-57-0x0000000005C70000-0x0000000005CBC000-memory.dmp

memory/3856-58-0x0000000006B80000-0x0000000006BB2000-memory.dmp

memory/4344-60-0x0000000075AF0000-0x0000000075B3C000-memory.dmp

memory/3856-59-0x0000000075AF0000-0x0000000075B3C000-memory.dmp

memory/4344-79-0x0000000006780000-0x000000000679E000-memory.dmp

memory/3856-80-0x0000000006DC0000-0x0000000006E63000-memory.dmp

memory/4344-81-0x0000000007B50000-0x00000000081CA000-memory.dmp

memory/3856-82-0x0000000006F00000-0x0000000006F1A000-memory.dmp

memory/4344-83-0x0000000007570000-0x000000000757A000-memory.dmp

memory/3856-84-0x0000000007180000-0x0000000007216000-memory.dmp

memory/3856-85-0x0000000007100000-0x0000000007111000-memory.dmp

memory/4344-86-0x0000000007730000-0x000000000773E000-memory.dmp

memory/4344-87-0x0000000007740000-0x0000000007754000-memory.dmp

memory/4344-88-0x0000000007840000-0x000000000785A000-memory.dmp

memory/4344-89-0x0000000007820000-0x0000000007828000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 44f2eb864abd8a2b65b56ba2b2716c8a
SHA1 0051989bdb0cff381eef3d5d5256bf799a000afe
SHA256 08122b3a42975f974398ebcb61035e523a2ff91582760b0ba1d8f7c71cc98ed9
SHA512 306b82cb90c9f00900b0e70c10320f88831c9a289e100fa72be4b9fbdd27cfb76fb74ad14cf7c267c4099751f97f8608b842df5018fdb52ae785c0e71afff7d2

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

memory/1248-95-0x00000000062F0000-0x0000000006332000-memory.dmp

memory/1248-96-0x0000000007460000-0x00000000074B0000-memory.dmp

memory/1248-97-0x00000000074B0000-0x00000000075D0000-memory.dmp

memory/1248-98-0x00000000075E0000-0x0000000007934000-memory.dmp

memory/1248-99-0x0000000007990000-0x00000000079DC000-memory.dmp