Malware Analysis Report

2024-09-23 02:55

Sample ID 240708-h9s6fa1bjf
Target Montants à justifier_DGFIP45921-2.vbs
SHA256 ea21df3506bd3e847b7d8c8b17ab681431ea616d48fc67e58352bc187fe81f7d
Tags
stormkitty xworm rat stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ea21df3506bd3e847b7d8c8b17ab681431ea616d48fc67e58352bc187fe81f7d

Threat Level: Known bad

The file Montants à justifier_DGFIP45921-2.vbs was found to be: Known bad.

Malicious Activity Summary

stormkitty xworm rat stealer trojan

Detect Xworm Payload

StormKitty payload

Xworm

StormKitty

Drops startup file

Checks computer location settings

Drops file in System32 directory

Suspicious use of SetThreadContext

Program crash

Enumerates physical storage devices

Suspicious use of FindShellTrayWindow

Uses Task Scheduler COM API

Checks processor information in registry

Suspicious use of SendNotifyMessage

Suspicious use of AdjustPrivilegeToken

Enumerates system info in registry

Suspicious use of WriteProcessMemory

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-07-08 07:26

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-08 07:26

Reported

2024-07-08 07:29

Platform

win7-20240705-en

Max time kernel

136s

Max time network

128s

Command Line

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Montants à justifier_DGFIP45921-2.vbs"

Signatures

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2244 wrote to memory of 2604 N/A C:\Windows\system32\taskeng.exe C:\Windows\System32\WScript.exe
PID 2244 wrote to memory of 2604 N/A C:\Windows\system32\taskeng.exe C:\Windows\System32\WScript.exe
PID 2244 wrote to memory of 2604 N/A C:\Windows\system32\taskeng.exe C:\Windows\System32\WScript.exe
PID 2604 wrote to memory of 3028 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2604 wrote to memory of 3028 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2604 wrote to memory of 3028 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 3028 wrote to memory of 2004 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 3028 wrote to memory of 2004 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 3028 wrote to memory of 2004 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 2604 wrote to memory of 2532 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2604 wrote to memory of 2532 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2604 wrote to memory of 2532 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2532 wrote to memory of 1152 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 2532 wrote to memory of 1152 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 2532 wrote to memory of 1152 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 2604 wrote to memory of 1040 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2604 wrote to memory of 1040 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2604 wrote to memory of 1040 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 1040 wrote to memory of 2100 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 1040 wrote to memory of 2100 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 1040 wrote to memory of 2100 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 2604 wrote to memory of 2128 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2604 wrote to memory of 2128 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2604 wrote to memory of 2128 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2128 wrote to memory of 2224 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 2128 wrote to memory of 2224 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 2128 wrote to memory of 2224 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 2604 wrote to memory of 1460 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2604 wrote to memory of 1460 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2604 wrote to memory of 1460 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 1460 wrote to memory of 2096 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 1460 wrote to memory of 2096 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 1460 wrote to memory of 2096 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 2604 wrote to memory of 848 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2604 wrote to memory of 848 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2604 wrote to memory of 848 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 848 wrote to memory of 928 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 848 wrote to memory of 928 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 848 wrote to memory of 928 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Montants à justifier_DGFIP45921-2.vbs"

C:\Windows\system32\taskeng.exe

taskeng.exe {94508DEB-5B4F-4C97-8A4E-D93252C87668} S-1-5-21-3502430532-24693940-2469786940-1000:PSBQWFYT\Admin:Interactive:[1]

C:\Windows\System32\WScript.exe

C:\Windows\System32\WScript.exe "C:\Users\Admin\asy3.vbs"

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"

C:\Windows\system32\wermgr.exe

"C:\Windows\system32\wermgr.exe" "-outproc" "3028" "1244"

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"

C:\Windows\system32\wermgr.exe

"C:\Windows\system32\wermgr.exe" "-outproc" "2532" "1240"

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"

C:\Windows\system32\wermgr.exe

"C:\Windows\system32\wermgr.exe" "-outproc" "1040" "1248"

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"

C:\Windows\system32\wermgr.exe

"C:\Windows\system32\wermgr.exe" "-outproc" "2128" "1244"

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"

C:\Windows\system32\wermgr.exe

"C:\Windows\system32\wermgr.exe" "-outproc" "1460" "1244"

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"

C:\Windows\system32\wermgr.exe

"C:\Windows\system32\wermgr.exe" "-outproc" "848" "1248"

Network

N/A

Files

C:\Users\Admin\asy3.vbs

MD5 ecd56d423345d25d32d6894da7ea9a41
SHA1 fa194094d6f86b76b9ea51cbee26ea2bd93d8852
SHA256 01d5fd9a203634b7d45a547cdf72a1edcd601340f37892c324b5f842b22c7b73
SHA512 a6d4550a2bd57be7cd3b50754d2826a100a844553e2a4308366cdd442250989971635d3847add663ec307981e8566f9bd823dece00fac48d085f60336bf5d355

memory/3028-6-0x000000001B4B0000-0x000000001B792000-memory.dmp

memory/3028-7-0x0000000002790000-0x0000000002798000-memory.dmp

memory/3028-8-0x000000001BC40000-0x000000001BC4A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\OutofProcReport259527873.txt

MD5 ccd048ed9e30d88d32140cb383408396
SHA1 6b7915d8a4e56223898864239f5a81a08ee8887e
SHA256 0bc16af53b483430363c9b1a8822696293ab162b5ad060a1bbfa3931598a943d
SHA512 7dd31d57d9ffa2060962f8f76ae027b99f0e2de85684602aa2f6b471265f826fda2179e55cf88dc8e4f53e39153e72d7690eeddf4daa0cafdf18980c27b68faa

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 35f1d0ed0dd5b3c416e5090c6e758a4d
SHA1 974a485c81fac889a6fa32e4a28c1ce9b6e416a8
SHA256 773a930d69b3d4340ebc75556b642bff99e4c3379e2a7d3f5045a0f77f5be730
SHA512 a6fd8ccd92562156d4b8aba1260a0103903364012253019cfa6783194956df28f213722e93879da74cc249f702e3f1bd5ac7fd3fcf9c276abfb68a7c0674ac1a

memory/2532-16-0x000000001B680000-0x000000001B962000-memory.dmp

memory/2532-17-0x0000000001E70000-0x0000000001E78000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\OutofProcReport259543531.txt

MD5 2d1035545767b94823f5b24a440b64b5
SHA1 563d66a57174c4126bc7ae7914fc8a6f0a8554aa
SHA256 0f53ed6bf87c3b8bbb4d2306fca077cb2e0210ec1e038595b997ade265b16ad9
SHA512 a339e1c5b70bd3d542434021e9b2af7e51dfab4e6c4b0e80e6b7b3b1063bff13c3e54a143a10c28e2d2a0c4d80dd2a0a8ca39abab00d8184b0c8ca6513d0ebfc

C:\Users\Admin\AppData\Local\Temp\OutofProcReport259561431.txt

MD5 d82137246ca155fe5b412296dc1375d6
SHA1 ca8bf95afdbaab16f02cfc4c1c934134bbbda5f0
SHA256 b556fbb50a9c60ea443547cc091199c21a800fb3d7d0ba424c3fddd071f53a5d
SHA512 de3d60a03d176612d60998bc6d6ce5a0dfda77841a46bdf50774da6df61b8dead3b796134ceb6b24b69f87bc36eb1162e4b9eb94b43e2a71272938a5ee7eceaa

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Temp\OutofProcReport259573380.txt

MD5 c322d0b401cc4ec07f8583b34210d9c6
SHA1 0befbf3efb13b45edff5e189dddd64ac6e975d85
SHA256 b9e72582cabc62266921ed3841cf398460a183758358fb0ed87a3ca867ca859f
SHA512 3d5c5d44f92e3cf3697dc75995ce55233256ffd44ffce73448b6c28ee8cd4be260eeadbc3d6644011103f2570e859cda5c2b5f3865a658eb90f5b8db5f3e31aa

C:\Users\Admin\AppData\Local\Temp\OutofProcReport259592185.txt

MD5 9fd99be1efbb5e37f0de4c7c1254a9ed
SHA1 928e749439840bbe9b9ab9ec4b1423acff77a0e8
SHA256 0d54a6ddd5e9c6273dabb5ae7be43d2bb57d317ffcc548a17845a3a082f07d2f
SHA512 4e431f5988d9f4e0ce9145c6de0cc91a0a70d446e1278d533fb8b29e462da4e95fc30f70befd8ef53edc43b94c4c6588a887e67c97c4d8d7b1eba0263b8d1be8

C:\Users\Admin\AppData\Local\Temp\OutofProcReport259605970.txt

MD5 94cec913d4a22658af81c6380169ec34
SHA1 0a39121204068fceb14f05605658838e614c5fbc
SHA256 961b5b157e01ff91bfb86f12bdd84e7b22c7d47d92f1c72219aae85eb657739f
SHA512 768f53e6b441e5552e4818c41ef0f81fc7b3955d71eb5a0385b6292bc4aeea11a2c239d4300b89a60b69b470b2b665825f2d2fff2ec0c898ef6b32f1908eee80

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-08 07:26

Reported

2024-07-08 07:29

Platform

win10v2004-20240704-en

Max time kernel

146s

Max time network

154s

Command Line

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Montants à justifier_DGFIP45921-2.vbs"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

StormKitty

stealer stormkitty

StormKitty payload

Description Indicator Process Target
N/A N/A N/A N/A

Xworm

trojan rat xworm

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\Control Panel\International\Geo\Nation C:\Windows\System32\WScript.exe N/A

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Notepad++.lnk C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Notepad++.lnk C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Notepad++.lnk C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\System32\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\System32\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Windows\system32\wermgr.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\wermgr.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Windows\system32\wermgr.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\wermgr.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\wermgr.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Windows\system32\wermgr.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\wermgr.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\wermgr.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\wermgr.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\system32\wermgr.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\system32\wermgr.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\system32\wermgr.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\system32\wermgr.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\system32\wermgr.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\system32\wermgr.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4988 wrote to memory of 4288 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 4988 wrote to memory of 4288 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 4288 wrote to memory of 4844 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 4288 wrote to memory of 4844 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 4288 wrote to memory of 4844 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 4288 wrote to memory of 4844 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 4288 wrote to memory of 4844 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 4288 wrote to memory of 4844 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 4288 wrote to memory of 4844 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 4288 wrote to memory of 4844 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 4288 wrote to memory of 2448 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 4288 wrote to memory of 2448 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 4988 wrote to memory of 3508 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 4988 wrote to memory of 3508 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 4988 wrote to memory of 3720 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 4988 wrote to memory of 3720 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 3508 wrote to memory of 1776 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 3508 wrote to memory of 1776 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 3508 wrote to memory of 1776 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 3508 wrote to memory of 1776 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 3508 wrote to memory of 1776 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 3508 wrote to memory of 1776 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 3508 wrote to memory of 1776 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 3508 wrote to memory of 1776 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 3508 wrote to memory of 2712 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 3508 wrote to memory of 2712 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 3720 wrote to memory of 4656 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 3720 wrote to memory of 4656 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Montants à justifier_DGFIP45921-2.vbs"

C:\Windows\System32\WScript.exe

C:\Windows\System32\WScript.exe "C:\Users\Admin\asy3.vbs"

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"

C:\Windows\system32\wermgr.exe

"C:\Windows\system32\wermgr.exe" "-outproc" "0" "4288" "2856" "2808" "2860" "0" "0" "2864" "0" "0" "0" "0" "0"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4844 -ip 4844

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 2076

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"

C:\Program Files\VideoLAN\VLC\vlc.exe

"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\SyncGroup.WTV"

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"

C:\Windows\system32\wermgr.exe

"C:\Windows\system32\wermgr.exe" "-outproc" "0" "3508" "2896" "2832" "2900" "0" "0" "2904" "0" "0" "0" "0" "0"

C:\Windows\system32\wermgr.exe

"C:\Windows\system32\wermgr.exe" "-outproc" "0" "3720" "2732" "2664" "2736" "0" "0" "2740" "0" "0" "0" "0" "0"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 fudisa.com udp
FR 194.59.31.74:58538 fudisa.com tcp
US 8.8.8.8:53 74.31.59.194.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 40.140.123.92.in-addr.arpa udp
US 8.8.8.8:53 25.140.123.92.in-addr.arpa udp
FR 194.59.31.74:58538 fudisa.com tcp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp

Files

C:\Users\Admin\asy3.vbs

MD5 ecd56d423345d25d32d6894da7ea9a41
SHA1 fa194094d6f86b76b9ea51cbee26ea2bd93d8852
SHA256 01d5fd9a203634b7d45a547cdf72a1edcd601340f37892c324b5f842b22c7b73
SHA512 a6d4550a2bd57be7cd3b50754d2826a100a844553e2a4308366cdd442250989971635d3847add663ec307981e8566f9bd823dece00fac48d085f60336bf5d355

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_n4jyxiap.doi.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4288-13-0x00000144DC310000-0x00000144DC332000-memory.dmp

memory/4288-14-0x00000144F45C0000-0x00000144F4604000-memory.dmp

memory/4288-15-0x00000144F6A80000-0x00000144F6AF6000-memory.dmp

memory/4288-17-0x00000144F4590000-0x00000144F459A000-memory.dmp

memory/4288-18-0x00000144F45A0000-0x00000144F45AC000-memory.dmp

memory/4844-19-0x0000000000400000-0x0000000000418000-memory.dmp

memory/4844-29-0x0000000004F40000-0x0000000004FDC000-memory.dmp

memory/4844-34-0x0000000005BC0000-0x0000000006164000-memory.dmp

memory/4844-35-0x0000000006170000-0x0000000006202000-memory.dmp

memory/4844-36-0x0000000005B80000-0x0000000005B8A000-memory.dmp

memory/4844-37-0x0000000006390000-0x00000000063F6000-memory.dmp

memory/4844-38-0x0000000006CA0000-0x0000000006CAE000-memory.dmp

memory/4844-39-0x0000000006F40000-0x000000000705E000-memory.dmp

memory/4844-40-0x00000000070A0000-0x00000000073F4000-memory.dmp

memory/4844-41-0x0000000007450000-0x000000000749C000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 51b6b5772463397d63ca4103059da273
SHA1 9132c9060451b53026c7a7251c6f0174c1713431
SHA256 42884de82210451b270eec56549ab25d3a52c6fa359ce0f9107a09a9e20d3e16
SHA512 cd8f1aa8d2306ed5d90a16333393f41716b150ffb72a6b13d3b09b11b8dcd08a7e22d55e1f1f4364772c9055d23374d70327412de6eab999d76ba6af04696161

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 44f31555e27c0c27eee96bc36427be1e
SHA1 4438013b06676972692576a65b87416bf6118ec8
SHA256 390b019fad0b1a43f02c1aea377f28b2d5d168bd01619aeca51a63a9f0441351
SHA512 849cdaed256213f0acfc8b94741f8f470d7096e3a7197a074a5ed8cc7b99fd9c37eab0647cc294bb1e8d8259a588399845973e1fbdcd1f5c48cb79834a634aee

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 9461a7cfb20ff5381df28f51b80c5ef1
SHA1 c86c53fca1dcbe307dafbefbb366abf52c9f5eca
SHA256 d4af1948337d0deb725f4f2b1fe1a9b60f4519841e28748b11bfd62ccd71e028
SHA512 da1e17f67dfebb004ba93d489be504fd7af6d62709ada2581ffa77880baecdaa0015b49d36333d18216d9dc6aad7b0ea2e5bd224d8d3f65ee9b66a05fc45e304

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 0fa890bcc24627b309591f8d2a692028
SHA1 edba7cfb6fee6860c862d4b384a03cdebe535ee4
SHA256 48b7a3f9b77f9ca8c6e20c9a35dfc8068ad8006f43e6e94c2c46fdb9c35c15c5
SHA512 a34380e2422782a3bab9842424dc41005e4878f735b2aa5d9aa80cbb1a6d4901c50f4022a70fe5232e5e6e9c35f11d6df62908a1b2d1e6a9aa531510430260ac

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

MD5 dc0fc3b1d8dfb2151af683c5fe9128be
SHA1 7ff31e4cc5589bc38031b986f3c54fe94435a265
SHA256 8b5d267bf8af05b8181abe36234fae9b9ce19a06875fc09b62d7b88240e5820a
SHA512 e694e1fcc26bd7899aeaca448fefdf1f283003889d4a6f8673b092e8968b4afdfc1c16d72c5e22da60c16cbebe28477bc71a6efe551b17e9b5948011fd0a7ff2

memory/4632-105-0x00007FF7672B0000-0x00007FF7673A8000-memory.dmp

memory/4632-106-0x00007FFE236F0000-0x00007FFE23724000-memory.dmp

memory/4632-107-0x00007FFE203F0000-0x00007FFE206A6000-memory.dmp

memory/4632-108-0x00007FFE1CF00000-0x00007FFE1DFB0000-memory.dmp

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 158d9d644a4c2f618f9c17b99b854919
SHA1 28a09f90a231daee1cced803ab0588b7bdf5efb4
SHA256 44b65cf1f7624bd22f42b45061a9ea51cc40cd19ff12a39fe1534e752b56fdd2
SHA512 9e54a4f9632d0795b42ff124212b7e0979a4daa2b460a69976ca1792eede3c3f7ece2c56cc939a078135402a725646255c019b1c5d24e8a1045f7635ec43816b

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

MD5 a26df49623eff12a70a93f649776dab7
SHA1 efb53bd0df3ac34bd119adf8788127ad57e53803
SHA256 4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245
SHA512 e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 2fa26d61362615b1d082cd7f47b0b7b9
SHA1 fdeaf9aa10db2844ef9a13f05996e680ffc7e4af
SHA256 c2d8dc5712917d6d545e3ce189ddd6beae5355de06a29e1728c1073718783ae5
SHA512 f9a56f6da4651782eecc5b01153b00d58cd571fa980f95b1a93b3647a8ea717430112cd93877b2ca0c5a816e924c5dfe0ce7235d82433998e72aa0413890fdee

C:\Users\Admin\AppData\Roaming\Notepad++.exe

MD5 9827ff3cdf4b83f9c86354606736ca9c
SHA1 e73d73f42bb2a310f03eb1bcbb22be2b8eb7c723
SHA256 c1cf3dc8fa1c7fc00f88e07ad539979b3706ca8d69223cffd1d58bc8f521f63a
SHA512 8261828d55f3b5134c0aeb98311c04e20c5395d4347251746f3be0fb854f36cc7e118713cd00c9867537e6e47d5e71f2b2384fc00c67f0ae1b285b8310321579

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Notepad++.lnk

MD5 585b1c86e73cef9b2bcf9103c32ab3e5
SHA1 e7c3dc09a1db6a438ba93e66de583cf8cda00c64
SHA256 c742a748d3145e958620cadaf3dd07ca5e2874722838b3f48316ac447b8d1838
SHA512 ce57b55b7f2e7bcb223cd3e59d1f6a98f1afabbba52a3f44172495db345a1fba8592e79154f710e9e74878c79fb1cada94d0c746a48b1afad2b19e2e8436c3de