Analysis

  • max time kernel
    148s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-09-2024 10:00

General

  • Target

    DOC- 1000290099433.vbe

  • Size

    11KB

  • MD5

    1ba91d56988897f8677cc18f54ac7e13

  • SHA1

    1a51f7b8534c912b18053ac2371907f095128a93

  • SHA256

    7576b26f5b40500a27c4279db479d482fb453e2dbc24d6b8754a07720c19055f

  • SHA512

    192c23958cd6e863ed205e4bbcddfa2915f197e9f9ca8e1cd66d4b7bcb834794c0012456789aef826622ab63cd589336b187c48f422ffca0b0a1094b59967f2f

  • SSDEEP

    192:l7TZ1ZSTlbLJya3RGALtUtNG7YkGEY9CNsRXX1ZAkt0pdzea1iydDcgLK:trITlbz3L5UtNGWEYCNsRXX1tedzL1iJ

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Blocklisted process makes network request 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 9 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 7 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\DOC- 1000290099433.vbe"
    1⤵
    • Blocklisted process makes network request
    PID:464
  • C:\Windows\System32\WScript.exe
    C:\Windows\System32\WScript.exe "C:\Users\Admin\AppData\Roaming\CeKsDwHNOyLUtGz.vbs"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:728
    • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"
      2⤵
      • Drops file in System32 directory
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2972
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3480
      • C:\Windows\system32\wermgr.exe
        "C:\Windows\system32\wermgr.exe" "-outproc" "0" "2972" "2728" "2668" "2732" "0" "0" "2736" "0" "0" "0" "0" "0"
        3⤵
        • Checks processor information in registry
        • Enumerates system info in registry
        PID:2464
    • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"
      2⤵
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4424
      • C:\Windows\system32\wermgr.exe
        "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4424" "2680" "2616" "2684" "0" "0" "2688" "0" "0" "0" "0" "0"
        3⤵
        • Checks processor information in registry
        • Enumerates system info in registry
        PID:4744
  • C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /n "C:\Users\Admin\Desktop\StartRestore.potx"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:3240

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Microsoft\Windows\WER\Temp\WERF3A8.tmp.xml

    Filesize

    4KB

    MD5

    6bb3cc91ff3e5f3fd06bc718bc69c57b

    SHA1

    4d39ee959575f1cdb4055f9e48f4df3d33ed3891

    SHA256

    7adce4723e0c6a6a74f8f639c61d2a580eec5ec826e42a750bb39af449224d09

    SHA512

    41ff279be7f093ade4a2cbc5272cf881cd672ce11ea79781908a35de8110c0ae8342c98a08d410111fa381c79776fbebdd0f9b1b012da0627dcaaeeb8ab0d5a4

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

    Filesize

    3KB

    MD5

    9461a7cfb20ff5381df28f51b80c5ef1

    SHA1

    c86c53fca1dcbe307dafbefbb366abf52c9f5eca

    SHA256

    d4af1948337d0deb725f4f2b1fe1a9b60f4519841e28748b11bfd62ccd71e028

    SHA512

    da1e17f67dfebb004ba93d489be504fd7af6d62709ada2581ffa77880baecdaa0015b49d36333d18216d9dc6aad7b0ea2e5bd224d8d3f65ee9b66a05fc45e304

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

    Filesize

    53KB

    MD5

    a26df49623eff12a70a93f649776dab7

    SHA1

    efb53bd0df3ac34bd119adf8788127ad57e53803

    SHA256

    4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245

    SHA512

    e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

    Filesize

    2KB

    MD5

    2b30242fe3de4d9edb43c28f08031166

    SHA1

    3dec76d6059bc908c3c1afe3c6512bb9b2884466

    SHA256

    176626b849aae53dfff8e6577e14ce326ef446cb4ef95fc7aade9b6e2444345a

    SHA512

    9891c05741744099c40dd66f951e963fe762e3d241a43f338bc805df81727fc0728c0f257a229f7c5a79d713832cd933488eb6740cb17e29630a53b4753b4240

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fxddiada.jni.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Roaming\CeKsDwHNOyLUtGz.vbs

    Filesize

    2KB

    MD5

    5df9cc7a167a8711770e63f29cc69d16

    SHA1

    312cc26407eada041f5310a62fd73b99fd03a240

    SHA256

    ec8a7ee52bf19d91f02f739f67f186a17730ca0bedab940b0b5f75973375a6cf

    SHA512

    bb7298e112011387cd7f65bd048fecdeb71104963586b423daf271bdfa4809b9b9f113680b9ce177f6139b63e19b805edd827d026cee9a219e442f00d50ad235

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

    Filesize

    6KB

    MD5

    33b173b024be5338914126dbcae0b4ae

    SHA1

    f65f21adc423357ab991ec6421733d8460b257ec

    SHA256

    895ebc76d2904a428d711e181ff2a2f527a603baccb04151f69ba7b6ca92d893

    SHA512

    f43ae1d66d380ab22e90ef05c6ada50a23bb9c716824637e53cf1adecdef34d09fc3d6f44e1bf54daed7e1db1663909a3de821fe34b860c19483a1c157cc08e1

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

    Filesize

    6KB

    MD5

    69fdbaa96a4e3becd99c5249678836ae

    SHA1

    0e086ab6c8702ae930882e9fc0ac350ac66f5910

    SHA256

    1fbcb7b9ca405eff94ccded906d3ef1ab1bbf4cb483be9de24bfcba6b33707b0

    SHA512

    e5b16dbab1bd31b0d78656ce4ae0fd7b6dcbd84ef6dc85253d3c7f13bef345af1ba959035f808f27f197f84b11b1f631f749401fb54ab1323e63c71d3bfa152b

  • memory/2972-14-0x000002612C880000-0x000002612C8C4000-memory.dmp

    Filesize

    272KB

  • memory/2972-67-0x0000026112330000-0x000002611233A000-memory.dmp

    Filesize

    40KB

  • memory/2972-68-0x000002612C850000-0x000002612C85A000-memory.dmp

    Filesize

    40KB

  • memory/2972-15-0x000002612C950000-0x000002612C9C6000-memory.dmp

    Filesize

    472KB

  • memory/2972-6-0x000002612C3C0000-0x000002612C3E2000-memory.dmp

    Filesize

    136KB

  • memory/3240-48-0x00007FF9B2BD0000-0x00007FF9B2BE0000-memory.dmp

    Filesize

    64KB

  • memory/3240-18-0x00007FF9B2BD0000-0x00007FF9B2BE0000-memory.dmp

    Filesize

    64KB

  • memory/3240-45-0x00007FF9B2BD0000-0x00007FF9B2BE0000-memory.dmp

    Filesize

    64KB

  • memory/3240-47-0x00007FF9B2BD0000-0x00007FF9B2BE0000-memory.dmp

    Filesize

    64KB

  • memory/3240-22-0x00007FF9B03D0000-0x00007FF9B03E0000-memory.dmp

    Filesize

    64KB

  • memory/3240-21-0x00007FF9B03D0000-0x00007FF9B03E0000-memory.dmp

    Filesize

    64KB

  • memory/3240-20-0x00007FF9B2BD0000-0x00007FF9B2BE0000-memory.dmp

    Filesize

    64KB

  • memory/3240-17-0x00007FF9B2BD0000-0x00007FF9B2BE0000-memory.dmp

    Filesize

    64KB

  • memory/3240-16-0x00007FF9B2BD0000-0x00007FF9B2BE0000-memory.dmp

    Filesize

    64KB

  • memory/3240-46-0x00007FF9B2BD0000-0x00007FF9B2BE0000-memory.dmp

    Filesize

    64KB

  • memory/3240-19-0x00007FF9B2BD0000-0x00007FF9B2BE0000-memory.dmp

    Filesize

    64KB

  • memory/3480-69-0x0000000000560000-0x00000000005A0000-memory.dmp

    Filesize

    256KB

  • memory/3480-88-0x0000000005130000-0x00000000056D4000-memory.dmp

    Filesize

    5.6MB

  • memory/3480-89-0x0000000004A50000-0x0000000004AB6000-memory.dmp

    Filesize

    408KB

  • memory/3480-90-0x0000000005FD0000-0x0000000006020000-memory.dmp

    Filesize

    320KB

  • memory/3480-91-0x00000000060C0000-0x0000000006152000-memory.dmp

    Filesize

    584KB

  • memory/3480-92-0x0000000006040000-0x000000000604A000-memory.dmp

    Filesize

    40KB