Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11-11-2024 13:26
Static task
static1
Behavioral task
behavioral1
Sample
Ref#130709.vbe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Ref#130709.vbe
Resource
win10v2004-20241007-en
General
-
Target
Ref#130709.vbe
-
Size
10KB
-
MD5
cf567f1369e0a7b9d18a06ef67df6877
-
SHA1
e007346258255d739beeefc52346a239f8818c5c
-
SHA256
b7afcdd36c30b9be80b532b7f9510a50eedef13d26f88385bb94a7e31ea061d6
-
SHA512
419f209fa202c6e1cd0b558f7a8277a43408c19a14e76dbd31d70a8b2e9c522217fe2edda1bdb4e6fae7af96b9a53c1893bc260053fdfc65e3a60c8423be9d97
-
SSDEEP
192:v9iw0wLDaKbUcQKbwXDHo3EvWzm9/1q25cBMRPjvA5MGVK:H0wLuKbUcQewWzs/c2Wa+8
Malware Config
Extracted
Protocol: smtp- Host:
zulpine.shop - Port:
587 - Username:
[email protected] - Password:
dkA6kDAnLHNg
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
WScript.exeflow pid Process 1 3760 WScript.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WScript.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation WScript.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
MSBuild.exedescription ioc Process Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 44 checkip.dyndns.org -
Drops file in System32 directory 2 IoCs
Processes:
powershell.exepowershell.exedescription ioc Process File opened for modification C:\Windows\System32\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid Process procid_target PID 4324 set thread context of 3964 4324 powershell.exe 112 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
MSBuild.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSBuild.exe -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
wermgr.exewermgr.exedescription ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 wermgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz wermgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString wermgr.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 wermgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz wermgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString wermgr.exe -
Enumerates system info in registry 2 TTPs 4 IoCs
Processes:
wermgr.exewermgr.exedescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU wermgr.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS wermgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU wermgr.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS wermgr.exe -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 1 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
vlc.exepid Process 3856 vlc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exepowershell.exeMSBuild.exepid Process 4324 powershell.exe 4324 powershell.exe 1372 powershell.exe 1372 powershell.exe 4324 powershell.exe 3964 MSBuild.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
vlc.exepid Process 3856 vlc.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exepowershell.exeMSBuild.exedescription pid Process Token: SeDebugPrivilege 4324 powershell.exe Token: SeDebugPrivilege 1372 powershell.exe Token: SeDebugPrivilege 3964 MSBuild.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
vlc.exepid Process 3856 vlc.exe 3856 vlc.exe 3856 vlc.exe -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
vlc.exepid Process 3856 vlc.exe 3856 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
vlc.exepid Process 3856 vlc.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
WScript.exepowershell.exepowershell.exedescription pid Process procid_target PID 3552 wrote to memory of 4324 3552 WScript.exe 102 PID 3552 wrote to memory of 4324 3552 WScript.exe 102 PID 3552 wrote to memory of 1372 3552 WScript.exe 110 PID 3552 wrote to memory of 1372 3552 WScript.exe 110 PID 4324 wrote to memory of 3964 4324 powershell.exe 112 PID 4324 wrote to memory of 3964 4324 powershell.exe 112 PID 4324 wrote to memory of 3964 4324 powershell.exe 112 PID 4324 wrote to memory of 3964 4324 powershell.exe 112 PID 4324 wrote to memory of 3964 4324 powershell.exe 112 PID 4324 wrote to memory of 3964 4324 powershell.exe 112 PID 4324 wrote to memory of 3964 4324 powershell.exe 112 PID 4324 wrote to memory of 3964 4324 powershell.exe 112 PID 1372 wrote to memory of 1560 1372 powershell.exe 113 PID 1372 wrote to memory of 1560 1372 powershell.exe 113 PID 4324 wrote to memory of 2140 4324 powershell.exe 114 PID 4324 wrote to memory of 2140 4324 powershell.exe 114 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
outlook_office_path 1 IoCs
Processes:
MSBuild.exedescription ioc Process Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
outlook_win_path 1 IoCs
Processes:
MSBuild.exedescription ioc Process Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Ref#130709.vbe"1⤵
- Blocklisted process makes network request
PID:3760
-
C:\Windows\System32\WScript.exeC:\Windows\System32\WScript.exe "C:\Users\Admin\AppData\Roaming\gMBlGsAXoyfBvsA.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"2⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:3964
-
-
C:\Windows\system32\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "4324" "2732" "2672" "2736" "0" "0" "2740" "0" "0" "0" "0" "0"3⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:2140
-
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Windows\system32\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "1372" "2688" "2616" "2692" "0" "0" "2696" "0" "0" "0" "0" "0"3⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:1560
-
-
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\StepBackup.mpeg2"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3856
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD53f01549ee3e4c18244797530b588dad9
SHA13e87863fc06995fe4b741357c68931221d6cc0b9
SHA25636b51e575810b6af6fc5e778ce0f228bc7797cd3224839b00829ca166fa13f9a
SHA51273843215228865a4186ac3709bf2896f0f68da0ba3601cc20226203dd429a2ad9817b904a45f6b0456b8be68deebf3b011742a923ce4a77c0c6f3a155522ab50
-
Filesize
53KB
MD5a26df49623eff12a70a93f649776dab7
SHA1efb53bd0df3ac34bd119adf8788127ad57e53803
SHA2564ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245
SHA512e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c
-
Filesize
3KB
MD56e809f4c18466a0a63db912fb7a2441c
SHA1d88653e1426406c3175c3fee38d55cd94a1ec5b1
SHA2562a684a0f36716559ec3fef1d5cdcd0fa7d48cd59e40457b7adc4d7b1f9a0c9fa
SHA512b47bb55f42d8930277dcab4d3850aba5b1f40b794f07cf1a0858b7280dc8bab243f445c50d2a45fa183c8f664c4864f476d4565c85380fc10cf45fe53d16100c
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize6KB
MD5384261486581198676893b6c8e298989
SHA11a9b410eb919c624a2837a765e86124ec2dcabb4
SHA256a4b357de9a9020506d27502d8fd2f74f203322facbfc3915925043d031e09847
SHA5122340c327763813f11f6ea26f8c7f60daa59663786ecb52e9c6e5f9855a5f346be0a1649716b52761e13160e42314fa4458857e01ccc5517c2a93036097f5b3f1
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize6KB
MD54cbd247111e5a2e7e8785d4e8cc2a608
SHA1732e6cc559513fb1c7f85c58400aeb437fde5649
SHA2561a7310cb18415911d26a1ff4a4d403ac73a7b5c54c0dfd71a27f9db41d628a7e
SHA512f00e4ed727fd8214b418b1e141279beb35109b7ede9e80d01bd6e3d9072f87a574f2c3fcdd2185c0605ed4a881964625e0e428aa97066db57a24045d72762276
-
Filesize
1KB
MD577c5b6fe271fef2a65006abf49b4fe66
SHA1cd279263b404e2e4e2a3fb509da19c9a5f3bdcb3
SHA25678c66f29b0ade0cb644603b4bfc261b630be611ba55b902f090c94058954ec84
SHA512cf18faacf59f75d95ae8cc99555ff51b0e4963f57d12ceaeccdd97808c423713b0a34af4cee18338a44ad474a8d9abae778b1f202a511ad932521e3f0b5de140