Malware Analysis Report

2024-12-01 03:12

Sample ID 241111-qphg7syngv
Target Ref#130709.vbe
SHA256 b7afcdd36c30b9be80b532b7f9510a50eedef13d26f88385bb94a7e31ea061d6
Tags
collection discovery
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b7afcdd36c30b9be80b532b7f9510a50eedef13d26f88385bb94a7e31ea061d6

Threat Level: Known bad

The file Ref#130709.vbe was found to be: Known bad.

Malicious Activity Summary

collection discovery

Blocklisted process makes network request

Checks computer location settings

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Drops file in System32 directory

Suspicious use of SetThreadContext

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetWindowsHookEx

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

outlook_office_path

Suspicious use of SendNotifyMessage

outlook_win_path

Uses Task Scheduler COM API

Script User-Agent

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: AddClipboardFormatListener

Enumerates system info in registry

Checks processor information in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-11 13:26

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-11 13:26

Reported

2024-11-11 13:28

Platform

win7-20240903-en

Max time kernel

146s

Max time network

118s

Command Line

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Ref#130709.vbe"

Signatures

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\System32\WScript.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A

Enumerates physical storage devices

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2680 wrote to memory of 2572 N/A C:\Windows\system32\taskeng.exe C:\Windows\System32\WScript.exe
PID 2680 wrote to memory of 2572 N/A C:\Windows\system32\taskeng.exe C:\Windows\System32\WScript.exe
PID 2680 wrote to memory of 2572 N/A C:\Windows\system32\taskeng.exe C:\Windows\System32\WScript.exe
PID 2572 wrote to memory of 2756 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2572 wrote to memory of 2756 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2572 wrote to memory of 2756 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2756 wrote to memory of 2976 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 2756 wrote to memory of 2976 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 2756 wrote to memory of 2976 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 2572 wrote to memory of 272 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2572 wrote to memory of 272 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2572 wrote to memory of 272 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 272 wrote to memory of 1148 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 272 wrote to memory of 1148 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 272 wrote to memory of 1148 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 2572 wrote to memory of 2104 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2572 wrote to memory of 2104 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2572 wrote to memory of 2104 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2104 wrote to memory of 2912 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 2104 wrote to memory of 2912 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 2104 wrote to memory of 2912 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 2572 wrote to memory of 3032 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2572 wrote to memory of 3032 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2572 wrote to memory of 3032 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 3032 wrote to memory of 2472 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 3032 wrote to memory of 2472 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 3032 wrote to memory of 2472 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 2572 wrote to memory of 2892 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2572 wrote to memory of 2892 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2572 wrote to memory of 2892 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2892 wrote to memory of 2288 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 2892 wrote to memory of 2288 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 2892 wrote to memory of 2288 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 2572 wrote to memory of 612 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2572 wrote to memory of 612 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2572 wrote to memory of 612 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 612 wrote to memory of 2172 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 612 wrote to memory of 2172 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 612 wrote to memory of 2172 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 2572 wrote to memory of 1780 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2572 wrote to memory of 1780 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2572 wrote to memory of 1780 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 1780 wrote to memory of 2784 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 1780 wrote to memory of 2784 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 1780 wrote to memory of 2784 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Ref#130709.vbe"

C:\Windows\system32\taskeng.exe

taskeng.exe {5CB1849C-7691-4AD8-8ADF-75A6607870DC} S-1-5-21-1488793075-819845221-1497111674-1000:UPNECVIU\Admin:Interactive:[1]

C:\Windows\System32\WScript.exe

C:\Windows\System32\WScript.exe "C:\Users\Admin\AppData\Roaming\gMBlGsAXoyfBvsA.vbs"

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"

C:\Windows\system32\wermgr.exe

"C:\Windows\system32\wermgr.exe" "-outproc" "2756" "1240"

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"

C:\Windows\system32\wermgr.exe

"C:\Windows\system32\wermgr.exe" "-outproc" "272" "1244"

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"

C:\Windows\system32\wermgr.exe

"C:\Windows\system32\wermgr.exe" "-outproc" "2104" "1236"

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"

C:\Windows\system32\wermgr.exe

"C:\Windows\system32\wermgr.exe" "-outproc" "3032" "1244"

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"

C:\Windows\system32\wermgr.exe

"C:\Windows\system32\wermgr.exe" "-outproc" "2892" "1236"

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"

C:\Windows\system32\wermgr.exe

"C:\Windows\system32\wermgr.exe" "-outproc" "612" "1240"

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"

C:\Windows\system32\wermgr.exe

"C:\Windows\system32\wermgr.exe" "-outproc" "1780" "1244"

Network

Country Destination Domain Proto
DE 144.91.79.54:80 144.91.79.54 tcp

Files

C:\Users\Admin\AppData\Roaming\gMBlGsAXoyfBvsA.vbs

MD5 77c5b6fe271fef2a65006abf49b4fe66
SHA1 cd279263b404e2e4e2a3fb509da19c9a5f3bdcb3
SHA256 78c66f29b0ade0cb644603b4bfc261b630be611ba55b902f090c94058954ec84
SHA512 cf18faacf59f75d95ae8cc99555ff51b0e4963f57d12ceaeccdd97808c423713b0a34af4cee18338a44ad474a8d9abae778b1f202a511ad932521e3f0b5de140

memory/2756-6-0x000000001B570000-0x000000001B852000-memory.dmp

memory/2756-7-0x00000000021D0000-0x00000000021D8000-memory.dmp

memory/2756-8-0x0000000002990000-0x0000000002998000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\OutofProcReport259513092.txt

MD5 71a7a78b46be63b637bccbd6789ffd2c
SHA1 1d192cc17c16de1c951a04d8e38b61409c66255d
SHA256 ff1978b24d1d4d9516ba55633b059d1b0d137fbae1878fd8e943fffa4d6f434c
SHA512 b0e5bb1274d783ecfa16745e77998f8bba629e7b849aad670e90b8a44008968a156a3231ff754fafbadaeeac85c79d8d7a417d39e3debb6421b2b1d16526c483

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 c2770d25bde50dff19da4ce9f075ba77
SHA1 d4af8e5d0967b1ad2e88eb27c86d080c935ea7d7
SHA256 df86c0bd31e73ff1cb15ea8edf6f61cedbdce71e32c1005d59aabdfedbea6535
SHA512 aef85238b128bafaf14d845ebd9b63e8aade8903d74fc1ef20923fc054d1b19ac4573f2af54982aabe045f4e7d2b03807bfb87d3377e1fa081a223d21b5a30a7

memory/272-16-0x000000001B5F0000-0x000000001B8D2000-memory.dmp

memory/272-17-0x0000000002960000-0x0000000002968000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\OutofProcReport259525176.txt

MD5 33786fb2a6be5f6bfee1d64611e005e1
SHA1 8ccf8899b2797d64129d5b2056ef2a628d263d07
SHA256 53534c56c1e8e61fc934284f156e792813d7161a43e2f813d5b0f599976d9ade
SHA512 5acad5e47617445bad8bbc19c06f4d30290017a64aa134777faef33759e8871d7dad923397cc7debfd78c921eeace1d98319b6075b2f288dcfe6581154d00b0e

C:\Users\Admin\AppData\Local\Temp\OutofProcReport259542494.txt

MD5 5eb39ba056aba1eaf37f1e8d94bb8f6e
SHA1 763a13f18e1a015d0132c8ea3fefc1532260b870
SHA256 e02ae2f118f0043118b95010aa5eb60dd3de68a60488f8af2224350602235142
SHA512 508e473b931ed3e4c5d8c2822ab8425ce0be05d7d7c39cc578ec561912fc00585ea644b262672d98e6057cd251417693099cc0e79fbb44cc597dd0218548a104

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Temp\OutofProcReport259558203.txt

MD5 0eafbd4df28e1ad863635628cebb9e53
SHA1 48f230417c87f5f7b419b87e831625e201db6e60
SHA256 77e2ad941bf65f96a19f6411cdc12c41facbf0386fb0f6cfb3c4c149aa8554ce
SHA512 780b4669e16e3d914a3ec8d2e4fe76ea91e4481628626c7d1e9b2bd2d4c1a6cdfc36ffc20d08715537e0243dc42f2b69801374ab18990d97519df3e1694c3b53

C:\Users\Admin\AppData\Local\Temp\OutofProcReport259567772.txt

MD5 7c0dba3905eb74d08548b2d13af41c49
SHA1 8e2a12d94c49d611c8d9f90b2de7065d21eb33a2
SHA256 c502e22281ce9b7fa15de29dc522a0d709f3a2343474a3cb55bfed04c90d6b5c
SHA512 10a3056cbc1d5529fdddfbb6a192e3b9745659bc28a758a48c80435c1512f8a8a6691773b41afc19c2faf1acf8badafc6070d6d9641acb1b17d4c82976447db3

C:\Users\Admin\AppData\Local\Temp\OutofProcReport259585176.txt

MD5 94fd26b0ea30b20ec8728208b489c49a
SHA1 cc79a4dbacc83caa08e2bb28aa0eddd3ddbba83e
SHA256 33886bec34b4df5aaa92a7abd0dd13239168ba49dffb27bb621adede2df6ae8d
SHA512 e28e0517eea5b0862e69fbe9d5e6f2f4933c29840e2f52215c2acec52495832ce0d073e9d5fc2e1457c9a257a6dbde41d9248ebba3123c9e526dccec6b14ac1d

C:\Users\Admin\AppData\Local\Temp\OutofProcReport259602189.txt

MD5 129641204ef54fc3171e62c37a62284f
SHA1 13d54e835883c696a17b571bfb72ec04315ed443
SHA256 f7a40805dfb98d8667da5bb1fc390bc045320faaa21e35e819e0b79d2f49caf3
SHA512 50399639e93d93dc8641f6dee0f500b3a4379fa69d5466688b464819cc294ee392050692df7588337c43488cab628b4deee9bc6ce3c5f739e84961cd91db7bba

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-11 13:26

Reported

2024-11-11 13:28

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

149s

Command Line

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Ref#130709.vbe"

Signatures

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\System32\WScript.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation C:\Windows\System32\WScript.exe N/A

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A checkip.dyndns.org N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\System32\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4324 set thread context of 3964 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Windows\system32\wermgr.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\wermgr.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\wermgr.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Windows\system32\wermgr.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\wermgr.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\wermgr.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\system32\wermgr.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\system32\wermgr.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\system32\wermgr.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\system32\wermgr.exe N/A

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3552 wrote to memory of 4324 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 3552 wrote to memory of 4324 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 3552 wrote to memory of 1372 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 3552 wrote to memory of 1372 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 4324 wrote to memory of 3964 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 4324 wrote to memory of 3964 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 4324 wrote to memory of 3964 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 4324 wrote to memory of 3964 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 4324 wrote to memory of 3964 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 4324 wrote to memory of 3964 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 4324 wrote to memory of 3964 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 4324 wrote to memory of 3964 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 1372 wrote to memory of 1560 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 1372 wrote to memory of 1560 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 4324 wrote to memory of 2140 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 4324 wrote to memory of 2140 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe

Uses Task Scheduler COM API

persistence

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A

Processes

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Ref#130709.vbe"

C:\Windows\System32\WScript.exe

C:\Windows\System32\WScript.exe "C:\Users\Admin\AppData\Roaming\gMBlGsAXoyfBvsA.vbs"

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"

C:\Program Files\VideoLAN\VLC\vlc.exe

"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\StepBackup.mpeg2"

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"

C:\Windows\system32\wermgr.exe

"C:\Windows\system32\wermgr.exe" "-outproc" "0" "1372" "2688" "2616" "2692" "0" "0" "2696" "0" "0" "0" "0" "0"

C:\Windows\system32\wermgr.exe

"C:\Windows\system32\wermgr.exe" "-outproc" "0" "4324" "2732" "2672" "2736" "0" "0" "2740" "0" "0" "0" "0" "0"

Network

Country Destination Domain Proto
DE 144.91.79.54:80 144.91.79.54 tcp
US 8.8.8.8:53 54.79.91.144.in-addr.arpa udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 checkip.dyndns.org udp
BR 132.226.247.73:80 checkip.dyndns.org tcp
US 8.8.8.8:53 reallyfreegeoip.org udp
US 104.21.67.152:443 reallyfreegeoip.org tcp
US 8.8.8.8:53 73.247.226.132.in-addr.arpa udp
US 8.8.8.8:53 152.67.21.104.in-addr.arpa udp
US 8.8.8.8:53 zulpine.shop udp
US 203.161.48.208:587 zulpine.shop tcp
US 8.8.8.8:53 208.48.161.203.in-addr.arpa udp
US 8.8.8.8:53 67.208.201.84.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Roaming\gMBlGsAXoyfBvsA.vbs

MD5 77c5b6fe271fef2a65006abf49b4fe66
SHA1 cd279263b404e2e4e2a3fb509da19c9a5f3bdcb3
SHA256 78c66f29b0ade0cb644603b4bfc261b630be611ba55b902f090c94058954ec84
SHA512 cf18faacf59f75d95ae8cc99555ff51b0e4963f57d12ceaeccdd97808c423713b0a34af4cee18338a44ad474a8d9abae778b1f202a511ad932521e3f0b5de140

memory/4324-4-0x0000022474860000-0x0000022474882000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_id5bafky.kjy.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4324-14-0x00000224757E0000-0x0000022475824000-memory.dmp

memory/4324-15-0x00000224758B0000-0x0000022475926000-memory.dmp

memory/3856-16-0x00007FF7750D0000-0x00007FF7751C8000-memory.dmp

memory/3856-17-0x00007FFE44000000-0x00007FFE44034000-memory.dmp

memory/3856-25-0x00007FFE3A4B0000-0x00007FFE3A4C1000-memory.dmp

memory/3856-18-0x00007FFE31550000-0x00007FFE31806000-memory.dmp

memory/3856-24-0x00007FFE3FD20000-0x00007FFE3FD3D000-memory.dmp

memory/3856-23-0x00007FFE44D60000-0x00007FFE44D71000-memory.dmp

memory/3856-27-0x00007FFE37D70000-0x00007FFE37DB1000-memory.dmp

memory/3856-26-0x00007FFE2E5B0000-0x00007FFE2E7BB000-memory.dmp

memory/3856-22-0x00007FFE45860000-0x00007FFE45877000-memory.dmp

memory/3856-21-0x00007FFE45A40000-0x00007FFE45A51000-memory.dmp

memory/3856-20-0x00007FFE46050000-0x00007FFE46067000-memory.dmp

memory/3856-19-0x00007FFE47920000-0x00007FFE47938000-memory.dmp

memory/3856-29-0x00007FFE39810000-0x00007FFE39831000-memory.dmp

memory/3856-34-0x00007FFE2E130000-0x00007FFE2E142000-memory.dmp

memory/3856-33-0x00007FFE382D0000-0x00007FFE382E1000-memory.dmp

memory/3856-32-0x00007FFE382F0000-0x00007FFE38301000-memory.dmp

memory/3856-31-0x00007FFE391F0000-0x00007FFE39201000-memory.dmp

memory/3856-30-0x00007FFE3A490000-0x00007FFE3A4A8000-memory.dmp

memory/3856-28-0x00007FFE2B450000-0x00007FFE2C500000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 4cbd247111e5a2e7e8785d4e8cc2a608
SHA1 732e6cc559513fb1c7f85c58400aeb437fde5649
SHA256 1a7310cb18415911d26a1ff4a4d403ac73a7b5c54c0dfd71a27f9db41d628a7e
SHA512 f00e4ed727fd8214b418b1e141279beb35109b7ede9e80d01bd6e3d9072f87a574f2c3fcdd2185c0605ed4a881964625e0e428aa97066db57a24045d72762276

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 384261486581198676893b6c8e298989
SHA1 1a9b410eb919c624a2837a765e86124ec2dcabb4
SHA256 a4b357de9a9020506d27502d8fd2f74f203322facbfc3915925043d031e09847
SHA512 2340c327763813f11f6ea26f8c7f60daa59663786ecb52e9c6e5f9855a5f346be0a1649716b52761e13160e42314fa4458857e01ccc5517c2a93036097f5b3f1

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

MD5 a26df49623eff12a70a93f649776dab7
SHA1 efb53bd0df3ac34bd119adf8788127ad57e53803
SHA256 4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245
SHA512 e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c

memory/4324-53-0x0000022474900000-0x0000022474908000-memory.dmp

memory/4324-54-0x0000022475830000-0x000002247583C000-memory.dmp

memory/3964-55-0x0000000000350000-0x000000000036E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 6e809f4c18466a0a63db912fb7a2441c
SHA1 d88653e1426406c3175c3fee38d55cd94a1ec5b1
SHA256 2a684a0f36716559ec3fef1d5cdcd0fa7d48cd59e40457b7adc4d7b1f9a0c9fa
SHA512 b47bb55f42d8930277dcab4d3850aba5b1f40b794f07cf1a0858b7280dc8bab243f445c50d2a45fa183c8f664c4864f476d4565c85380fc10cf45fe53d16100c

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 3f01549ee3e4c18244797530b588dad9
SHA1 3e87863fc06995fe4b741357c68931221d6cc0b9
SHA256 36b51e575810b6af6fc5e778ce0f228bc7797cd3224839b00829ca166fa13f9a
SHA512 73843215228865a4186ac3709bf2896f0f68da0ba3601cc20226203dd429a2ad9817b904a45f6b0456b8be68deebf3b011742a923ce4a77c0c6f3a155522ab50

memory/3964-74-0x00000000052C0000-0x0000000005864000-memory.dmp

memory/3964-75-0x0000000004D10000-0x0000000004DAC000-memory.dmp

memory/3964-76-0x0000000005E90000-0x0000000005F22000-memory.dmp

memory/3964-77-0x0000000005F30000-0x0000000005F80000-memory.dmp

memory/3856-90-0x00007FFE2B450000-0x00007FFE2C500000-memory.dmp

memory/3964-97-0x0000000006250000-0x0000000006412000-memory.dmp

memory/3964-98-0x00000000061F0000-0x00000000061FA000-memory.dmp