Malware Analysis Report

2024-12-07 14:07

Sample ID 241111-rrt5fsyrgw
Target SWIFTCOPY202973783.vbe
SHA256 ef670fb4793463bc81ae7f07fc809bab0962fec614a3fef3bc779a4a382c2eae
Tags
agenttesla discovery keylogger spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ef670fb4793463bc81ae7f07fc809bab0962fec614a3fef3bc779a4a382c2eae

Threat Level: Known bad

The file SWIFTCOPY202973783.vbe was found to be: Known bad.

Malicious Activity Summary

agenttesla discovery keylogger spyware stealer trojan

Agenttesla family

AgentTesla

Blocklisted process makes network request

Checks computer location settings

Looks up external IP address via web service

Suspicious use of SetThreadContext

Drops file in System32 directory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of FindShellTrayWindow

Suspicious behavior: AddClipboardFormatListener

Enumerates system info in registry

Script User-Agent

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Checks processor information in registry

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-11 14:26

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-11 14:26

Reported

2024-11-11 14:28

Platform

win7-20240903-en

Max time kernel

144s

Max time network

119s

Command Line

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\SWIFTCOPY202973783.vbe"

Signatures

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\System32\WScript.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A

Enumerates physical storage devices

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2764 wrote to memory of 2964 N/A C:\Windows\system32\taskeng.exe C:\Windows\System32\WScript.exe
PID 2764 wrote to memory of 2964 N/A C:\Windows\system32\taskeng.exe C:\Windows\System32\WScript.exe
PID 2764 wrote to memory of 2964 N/A C:\Windows\system32\taskeng.exe C:\Windows\System32\WScript.exe
PID 2964 wrote to memory of 2596 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2964 wrote to memory of 2596 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2964 wrote to memory of 2596 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 2692 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 2596 wrote to memory of 2692 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 2596 wrote to memory of 2692 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 2964 wrote to memory of 1732 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2964 wrote to memory of 1732 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2964 wrote to memory of 1732 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 1732 wrote to memory of 1912 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 1732 wrote to memory of 1912 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 1732 wrote to memory of 1912 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 2964 wrote to memory of 1144 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2964 wrote to memory of 1144 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2964 wrote to memory of 1144 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 1144 wrote to memory of 2892 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 1144 wrote to memory of 2892 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 1144 wrote to memory of 2892 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 2964 wrote to memory of 2932 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2964 wrote to memory of 2932 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2964 wrote to memory of 2932 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2932 wrote to memory of 1504 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 2932 wrote to memory of 1504 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 2932 wrote to memory of 1504 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 2964 wrote to memory of 1084 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2964 wrote to memory of 1084 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2964 wrote to memory of 1084 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 1084 wrote to memory of 900 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 1084 wrote to memory of 900 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 1084 wrote to memory of 900 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 2964 wrote to memory of 1032 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2964 wrote to memory of 1032 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2964 wrote to memory of 1032 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 1032 wrote to memory of 2396 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 1032 wrote to memory of 2396 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 1032 wrote to memory of 2396 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 2964 wrote to memory of 1796 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2964 wrote to memory of 1796 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2964 wrote to memory of 1796 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\SWIFTCOPY202973783.vbe"

C:\Windows\system32\taskeng.exe

taskeng.exe {0A6A1468-CA22-402D-A2E8-4983C2566402} S-1-5-21-3290804112-2823094203-3137964600-1000:VORHPBAB\Admin:Interactive:[1]

C:\Windows\System32\WScript.exe

C:\Windows\System32\WScript.exe "C:\Users\Admin\AppData\Roaming\LPFpWIHXbpdnRBc.vbs"

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"

C:\Windows\system32\wermgr.exe

"C:\Windows\system32\wermgr.exe" "-outproc" "2596" "1240"

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"

C:\Windows\system32\wermgr.exe

"C:\Windows\system32\wermgr.exe" "-outproc" "1732" "1244"

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"

C:\Windows\system32\wermgr.exe

"C:\Windows\system32\wermgr.exe" "-outproc" "1144" "1244"

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"

C:\Windows\system32\wermgr.exe

"C:\Windows\system32\wermgr.exe" "-outproc" "2932" "1236"

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"

C:\Windows\system32\wermgr.exe

"C:\Windows\system32\wermgr.exe" "-outproc" "1084" "1240"

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"

C:\Windows\system32\wermgr.exe

"C:\Windows\system32\wermgr.exe" "-outproc" "1032" "1240"

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"

C:\Program Files\VideoLAN\VLC\vlc.exe

"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\SearchRestart.wmv"

Network

Country Destination Domain Proto
DE 144.91.79.54:80 144.91.79.54 tcp

Files

C:\Users\Admin\AppData\Roaming\LPFpWIHXbpdnRBc.vbs

MD5 5b12725548e7be334795090aab4c663a
SHA1 3f3cfaba2d7d57817d08f73b6693c7ed7c632932
SHA256 7ea2c1cdb0947698fcc82e9c7624c63a92d73671dd48d368a35c968a77a6cfac
SHA512 14ea70502134fd28f709071da5d9a1adf4fe7fc08fea5afdc22092374043219eb5bae6a8506000efbcf231bc05162ab34d2fc95015156ac3fbc84da35ab8b928

memory/2596-6-0x000000001B730000-0x000000001BA12000-memory.dmp

memory/2596-7-0x0000000002310000-0x0000000002318000-memory.dmp

memory/2596-8-0x0000000002A60000-0x0000000002A68000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\OutofProcReport259491269.txt

MD5 b13bfb6f5bc4d46b6ac7b6f365c523f1
SHA1 c68c153e5639873edeafe4ecf1aa64e238c7a1cb
SHA256 770f78f437d2d6a8c43aef9ce396e5cf8db7252c9ea7af94511640ac41fc37b4
SHA512 eb72acf78c8bc6a4c6a7c6c7e83bbcda6de61b42b4f01fc732e2730503a49b4ed51ef28762cc9924874cf795c6c00254d74005832b08d53918091bbabcabff14

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 2573791824e3676331910ef358d5b1ed
SHA1 29a641bee4d06b9d21bc5bf03e467c1bbf49be03
SHA256 b23e743af61aa90365772b3a617f4bbe1ad387747d45821683eb69c937b00b4e
SHA512 6161f6ecf3e84e3192be0fb3835e59da3bdddbdc910ae8c9777eee5d8392409e0157c49c094a4b46e58c9ca44bbe3e58e771a74cabe232bfa9380f80f9f6d618

memory/1732-16-0x000000001B640000-0x000000001B922000-memory.dmp

memory/1732-17-0x0000000001E80000-0x0000000001E88000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\OutofProcReport259509678.txt

MD5 939ca7083f6dfc4aec857d503ad6b6ca
SHA1 dcd2fc454b9ec157bd6f73f37d509c98ecced116
SHA256 8fe8bb06de3468537474671ec96207b230206107631413787654bae51234e3a8
SHA512 0521cd8737244d7b7c7f701912752c09c979bc46addbc7471306d9d54b45a9f18ef34b8f6bdeab17a2b146555beea6b0583c53e8015e85a7c3131916b2e0daa2

C:\Users\Admin\AppData\Local\Temp\OutofProcReport259523185.txt

MD5 20e0b057f00973e29d2a8047a0279a72
SHA1 9e48e662c6fc348ae00d6454fc3ba6ef22c2c59b
SHA256 cfdc55c226754a8a8cfcc7391989a8fae56407f1ac844dda2aac1c2990f3eca8
SHA512 1f639efa1bef576e70dc295ca57513cfabd298c003448aa5be60147c709c015f8774d2c350621a680b512b6dc2e2adcf74475a87d9869f1337b575384b446792

C:\Users\Admin\AppData\Local\Temp\OutofProcReport259541618.txt

MD5 c2f3b99cf531911fab9b4b458fed9adb
SHA1 1912ba176308034e8238ae3b8797674c733d568a
SHA256 fa1e9b101c52df86fe71ba5cfbb4ab8bb4c825e3fe082633a29bcba52df8e767
SHA512 2bb85516ef01fdfc1e20972f09851f36f7ca61fb3be821c393ed9bc860e1e786197c6c251df39b51d64115dd44bad03588dc48e531baa269fbc438c2f5c68a16

C:\Users\Admin\AppData\Local\Temp\OutofProcReport259555242.txt

MD5 639a739d1691da27c72b302818583ff4
SHA1 3d37492f2b70d944031786ff89ae3cc34fb4603e
SHA256 1769120b4cc8d667b435128b631642621250396ffcfe99b34f663f858e9080ee
SHA512 b9e784bd5d2358c2b70e33770f7f8461f5121ff909c8157291f0fa413f01d6ff477c780ceb8cfbcc18bfcac2d46fb64c7240f52fa213e13a8391cf8d5705ebba

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Temp\OutofProcReport259568298.txt

MD5 d44b9d8322a05081ecdbe0c4d6cce5e4
SHA1 478a11deb7898f2f5613a0669b06f12c0fd9c8ca
SHA256 0c8c9332b48f918f976652420440b0cbdacc06a3067adc03ac53365bf0e047a7
SHA512 2cdede9b6c5552ff14c279fcc9576b3e193b27e693b546276e27b7498a0d0c64c159e9ab42b2b6b7fc86e3f789ed48564d6c0e76783889fdb4341f00b8ec2231

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-11 14:26

Reported

2024-11-11 14:28

Platform

win10v2004-20241007-en

Max time kernel

148s

Max time network

151s

Command Line

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\SWIFTCOPY202973783.vbe"

Signatures

AgentTesla

keylogger trojan stealer spyware agenttesla

Agenttesla family

agenttesla

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\System32\WScript.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation C:\Windows\System32\WScript.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 5012 set thread context of 2780 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\wermgr.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Windows\system32\wermgr.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\wermgr.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\system32\wermgr.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\system32\wermgr.exe N/A

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1464 wrote to memory of 5012 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 1464 wrote to memory of 5012 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 5012 wrote to memory of 2780 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 5012 wrote to memory of 2780 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 5012 wrote to memory of 2780 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 5012 wrote to memory of 2780 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 5012 wrote to memory of 2780 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 5012 wrote to memory of 2780 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 5012 wrote to memory of 2780 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 5012 wrote to memory of 2780 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 5012 wrote to memory of 4892 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 5012 wrote to memory of 4892 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\SWIFTCOPY202973783.vbe"

C:\Windows\System32\WScript.exe

C:\Windows\System32\WScript.exe "C:\Users\Admin\AppData\Roaming\LPFpWIHXbpdnRBc.vbs"

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"

C:\Windows\system32\wermgr.exe

"C:\Windows\system32\wermgr.exe" "-outproc" "0" "5012" "2732" "2660" "2736" "0" "0" "2740" "0" "0" "0" "0" "0"

Network

Country Destination Domain Proto
DE 144.91.79.54:80 144.91.79.54 tcp
US 8.8.8.8:53 54.79.91.144.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 66.208.201.84.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 api.ipify.org udp
US 172.67.74.152:443 api.ipify.org tcp
US 8.8.8.8:53 152.74.67.172.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 49.192.11.51.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Roaming\LPFpWIHXbpdnRBc.vbs

MD5 5b12725548e7be334795090aab4c663a
SHA1 3f3cfaba2d7d57817d08f73b6693c7ed7c632932
SHA256 7ea2c1cdb0947698fcc82e9c7624c63a92d73671dd48d368a35c968a77a6cfac
SHA512 14ea70502134fd28f709071da5d9a1adf4fe7fc08fea5afdc22092374043219eb5bae6a8506000efbcf231bc05162ab34d2fc95015156ac3fbc84da35ab8b928

memory/5012-4-0x0000022F24BF0000-0x0000022F24C12000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tca1x2xr.fjx.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/5012-14-0x0000022F24DC0000-0x0000022F24E04000-memory.dmp

memory/5012-15-0x0000022F3DDB0000-0x0000022F3DE26000-memory.dmp

memory/5012-17-0x0000022F24C90000-0x0000022F24C98000-memory.dmp

memory/5012-18-0x0000022F24CA0000-0x0000022F24CAC000-memory.dmp

memory/2780-19-0x0000000000810000-0x0000000000850000-memory.dmp

memory/2780-23-0x00000000052D0000-0x0000000005874000-memory.dmp

memory/2780-26-0x0000000004D20000-0x0000000004D86000-memory.dmp

memory/2780-31-0x0000000006290000-0x00000000062E0000-memory.dmp

memory/2780-32-0x0000000006380000-0x0000000006412000-memory.dmp

memory/2780-33-0x0000000006300000-0x000000000630A000-memory.dmp