Analysis
- max time kernel
4s - max time network
125s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
- submitted
12/11/2024, 03:06
General
- Target ef670fb4793463bc81ae7f07fc809bab0962fec614a3fef3bc779a4a382c2eae.vbe
- Size 10KB
- Sample241112-dl14xstdqd
- SHA256 ef670fb4793463bc81ae7f07fc809bab0962fec614a3fef3bc779a4a382c2eae
Malware Config
Signatures
- Blocklisted process makes network request 1 IoCs
- Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ef670fb4793463bc81ae7f07fc809bab0962fec614a3fef3bc779a4a382c2eae.vbe"1⤵
- Blocklisted process makes network request
-
C:\Windows\system32\taskeng.exetaskeng.exe {E9510FE3-B500-44F8-9EC9-6688831F679E} S-1-5-21-4177215427-74451935-3209572229-1000:JSMURNPT\Admin:Interactive:[1]1⤵
-
C:\Windows\System32\WScript.exeC:\Windows\System32\WScript.exe "C:\Users\Admin\AppData\Roaming\LPFpWIHXbpdnRBc.vbs"2⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"3⤵
-
C:\Windows\system32\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "2892" "1244"4⤵
-
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"3⤵
-
C:\Windows\system32\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "1672" "1248"4⤵
-
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"3⤵
-
C:\Windows\system32\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "1224" "1244"4⤵
-
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"3⤵
-
C:\Windows\system32\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "2312" "1236"4⤵
-
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"3⤵
-
C:\Windows\system32\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "1408" "1132"4⤵
-
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"3⤵
-
C:\Windows\system32\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "2728" "1244"4⤵
-
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"3⤵
-
C:\Windows\system32\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "2824" "1240"4⤵
-
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"3⤵
-
C:\Windows\system32\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "876" "1244"4⤵
-
-
-
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\StopClose.m1v"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
OutofProcReport259480482.txt
OutofProcReport259493203.txt
OutofProcReport259509463.txt
OutofProcReport259535815.txt
OutofProcReport259538751.txt
OutofProcReport259551925.txt
OutofProcReport259569959.txt
OutofProcReport259583601.txt
LPFpWIHXbpdnRBc.vbs
590aee7bdd69b59b.customDestinations-ms
memory/1672-17-0x00000000029E0000-0x00000000029E8000-memory.dmp
memory/1672-16-0x000000001B500000-0x000000001B7E2000-memory.dmp
memory/2892-8-0x0000000002A60000-0x0000000002A68000-memory.dmp
memory/2892-7-0x00000000027E0000-0x00000000027E8000-memory.dmp
memory/2892-6-0x000000001B690000-0x000000001B972000-memory.dmp
memory/2932-54-0x000007FEF2310000-0x000007FEF2321000-memory.dmp
memory/2932-66-0x000007FEF02F0000-0x000007FEF0308000-memory.dmp
memory/2932-45-0x000007FEF2430000-0x000007FEF2441000-memory.dmp
memory/2932-46-0x000007FEF2410000-0x000007FEF242D000-memory.dmp
memory/2932-47-0x000007FEF23F0000-0x000007FEF2401000-memory.dmp
memory/2932-48-0x000007FEF03F0000-0x000007FEF05FB000-memory.dmp
memory/2932-55-0x000007FEF22F0000-0x000007FEF2301000-memory.dmp
memory/2932-57-0x000007FEF22B0000-0x000007FEF22C1000-memory.dmp
memory/2932-56-0x000007FEF22D0000-0x000007FEF22EB000-memory.dmp
memory/2932-58-0x000007FEF2290000-0x000007FEF22A8000-memory.dmp
memory/2932-43-0x000007FEF6D60000-0x000007FEF6D71000-memory.dmp
memory/2932-53-0x000007FEF2330000-0x000007FEF2341000-memory.dmp
memory/2932-52-0x000007FEF2350000-0x000007FEF2368000-memory.dmp
memory/2932-51-0x000007FEF2370000-0x000007FEF2391000-memory.dmp
memory/2932-50-0x000007FEF23A0000-0x000007FEF23E1000-memory.dmp
memory/2932-49-0x000007FEED290000-0x000007FEEE340000-memory.dmp
memory/2932-67-0x000007FEF02C0000-0x000007FEF02E3000-memory.dmp
memory/2932-44-0x000007FEF6D40000-0x000007FEF6D57000-memory.dmp
memory/2932-65-0x000007FEF0310000-0x000007FEF0334000-memory.dmp
memory/2932-64-0x000007FEF0340000-0x000007FEF0368000-memory.dmp
memory/2932-63-0x000007FEF0370000-0x000007FEF03C7000-memory.dmp
memory/2932-62-0x000007FEF03D0000-0x000007FEF03E1000-memory.dmp
memory/2932-61-0x000007FEF1D90000-0x000007FEF1E0C000-memory.dmp
memory/2932-60-0x000007FEF1E10000-0x000007FEF1E77000-memory.dmp
memory/2932-68-0x000007FEF02A0000-0x000007FEF02B1000-memory.dmp
memory/2932-59-0x000007FEF1E80000-0x000007FEF1EB0000-memory.dmp
memory/2932-69-0x000007FEF0280000-0x000007FEF0292000-memory.dmp
memory/2932-70-0x000007FEEEBD0000-0x000007FEEEBE1000-memory.dmp
memory/2932-71-0x000007FEED0F0000-0x000007FEED1EF000-memory.dmp
memory/2932-72-0x000007FEEB5B0000-0x000007FEEB730000-memory.dmp
memory/2932-73-0x000007FEEB590000-0x000007FEEB5A7000-memory.dmp
memory/2932-42-0x000007FEF6EE0000-0x000007FEF6EF7000-memory.dmp
memory/2932-41-0x000007FEF7370000-0x000007FEF7388000-memory.dmp
memory/2932-40-0x000007FEF6510000-0x000007FEF67C6000-memory.dmp
memory/2932-39-0x000007FEF73D0000-0x000007FEF7404000-memory.dmp
memory/2932-38-0x000000013FAF0000-0x000000013FBE8000-memory.dmp