Malware Analysis Report

2024-12-07 14:05

Sample ID 241112-dl14xstdqd
Target ef670fb4793463bc81ae7f07fc809bab0962fec614a3fef3bc779a4a382c2eae.vbe
SHA256 ef670fb4793463bc81ae7f07fc809bab0962fec614a3fef3bc779a4a382c2eae
Tags
agenttesla discovery keylogger spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ef670fb4793463bc81ae7f07fc809bab0962fec614a3fef3bc779a4a382c2eae

Threat Level: Known bad

The file ef670fb4793463bc81ae7f07fc809bab0962fec614a3fef3bc779a4a382c2eae.vbe was found to be: Known bad.

Malicious Activity Summary

agenttesla discovery keylogger spyware stealer trojan

AgentTesla

Agenttesla family

Blocklisted process makes network request

Checks computer location settings

Looks up external IP address via web service

Drops file in System32 directory

Suspicious use of SetThreadContext

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Uses Task Scheduler COM API

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Script User-Agent

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious behavior: AddClipboardFormatListener

Checks processor information in registry

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-12 03:06

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-12 03:06

Reported

2024-11-12 03:09

Platform

win7-20240903-en

Max time kernel

4s

Max time network

125s

Command Line

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ef670fb4793463bc81ae7f07fc809bab0962fec614a3fef3bc779a4a382c2eae.vbe"

Signatures

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\System32\WScript.exe N/A

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A

Processes

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ef670fb4793463bc81ae7f07fc809bab0962fec614a3fef3bc779a4a382c2eae.vbe"

C:\Windows\system32\taskeng.exe

taskeng.exe {E9510FE3-B500-44F8-9EC9-6688831F679E} S-1-5-21-4177215427-74451935-3209572229-1000:JSMURNPT\Admin:Interactive:[1]

C:\Windows\System32\WScript.exe

C:\Windows\System32\WScript.exe "C:\Users\Admin\AppData\Roaming\LPFpWIHXbpdnRBc.vbs"

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"

C:\Windows\system32\wermgr.exe

"C:\Windows\system32\wermgr.exe" "-outproc" "2892" "1244"

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"

C:\Windows\system32\wermgr.exe

"C:\Windows\system32\wermgr.exe" "-outproc" "1672" "1248"

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"

C:\Windows\system32\wermgr.exe

"C:\Windows\system32\wermgr.exe" "-outproc" "1224" "1244"

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"

C:\Program Files\VideoLAN\VLC\vlc.exe

"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\StopClose.m1v"

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"

C:\Windows\system32\wermgr.exe

"C:\Windows\system32\wermgr.exe" "-outproc" "1408" "1132"

C:\Windows\system32\wermgr.exe

"C:\Windows\system32\wermgr.exe" "-outproc" "2312" "1236"

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"

C:\Windows\system32\wermgr.exe

"C:\Windows\system32\wermgr.exe" "-outproc" "2728" "1244"

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"

C:\Windows\system32\wermgr.exe

"C:\Windows\system32\wermgr.exe" "-outproc" "2824" "1240"

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"

C:\Windows\system32\wermgr.exe

"C:\Windows\system32\wermgr.exe" "-outproc" "876" "1244"

Network

Country Destination Domain Proto
DE 144.91.79.54:80 144.91.79.54 tcp

Files

C:\Users\Admin\AppData\Roaming\LPFpWIHXbpdnRBc.vbs

MD5 5b12725548e7be334795090aab4c663a
SHA1 3f3cfaba2d7d57817d08f73b6693c7ed7c632932
SHA256 7ea2c1cdb0947698fcc82e9c7624c63a92d73671dd48d368a35c968a77a6cfac
SHA512 14ea70502134fd28f709071da5d9a1adf4fe7fc08fea5afdc22092374043219eb5bae6a8506000efbcf231bc05162ab34d2fc95015156ac3fbc84da35ab8b928

memory/2892-6-0x000000001B690000-0x000000001B972000-memory.dmp

memory/2892-7-0x00000000027E0000-0x00000000027E8000-memory.dmp

memory/2892-8-0x0000000002A60000-0x0000000002A68000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\OutofProcReport259480482.txt

MD5 ea7f98efd2a234159b0cf4da3b45258b
SHA1 34ca1f0967be8fb5b94d171b20969a29fd6e3b63
SHA256 46f487dc30d2ee4e0037e6e5db22a5e9819b6c6a4e1deb344a9a80c09772285b
SHA512 433fcf0626c27136de14eff0bf8d798a961943c40e0045ecb55ecd45575a53cfbe0bdf03592c9ce8c1a40aedf6913af3e24903bb14ba85af86ffead86d99b6c5

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 dd01ac82dfe30855e48e1eee3f1fdbf0
SHA1 f33592932863f1f34dce8cff48f1daafb9d7fad9
SHA256 ef8b6d73e430df865bd72dfcfd677b8e77e885871097419915beb66e8a21531f
SHA512 44be9bd1cbcc5931f46fcf5407236e6f8c3b412f6ab329fe4e55e3c9a49e6c7f357727e789458b2cb7cf8e2ac1b43da6ddb5725be3263da3d8d4800cad17db26

memory/1672-16-0x000000001B500000-0x000000001B7E2000-memory.dmp

memory/1672-17-0x00000000029E0000-0x00000000029E8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\OutofProcReport259493203.txt

MD5 569b9aef679161cd5fbe9d29e5deb643
SHA1 165bc054ea419a8b011d7373c5c4328b58c04ab7
SHA256 0fedf6874fd672b2abdb83c0529b9b5b542a800acf97ea4ed7923611484d5562
SHA512 ed12bf3eea51a64e1a0ada97dc21265dfab351b835e376ad7fbd6aed9dd022353170ce0c1e8d4e62a2bca56e834770e2d94131e3a3f18f3d94ff7ce3fb331e68

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Temp\OutofProcReport259509463.txt

MD5 0310105db4657950b4112af745834414
SHA1 b72f167f6f61819a5c24c53ee86cddfdb69bfca9
SHA256 7dac6a046f2f5dac13a17cbe333bf24d4ebf64b2b2bbb5592ca05048c563774e
SHA512 ec51b3dcefd136422aeb8fa911a04bd37954f0f468d3400c250b283f517b23ceba8379f5d859c84100a43022f79009ca5342b24613f5709fe6895df09f433920

memory/2932-38-0x000000013FAF0000-0x000000013FBE8000-memory.dmp

memory/2932-39-0x000007FEF73D0000-0x000007FEF7404000-memory.dmp

memory/2932-40-0x000007FEF6510000-0x000007FEF67C6000-memory.dmp

memory/2932-41-0x000007FEF7370000-0x000007FEF7388000-memory.dmp

memory/2932-42-0x000007FEF6EE0000-0x000007FEF6EF7000-memory.dmp

memory/2932-43-0x000007FEF6D60000-0x000007FEF6D71000-memory.dmp

memory/2932-44-0x000007FEF6D40000-0x000007FEF6D57000-memory.dmp

memory/2932-45-0x000007FEF2430000-0x000007FEF2441000-memory.dmp

memory/2932-46-0x000007FEF2410000-0x000007FEF242D000-memory.dmp

memory/2932-47-0x000007FEF23F0000-0x000007FEF2401000-memory.dmp

memory/2932-48-0x000007FEF03F0000-0x000007FEF05FB000-memory.dmp

memory/2932-55-0x000007FEF22F0000-0x000007FEF2301000-memory.dmp

memory/2932-57-0x000007FEF22B0000-0x000007FEF22C1000-memory.dmp

memory/2932-56-0x000007FEF22D0000-0x000007FEF22EB000-memory.dmp

memory/2932-58-0x000007FEF2290000-0x000007FEF22A8000-memory.dmp

memory/2932-54-0x000007FEF2310000-0x000007FEF2321000-memory.dmp

memory/2932-53-0x000007FEF2330000-0x000007FEF2341000-memory.dmp

memory/2932-52-0x000007FEF2350000-0x000007FEF2368000-memory.dmp

memory/2932-51-0x000007FEF2370000-0x000007FEF2391000-memory.dmp

memory/2932-50-0x000007FEF23A0000-0x000007FEF23E1000-memory.dmp

memory/2932-49-0x000007FEED290000-0x000007FEEE340000-memory.dmp

memory/2932-67-0x000007FEF02C0000-0x000007FEF02E3000-memory.dmp

memory/2932-66-0x000007FEF02F0000-0x000007FEF0308000-memory.dmp

memory/2932-65-0x000007FEF0310000-0x000007FEF0334000-memory.dmp

memory/2932-64-0x000007FEF0340000-0x000007FEF0368000-memory.dmp

memory/2932-63-0x000007FEF0370000-0x000007FEF03C7000-memory.dmp

memory/2932-62-0x000007FEF03D0000-0x000007FEF03E1000-memory.dmp

memory/2932-61-0x000007FEF1D90000-0x000007FEF1E0C000-memory.dmp

memory/2932-60-0x000007FEF1E10000-0x000007FEF1E77000-memory.dmp

memory/2932-68-0x000007FEF02A0000-0x000007FEF02B1000-memory.dmp

memory/2932-59-0x000007FEF1E80000-0x000007FEF1EB0000-memory.dmp

memory/2932-69-0x000007FEF0280000-0x000007FEF0292000-memory.dmp

memory/2932-70-0x000007FEEEBD0000-0x000007FEEEBE1000-memory.dmp

memory/2932-71-0x000007FEED0F0000-0x000007FEED1EF000-memory.dmp

memory/2932-72-0x000007FEEB5B0000-0x000007FEEB730000-memory.dmp

memory/2932-73-0x000007FEEB590000-0x000007FEEB5A7000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\OutofProcReport259538751.txt

MD5 516e0c017dc6aeb8c20f5155a32254f3
SHA1 78e7d3cd98a715107ed1332496bc68f86e097bfd
SHA256 b3f23404b74c15b2449fb66927b8fe4622e5bdb95249ead8eb8752b5fa1d9b3b
SHA512 95bfbfdcc68176e5cfe901ebaa8fe9dc7df25d0022b64c5cb70b06f559235d9f7491cb3bc3295d576f35661ec3b2a2050fd6fea54cccc0b486d45f6798a841c2

C:\Users\Admin\AppData\Local\Temp\OutofProcReport259535815.txt

MD5 2cda67753a2f3f197dedc41b45ef865f
SHA1 7adcb4d7d9f5f96e3be5ed240e958b9faec43480
SHA256 ae7229555a6483815a98cd99b9bee8872aaf8c30d63d100fb62c816fca3384db
SHA512 46ef2c6d8cd42da0fe5bd64828ee3dcea193d5d1490150343e90184899522123ef976109d0a99f55bda44916c2396389bbb5100502230b5b667c94e1ba1985b6

C:\Users\Admin\AppData\Local\Temp\OutofProcReport259551925.txt

MD5 9efec0e8d33bfee6f5b67ec548a9dda1
SHA1 d9c699dc28d7579e770167d20e02778fad98b87f
SHA256 0ba284bc9fb87e7ffbb961db64e93d51dfd7aa435bf5f24edcc9a2704d80de97
SHA512 4c7d2c6bba99cb61ea0df200e3e41a650680db953edce4d699ac4bc77da69af9ac71263334f3079d54d7e0bc716c28ed57b716e3479aa731d9a9b99d32dc8b63

C:\Users\Admin\AppData\Local\Temp\OutofProcReport259569959.txt

MD5 220ec07114b76e64fb1d2778d8a251c8
SHA1 38a39dbd8c6eebc1d71ecc83ba59a399de9f351e
SHA256 3519b6c512a72be55e19414a4029cafba9e2451ebc4afc0ca1683ee40cbfb96e
SHA512 a0abbecc54607d7fffed172f44b15536e161afbfd5e9a78bb8182002f26c0905ce05dc7e768af8b04668dbd707622dee671e88aac66ade0e6ecec2ab62976896

C:\Users\Admin\AppData\Local\Temp\OutofProcReport259583601.txt

MD5 107504bb3da979f6705f69f9fc237b8e
SHA1 17653a4bfcca2989f2cae40b548e1fef6eb6929d
SHA256 f217890b62fbc61753a507c78960fd3001fa34477cf61ff130676c79d0b503e3
SHA512 5b221b10a626aceeeb4a9193ecffef9eb97a5143154be5405ae0eece16122bd7678e7e4e64898cd239b137a090342ad1b47346e99d8baa1de6f2230280b6400b

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-12 03:06

Reported

2024-11-12 03:09

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

152s

Command Line

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ef670fb4793463bc81ae7f07fc809bab0962fec614a3fef3bc779a4a382c2eae.vbe"

Signatures

AgentTesla

keylogger trojan stealer spyware agenttesla

Agenttesla family

agenttesla

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\System32\WScript.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation C:\Windows\System32\WScript.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\System32\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4884 set thread context of 4040 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Windows\system32\wermgr.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\wermgr.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\wermgr.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Windows\system32\wermgr.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\wermgr.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\wermgr.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\system32\wermgr.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\system32\wermgr.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\system32\wermgr.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\system32\wermgr.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2444 wrote to memory of 4884 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2444 wrote to memory of 4884 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2444 wrote to memory of 3816 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2444 wrote to memory of 3816 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 4884 wrote to memory of 4040 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 4884 wrote to memory of 4040 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 4884 wrote to memory of 4040 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 4884 wrote to memory of 4040 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 4884 wrote to memory of 4040 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 4884 wrote to memory of 4040 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 4884 wrote to memory of 4040 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 4884 wrote to memory of 4040 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 3816 wrote to memory of 1032 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 3816 wrote to memory of 1032 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 4884 wrote to memory of 4460 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 4884 wrote to memory of 4460 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ef670fb4793463bc81ae7f07fc809bab0962fec614a3fef3bc779a4a382c2eae.vbe"

C:\Windows\System32\WScript.exe

C:\Windows\System32\WScript.exe "C:\Users\Admin\AppData\Roaming\LPFpWIHXbpdnRBc.vbs"

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\ShowProtect.xlsx"

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"

C:\Windows\system32\wermgr.exe

"C:\Windows\system32\wermgr.exe" "-outproc" "0" "4884" "2884" "2812" "2888" "0" "0" "2892" "0" "0" "0" "0" "0"

C:\Windows\system32\wermgr.exe

"C:\Windows\system32\wermgr.exe" "-outproc" "0" "3816" "2688" "2648" "2692" "0" "0" "2696" "0" "0" "0" "0" "0"

Network

Country Destination Domain Proto
DE 144.91.79.54:80 144.91.79.54 tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 54.79.91.144.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 roaming.officeapps.live.com udp
IE 52.109.76.243:443 roaming.officeapps.live.com tcp
US 8.8.8.8:53 46.28.109.52.in-addr.arpa udp
US 8.8.8.8:53 243.76.109.52.in-addr.arpa udp
US 8.8.8.8:53 24.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 98.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 api.ipify.org udp
US 104.26.12.205:443 api.ipify.org tcp
US 8.8.8.8:53 205.12.26.104.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 7.173.189.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Roaming\LPFpWIHXbpdnRBc.vbs

MD5 5b12725548e7be334795090aab4c663a
SHA1 3f3cfaba2d7d57817d08f73b6693c7ed7c632932
SHA256 7ea2c1cdb0947698fcc82e9c7624c63a92d73671dd48d368a35c968a77a6cfac
SHA512 14ea70502134fd28f709071da5d9a1adf4fe7fc08fea5afdc22092374043219eb5bae6a8506000efbcf231bc05162ab34d2fc95015156ac3fbc84da35ab8b928

memory/4884-6-0x000002E1733D0000-0x000002E1733F2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lpo5krzj.akw.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4884-14-0x000002E173890000-0x000002E1738D4000-memory.dmp

memory/4884-15-0x000002E173960000-0x000002E1739D6000-memory.dmp

memory/3396-16-0x00007FF89CA70000-0x00007FF89CA80000-memory.dmp

memory/3396-18-0x00007FF89CA70000-0x00007FF89CA80000-memory.dmp

memory/3396-17-0x00007FF89CA70000-0x00007FF89CA80000-memory.dmp

memory/3396-19-0x00007FF89CA70000-0x00007FF89CA80000-memory.dmp

memory/3396-20-0x00007FF89CA70000-0x00007FF89CA80000-memory.dmp

memory/3396-21-0x00007FF89A110000-0x00007FF89A120000-memory.dmp

memory/3396-22-0x00007FF89A110000-0x00007FF89A120000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

MD5 e08434ddd350335ae8a5d3b88c7f3bc3
SHA1 85b1dcc343eb166772ea4beb8c49ebfc129f5d16
SHA256 4dfc6d2a56591886b2ee22312e7e7aed4b0082f8b3ff95892c25c92a91bee994
SHA512 c5c5ed859c2d9e4127cebace39abb0e2271074fd531307730834113db8bb7ba44899eaf01f72e39e0d2cb44032cd592ca8b390d6171e51826c9b0f9cd5c347ad

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

MD5 912142518f22b1ce19e4c25765018d36
SHA1 00916ef0f26ff318a96c375629872492a829a7db
SHA256 d509afbc041c0c89ef02c42958aaf2c71d06e66cb922fcdc30b79ad2d5d7f107
SHA512 a9bd43307ec0d848e6a17cf4c3cefc2da39b83bf74414661af0c815a9590b823e318312c669cf1a666d325172903bae43fbc6ecbde7f98f02d6120bc71559c75

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

MD5 a91ac6b399eee533c963b86cff1c9b36
SHA1 15f9002c736e5973e71a4c3159b7cc6aa16d3e67
SHA256 fed2a2226d71249c12370a91aa5057a5fa97378fab3b5823944002d9edc2cdf9
SHA512 1e4ca876033523e6bbe106831cbf01d3633a29790e58a81c50a64b0aa12160a9b59fe608ca8acfa08de9454115b049d590b8a45d4cd036778b9aca07bf440cd4

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 9df996a233fbbed30f94630780fcfc3a
SHA1 3e10110979768ba99de8d87a374e5c2b221580ae
SHA256 0ec20ac5ecb9fa252a7b3e0163f36cfe529310dd9ed3754d363eca6ebefab8c1
SHA512 65145b86cf9388adbc9d371f2633bd150134596bbda124f09415b08727d9b2a307eed160cb52a7f0e24e56fabee919fec811428c180ebaa31f694205b2bff490

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 2f07685ea3cc28d551db00e6d1cc246e
SHA1 6a09b8b4b50b84dc5a4547b74fb8cb0f343a8513
SHA256 ca139020a41563dc81f2faa5cae14e6665c32a155f79ce6811558e228add3a62
SHA512 861b6d4bbd32570b052852a3f855d9ef076f286eec6835e72b3d0071158edc38e990ffade576281edd55a07f3b453cf2a45f2024e8587127ed94f150fa00abb8

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

MD5 a26df49623eff12a70a93f649776dab7
SHA1 efb53bd0df3ac34bd119adf8788127ad57e53803
SHA256 4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245
SHA512 e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

MD5 36a3f1f08aaa7f5bd7e821d0b49c3008
SHA1 d5d2cf910666d7ec117179023e5b040ddc376dd2
SHA256 7ea83c30e1d4e70a25a321d67188aa031581f4533141f6219c63c7d96f6273c1
SHA512 f0a1e1c42a224f65aeb0c293c6180c12b5c374685f9bd8d2104046546a31a91929f748b6ad47744824edf9af03da042ca1aec66faa2c33a288ce61ab6e88c3c5

memory/4884-78-0x000002E171250000-0x000002E171258000-memory.dmp

memory/4884-79-0x000002E1733C0000-0x000002E1733CC000-memory.dmp

memory/4040-80-0x0000000000A00000-0x0000000000A40000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 e471065a1b3dd2a880666e8f93c0299f
SHA1 c4bb2ab71b256d7b1665bb857f22cfa6c76b0150
SHA256 0b0e6bd2aa2a2296ab8de04d5009393e04d0fb478fcd0fd24f0d3beabef94275
SHA512 1724e8f50e5d9414bbbe9fcc5dc4267584dbec57615abc787898b0830460bd0e35f1e27f67a2e1d8010dff10856486178048de0d0679c6e180c4af2a388749a9

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 9461a7cfb20ff5381df28f51b80c5ef1
SHA1 c86c53fca1dcbe307dafbefbb366abf52c9f5eca
SHA256 d4af1948337d0deb725f4f2b1fe1a9b60f4519841e28748b11bfd62ccd71e028
SHA512 da1e17f67dfebb004ba93d489be504fd7af6d62709ada2581ffa77880baecdaa0015b49d36333d18216d9dc6aad7b0ea2e5bd224d8d3f65ee9b66a05fc45e304

memory/4040-100-0x00000000053E0000-0x0000000005984000-memory.dmp

memory/4040-101-0x0000000005060000-0x00000000050C6000-memory.dmp

memory/4040-102-0x0000000006470000-0x00000000064C0000-memory.dmp

memory/4040-103-0x0000000006560000-0x00000000065F2000-memory.dmp

memory/4040-104-0x00000000064E0000-0x00000000064EA000-memory.dmp