| File name: | Loader.vbs |
| Full analysis: | https://app.any.run/tasks/2eaad993-3b53-4dac-8747-07eb53aa6d5d |
| Verdict: | Malicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | January 30, 2025, 09:16:58 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | text/plain |
| File info: | ASCII text, with very long lines (54467), with CRLF line terminators |
| MD5: | 8D5F24A56EA25EAC8902CB894310CE54 |
| SHA1: | D0EA9F51ADD9E14D55E601922105FF5C9D26E518 |
| SHA256: | B7BFD0ECC11D4B3AA7B6130B46BCB7B72CBA8917E17C5BBD57CB15AD668C7B38 |
| SSDEEP: | 3072:huGSHxttOY23B0d+asdLtMO2vY4kKsDKMvrX97e:MrV23ia2O2gaRMTN6 |
MALICIOUS
Bypass execution policy to execute commands
- powershell.exe (PID: 5652)
- powershell.exe (PID: 6520)
Run PowerShell with an invisible window
- powershell.exe (PID: 5652)
- powershell.exe (PID: 5036)
- powershell.exe (PID: 6520)
Changes powershell execution policy (Bypass)
- cmd.exe (PID: 2744)
Known privilege escalation attack
- dllhost.exe (PID: 836)
Adds process to the Windows Defender exclusion list
- dllhost.exe (PID: 836)
Changes the autorun value in the registry
- reg.exe (PID: 6500)
Request from PowerShell which ran from CMD.EXE
- powershell.exe (PID: 6520)
Gets or sets the initialization vector for the symmetric algorithm (POWERSHELL)
- powershell.exe (PID: 6520)
Uses AES cipher (POWERSHELL)
- powershell.exe (PID: 6520)
Dynamically loads an assembly (POWERSHELL)
- powershell.exe (PID: 6520)
Gets or sets the symmetric key that is used for encryption and decryption (POWERSHELL)
- powershell.exe (PID: 6520)
SUSPICIOUS
Runs shell command (SCRIPT)
- wscript.exe (PID: 936)
Creates FileSystem object to access computer's file system (SCRIPT)
- wscript.exe (PID: 936)
Application launched itself
- cmd.exe (PID: 5652)
Executing commands from a ".bat" file
- wscript.exe (PID: 936)
- cmd.exe (PID: 5652)
Writes binary data to a Stream object (SCRIPT)
- wscript.exe (PID: 936)
Starts CMD.EXE for commands execution
- wscript.exe (PID: 936)
- cmd.exe (PID: 5652)
Starts POWERSHELL.EXE for commands execution
- cmd.exe (PID: 2744)
- dllhost.exe (PID: 836)
The process bypasses the loading of PowerShell profile settings
- cmd.exe (PID: 2744)
Possibly malicious use of IEX has been detected
- cmd.exe (PID: 2744)
Uses base64 encoding (POWERSHELL)
- powershell.exe (PID: 5652)
- powershell.exe (PID: 6520)
CSC.EXE is used to compile C# code
- csc.exe (PID: 3848)
Executable content was dropped or overwritten
- csc.exe (PID: 3848)
Script adds exclusion process to Windows Defender
- dllhost.exe (PID: 836)
Script adds exclusion path to Windows Defender
- dllhost.exe (PID: 836)
Uses TASKKILL.EXE to kill process
- dllhost.exe (PID: 836)
Probably UAC bypass using CMSTP.exe (Connection Manager service profile)
- powershell.exe (PID: 5652)
Uses REG/REGEDIT.EXE to modify registry
- cmd.exe (PID: 2744)
Process requests binary or script from the Internet
- powershell.exe (PID: 6520)
Uses sleep to delay execution (POWERSHELL)
- powershell.exe (PID: 6520)
Connects to unusual port
- powershell.exe (PID: 6520)
Executes application which crashes
- powershell.exe (PID: 6520)
INFO
Checks proxy server information
- powershell.exe (PID: 5652)
- powershell.exe (PID: 6520)
- WerFault.exe (PID: 6892)
Disables trace logs
- powershell.exe (PID: 5652)
- cmstp.exe (PID: 3640)
- powershell.exe (PID: 6520)
Checks whether the specified file exists (POWERSHELL)
- powershell.exe (PID: 5652)
Checks supported languages
- csc.exe (PID: 3848)
- cvtres.exe (PID: 2324)
Create files in a temporary directory
- cvtres.exe (PID: 2324)
- csc.exe (PID: 3848)
Checks transactions between databases Windows and Oracle
- cmstp.exe (PID: 3640)
Checks if a key exists in the options dictionary (POWERSHELL)
- powershell.exe (PID: 5036)
Script raised an exception (POWERSHELL)
- powershell.exe (PID: 5036)
Found Base64 encoded network access via PowerShell (YARA)
- powershell.exe (PID: 5652)
Creates files in the program directory
- dllhost.exe (PID: 836)
Detects Fody packer (YARA)
- powershell.exe (PID: 5652)
Reads the machine GUID from the registry
- csc.exe (PID: 3848)
Found Base64 encoded text manipulation via PowerShell (YARA)
- conhost.exe (PID: 3732)
- cmd.exe (PID: 2744)
Found Base64 encoded access to environment variables via PowerShell (YARA)
- cmd.exe (PID: 2744)
Found Base64 encoded encryption-related PowerShell classes (YARA)
- cmd.exe (PID: 2744)
Found Base64 encoded file access via PowerShell (YARA)
- cmd.exe (PID: 2744)
Uses string split method (POWERSHELL)
- powershell.exe (PID: 6520)
Uses string replace method (POWERSHELL)
- powershell.exe (PID: 6520)
Gets data length (POWERSHELL)
- powershell.exe (PID: 6520)
Converts byte array into ASCII string (POWERSHELL)
- powershell.exe (PID: 6520)
Reads the software policy settings
- WerFault.exe (PID: 6892)
Creates files or folders in the user directory
- WerFault.exe (PID: 6892)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
146
Monitored processes
17
Malicious processes
5
Suspicious processes
2
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 836 | C:\WINDOWS\system32\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7} | C:\Windows\System32\dllhost.exe | svchost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: COM Surrogate Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 936 | "C:\WINDOWS\System32\WScript.exe" C:\Users\admin\AppData\Local\Temp\Loader.vbs | C:\Windows\System32\wscript.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.812.10240.16384 Modules
| |||||||||||||||
| 1556 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2324 | C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RES760E.tmp" "c:\Users\admin\AppData\Local\Temp\CSC45B5582D995C4898A88B61BA36A697D4.TMP" | C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe | — | csc.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft® Resource File To COFF Object Conversion Utility Exit code: 0 Version: 14.32.31326.0 Modules
| |||||||||||||||
| 2744 | C:\WINDOWS\system32\cmd.exe /K "C:\Users\admin\AppData\Local\Temp\c.bat" | C:\Windows\System32\cmd.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3640 | "C:\windows\system32\cmstp.exe" /au C:\windows\temp\t0jo4nbh.inf | C:\Windows\System32\cmstp.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Connection Manager Profile Installer Exit code: 1 Version: 7.2.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3732 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3848 | "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\tzbevyee.cmdline" | C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | powershell.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Visual C# Command Line Compiler Exit code: 0 Version: 4.8.9037.0 built by: NET481REL1 Modules
| |||||||||||||||
| 5036 | powershell -WindowStyle Hidden -c .('Add-MpP' + 'reference') -ExclusionPath C:\ -ExclusionProcess powershell.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | dllhost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows PowerShell Exit code: 1 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5604 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
22 082
Read events
22 056
Write events
26
Delete events
0
Modification events
| (PID) Process: | (3640) cmstp.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\CMSTP |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (3640) cmstp.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\CMSTP |
| Operation: | write | Name: | EnableAutoFileTracing |
Value: 0 | |||
| (PID) Process: | (3640) cmstp.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\CMSTP |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
| (PID) Process: | (3640) cmstp.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\CMSTP |
| Operation: | write | Name: | FileTracingMask |
Value: | |||
| (PID) Process: | (3640) cmstp.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\CMSTP |
| Operation: | write | Name: | ConsoleTracingMask |
Value: | |||
| (PID) Process: | (3640) cmstp.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\CMSTP |
| Operation: | write | Name: | MaxFileSize |
Value: 1048576 | |||
| (PID) Process: | (3640) cmstp.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\CMSTP |
| Operation: | write | Name: | FileDirectory |
Value: %windir%\tracing | |||
| (PID) Process: | (836) dllhost.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\cmmgr32.exe |
| Operation: | write | Name: | ProfileInstallPath |
Value: C:\ProgramData\Microsoft\Network\Connections\Cm | |||
| (PID) Process: | (3640) cmstp.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\Network Connections |
| Operation: | write | Name: | DesktopShortcut |
Value: 0 | |||
| (PID) Process: | (836) dllhost.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion |
| Operation: | write | Name: | SM_AccessoriesName |
Value: Accessories | |||
Executable files
1
Suspicious files
8
Text files
14
Unknown types
4
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 5652 | powershell.exe | C:\Users\admin\AppData\Local\Temp\tzbevyee.0.cs | text | |
MD5:B126AC3DA39FFA35CB857267CBC70CBB | SHA256:6E6DD39153A84B94B4F309A4C4521260CBDD8A6922ADE46096F42DA39BC20B93 | |||
| 936 | wscript.exe | C:\Users\admin\AppData\Local\Temp\c.bat | text | |
MD5:BFDCDFDFFC20E3A838CB9E9A372B7994 | SHA256:— | |||
| 5652 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_4s4geee2.3oh.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 5652 | powershell.exe | C:\Users\admin\AppData\Local\Temp\tzbevyee.cmdline | text | |
MD5:AE43697E6B935E10AC340CD9D3E666F0 | SHA256:— | |||
| 5652 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_vpyh4smp.cae.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 5036 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\WLID9EVI42DW8V6VMXKA.temp | binary | |
MD5:E8BB7B4EA4846E3A269D27F30C625911 | SHA256:65C88A1F8931796BE4AD8388BA70EE292DC670A2F01E814C3B24DC4AA1C61DF0 | |||
| 2744 | cmd.exe | C:\Users\admin\dwm.bat | text | |
MD5:BFDCDFDFFC20E3A838CB9E9A372B7994 | SHA256:— | |||
| 5036 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive | binary | |
MD5:F4B19C098E510AA7EE7CABA0E5F7CA75 | SHA256:— | |||
| 6892 | WerFault.exe | C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_powershell.exe_75a5b4b15495cf17fc468dccee367687630e79_bcaed68b_25bf594c-be8e-4783-9568-c48a199c58e1\Report.wer | — | |
MD5:— | SHA256:— | |||
| 6892 | WerFault.exe | C:\Users\admin\AppData\Local\CrashDumps\powershell.exe.6520.dmp | — | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
32
DNS requests
18
Threats
4
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
1176 | svchost.exe | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
6520 | powershell.exe | GET | 200 | 156.253.250.62:5000 | http://156.253.250.62:5000/download/GeneratedScript.ps1 | unknown | — | — | unknown |
6708 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
6708 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
5032 | backgroundTaskHost.exe | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
6892 | WerFault.exe | GET | 200 | 23.48.23.143:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6892 | WerFault.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | unknown |
— | — | 51.124.78.146:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | unknown |
5064 | SearchApp.exe | 104.126.37.161:443 | www.bing.com | Akamai International B.V. | DE | unknown |
— | — | 2.17.190.73:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
5652 | powershell.exe | 168.119.145.117:443 | 0x0.st | Hetzner Online GmbH | DE | suspicious |
5004 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
1176 | svchost.exe | 20.190.159.129:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
1176 | svchost.exe | 2.17.190.73:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
1076 | svchost.exe | 23.35.238.131:443 | go.microsoft.com | AKAMAI-AS | DE | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
www.bing.com |
| unknown |
ocsp.digicert.com |
| unknown |
0x0.st |
| unknown |
settings-win.data.microsoft.com |
| unknown |
login.live.com |
| unknown |
go.microsoft.com |
| unknown |
slscr.update.microsoft.com |
| unknown |
www.microsoft.com |
| unknown |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
arc.msn.com |
| unknown |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2192 | svchost.exe | Misc activity | ET FILE_SHARING File Sharing Related Domain in DNS Lookup (0x0 .st) |
5652 | powershell.exe | Misc activity | ET FILE_SHARING File Sharing Domain Observed in TLS SNI (0x0 .st) |
6520 | powershell.exe | Potentially Bad Traffic | ET INFO PS1 Powershell File Request |
6520 | powershell.exe | Not Suspicious Traffic | ET INFO Windows Powershell User-Agent Usage |