9a3c69a9e5f02c1e3022586c5ffe3e9dca7224f4c5107ce1f758eae62f747576

Resubmissions

19-08-2021 15:28

22-07-2021 08:22

Target

1.hta
Size

2KB
MD5

c5f48abc68324cd059e74b35c44b64c7
SHA1

e68b086934eb0d4576ac3711062efba4236df436
SHA256

9a3c69a9e5f02c1e3022586c5ffe3e9dca7224f4c5107ce1f758eae62f747576
SHA512

271dedd705ed5a64cda497d0b86cd1509f34911602aac65cbc8a5120ef37efccc2ec8d45538cec29e1bbb5aa5fb5d76aa0a3502e00208e0c4067d4dd9b465d21

Score

8^/10

Blocklisted process makes network request 1 IoCs

Processes:

mshta.exe

flow pid process

7 1660 mshta.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

mshta.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main mshta.exe

flow	pid	process
7	1660	mshta.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

mshta.exe

description	pid	process	target process
PID 1660 wrote to memory of 1480	1660	mshta.exe	regsvr32.exe
PID 1660 wrote to memory of 1480	1660	mshta.exe	regsvr32.exe
PID 1660 wrote to memory of 1480	1660	mshta.exe	regsvr32.exe
PID 1660 wrote to memory of 1480	1660	mshta.exe	regsvr32.exe
PID 1660 wrote to memory of 1480	1660	mshta.exe	regsvr32.exe
PID 1660 wrote to memory of 1480	1660	mshta.exe	regsvr32.exe
PID 1660 wrote to memory of 1480	1660	mshta.exe	regsvr32.exe

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" c:\users\public\simpleAndAnd.jpg
2⤵
PID:1480

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

memory/1480-60-0x0000000000000000-mapping.dmp

Download
memory/1480-61-0x0000000076E11000-0x0000000076E13000-memory.dmp

Filesize
8KB

Download
memory/1480-62-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download