Analysis
-
max time kernel
138s -
max time network
140s -
platform
windows7_x64 -
resource
win7-en -
submitted
13-09-2021 17:15
Static task
static1
Behavioral task
behavioral1
Sample
currCurrPl.hta
Resource
win7-en
Behavioral task
behavioral2
Sample
currCurrPl.hta
Resource
win10v20210408
General
-
Target
currCurrPl.hta
-
Size
2KB
-
MD5
29218d420ce0c0f84c301c035801f6ff
-
SHA1
e61258fb5fc9ce9b814b276298885fee5e16083d
-
SHA256
d869fccdb3807528fb62cabc388d4ad9da641fc3354c4432ce2a93ce99e43d3c
-
SHA512
591ee976ab70304faf1283dedea6101cd0b592560984dd60d70e5aabd0e20bb1e24e8f281414a51f7eff842802bd1901b118170431b50720cfad80e4e0c29ea3
Malware Config
Extracted
trickbot
2000033
zem1
179.42.137.102:443
191.36.152.198:443
179.42.137.104:443
179.42.137.106:443
179.42.137.108:443
202.183.12.124:443
194.190.18.122:443
103.56.207.230:443
171.103.187.218:449
171.103.189.118:449
18.139.111.104:443
179.42.137.105:443
186.4.193.75:443
171.101.229.2:449
179.42.137.107:443
103.56.43.209:449
179.42.137.110:443
45.181.207.156:443
197.44.54.162:449
179.42.137.109:443
103.59.105.226:449
45.181.207.101:443
117.196.236.205:443
72.224.45.102:449
179.42.137.111:443
96.47.239.181:443
171.100.112.190:449
117.196.239.6:443
-
autorunName:pwgrabbName:pwgrabc
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
mshta.exeflow pid process 7 1512 mshta.exe -
Downloads MZ/PE file
-
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 1664 regsvr32.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 16 ip.anysrc.net -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
mshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
wermgr.exedescription pid process Token: SeDebugPrivilege 1012 wermgr.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
mshta.exeregsvr32.exedescription pid process target process PID 1512 wrote to memory of 1664 1512 mshta.exe regsvr32.exe PID 1512 wrote to memory of 1664 1512 mshta.exe regsvr32.exe PID 1512 wrote to memory of 1664 1512 mshta.exe regsvr32.exe PID 1512 wrote to memory of 1664 1512 mshta.exe regsvr32.exe PID 1512 wrote to memory of 1664 1512 mshta.exe regsvr32.exe PID 1512 wrote to memory of 1664 1512 mshta.exe regsvr32.exe PID 1512 wrote to memory of 1664 1512 mshta.exe regsvr32.exe PID 1664 wrote to memory of 1012 1664 regsvr32.exe wermgr.exe PID 1664 wrote to memory of 1012 1664 regsvr32.exe wermgr.exe PID 1664 wrote to memory of 1012 1664 regsvr32.exe wermgr.exe PID 1664 wrote to memory of 1012 1664 regsvr32.exe wermgr.exe PID 1664 wrote to memory of 1012 1664 regsvr32.exe wermgr.exe PID 1664 wrote to memory of 1012 1664 regsvr32.exe wermgr.exe
Processes
-
C:\Windows\SysWOW64\mshta.exeC:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\currCurrPl.hta"1⤵
- Blocklisted process makes network request
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" c:\users\public\currCurrPl.jpg2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe3⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\??\c:\users\public\currCurrPl.jpgMD5
7e41bfedd26ac058eb4497c11d597be8
SHA1157ae96e4ad26d19e0971c390ae0cde03a983465
SHA25649e55b5bf1b26c74dedcfa9bdae97b8860b817782b7db564c06a58e30f27c560
SHA5122f64c737b2a15e3e40242480c073c69ea72694c2aeb71a783da389f1948ba4afcbfc46bbad2373d640e6d63e9a3455a6598f0f385451bd854fdf3bce9bb037fc
-
\Users\Public\currCurrPl.jpgMD5
7e41bfedd26ac058eb4497c11d597be8
SHA1157ae96e4ad26d19e0971c390ae0cde03a983465
SHA25649e55b5bf1b26c74dedcfa9bdae97b8860b817782b7db564c06a58e30f27c560
SHA5122f64c737b2a15e3e40242480c073c69ea72694c2aeb71a783da389f1948ba4afcbfc46bbad2373d640e6d63e9a3455a6598f0f385451bd854fdf3bce9bb037fc
-
memory/1012-66-0x0000000000000000-mapping.dmp
-
memory/1012-68-0x0000000000190000-0x0000000000191000-memory.dmpFilesize
4KB
-
memory/1012-67-0x0000000000060000-0x0000000000089000-memory.dmpFilesize
164KB
-
memory/1512-53-0x00000000756A1000-0x00000000756A3000-memory.dmpFilesize
8KB
-
memory/1664-54-0x0000000000000000-mapping.dmp
-
memory/1664-58-0x0000000010000000-0x0000000010004000-memory.dmpFilesize
16KB
-
memory/1664-60-0x00000000001A0000-0x00000000001D8000-memory.dmpFilesize
224KB
-
memory/1664-63-0x00000000001E0000-0x0000000000225000-memory.dmpFilesize
276KB
-
memory/1664-65-0x0000000000241000-0x0000000000243000-memory.dmpFilesize
8KB
-
memory/1664-64-0x0000000000390000-0x00000000003A1000-memory.dmpFilesize
68KB