Overview
overview
10Static
static
3˳20...oc.lnk
windows7-x64
3˳20...oc.lnk
windows10-2004-x64
7˳20...�.xlsx
windows7-x64
1˳20...�.xlsx
windows10-2004-x64
1顺丰2023...rv.exe
windows7-x64
10顺丰2023...rv.exe
windows10-2004-x64
10顺丰2023...pt.vbs
windows7-x64
10顺丰2023...pt.vbs
windows10-2004-x64
10顺丰2023...nt.dll
windows7-x64
1顺丰2023...nt.dll
windows10-2004-x64
1Analysis
-
max time kernel
145s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
31-08-2023 04:59
Static task
static1
Behavioral task
behavioral1
Sample
˳20234²Ա/20234²ԱԱ.doc.lnk
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
˳20234²Ա/20234²ԱԱ.doc.lnk
Resource
win10v2004-20230703-en
Behavioral task
behavioral3
Sample
˳20234²Ա/嵥б/Ա嵥.xlsx
Resource
win7-20230712-en
Behavioral task
behavioral4
Sample
˳20234²Ա/嵥б/Ա嵥.xlsx
Resource
win10v2004-20230703-en
Behavioral task
behavioral5
Sample
顺丰2023年4月裁员名单/清单列表/.__MACOSX__/闕ウ�ュ隴�/._MACOS_/NisSrv.exe
Resource
win7-20230824-en
Behavioral task
behavioral6
Sample
顺丰2023年4月裁员名单/清单列表/.__MACOSX__/闕ウ�ュ隴�/._MACOS_/NisSrv.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral7
Sample
顺丰2023年4月裁员名单/清单列表/.__MACOSX__/闕ウ�ュ隴�/._MACOS_/apt.vbs
Resource
win7-20230712-en
Behavioral task
behavioral8
Sample
顺丰2023年4月裁员名单/清单列表/.__MACOSX__/闕ウ�ュ隴�/._MACOS_/apt.vbs
Resource
win10v2004-20230703-en
Behavioral task
behavioral9
Sample
顺丰2023年4月裁员名单/清单列表/.__MACOSX__/闕ウ�ュ隴�/._MACOS_/mpclient.dll
Resource
win7-20230712-en
Behavioral task
behavioral10
Sample
顺丰2023年4月裁员名单/清单列表/.__MACOSX__/闕ウ�ュ隴�/._MACOS_/mpclient.dll
Resource
win10v2004-20230703-en
General
-
Target
顺丰2023年4月裁员名单/清单列表/.__MACOSX__/闕ウ�ュ隴�/._MACOS_/apt.vbs
-
Size
265B
-
MD5
a513cda58ecfa219a487807b3e41c6e4
-
SHA1
4beb5b4e9011113fa46dc4012f2636de2fbfa602
-
SHA256
7f759dc9bd152d933acab73cd2710324ba1ee063dd7af602825847eb1b7ae825
-
SHA512
cfb620c5e3cbecb5dcf88fc0c718db038bb1cb0330d5504c5f878c057089881d73b441b6d39af9b6e1e79112db840d9706417888c1a1bdd09b4cb50b6ed300a7
Malware Config
Extracted
cobaltstrike
100000
http://bsupport.huawei.com:80/audiencemanager.js
-
access_type
512
-
host
bsupport.huawei.com,/audiencemanager.js
-
http_header1
AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAABAAAAAaSG9zdDogc3RhdGljLm1pY3Jvc29mdC5jb20AAAAKAAAAJlJlZmVyZXI6IGh0dHBzOi8vc3RhdGljLm1pY3Jvc29mdC5jb20vAAAACgAAAB5BY2NlcHQtRW5jb2Rpbmc6IGd6aXAsIGRlZmxhdGUAAAAHAAAAAAAAAA0AAAACAAAACF9fbXMtY3Y9AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAABAAAAAVSG9zdDogY2RuLmJvb3Rjc3MuY29tAAAACgAAACBSZWZlcmVyOiBodHRwOi8vY2RuLmJvb3Rjc3MuY29tLwAAAAoAAAAeQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlAAAABwAAAAAAAAANAAAABQAAAAdfX21zLWN2AAAABwAAAAEAAAANAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
jitter
9472
-
polling_time
30000
-
port_number
80
-
sc_process32
%windir%\syswow64\runonce.exe
-
sc_process64
%windir%\sysnative\runonce.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCEhSlSrqe08fqi2sm/HDDQ/TULIO/SwoS+x4kBoCzrWo49EzP4g4IiU4V9blbEBfc48fOrI7vVMRHBnnibaOsgAgnfzQ7n2/jw3af65qHQSOgbt8SSfs36WfCbzPKMc1tGpgiqYG+hAFGu/snKl0iZSddRLL8csTaipueoauIGWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
1.435374848e+09
-
unknown2
AAAABAAAAAEAAAf+AAAAAgAAIUwAAAACAAAPtQAAAA0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/audiencemanager-v2.js
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4044.62 Safari/537.36
-
watermark
100000
Signatures
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
WScript.exedescription pid process target process PID 1964 wrote to memory of 2248 1964 WScript.exe NisSrv.exe PID 1964 wrote to memory of 2248 1964 WScript.exe NisSrv.exe PID 1964 wrote to memory of 2248 1964 WScript.exe NisSrv.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\顺丰2023年4月裁员名单\清单列表\.__MACOSX__\闕ウ�ュ隴�\._MACOS_\apt.vbs"1⤵
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\顺丰2023年4月裁员名单\清单列表\.__MACOSX__\闕ウ�ュ隴�\._MACOS_\NisSrv.exe"C:\Users\Admin\AppData\Local\Temp\顺丰2023年4月裁员名单\清单列表\.__MACOSX__\闕ウ�ュ隴�\._MACOS_\NisSrv.exe"2⤵PID:2248
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2248-0-0x0000000001BF0000-0x0000000001C31000-memory.dmpFilesize
260KB
-
memory/2248-5-0x0000000027BF0000-0x0000000027C3F000-memory.dmpFilesize
316KB
-
memory/2248-4-0x0000000001EE0000-0x0000000001F2F000-memory.dmpFilesize
316KB
-
memory/2248-6-0x0000000073D90000-0x00000000745B2000-memory.dmpFilesize
8.1MB