Overview
overview
10Static
static
3˳20...oc.lnk
windows7-x64
3˳20...oc.lnk
windows10-2004-x64
7˳20...�.xlsx
windows7-x64
1˳20...�.xlsx
windows10-2004-x64
1顺丰2023...rv.exe
windows7-x64
10顺丰2023...rv.exe
windows10-2004-x64
10顺丰2023...pt.vbs
windows7-x64
10顺丰2023...pt.vbs
windows10-2004-x64
10顺丰2023...nt.dll
windows7-x64
1顺丰2023...nt.dll
windows10-2004-x64
1Analysis
-
max time kernel
143s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
31-08-2023 04:59
Static task
static1
Behavioral task
behavioral1
Sample
˳20234²Ա/20234²ԱԱ.doc.lnk
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
˳20234²Ա/20234²ԱԱ.doc.lnk
Resource
win10v2004-20230703-en
Behavioral task
behavioral3
Sample
˳20234²Ա/嵥б/Ա嵥.xlsx
Resource
win7-20230712-en
Behavioral task
behavioral4
Sample
˳20234²Ա/嵥б/Ա嵥.xlsx
Resource
win10v2004-20230703-en
Behavioral task
behavioral5
Sample
顺丰2023年4月裁员名单/清单列表/.__MACOSX__/闕ウ�ュ隴�/._MACOS_/NisSrv.exe
Resource
win7-20230824-en
Behavioral task
behavioral6
Sample
顺丰2023年4月裁员名单/清单列表/.__MACOSX__/闕ウ�ュ隴�/._MACOS_/NisSrv.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral7
Sample
顺丰2023年4月裁员名单/清单列表/.__MACOSX__/闕ウ�ュ隴�/._MACOS_/apt.vbs
Resource
win7-20230712-en
Behavioral task
behavioral8
Sample
顺丰2023年4月裁员名单/清单列表/.__MACOSX__/闕ウ�ュ隴�/._MACOS_/apt.vbs
Resource
win10v2004-20230703-en
Behavioral task
behavioral9
Sample
顺丰2023年4月裁员名单/清单列表/.__MACOSX__/闕ウ�ュ隴�/._MACOS_/mpclient.dll
Resource
win7-20230712-en
Behavioral task
behavioral10
Sample
顺丰2023年4月裁员名单/清单列表/.__MACOSX__/闕ウ�ュ隴�/._MACOS_/mpclient.dll
Resource
win10v2004-20230703-en
General
-
Target
顺丰2023年4月裁员名单/清单列表/.__MACOSX__/闕ウ�ュ隴�/._MACOS_/apt.vbs
-
Size
265B
-
MD5
a513cda58ecfa219a487807b3e41c6e4
-
SHA1
4beb5b4e9011113fa46dc4012f2636de2fbfa602
-
SHA256
7f759dc9bd152d933acab73cd2710324ba1ee063dd7af602825847eb1b7ae825
-
SHA512
cfb620c5e3cbecb5dcf88fc0c718db038bb1cb0330d5504c5f878c057089881d73b441b6d39af9b6e1e79112db840d9706417888c1a1bdd09b4cb50b6ed300a7
Malware Config
Extracted
cobaltstrike
100000
http://bsupport.huawei.com:80/audiencemanager.js
-
access_type
512
-
host
bsupport.huawei.com,/audiencemanager.js
-
http_header1
AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAABAAAAAaSG9zdDogc3RhdGljLm1pY3Jvc29mdC5jb20AAAAKAAAAJlJlZmVyZXI6IGh0dHBzOi8vc3RhdGljLm1pY3Jvc29mdC5jb20vAAAACgAAAB5BY2NlcHQtRW5jb2Rpbmc6IGd6aXAsIGRlZmxhdGUAAAAHAAAAAAAAAA0AAAACAAAACF9fbXMtY3Y9AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAABAAAAAVSG9zdDogY2RuLmJvb3Rjc3MuY29tAAAACgAAACBSZWZlcmVyOiBodHRwOi8vY2RuLmJvb3Rjc3MuY29tLwAAAAoAAAAeQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlAAAABwAAAAAAAAANAAAABQAAAAdfX21zLWN2AAAABwAAAAEAAAANAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
jitter
9472
-
polling_time
30000
-
port_number
80
-
sc_process32
%windir%\syswow64\runonce.exe
-
sc_process64
%windir%\sysnative\runonce.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCEhSlSrqe08fqi2sm/HDDQ/TULIO/SwoS+x4kBoCzrWo49EzP4g4IiU4V9blbEBfc48fOrI7vVMRHBnnibaOsgAgnfzQ7n2/jw3af65qHQSOgbt8SSfs36WfCbzPKMc1tGpgiqYG+hAFGu/snKl0iZSddRLL8csTaipueoauIGWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
1.435374848e+09
-
unknown2
AAAABAAAAAEAAAf+AAAAAgAAIUwAAAACAAAPtQAAAA0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/audiencemanager-v2.js
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4044.62 Safari/537.36
-
watermark
100000
Extracted
cobaltstrike
0
-
watermark
0
Signatures
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Control Panel\International\Geo\Nation WScript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
WScript.exedescription pid process target process PID 2392 wrote to memory of 4332 2392 WScript.exe NisSrv.exe PID 2392 wrote to memory of 4332 2392 WScript.exe NisSrv.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\顺丰2023年4月裁员名单\清单列表\.__MACOSX__\闕ウ�ュ隴�\._MACOS_\apt.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\顺丰2023年4月裁员名单\清单列表\.__MACOSX__\闕ウ�ュ隴�\._MACOS_\NisSrv.exe"C:\Users\Admin\AppData\Local\Temp\顺丰2023年4月裁员名单\清单列表\.__MACOSX__\闕ウ�ュ隴�\._MACOS_\NisSrv.exe"2⤵PID:4332
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4332-1-0x000001C937CA0000-0x000001C937CE1000-memory.dmpFilesize
260KB
-
memory/4332-4-0x000001C937CF0000-0x000001C937D3F000-memory.dmpFilesize
316KB
-
memory/4332-5-0x000001C937CA0000-0x000001C937CEF000-memory.dmpFilesize
316KB
-
memory/4332-6-0x0000000074AE0000-0x0000000075302000-memory.dmpFilesize
8.1MB
-
memory/4332-7-0x000001C937CA0000-0x000001C937CE1000-memory.dmpFilesize
260KB