ae0ef6f7368de8b504832aadf49b703a40c30aba33a9077d77cec13ff7bb2ab0

General

Target

30042024_0855_lnvoice_bill___(83737738837)388475.ps1
Size

267KB
MD5

a27a0d0efc218a34b3869de11abc6f96
SHA1

c76826e0326325c3381e8f59b176077c2f717bba
SHA256

ae0ef6f7368de8b504832aadf49b703a40c30aba33a9077d77cec13ff7bb2ab0
SHA512

e79ec4ce989c0b54747d9d85dcef3f52021defe66a48c2ac57b76c6f1f6318a75b916e0fa575bb4304415e5cfc820356f378b164b818175c1b1d3ce8e644c9b8
SSDEEP

6144:SGNQeKCEIqQWVUBFJHFet4UHjbpjDB7oHv+JUB93CsL9QIH/zT:SGNQeKCEIqQWVUBFJHFelD1DB7oHv+Jk

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4776	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3924	powershell.exe
3924	powershell.exe
1564	powershell.exe
1564	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3924	powershell.exe
Token: SeDebugPrivilege	1564	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3924 wrote to memory of 4020	3924	powershell.exe	86
PID 3924 wrote to memory of 4020	3924	powershell.exe	86
PID 4020 wrote to memory of 1564	4020	WScript.exe	87
PID 4020 wrote to memory of 1564	4020	WScript.exe	87
PID 1564 wrote to memory of 3504	1564	powershell.exe	89
PID 1564 wrote to memory of 3504	1564	powershell.exe	89
PID 3504 wrote to memory of 4776	3504	cmd.exe	90
PID 3504 wrote to memory of 4776	3504	cmd.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\30042024_0855_lnvoice_bill___(83737738837)388475.ps1
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3924
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\ProgramData\Express\xx.vbs"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4020
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\ProgramData\Express\xx.bat
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1564
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Express\xx.bat""
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3504
    - - C:\Windows\system32\schtasks.exe
        
        schtasks.exe /create /tn Express /sc minute /mo 3 /tr "C:\ProgramData\Express\Cotrl.vbs"
        5⤵
        Creates scheduled task(s)
        
        PID:4776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Express\xx.bat

Filesize
95B

MD5
43ff49fbde6f4391891cf2a46b406da4

SHA1
695b9eb511af67cab16d5cf108258947f864e2da

SHA256
5ad35cc29456c109608243d046951e541ee44aef379eea3a5304e6a17a1b806f

SHA512
ac9e4fb602412aedc65dd5ac312b7c61d4ed183d4e2150d98c4b5c485caafc3a42f3c26fdfc68c4a305e1a9ed40e9b63898f02932a3247019d2c66d822939364

Download Submit
C:\ProgramData\Express\xx.vbs

Filesize
775B

MD5
c840c0438f2fae0ddda74a43411a9b01

SHA1
786f5955d835d1d4c137ffed6a15fdfa6b5d5db0

SHA256
e262ddea8db55b52c2aee29444ef27b28f6a0f0da3e4c79ae823e8ad67ef1749

SHA512
142da2962e2a7897e1f96aa98d178fcc7f8729c76c090bf04b3a3a358cc75ac10933278fa78295eb649634471a31b16c399ebc417a3205dbc31583a2a3c9d78d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
223bd4ae02766ddc32e6145fd1a29301

SHA1
900cfd6526d7e33fb4039a1cc2790ea049bc2c5b

SHA256
1022ec2fed08ff473817fc53893e192a8e33e6a16f3d2c8cb6fd37f49c938e1e

SHA512
648cd3f8a89a18128d2b1bf960835e087a74cdbc783dbfcc712b3cb9e3a2e4f715e534ba2ef81d89af8f60d4882f6859373248c875ceb26ad0922e891f2e74cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
5161e9d6b9b677b7af6e5bb11a361b91

SHA1
9fe0a04c2bb86467b9aa584c78db4fc7eccfdd42

SHA256
addb0aa038e121d21d7b4bd4ba49316c05294a582cb430eb37ce3925324bd3d0

SHA512
95b4a85b4240145d35f1f14bc07ee87b597d484935599f898074be16a7bfcc6fdb36e31e5afedac1c83bdbcbf402c40a3573f2b3512ba521f3ad29fd503f7749

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fk1iuh42.ij3.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/3924-5-0x000001C5B0D80000-0x000001C5B0DA2000-memory.dmp

Filesize
136KB

Download
memory/3924-10-0x00007FFD98820000-0x00007FFD992E1000-memory.dmp

Filesize
10.8MB

Download
memory/3924-12-0x000001C5B0490000-0x000001C5B04A0000-memory.dmp

Filesize
64KB

Download
memory/3924-11-0x000001C5B0490000-0x000001C5B04A0000-memory.dmp

Filesize
64KB

Download
memory/3924-23-0x00007FFD98820000-0x00007FFD992E1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads