63337d793d4fddd163b6bd6096b14203bcf39087e6c10fd655c32d45458fbbbb

General

Target
DOC-BG7UMS.hta
Size 2KB
Sample260803-xmd6bseb82
SHA256 63337d793d4fddd163b6bd6096b14203bcf39087e6c10fd655c32d45458fbbbb
MD5 37a9b7588a302e5b6cfb83049fc7a9f6
SHA1 2b1c66dafac7556adaa60863238155007a0fb24f
SHA512 5a574af50e1e17c10431b08d22c5f527a3baa6c8a1bfa769e0e0fba2b7cb6d289c78ebc2ab680696538fdf77ecc32a4d57fe800d988d067a74afde4d3b853396
TLSH
T14A51A6F7B94243C5BC7249AF5A2F608814D41A433366E4F8F687E901EF4CE5A45383E8
MD5 SHA1 SHA512 TLSH

Score

8^/10

adware defense_evasion discovery spyware

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	3912	mshta.exe
8	3912	mshta.exe
9	3912	mshta.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	rundll32.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	9	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4680	rundll32.exe
4400	rundll32.exe
1736	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3912 wrote to memory of 4400	3912	mshta.exe	89
PID 3912 wrote to memory of 4680	3912	mshta.exe	90
PID 3912 wrote to memory of 1736	3912	mshta.exe	91

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5052	attrib.exe

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\DOC-BG7UMS.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Badlisted process makes network request
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3912
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  PID:4400
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:00000000
    3⤵
    PID:4952
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  PID:4680
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:00000000
    3⤵
    PID:2100
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  PID:1736
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:00000000
    3⤵
    PID:2680
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
  2⤵
  PID:2828
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:00000000
    3⤵
    PID:1560
- C:\Windows\SysWOW64\attrib.exe
  "C:\Windows\System32\attrib.exe" +h +s "C:\svdqiddi\"
  2⤵
  - Views/modifies file attributes
  PID:5052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

a1.zip

Path C:\svdqiddi\a1.zip
Size 494KB
SHA256 95876859c76fe88a075cb13f7a77d4342784ac452bd3233402afb196368aa33c
MD5 0e2a4ee484aed02cd0189873c7eb6a45
SHA1 2479a17fafb6d3435e748c3d727a2b5da75714ed
SHA512 da57d3fe348d1eee1b0c4badb2bffa014263f0bba122e241f98a3a312626a6df5c9b316886bff5e253a070edbdfd677fd1fe59990232b5a790a267a402d45d44
SSDEEP 12288:cxU7hblQnL+/dh+Gez4yOGtBan225oCWp8SrIy:cq7hblmK/dgGeVlk22aCarIy
TLSH
T161B4231C22C4BD086D3D97FB58539F7405EA6A9E14B8024CE18B73C4ABCEF815F829E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a2.zip

Path C:\svdqiddi\a2.zip
Size 1.3MB
SHA256 afc2fa59fc610bcdf68ecfa00d7c444b6f338985640d184e9eff2201f663fd9d
MD5 843ce2aee73615895eadb3327a19aa00
SHA1 d7fafb155604313d1f07fe2574a619a6fc94a3a4
SHA512 2770d2b7baafe7cb4817cf72c964bf28a08a9ef14eb01387ed3acae9363bb2ae6ddf8ce9be246c5b100655e07f579020e9d815a5ca3b21e216138fa0c9bc5f27
SSDEEP 24576:ZAQYltjM5BqgdnjIyK2UxYGAXTZWyutR+kXM0JyU9mSff3Pc7pOU5JLMiE:ZAQUgNIkUx6TZW58kX9UU9mcfUF5J4iE
TLSH
T1625533F2195136CAA1ACBC1F05F057D581867C9ABFFE2B4E3641308E0D15F91BEB9268
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a3.zip

Path C:\svdqiddi\a3.zip
Size 2KB
SHA256 8851d1a483dcb2c4bb068aade34dde376d8a787131e34df2bcb478ab6b5ff2ea
MD5 76ca6c7e20e4a6912e0fd40104bb96ae
SHA1 c32c523de4e78d802b9c9b2e152437ae0b49b718
SHA512 93531c8ad20edc41acc3427085aab6254b67f50a9b525dcc79db8df9880f40faa67e7aa103115fdaaa984c4da3f3a070dbdb9ab60f0f26679c7fb21d4fe32f98
TLSH
T18A411AE98D7CBD91D6CE79B49A285871953B2EC499C461A91FBFEC052120398CA2F42C
MD5 SHA1 SHA512 TLSH

Submit Download

svdqiddi.exe

Path C:\svdqiddi\svdqiddi.exe
Size 957KB
SHA256 bdd2b7236a110b04c288380ad56e8d7909411da93eed2921301206de0cb0dda1
MD5 279274f8a137bf31425a9c2c14444b66
SHA1 6f7f971406854309d94139aa70bdc772308aff52
SHA512 2e69e99ae2c2f0c3361351853ecfcd1982ea542ef8aff9314e991642f106a87d45479f21f53367ad93b29ce9d98b60706ff9554a9c9d2a793fbed1589b90a85d
SSDEEP 24576:8SmEH7kpRArkvBz1oxovFDVeAj2HoB3a33rfBH:827kpRA4R1oGDVeQXsrf
TLSH
T11B259E0373D18022FF93A9721E5FE72656BC6D2A0323956F13D81EB9F9305B14A1E672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads