IOCs: Artifacts: File name: DHL_AWB invoice.scr File name: 2207875.bat Analysis: Once the “cmd.exe” process had started, I noticed that there was a new file in the %TEMP% folder as well. The following is a cleaned up version of one of the batch files creeated.<\/p>\n Timing the creation of the batch files with the PCAP, it looks like it may have been reaching out to the “pornhouse[.]mobi” site at the same time. <\/p>\n![\"\"](\"http:\/\/www.herbiez.com\/wp-content\/uploads\/2018\/04\/email.png\")
<\/a><\/p>\n
\n=====
\n67[.]227.226[.]240 \/ pornhouse[.]mobi (GET \/main.php?dir=\/\/Virgin%20Babes%20First%20Sex&start=1&sort=1 HTTP\/1.0)<\/p>\n
\n==========
\nFile name: DHL_AWB invoice.ace
\nFile size: 361KB
\nFile path: NA
\nMD5 hash: 1a8b1c6a01679c78b0bb0ec701a17299
\nVirustotal: http:\/\/www.virustotal.com\/#\/file\/3b04d16d9bdad64afd5acfeca0e94d228ba481d00535ba9622daa111d81fa20b\/detection<\/a>
\nDetection ratio: 2 \/ 59
\nFirst Detected: 2018-04-20 11:02:07
\nHybrid Analysis: NA<\/p>\n
\nFile size: 830KB
\nFile path: NA
\nMD5 hash: 2df397766a1d4c2cfc0878d0f06e017c
\nVirustotal: NA
\nHybrid Analysis: http:\/\/www.hybrid-analysis.com\/sample\/0161db0f1201509c9a5ab91ce20974f4d239a3d55915fd81e39177835f2af623?environmentId=100<\/a>
\nAny.Run: http:\/\/app.any.run\/tasks\/f798e581-cfb9-4225-866f-48870e8db8de<\/a><\/p>\n
\nFile size: 94B
\nFile path: C:\\Users\\%username%\\AppData\\Local\\Temp
\nMD5 hash: 3880eeb1c736d853eb13b44898b718ab
\nVirustotal: http:\/\/www.virustotal.com\/#\/file\/936d9411d5226b7c5a150ecaf422987590a8870c8e095e1caa072273041a86e7\/detection<\/a>
\nDetection ratio: 26 \/ 60
\nFirst Detected: 2012-12-18 22:56:31
\nHybrid Analysis: http:\/\/www.hybrid-analysis.com\/search?query=3880eeb1c736d853eb13b44898b718ab<\/a><\/p>\n
\n=========
\nThis was a simple infection that stemed from extracting out the malicious screensaver file from the ACE archive. Once the malicious screensaver was ran, less than a minute later went by and the process terminated itself while starting up some child processes (process hollowing). Once the malware took foot, what I saw was the screensaver run, then terminate, while then creating a new thread for “cmd.exe” as seen below.<\/p>\n![\"\"](\"http:\/\/www.herbiez.com\/wp-content\/uploads\/2018\/04\/proceess-tree.png\")
<\/a><\/p>\n\r\n:ktk \r\ndel %1 \r\nif exist %1 goto \t\r\nktk\r\ndel %0<\/pre>\n
![\"\"](\"http:\/\/www.herbiez.com\/wp-content\/uploads\/2018\/04\/pcap.png\")
<\/a><\/p>\n
![\"\"](\"http:\/\/www.herbiez.com\/wp-content\/uploads\/2018\/04\/tcp_stream.png\")
<\/a><\/p>\n