c129a8bf28d476a7280535f0ce192769d8cb1fa519bab306ff506c08cbcf7436

Analysis

max time kernel
4294178s
max time network
135s
platform
windows7_x64
resource
win7-20220311-en
submitted
25-03-2022 15:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Attachment.png.lnk
Size

1KB
MD5

f69905d19f03b83058a219513a0a7e48
SHA1

d0b0b2f0f27e054a0ab0f5e59a149d3d3552703e
SHA256

86ecbf142d41beffff01fdd56fb9c9786e2826cfe00593abeeb69162daf9d808
SHA512

c9c5aad4f5d5ca9d89b64a689977630a01b8075336e90edb6279c1064b735dc704e72b08daca807cdc968a8e57dc708d1d7e4c830c15aab73fdd62f486ef2b7f

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

656 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 656 powershell.exe

pid	process
656	powershell.exe

description	pid	process
Token: SeDebugPrivilege	656	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1040 wrote to memory of 656	1040	cmd.exe	powershell.exe
PID 1040 wrote to memory of 656	1040	cmd.exe	powershell.exe
PID 1040 wrote to memory of 656	1040	cmd.exe	powershell.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Attachment.png.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:1040

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -w h -file z.ps1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:656

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/656-88-0x0000000000000000-mapping.dmp

Download
memory/656-93-0x000007FEF2D00000-0x000007FEF385D000-memory.dmp

Filesize
11.4MB

Download
memory/656-94-0x0000000002834000-0x0000000002837000-memory.dmp

Filesize
12KB

Download
memory/1040-54-0x000007FEFB771000-0x000007FEFB773000-memory.dmp

Filesize
8KB

Download