Resubmissions

02-06-2022 22:15

220602-16kn1abhf3 10

02-06-2022 21:45

220602-1mh13abha3 7

02-06-2022 21:44

220602-1ln6pabgh8 8

02-06-2022 21:40

220602-1jcpwabgh5 10

02-06-2022 21:27

220602-1ay7hsffap 10

Analysis

  • max time kernel
    40s
  • max time network
    43s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    02-06-2022 22:15

General

  • Target

    Scan_282.jpg.lnk

  • Size

    1KB

  • MD5

    371924fdfffd4ca69857e94260c34a74

  • SHA1

    2a1dc23c24010a8b5ef3b512ea3e3c6d2f52a44b

  • SHA256

    801086851a46749a95efc050102fb85b761c0ccb191dfd29ff39c6b7cacb6292

  • SHA512

    f9cbf21c27cf3473a2b73141dfd728d9d8824d20afc24f4b4b93ca5bf9536bd594c7a6d4100be2a2fc9c8e4b85b9dcf9797f61f60267128ea31cb44bfb43aba0

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Scan_282.jpg.lnk
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1304
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -w h -file 1728.ps1
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1208

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1208-101-0x000007FEF6B80000-0x000007FEF6BE9000-memory.dmp

    Filesize

    420KB

  • memory/1208-96-0x000007FEF35A0000-0x000007FEF38CE000-memory.dmp

    Filesize

    3.2MB

  • memory/1208-111-0x000007FEF2DC0000-0x000007FEF2F55000-memory.dmp

    Filesize

    1.6MB

  • memory/1208-103-0x000007FEF4E60000-0x000007FEF5D3C000-memory.dmp

    Filesize

    14.9MB

  • memory/1208-102-0x000007FEF6B40000-0x000007FEF6B72000-memory.dmp

    Filesize

    200KB

  • memory/1208-95-0x000007FEF4E60000-0x000007FEF5D3C000-memory.dmp

    Filesize

    14.9MB

  • memory/1208-97-0x000007FEF6960000-0x000007FEF6A12000-memory.dmp

    Filesize

    712KB

  • memory/1208-98-0x00000000028E4000-0x00000000028E7000-memory.dmp

    Filesize

    12KB

  • memory/1208-100-0x000007FEF4430000-0x000007FEF4E53000-memory.dmp

    Filesize

    10.1MB

  • memory/1208-99-0x000007FEF38D0000-0x000007FEF442D000-memory.dmp

    Filesize

    11.4MB

  • memory/1208-93-0x000007FEF4430000-0x000007FEF4E53000-memory.dmp

    Filesize

    10.1MB

  • memory/1208-94-0x000007FEF38D0000-0x000007FEF442D000-memory.dmp

    Filesize

    11.4MB

  • memory/1208-104-0x000007FEF68B0000-0x000007FEF695A000-memory.dmp

    Filesize

    680KB

  • memory/1208-105-0x000007FEF67C0000-0x000007FEF68A5000-memory.dmp

    Filesize

    916KB

  • memory/1208-106-0x000007FEF3380000-0x000007FEF3596000-memory.dmp

    Filesize

    2.1MB

  • memory/1208-107-0x000007FEF6780000-0x000007FEF67BE000-memory.dmp

    Filesize

    248KB

  • memory/1208-108-0x000007FEF3260000-0x000007FEF3378000-memory.dmp

    Filesize

    1.1MB

  • memory/1208-110-0x000007FEF25C0000-0x000007FEF2C65000-memory.dmp

    Filesize

    6.6MB

  • memory/1208-109-0x000007FEF2F60000-0x000007FEF30CC000-memory.dmp

    Filesize

    1.4MB

  • memory/1304-54-0x000007FEFBDC1000-0x000007FEFBDC3000-memory.dmp

    Filesize

    8KB