8ea25999fe93b84c817faa74af0ad94f0c0064d8e28fba5fea17665c38695430

Target

Scan_282.jpg.lnk
Size

1KB
MD5

371924fdfffd4ca69857e94260c34a74
SHA1

2a1dc23c24010a8b5ef3b512ea3e3c6d2f52a44b
SHA256

801086851a46749a95efc050102fb85b761c0ccb191dfd29ff39c6b7cacb6292
SHA512

f9cbf21c27cf3473a2b73141dfd728d9d8824d20afc24f4b4b93ca5bf9536bd594c7a6d4100be2a2fc9c8e4b85b9dcf9797f61f60267128ea31cb44bfb43aba0

Score

7^/10

Malware Config

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

cmd.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description	pid	Process	procid_target
PID 2704 wrote to memory of 1872	2704	cmd.exe	79
PID 2704 wrote to memory of 1872	2704	cmd.exe	79

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Scan_282.jpg.lnk
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -w h -file 1728.ps1
  2⤵
  PID:1872

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact