Resubmissions

05-06-2022 15:10

220605-sj6zqabfd5 8

02-06-2022 19:49

220602-yjvvcabad9 10

Analysis

  • max time kernel
    41s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    02-06-2022 19:49

General

  • Target

    Scan_139.jpg.lnk

  • Size

    1KB

  • MD5

    ae4d8e1b3f31028acb611bdefbfa51b2

  • SHA1

    6327c8798e529dd479e7bdd99c314867a7cccd3b

  • SHA256

    f73826aa0bdf74bc777023b1e2c05fbb79194f81be1c2977af1fcbe6298740ff

  • SHA512

    4bc8d72294ee65c89e0a0815321e1d67ae9f3ed43d7dd7aabc3fc05d02c766ff68664873265e3ef01e1fee12807d9b52c218d23d03b0fd91520ab853ea883557

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Scan_139.jpg.lnk
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:360
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -w h -file 1662.ps1
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1000

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/360-54-0x000007FEFB8E1000-0x000007FEFB8E3000-memory.dmp

    Filesize

    8KB

  • memory/1000-88-0x0000000000000000-mapping.dmp

  • memory/1000-93-0x000007FEF3F20000-0x000007FEF4943000-memory.dmp

    Filesize

    10.1MB

  • memory/1000-94-0x000007FEF33C0000-0x000007FEF3F1D000-memory.dmp

    Filesize

    11.4MB

  • memory/1000-95-0x000007FEF4950000-0x000007FEF582C000-memory.dmp

    Filesize

    14.9MB

  • memory/1000-96-0x000007FEF3F20000-0x000007FEF4943000-memory.dmp

    Filesize

    10.1MB

  • memory/1000-97-0x000007FEF6450000-0x000007FEF6502000-memory.dmp

    Filesize

    712KB

  • memory/1000-98-0x0000000002784000-0x0000000002787000-memory.dmp

    Filesize

    12KB

  • memory/1000-99-0x000007FEF3090000-0x000007FEF33BE000-memory.dmp

    Filesize

    3.2MB

  • memory/1000-100-0x000007FEF33C0000-0x000007FEF3F1D000-memory.dmp

    Filesize

    11.4MB

  • memory/1000-101-0x000007FEF6C50000-0x000007FEF6CB9000-memory.dmp

    Filesize

    420KB

  • memory/1000-102-0x000007FEF4950000-0x000007FEF582C000-memory.dmp

    Filesize

    14.9MB

  • memory/1000-103-0x000007FEF66A0000-0x000007FEF66D2000-memory.dmp

    Filesize

    200KB

  • memory/1000-104-0x000007FEF63A0000-0x000007FEF644A000-memory.dmp

    Filesize

    680KB

  • memory/1000-105-0x000007FEF62B0000-0x000007FEF6395000-memory.dmp

    Filesize

    916KB

  • memory/1000-106-0x000007FEF2D50000-0x000007FEF2E68000-memory.dmp

    Filesize

    1.1MB

  • memory/1000-107-0x000007FEF6660000-0x000007FEF669E000-memory.dmp

    Filesize

    248KB

  • memory/1000-108-0x000007FEF2E70000-0x000007FEF3086000-memory.dmp

    Filesize

    2.1MB

  • memory/1000-109-0x000007FEF2A50000-0x000007FEF2BBC000-memory.dmp

    Filesize

    1.4MB

  • memory/1000-110-0x000007FEF28B0000-0x000007FEF2A45000-memory.dmp

    Filesize

    1.6MB

  • memory/1000-111-0x000007FEEF0E0000-0x000007FEEF785000-memory.dmp

    Filesize

    6.6MB