c3a06c5448869d4f136f1c15926ec4b2df48993fb86f3bd5dd4a69afbe3d46e4

General

Target

Scan_314.jpg.lnk
Size

1KB
MD5

a43cd61911f636d590eb9a5edfc4777f
SHA1

419c382c0311691ee2ba00537d640500d1896366
SHA256

6ec963361dc22ff695854bbb3838856d78c1aef73ea07fc855b6d82b57ca51b1
SHA512

b8889b2f6cde2f85bdcdbe7f529bcdfb6637ec7b29c8f0d1198e954467fb404e1441195942abdb6029bdad5a224628fd05d8f6f8fe0431eb5d9bd13d2e2d7958

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

928 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 928 powershell.exe

pid	process
928	powershell.exe

description	pid	process
Token: SeDebugPrivilege	928	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1296 wrote to memory of 928	1296	cmd.exe	powershell.exe
PID 1296 wrote to memory of 928	1296	cmd.exe	powershell.exe
PID 1296 wrote to memory of 928	1296	cmd.exe	powershell.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Scan_314.jpg.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:1296

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -w h -file 1204.ps1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:928

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/928-101-0x000007FEFAC60000-0x000007FEFAD12000-memory.dmp

Filesize
712KB

Download
memory/928-96-0x000007FEF3170000-0x000007FEF349E000-memory.dmp

Filesize
3.2MB

Download
memory/928-111-0x000007FEF2710000-0x000007FEF2DB5000-memory.dmp

Filesize
6.6MB

Download
memory/928-103-0x000007FEFABF0000-0x000007FEFAC59000-memory.dmp

Filesize
420KB

Download
memory/928-102-0x000007FEFAE30000-0x000007FEFAE62000-memory.dmp

Filesize
200KB

Download
memory/928-95-0x000007FEF4A30000-0x000007FEF590C000-memory.dmp

Filesize
14.9MB

Download
memory/928-97-0x000007FEF4000000-0x000007FEF4A23000-memory.dmp

Filesize
10.1MB

Download
memory/928-98-0x000007FEF4A30000-0x000007FEF590C000-memory.dmp

Filesize
14.9MB

Download
memory/928-99-0x0000000002654000-0x0000000002657000-memory.dmp

Filesize
12KB

Download
memory/928-100-0x000007FEF34A0000-0x000007FEF3FFD000-memory.dmp

Filesize
11.4MB

Download
memory/928-93-0x000007FEF4000000-0x000007FEF4A23000-memory.dmp

Filesize
10.1MB

Download
memory/928-88-0x0000000000000000-mapping.dmp

Download
memory/928-94-0x000007FEF34A0000-0x000007FEF3FFD000-memory.dmp

Filesize
11.4MB

Download
memory/928-104-0x000007FEF67B0000-0x000007FEF685A000-memory.dmp

Filesize
680KB

Download
memory/928-105-0x000007FEF66C0000-0x000007FEF67A5000-memory.dmp

Filesize
916KB

Download
memory/928-107-0x000007FEF5AB0000-0x000007FEF5AEE000-memory.dmp

Filesize
248KB

Download
memory/928-108-0x000007FEF2F50000-0x000007FEF3166000-memory.dmp

Filesize
2.1MB

Download
memory/928-106-0x000007FEF5AF0000-0x000007FEF5C08000-memory.dmp

Filesize
1.1MB

Download
memory/928-109-0x000007FEF25A0000-0x000007FEF270C000-memory.dmp

Filesize
1.4MB

Download
memory/928-110-0x000007FEF2400000-0x000007FEF2595000-memory.dmp

Filesize
1.6MB

Download
memory/1296-54-0x000007FEFB971000-0x000007FEFB973000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing