50518300d02153d04bf8eb8efd784fd88db56fbae142c1cfd5af45a52023d262

Analysis

Target

doc_2265273.lnk
Size

2KB
MD5

a312e810fd34a9668948d6fa45982d25
SHA1

a54e369404b7f2a1bc894116c4f9ee619cefe294
SHA256

50518300d02153d04bf8eb8efd784fd88db56fbae142c1cfd5af45a52023d262
SHA512

19dd647a3332b11440cce6ef2b129e09f3d280b997d8bc64449f2676f7dec5e8c260c494551a79faebc4b6e9c0bbfc955ea1d37018da013cd84266bcd9335fef

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1500 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1500 powershell.exe

pid	process
1500	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1500	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

cmd.exepowershell.exe

description	pid	process	target process
PID 316 wrote to memory of 1500	316	cmd.exe	powershell.exe
PID 316 wrote to memory of 1500	316	cmd.exe	powershell.exe
PID 316 wrote to memory of 1500	316	cmd.exe	powershell.exe
PID 1500 wrote to memory of 1996	1500	powershell.exe	rundll32.exe
PID 1500 wrote to memory of 1996	1500	powershell.exe	rundll32.exe
PID 1500 wrote to memory of 1996	1500	powershell.exe	rundll32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\doc_2265273.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:316

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" c:\users\public\default.png #1
3⤵
PID:1996

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/316-54-0x000007FEFC331000-0x000007FEFC333000-memory.dmp

Filesize
8KB

Download
memory/1500-88-0x0000000000000000-mapping.dmp

Download
memory/1500-93-0x000007FEF4970000-0x000007FEF5393000-memory.dmp

Filesize
10.1MB

Download
memory/1500-95-0x0000000002454000-0x0000000002457000-memory.dmp

Filesize
12KB

Download
memory/1500-94-0x000007FEF3E10000-0x000007FEF496D000-memory.dmp

Filesize
11.4MB

Download
memory/1500-96-0x000000001B840000-0x000000001BB3F000-memory.dmp

Filesize
3.0MB

Download
memory/1500-98-0x0000000002454000-0x0000000002457000-memory.dmp

Filesize
12KB

Download
memory/1500-99-0x000000000245B000-0x000000000247A000-memory.dmp

Filesize
124KB

Download
memory/1996-97-0x0000000000000000-mapping.dmp

Download