ca484520cfabc9c78add59a56122798772598be027479adafa02c56bb9973606

Analysis

max time kernel
44s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 23:16

Target

order.lnk
Size

1KB
MD5

b72d56cfad5baae4998ed2cfd973d32f
SHA1

ec16c82eff62e4b1beba2f04c9f5ecb0c955e3da
SHA256

ac8e67644d7b6b6f0bd78522a3568c98fe386a23542f73a2ec1a3cff4f433684
SHA512

5513fc13e402538a953b6db220b5b784eadd2f5326fdedad3820c794981ca6d2c2c361da7898aec31b7fdf5f0723b3fec656b2e532fa7b8a7628471d8d7ab1d5

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 1732	1324	cmd.exe	28
PID 1324 wrote to memory of 1732	1324	cmd.exe	28
PID 1324 wrote to memory of 1732	1324	cmd.exe	28
PID 1732 wrote to memory of 812	1732	cmd.exe	29
PID 1732 wrote to memory of 812	1732	cmd.exe	29
PID 1732 wrote to memory of 812	1732	cmd.exe	29
PID 1732 wrote to memory of 1504	1732	cmd.exe	30
PID 1732 wrote to memory of 1504	1732	cmd.exe	30
PID 1732 wrote to memory of 1504	1732	cmd.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\order.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c matrix.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K copy /y /b C:\Windows\System32\rundll32.exe C:\ProgramData\oiv0I4ymqE.exe
    3⤵
    PID:812
- - C:\Windows\system32\xcopy.exe
    xcopy /h /y worldsex.dll C:\ProgramData
    3⤵
    PID:1504

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1324-54-0x000007FEFB781000-0x000007FEFB783000-memory.dmp

Filesize
8KB

Download