fbd403eb77a8afdd3c5036235e8afc3256b1da2c5cdc216f319e4fa71f898852

Analysis

max time kernel
2s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
08-12-2022 19:34

Target

list.lnk
Size

1KB
MD5

6d6c8abcd4144c4ea09d7f1b759d93b7
SHA1

9141c9c89ce1fe76bffd88c4aa1d6c4c0b2ccbbc
SHA256

068901e007a00393ac50592d599b473149fae5f1b559b6240952f3866a167973
SHA512

80f8bceb3c8978b8da3a4387dc43b2cb647cc89d5fd2e347dd6fcbe74ca2733b5a14921f883ba0d741f2a7ce4e32e605ab81d799664d56f3bc71fe3912010547

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 1760	1460	cmd.exe	29
PID 1460 wrote to memory of 1760	1460	cmd.exe	29
PID 1460 wrote to memory of 1760	1460	cmd.exe	29
PID 1760 wrote to memory of 760	1760	cmd.exe	30
PID 1760 wrote to memory of 760	1760	cmd.exe	30
PID 1760 wrote to memory of 760	1760	cmd.exe	30
PID 1760 wrote to memory of 1872	1760	cmd.exe	31
PID 1760 wrote to memory of 1872	1760	cmd.exe	31
PID 1760 wrote to memory of 1872	1760	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\list.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c conf.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K copy /y /b C:\Windows\System32\rundll32.exe C:\ProgramData\DAGLhBmCYpVOD.exe
    3⤵
    PID:760
- - C:\Windows\system32\xcopy.exe
    xcopy /h /y tutorials.dll C:\ProgramData
    3⤵
    PID:1872

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1460-54-0x000007FEFC101000-0x000007FEFC103000-memory.dmp

Filesize
8KB

Download