e7e68c5e7d8d244f57455f83148f574094d216a634cb2259880c0910088402a4

Analysis

max time kernel
9s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
10-02-2023 21:08

Target

project information.lnk
Size

975B
MD5

c6b475cbf0af53b086df880b42c21409
SHA1

e8aa3b7fc99e14f92bf369efdac3f2b558914915
SHA256

ae981b4dd9a5b4a4d8a21250244216dc7e9ac03bd54048527f31d3554b66fad1
SHA512

8a9031fb1f0238c92ebf6d432b950c7f806dbb085a288f6bc0c120ff9f779a670169c320aac48784cad64b235fee845bc1e04037f18dbeb2dc5a3fcf30397dc7

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 572	1988	cmd.exe	29
PID 1988 wrote to memory of 572	1988	cmd.exe	29
PID 1988 wrote to memory of 572	1988	cmd.exe	29
PID 572 wrote to memory of 1492	572	cmd.exe	30
PID 572 wrote to memory of 1492	572	cmd.exe	30
PID 572 wrote to memory of 1492	572	cmd.exe	30
PID 1492 wrote to memory of 296	1492	cmd.exe	31
PID 1492 wrote to memory of 296	1492	cmd.exe	31
PID 1492 wrote to memory of 296	1492	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\project information.lnk"
1⤵
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c math.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:572
- - C:\Windows\system32\cmd.exe
    cmd.exe /c start /b /min copy /Y C:\Windows\System32\rundll32.exe C:\ProgramData\2XvdXuWL0hw1.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1492
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K copy /Y C:\Windows\System32\rundll32.exe C:\ProgramData\2XvdXuWL0hw1.exe
      4⤵
      PID:296

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1988-54-0x000007FEFC241000-0x000007FEFC243000-memory.dmp

Filesize
8KB

Download