c640adc8c6c82e658ccc5595ac2ca3c1c226a87206ae8a1e31c3db261aeac0df

Analysis

max time kernel
24s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
11/02/2023, 13:11

Target

project information.lnk
Size

987B
MD5

52318d33bcdb7be297b3fc01cb2b590c
SHA1

9c0e1191509c7d610c5e3cfbb8bc1b83b28fb03f
SHA256

da489201afe602684791b0a4b7b238df9f3549c276ccdcaeca8375f31f2b66dc
SHA512

27c48a86e08dcd3806f8989be739615f2c978da0dd216a43696590603be51867bff03d66e5bf808acd5d51ac203254b8eefd1d8dc6b9325ac5c0f3f2833ba8f2

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 824	2028	cmd.exe	29
PID 2028 wrote to memory of 824	2028	cmd.exe	29
PID 2028 wrote to memory of 824	2028	cmd.exe	29
PID 824 wrote to memory of 344	824	cmd.exe	30
PID 824 wrote to memory of 344	824	cmd.exe	30
PID 824 wrote to memory of 344	824	cmd.exe	30
PID 344 wrote to memory of 1088	344	cmd.exe	31
PID 344 wrote to memory of 1088	344	cmd.exe	31
PID 344 wrote to memory of 1088	344	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\project information.lnk"
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c topicsMain.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:824
- - C:\Windows\system32\cmd.exe
    cmd.exe /c start /b /min copy /Y C:\Windows\System32\rundll32.exe C:\ProgramData\TUmLJFkwKhG.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:344
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K copy /Y C:\Windows\System32\rundll32.exe C:\ProgramData\TUmLJFkwKhG.exe
      4⤵
      PID:1088

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2028-54-0x000007FEFC2B1000-0x000007FEFC2B3000-memory.dmp

Filesize
8KB

Download