6bd244fcf3711f5cba246dc3e3a2ca14855c849856a03cb700cb49fe85663de7

Analysis

max time kernel
46s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
13/02/2023, 16:32

Target

project information.lnk
Size

975B
MD5

662e0554d91f79fa97a53e224ac8a5bd
SHA1

44b14afd5c0a849d3553e4636e0a5125abc8087d
SHA256

5a32e8b0b07cc41971fc057bffa79ce0760d110d3c72e018af0c645a698cec6e
SHA512

d062b646289d056cf858477b09456868a5b9f7a61788efd3f40473c64a9ff942e06f8b5581b2d295de803d3fea42ef6a86fad1a8c8e63243d8fd7380bffd0c78

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 1780	1252	cmd.exe	28
PID 1252 wrote to memory of 1780	1252	cmd.exe	28
PID 1252 wrote to memory of 1780	1252	cmd.exe	28
PID 1780 wrote to memory of 1784	1780	cmd.exe	29
PID 1780 wrote to memory of 1784	1780	cmd.exe	29
PID 1780 wrote to memory of 1784	1780	cmd.exe	29
PID 1784 wrote to memory of 1416	1784	cmd.exe	30
PID 1784 wrote to memory of 1416	1784	cmd.exe	30
PID 1784 wrote to memory of 1416	1784	cmd.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\project information.lnk"
1⤵
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c lang.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1780
- - C:\Windows\system32\cmd.exe
    cmd.exe /c start /b /min copy /Y C:\Windows\System32\rundll32.exe C:\ProgramData\p4VvpBZGbyg.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1784
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K copy /Y C:\Windows\System32\rundll32.exe C:\ProgramData\p4VvpBZGbyg.exe
      4⤵
      PID:1416

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1252-54-0x000007FEFB741000-0x000007FEFB743000-memory.dmp

Filesize
8KB

Download