204888f940e1bfe5ef634403a096f4de5ef88b154f037539f5de7274d7f3349d

Analysis

max time kernel
30s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
13-02-2023 18:55

Target

project requirements.lnk
Size

981B
MD5

9b512828eb27519424b4985ae1160075
SHA1

d73d9c30a84c83bcc54a53d42bff7d43eebba5b5
SHA256

14d23f1c4316b2748f257f72b3fdac993b304c73c58ebb12a754f27feb0050fc
SHA512

163d589c12c7214b5f0be5d1b7de78edd9e17d721c4de07c80a4c8a9895a116658212fd7d00c05588bb89c5b7eb1626b8ff2cf17ffb4f05a5700d27922c2f343

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 940 wrote to memory of 1500	940	cmd.exe	29
PID 940 wrote to memory of 1500	940	cmd.exe	29
PID 940 wrote to memory of 1500	940	cmd.exe	29
PID 1500 wrote to memory of 1244	1500	cmd.exe	30
PID 1500 wrote to memory of 1244	1500	cmd.exe	30
PID 1500 wrote to memory of 1244	1500	cmd.exe	30
PID 1244 wrote to memory of 792	1244	cmd.exe	31
PID 1244 wrote to memory of 792	1244	cmd.exe	31
PID 1244 wrote to memory of 792	1244	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\project requirements.lnk"
1⤵
- Suspicious use of WriteProcessMemory
PID:940
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c samsung.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1500
- - C:\Windows\system32\cmd.exe
    cmd.exe /c start /b /min copy /Y C:\Windows\System32\rundll32.exe C:\ProgramData\G84IrBV5PP.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1244
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K copy /Y C:\Windows\System32\rundll32.exe C:\ProgramData\G84IrBV5PP.exe
      4⤵
      PID:792

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/940-54-0x000007FEFC4E1000-0x000007FEFC4E3000-memory.dmp

Filesize
8KB

Download