f2406ca9821dd1af9404128f5c2964f99bf1480317a398970c3fe46efd596ab0

Analysis

max time kernel
43s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
13-02-2023 19:00

Target

project information.lnk
Size

981B
MD5

ab75f98820d239a2f300d1258e65ff57
SHA1

9571afbbc444cdf6ede14c0996e6e915ef21baed
SHA256

0d395daea134bf3ad5d52e47424725842391ceef3fba206031038f9d9f570191
SHA512

9929dc69ce18949b9b6efb36d501bb92a7ae7f18a82f61245088de474258ab8c33e701bc4e5f52394a7bbe80bec48269989ada0ed989ef206e3040b27a45a6ea

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1604	2016	cmd.exe	28
PID 2016 wrote to memory of 1604	2016	cmd.exe	28
PID 2016 wrote to memory of 1604	2016	cmd.exe	28
PID 1604 wrote to memory of 840	1604	cmd.exe	29
PID 1604 wrote to memory of 840	1604	cmd.exe	29
PID 1604 wrote to memory of 840	1604	cmd.exe	29
PID 840 wrote to memory of 636	840	cmd.exe	30
PID 840 wrote to memory of 636	840	cmd.exe	30
PID 840 wrote to memory of 636	840	cmd.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\project information.lnk"
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cookies.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1604
- - C:\Windows\system32\cmd.exe
    cmd.exe /c start /b /min copy /Y C:\Windows\System32\rundll32.exe C:\ProgramData\u9OwF0LTWHo.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:840
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K copy /Y C:\Windows\System32\rundll32.exe C:\ProgramData\u9OwF0LTWHo.exe
      4⤵
      PID:636

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2016-54-0x000007FEFB731000-0x000007FEFB733000-memory.dmp

Filesize
8KB

Download