89182337d39268acce8b9843af9c84ca00ba41a394e8ded1426f95d6d63964c3

Analysis

max time kernel
115s
max time network
34s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
10-07-2023 11:44

Target

Lisk.7z
Size

27.4MB
MD5

cd5d5e7d35ac89b829555f3304c1116d
SHA1

7a8efeb61f574c4ebcb4358e7fde93b98caaf56f
SHA256

89182337d39268acce8b9843af9c84ca00ba41a394e8ded1426f95d6d63964c3
SHA512

5eab6d74d36a14e469ad9a3f7368191696a488f0baccf114cdaa4e9ff2b826c8c7c4626034dd3429e038328793ec490ac30d2e296127b3ab5ce1e0ff6aa250a0
SSDEEP

786432:awR8h3mfBrojMsulqgHqhE2t21FbhgH9tRJqdwG2tRtO9BS/:aKfZoBulFiVI1L8RJqdynmS/

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

rundll32.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_Classes\Local Settings rundll32.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

rundll32.exe

pid process

2908 rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_Classes\Local Settings	rundll32.exe

pid	process
2908	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 2396 wrote to memory of 2908	2396	cmd.exe	rundll32.exe
PID 2396 wrote to memory of 2908	2396	cmd.exe	rundll32.exe
PID 2396 wrote to memory of 2908	2396	cmd.exe	rundll32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Lisk.7z
1⤵
- Suspicious use of WriteProcessMemory
PID:2396

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact