6f7535d0d70cf0527b4fe687d31e534aa537073a2865bd1181c32d09b092a685

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/01/2024, 23:37

Target

6f7535d0d70cf0527b4fe687d31e534aa537073a2865bd1181c32d09b092a685.lnk
Size

2KB
MD5

358d952e52f642d2ca0621093628fbc9
SHA1

8d7b505f597801197f197abaa7ffc10c4ccc4f8a
SHA256

6f7535d0d70cf0527b4fe687d31e534aa537073a2865bd1181c32d09b092a685
SHA512

ffcb43003413141fb8f11e773fbf2e7bf15104f372b6389c8d28b1c45ecbd0cd77cdee6a41012782b17e3f50299dc47c91394d7d79a3bff1926a7257d7a22b0a

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2860	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2860	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2816	2176	cmd.exe	29
PID 2176 wrote to memory of 2816	2176	cmd.exe	29
PID 2176 wrote to memory of 2816	2176	cmd.exe	29
PID 2816 wrote to memory of 2860	2816	cmd.exe	30
PID 2816 wrote to memory of 2860	2816	cmd.exe	30
PID 2816 wrote to memory of 2860	2816	cmd.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\6f7535d0d70cf0527b4fe687d31e534aa537073a2865bd1181c32d09b092a685.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /k set COMPLUS_ApplicationMigrationRuntimeActivationConfigPath=C:\Program Files\AppFabric 1.1 for Windows Server\&powershell.exe -noexit -command "Import-Module DistributedCacheAdministration;Use-CacheCluster"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -noexit -command "Import-Module DistributedCacheAdministration;Use-CacheCluster"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2860

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2860-40-0x000000001B2D0000-0x000000001B5B2000-memory.dmp

Filesize
2.9MB

Download
memory/2860-41-0x0000000002550000-0x0000000002558000-memory.dmp

Filesize
32KB

Download
memory/2860-42-0x000007FEF57E0000-0x000007FEF617D000-memory.dmp

Filesize
9.6MB

Download
memory/2860-43-0x0000000002690000-0x0000000002710000-memory.dmp

Filesize
512KB

Download
memory/2860-44-0x000007FEF57E0000-0x000007FEF617D000-memory.dmp

Filesize
9.6MB

Download
memory/2860-46-0x0000000002690000-0x0000000002710000-memory.dmp

Filesize
512KB

Download
memory/2860-47-0x0000000002690000-0x0000000002710000-memory.dmp

Filesize
512KB

Download
memory/2860-45-0x0000000002690000-0x0000000002710000-memory.dmp

Filesize
512KB

Download
memory/2860-48-0x000007FEF57E0000-0x000007FEF617D000-memory.dmp

Filesize
9.6MB

Download
memory/2860-49-0x0000000002690000-0x0000000002710000-memory.dmp

Filesize
512KB

Download
memory/2860-50-0x0000000002690000-0x0000000002710000-memory.dmp

Filesize
512KB

Download
memory/2860-51-0x0000000002690000-0x0000000002710000-memory.dmp

Filesize
512KB

Download