4a15862e3e915052a502f2c37459aa5a581855fbf4e35346403992a36ded6a53

Analysis

max time kernel
16s
max time network
18s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
29-08-2024 17:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WinX/Group3/04 - Disk Management.lnk
Size

1015B
MD5

c17a68b75f528c05f77d35276ee593d7
SHA1

4614ac551118c8f3423d83660c2356ea621e455d
SHA256

d3f75300b0fb4b87609cf2259a5ee4dac769918abc70f93bd6b2192ba2efe95b
SHA512

9da3337d5de5777b95210ef51831d587bd06a9a29a7a8b22f0aa1e74861449599d2e47ad232e6f707dc1cfa5e14a01cff447d72b950bd3f03fc7d3eadfa3fbf4

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\diskmgmt.msc	mmc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	2888	mmc.exe
Token: SeIncBasePriorityPrivilege	2888	mmc.exe
Token: 33	2888	mmc.exe
Token: SeIncBasePriorityPrivilege	2888	mmc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2888	mmc.exe
2888	mmc.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2888	2220	cmd.exe	31
PID 2220 wrote to memory of 2888	2220	cmd.exe	31
PID 2220 wrote to memory of 2888	2220	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\WinX\Group3\04 - Disk Management.lnk"
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\system32\mmc.exe
  "C:\Windows\system32\mmc.exe" "C:\Windows\system32\diskmgmt.msc"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2888

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:2668

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:2876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2888-36-0x00000000022F0000-0x00000000022F1000-memory.dmp

Filesize
4KB

Download
memory/2888-37-0x00000000022F0000-0x00000000022F1000-memory.dmp

Filesize
4KB

Download