4a15862e3e915052a502f2c37459aa5a581855fbf4e35346403992a36ded6a53

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
29-08-2024 17:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WinX/Group2/3 - Windows Explorer.lnk
Size

1KB
MD5

5aeef797f4ce51683f3321c337ae9d85
SHA1

9255e9042d130c504645a64beed00d4a4c233fd8
SHA256

2b7827fa8f8b2e19a10da8c5b0c744d064a077bde7347153767c16191eb272fe
SHA512

49d056768d4724f4591e59917cd0c979146b37746f7a549ed017ea6c0d96dd18af9e8c4304e010ae1af14311ba9a78c7ebe9759f50f3037fe3b5cb4d4c8c7064

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 2860	1900	cmd.exe	31
PID 1900 wrote to memory of 2860	1900	cmd.exe	31
PID 1900 wrote to memory of 2860	1900	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\WinX\Group2\3 - Windows Explorer.lnk"
1⤵
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" shell:::{52205fd8-5dfb-447d-801a-d0b52f2e83e1}
  2⤵
  PID:2860

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2224-36-0x00000000020F0000-0x00000000020F1000-memory.dmp

Filesize
4KB

Download
memory/2224-37-0x00000000020F0000-0x00000000020F1000-memory.dmp

Filesize
4KB

Download