210f709308b236faa3a3d2d80835dcc58595d788ae4b691566c18c56ae902277

Analysis

max time kernel
142s
max time network
146s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 06:37

Target

Device/HarddiskVolume3/$Recycle.Bin/S-1-5-21-1609150881-1430008545-2034545098-1122/$R0H9FZL.lnk
Size

850B
MD5

b380de9c33f47a45008bbec8cca24120
SHA1

df471da1deeb2a022e9e359b49a2fce890ff3d83
SHA256

4297e0997a42a0fc83b869779532528567b4b6fd3e0f9d1baa66d749ae255146
SHA512

b7c27caf6b197bd8b93759c2690e4747af975d64e9811de8ec6c7b3a3e0222874f5bf5014f60e0a60b7b9013abf2d4b836f43a6593678648f7c8806f2ed85019

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1504	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1504	AUDIODG.EXE
Token: 33	1504	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1504	AUDIODG.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 2732	2988	cmd.exe	31
PID 2988 wrote to memory of 2732	2988	cmd.exe	31
PID 2988 wrote to memory of 2732	2988	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume3\$Recycle.Bin\S-1-5-21-1609150881-1430008545-2034545098-1122\$R0H9FZL.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c start streamerdata\streamer.exe /AutoIt3ExecuteScript "streamerdata\stream.txt" 80vy22qQ3mi7Esu & exit
  2⤵
  PID:2732

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x508
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1504

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact