3264d09d3a398417226b7d346c2fc4757ffa445373763e2d7c2f18ef6edb2354

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-10-2024 17:21

Target

ClickMe.lnk
Size

1KB
MD5

08b5b3505abb428c860598363761f2e8
SHA1

2344992168414c023bd6851d63ea62520770365a
SHA256

3ba3c169988a8bc600b58e2ca578e36b48de210bbf058f61b3e7525af01c982d
SHA512

1b547c089197aba0dce835de875dbdb2c69ed2e9c2199f10ed767b642935dc1c3f50b1ef0521924459d09942fceac5478cf5a0471f94b7bc06c18da9149a2c4c

Score

8^/10

execution

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

2756 powershell.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

2756 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2756 powershell.exe

pid	process
2756	powershell.exe

pid	process
2756	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2756	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 2524 wrote to memory of 2756	2524	cmd.exe	powershell.exe
PID 2524 wrote to memory of 2756	2524	cmd.exe	powershell.exe
PID 2524 wrote to memory of 2756	2524	cmd.exe	powershell.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\ClickMe.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -ExecutionPolicy Bypass -nologo -noprofile -File "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\dd.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2756

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2756-38-0x000007FEF5EFE000-0x000007FEF5EFF000-memory.dmp

Filesize
4KB

Download
memory/2756-39-0x000000001B630000-0x000000001B912000-memory.dmp

Filesize
2.9MB

Download
memory/2756-40-0x00000000028E0000-0x00000000028E8000-memory.dmp

Filesize
32KB

Download
memory/2756-41-0x0000000002CC4000-0x0000000002CC7000-memory.dmp

Filesize
12KB

Download
memory/2756-42-0x000007FEF5C40000-0x000007FEF65DD000-memory.dmp

Filesize
9.6MB

Download