34c45b411c3de8614c85819eb0b887e7c293349de463ecdc20a88c0a71b68d68 | Triage

Analysis

max time kernel
144s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27-04-2024 22:18

Sharing

Report Analysis Logs

General

Target

JO-PARIS2024-Billets.lnk
Size

255B
MD5

d799b76f640f70fe024afc355df6587e
SHA1

eebdd4e1a602ffb4a9404883b390da38929fcbf9
SHA256

9c8939388a8f1bd5c251f065399b9fea03eb0482c0febcc06901afd7799bfe61
SHA512

d3041b1569daac8cc9134dc097dd720b01ba8f5dbef213939c6a2c8855798f39b5ce931ca3edd19f29e7867c7756bb90d9ce429f2b1a0edc82dc8d3fc74e9d39

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

cmd.exe

pid process

1804 cmd.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\JO-PARIS2024-Billets.lnk
1⤵
- Suspicious use of FindShellTrayWindow
PID:1804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3756 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8
1⤵
PID:3940

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...