59821b8aabe5acc8b1eb91ed2de2cba91b05351c3d9e3bf52ba0ba786f359b87

Analysis

Target

Install.lnk
Size

1KB
MD5

bfd7d505168be59a0e51765c53e69ca5
SHA1

c2dc5035d451873d1adfce8b2d41e2b3561b8ef4
SHA256

2f00d7cd954bcb1fffdc3f14fde7f239b4eb3aecc9f6ac24540ed25856969f33
SHA512

96201f70ddce456dcefe89ad46716421523a7367d2e3d85ef06c8329a7144793e228701a3536a75379dbbb57f96cd060547c1bf2eb74cb343f278b0de03e6d2e

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
768	cmd.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Install.lnk
1⤵
- Suspicious use of FindShellTrayWindow
PID:768

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact