0ddff43e7a3ae1e83616c55ae7b9e31257d42ec84db434e7bdcc0e94df2b207b | Triage

Analysis

max time kernel
142s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
20-11-2023 11:01

Sharing

Report Analysis Logs

General

Target

Amministrazione.url
Size

204B
MD5

3e797df6c23bae007f16dde16d4374e9
SHA1

42128dd598f267637be86fdec4dc69480b6ab810
SHA256

7dfcedc537a858be0d598ef2f327d4fa2aeb3f4191a7f724fcad85a1c894ea53
SHA512

fc3b7b054486e7c56879b8c9fc6051fe744f31ac0758f646fa48ed836e59b5522bbc3a2a38bac0dbfa5bde3daa0619e21a6a15a8d5ceb4f0f4686349e28edd7b

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

rundll32.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000_Classes\Local Settings rundll32.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

rundll32.exe

pid process

4948 rundll32.exe

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\Amministrazione.url
1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:4948

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...