105cc8958dde5aa748097eacf59edb7ff70f5826fe754ade45d4a4545f47fe4f

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
24-11-2023 20:27

Target

mechvibes-2.3.0/src/assets/milligram.min.css
Size

8KB
MD5

b2b580b8645eb6a38c18ddbd108e4f2f
SHA1

b2aac7b09c873ab06676265f2d7ad4a43548bb7f
SHA256

6da4b12842121dd4805a28a93e4591baab8832380d211fff6bef82ca19d07483
SHA512

c62ba7abd8692ac21ccf8db3b74a36bc2a37e315748fa372f21804ca53775c1825643b536769f09ea17f67f4d309cd7cb0676f0a36c522735dfbeeaadc9d0dea
SSDEEP

192:dnmEOcMsE4GV+OaSCQU2nUqwxbFER0JDaUtNQzzz4hDz/V33VHt399/lWxnQ9rwx:5mEY+bJ3Dfnq

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1608 wrote to memory of 2660	1608	cmd.exe	29
PID 1608 wrote to memory of 2660	1608	cmd.exe	29
PID 1608 wrote to memory of 2660	1608	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\mechvibes-2.3.0\src\assets\milligram.min.css
1⤵
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\mechvibes-2.3.0\src\assets\milligram.min.css
  2⤵
  PID:2660

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact