f1a398113ad169cb462ffeb52eaf0e95085bf27e5e7eed458e57dd81953bcd0b

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 17:05

Target

3 - Оптимизация Windows/7 - Отключить Повышенную Точность.lnk
Size

943B
MD5

e8da1a1fccf4bb75e8f9db8914b7be33
SHA1

b86b64240d4225ef376bf0016b65bace41b0cd34
SHA256

92320662bd197480752d1afc758552e90d4efbf683c56e38952130b93cbac2b2
SHA512

2df00a8bf41042bc7a564e21961d0e263052921004907a7ecbc79b3a97dbca0a33863252e36cf7935a82075169087af3600cc4d5f4e4bd0b9492ab1bf18e85ee

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Control Panel 5 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Control Panel\Mouse\MouseTrails = "0"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Control Panel\Mouse\MouseThreshold1 = "6"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Control Panel\Mouse\MouseThreshold2 = "10"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Control Panel\Mouse\MouseSpeed = "1"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Control Panel\Mouse\MouseSensitivity = "10"	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 2464	1820	cmd.exe	16
PID 1820 wrote to memory of 2464	1820	cmd.exe	16
PID 1820 wrote to memory of 2464	1820	cmd.exe	16
PID 2464 wrote to memory of 2852	2464	control.exe	17
PID 2464 wrote to memory of 2852	2464	control.exe	17
PID 2464 wrote to memory of 2852	2464	control.exe	17

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\3 - Оптимизация Windows\7 - Отключить Повышенную Точность.lnk"
1⤵
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Windows\System32\control.exe
  "C:\Windows\System32\control.exe" "C:\Windows\System32\main.cpl",,2
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2464
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Windows\System32\main.cpl",,2
    3⤵
    - Modifies Control Panel
    PID:2852

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact