43f6a127af0fff41e71da8671aff0b1ec301d748e1bd0ca9e53cf98f887d5a3d

Analysis

max time kernel
143s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 08:15

Target

13258a8e9895e5bd8e307f90ce1a308d.lnk
Size

1KB
MD5

13258a8e9895e5bd8e307f90ce1a308d
SHA1

adc280173280f3e1fd8491a8c1e548e6ec33941b
SHA256

43f6a127af0fff41e71da8671aff0b1ec301d748e1bd0ca9e53cf98f887d5a3d
SHA512

0b5f7306d9c15af770c4d14b3b1d00e0b7b3f4a5f818ea08da38f0c8e25c1d49817f003199c78afd3ea20650902837ac874de4464beccd6ff97f1ff1ec3a134a

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1692	cmd.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\13258a8e9895e5bd8e307f90ce1a308d.lnk
1⤵
- Suspicious use of FindShellTrayWindow
PID:1692

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact