7989a6983b5c35681695d52fc39e7ee22f6f1d2dd9bfc8edf1be0b00404e53be

Analysis

max time kernel
131s
max time network
212s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 11:52

Target

179fc12dd3523ca64e315f1d2ca4e702.lnk
Size

943B
MD5

179fc12dd3523ca64e315f1d2ca4e702
SHA1

e8b8d786b5f10e2aed375984e6cd30880cd82164
SHA256

7989a6983b5c35681695d52fc39e7ee22f6f1d2dd9bfc8edf1be0b00404e53be
SHA512

9f8dd6a4146d283087a46733eb3be3bd5df6161701fc309f0c39f55017e07d38ffa2ad43aa5b8c18416e1d7fca0be96c6ba0b4b4a2c2c0ba4b3e840e1e025654

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2096	cmd.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\179fc12dd3523ca64e315f1d2ca4e702.lnk
1⤵
- Suspicious use of FindShellTrayWindow
PID:2096

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact