ff63e38e9428dfa6c4c84db64779cbc1f234b080797d1ee6463073d8034691c4

Analysis

max time kernel
159s
max time network
248s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 04:55

Target

290694e13fbb311b4a08ebbd178a8d20.lnk
Size

1KB
MD5

290694e13fbb311b4a08ebbd178a8d20
SHA1

896eca5f3e3c22fc1cd682205e7ba9c206523f07
SHA256

ff63e38e9428dfa6c4c84db64779cbc1f234b080797d1ee6463073d8034691c4
SHA512

75b4e42c7f267303f684039ca5070addff22e371d9a95a06855242ae2b23acb9eafdb8c9963656133df5749b192c12fd39c854efae222e5cb75b5e61438fb61d

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
652	cmd.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\290694e13fbb311b4a08ebbd178a8d20.lnk
1⤵
- Suspicious use of FindShellTrayWindow
PID:652

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact