12f911d87fda6123a85fc2f34389871d42ddaf7d7839822a02967a2f7862dc8c

Analysis

max time kernel
156s
max time network
183s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 05:47

Target

2a99275c5d6420cab84fcd201497f217.lnk
Size

841B
MD5

2a99275c5d6420cab84fcd201497f217
SHA1

52dac0cd0ce33e7b608344ac3dbda43fe2402178
SHA256

12f911d87fda6123a85fc2f34389871d42ddaf7d7839822a02967a2f7862dc8c
SHA512

92ed797ec0ec9a875a1372630e6d71b3f607db89967e0b163f4e09c1eb93c551d88f1ea214ddec2c1bab66ebb4e8865006188da288e855ff33109a3d23d2270d

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2728	cmd.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\2a99275c5d6420cab84fcd201497f217.lnk
1⤵
- Suspicious use of FindShellTrayWindow
PID:2728

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact