440df38880ad3bb6befe3fc3e11846f57d3ec1cd1547d90f9392a4a7a8dbd53a

Analysis

max time kernel
132s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04/01/2024, 04:27

Target

3fe4ede2325785ca9f9a0df61048ff8b.lnk
Size

821B
MD5

3fe4ede2325785ca9f9a0df61048ff8b
SHA1

1a7b12fc1b18f2a319ecf6227895dc48e187f376
SHA256

440df38880ad3bb6befe3fc3e11846f57d3ec1cd1547d90f9392a4a7a8dbd53a
SHA512

21443b3658a30e7a43657d4269ac74cd36070d985ad839fe6048976bdf3a19f7f158ceb4837ec64cab3a30192f9706c7635bb6737196a39872e360c62a65a601

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1420	cmd.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\3fe4ede2325785ca9f9a0df61048ff8b.lnk
1⤵
- Suspicious use of FindShellTrayWindow
PID:1420

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact