6fb809acf74b4ee265e2cccde8dba7abaa9bf0391a1e7c2dd5997fa85fdcd4e3

Analysis

max time kernel
136s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2024, 10:32

Target

b7338524c3066c5ce482ad0ae2d155e9.lnk
Size

806B
MD5

b7338524c3066c5ce482ad0ae2d155e9
SHA1

ec3e6b3d09add120613cfe56666961dbbe0c2560
SHA256

6fb809acf74b4ee265e2cccde8dba7abaa9bf0391a1e7c2dd5997fa85fdcd4e3
SHA512

fa61592ad755829a3edf239d7068bef32a1c8cf0803bf054733cec9a79075f8346f7e153b442e8788f3a75e18727b3671caf3c327e568c762e2fb6cdd69bbe60

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4788	cmd.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\b7338524c3066c5ce482ad0ae2d155e9.lnk
1⤵
- Suspicious use of FindShellTrayWindow
PID:4788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4004 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:8
1⤵
PID:1808

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact