b3c5e464e43d7db2432f3e28de75bd0eee8fa7a2b7b6fef7134e7115d6681be3

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25-03-2024 14:35

Target

$RECYCLE.BIN/$RAEXCG6.lnk
Size

764B
MD5

50ca4a3117112b2921ca0dd1d2669b3f
SHA1

523f7011bd9bd86930c055ddf92441d441bf9043
SHA256

2f0ff66fb95769969f2036a205033f6868da8ebd1a211c45a8afc3f805940a69
SHA512

33db76a36c9a27c1344e7d39fa55fb9be4a047785d10ac48f272d15fc9b30f67a2994117bd4b2f33662ad0f3b747aee85ef9a41f4242744ca974a8e066e59143

Score

6^/10

Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

cmd.exe

description ioc process

File opened (read-only) \??\D: cmd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File opened (read-only)	\??\D:	cmd.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\$RECYCLE.BIN\$RAEXCG6.lnk
1⤵
- Enumerates connected drives
PID:408

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance