dfab832eb78227048791adb88c0b064c282fca151eecc805f1375713c41b460b

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 02:08

Target

dfab832eb78227048791adb88c0b064c282fca151eecc805f1375713c41b460b.lnk
Size

435B
MD5

5bc0f6a18d92ba69a935c0e007a0a3c0
SHA1

a21b8cabef8a556b7fe8ef8427c6b97b51c54bda
SHA256

dfab832eb78227048791adb88c0b064c282fca151eecc805f1375713c41b460b
SHA512

0bdd30a3c629e4d28b6570bd2a0ffaf4afaf7a0f94c3a256bcdb87d57077b73b09728ff1410b0cdf32571c5ad9ac595b799fe921eaa82726e61f7d6ec17703a4

Score

6^/10

Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

cmd.exe

description ioc process

File opened (read-only) \??\E: cmd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File opened (read-only)	\??\E:	cmd.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\dfab832eb78227048791adb88c0b064c282fca151eecc805f1375713c41b460b.lnk
1⤵
- Enumerates connected drives
PID:2468

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact