023d38d5630b66dbf66c1f23be937f66a4d55b2aab0473ad7a6eb84557e3d63a

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
27/07/2024, 00:43

Target

Unlimited Menus/Data/Command Prompt.lnk
Size

1KB
MD5

cf79b19e9bc736f2a15a37e566bf7543
SHA1

b6e6771e03ac9883ac7c071d67be2432707b5ac7
SHA256

5d3bf57769f44021af3115c9cc4ced60d5928002768bbd1a5a9cbbcc6b029595
SHA512

e216d3a1148ad0996414d1945169cf37bce3b6b4ce4db105f2bba3cac82c56b21352cbc85caae10bcf0abe4231d026eed7ba2c07267b27ec28d7724e78c42c12

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 2168	836	cmd.exe	31
PID 836 wrote to memory of 2168	836	cmd.exe	31
PID 836 wrote to memory of 2168	836	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Unlimited Menus\Data\Command Prompt.lnk"
1⤵
- Suspicious use of WriteProcessMemory
PID:836
- C:\WINDOWS\SYSTEM32\cmd.exe
  "C:\WINDOWS\SYSTEM32\cmd.exe"
  2⤵
  PID:2168

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact