8eb6945907c07f04bcfd3d70dde85c2c6adafad1f5a11008df67882a5220f767

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 09:43

Target

2年自动驾驶产品经理-孙静个人简历.pdf.lnk
Size

1KB
MD5

81825aa0279d8b0f0adf016a7ec1a222
SHA1

2297f1677c9b4249f53f9171bdebedb11dc11d26
SHA256

930aa3163b8c50dd5acb614d003f163253bac604b3ddf0368f9cee2504dd56f6
SHA512

1b044a88bec5317ce6041d3456fd216ebaa6f24acf1b98ebbea2b42d11a9a87c422c5eacf6335766685cedf23e8d5632569b76a92f58c08e25dd77a8fa4cda2e

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 1656	2336	cmd.exe	31
PID 2336 wrote to memory of 1656	2336	cmd.exe	31
PID 2336 wrote to memory of 1656	2336	cmd.exe	31
PID 2344 wrote to memory of 2836	2344	explorer.exe	33
PID 2344 wrote to memory of 2836	2344	explorer.exe	33
PID 2344 wrote to memory of 2836	2344	explorer.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\2年自动驾驶产品经理-孙静个人简历.pdf.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" ".\__MACOS__\__MACOS__\__MACOS__\__MACOS__\__MACOS__\setup.exe"
  2⤵
  PID:1656

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Users\Admin\AppData\Local\Temp\__MACOS__\__MACOS__\__MACOS__\__MACOS__\__MACOS__\setup.exe
  "C:\Users\Admin\AppData\Local\Temp\__MACOS__\__MACOS__\__MACOS__\__MACOS__\__MACOS__\setup.exe"
  2⤵
  PID:2836

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact