b8bb69625663a99c2400b84dbea5de7649961ee0684b08057dcdd55221fd758d

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 11:31

Target

Otago_IB_Conf.lnk
Size

1KB
MD5

4af014550fcfd0cb5a60d18d3e339654
SHA1

f7cd52bf3c622c2784dcb7dbb0e39d9bbbcb2fef
SHA256

43be8f7868bd8a976ca55757b5253b577012e02e75798225d76cf1111b401668
SHA512

3690164c4cb64328f73c15ccc5c43b5fed0196ca27f62af40cef608d29e619d1272fb0a31b58de13dde7d67be65f4b2166a55d3dc6e78ccf10665ff175d8e97a

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 2276	2904	cmd.exe	30
PID 2904 wrote to memory of 2276	2904	cmd.exe	30
PID 2904 wrote to memory of 2276	2904	cmd.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Otago_IB_Conf.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start "" "Otago_IB.lnk" && start "" "Otago_IB_Conference.pptx"
  2⤵
  PID:2276

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2276-62-0x0000000002AF0000-0x0000000002AF1000-memory.dmp

Filesize
4KB

Download