Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21-10-2024 18:16
General
-
Target
4078c6d0ff9e7acc63c49589d0bc171ce3f2c913bee1bb7bf972e9068f8759f7.lnk
-
Size
1KB
-
MD5
eeb472b4565d63a5204a0ee321871a2e
-
SHA1
13e65f54a70261546435b07ec0e81b9d9557971f
-
SHA256
4078c6d0ff9e7acc63c49589d0bc171ce3f2c913bee1bb7bf972e9068f8759f7
-
SHA512
67a2255532441c832d3da7c13bcbc26680502ab287352ff954d071809b44718b8488af895ff13c1708593c1761cec9f0a1018a9866f791dd469e48cb5e5ac271
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\4078c6d0ff9e7acc63c49589d0bc171ce3f2c913bee1bb7bf972e9068f8759f7.lnk1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c "CustomShellHost.exe & 111.cmd"2⤵
-