77373ee9869b492de0db2462efd5d3eff910b227e53d238fae16ad011826388a

Analysis

max time kernel
149s
max time network
131s
platform
windows11-21h2_x64
resource
win11-20251015-en
resource tags

arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system
submitted
04/11/2025, 09:05

Target
CV.pdf.lnk
Size 812B
Sample251104-k2flgsbr2t
SHA256 77373ee9869b492de0db2462efd5d3eff910b227e53d238fae16ad011826388a
MD5 fc4ee75d5bec11da8904ccb630f0a96d
SHA1 6712001f18151927935f017d004bf0e096cc8123
SHA512 afacc97e5de4bd1fc6dfd734816d61e47e14074106e9a3a46cbf5da525019fabbc9f769645aa1125ba55f8824d59cb52d8e564c824ee4d66fc213aabd8b0c5e6
MD5 SHA1 SHA512

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5856 wrote to memory of 5844	5856	cmd.exe	83
PID 5856 wrote to memory of 5844	5856	cmd.exe	83
PID 5844 wrote to memory of 5708	5844	cmd.exe	84
PID 5844 wrote to memory of 5708	5844	cmd.exe	84

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\CV.pdf.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:5856
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c ftp.exe -s:"offsec-certified-professional.png"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5844
- - C:\Windows\system32\ftp.exe
    ftp.exe -s:"offsec-certified-professional.png"
    3⤵
    PID:5708

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact