01e2bf1d84f8f5f546ba7597b300c30e7c4bfb59fc1cab745872c9e8436cda22 | Triage

Analysis

max time kernel
5s
max time network
8s
platform
windows7_x64
resource
win7v20210410
submitted
05-05-2021 20:57

Sharing

Report Analysis Logs

General

Target

MSVCRT.DLL
Size

272KB
MD5

0a8e038a03d7e409e5140fc9222af3a8
SHA1

afc924038bc8364f7816bfd4830b321ec1b78f6a
SHA256

babbfb63bb9ddd3763a5f528e3c438a590c7cb63d75ac4da7d1cdd0f7a107d0c
SHA512

4a9cfabb8e45e1b41e80913d956a18405a6d3068930ce59177e2908360ff2e5ff311573fe22e541c65ad3e81991ab9634d81b0c653e2e5ee1eb26bee257cafbb

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\MSVCRT.DLL
1⤵
PID:480

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/480-60-0x000007FEFBEF1000-0x000007FEFBEF3000-memory.dmp

Filesize
8KB

Download
memory/480-61-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download