7b9ddcc06c5b09f7628abe23d92447a00eabdacc6a6c6dfb49dee4448b8d0aef | Triage

Analysis

max time kernel
3s
max time network
28s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
31-01-2022 12:51

Sharing

Report Analysis Logs

General

Target

TT_COPY.exe
Size

430KB
MD5

b38f111117f91cee4e7a32d369e5f647
SHA1

ad2036f338ed3e3a75b9dc2feb8425cb09968b01
SHA256

0ab24b5c9e24d195f00fa83a9078606341d6e7f56fc60c0b727a8f2c2b905c02
SHA512

af101647a761abae5c2d8285c0be3f3350b5be8f550ef7918001da2484f6ab6cea0c902f023c5cce7f838af3e498ecbff2ce24384980977d93b9f7185a9fe403

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

TT_COPY.exe

pid process

2724 TT_COPY.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\TT_COPY.exe
"C:\Users\Admin\AppData\Local\Temp\TT_COPY.exe"
1⤵
- Loads dropped DLL
PID:2724

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsz3D95.tmp\zcnjabehxo.dll
MD5
7868bf8834a0fe5b7590dde280a53351

SHA1
ae9abcc313e778d5ffe4e1d68a330ea14ee01dbc

SHA256
db0c352adce776fc3777006c1cbdeed7b1f7bf2adea4b284a5c2c5b25afca43e

SHA512
c7636f2aa4e294cfa0a1aa66e502f8a773663fcd6d54551adb133bbe55ac3a4b9d42fcf723a92de791a030e22a9c1c018f7852989ca1aea2b24978c87bfa0cf5

Download Submit