12d2d40869893190035b7069b850db1a4437b8dafbfba89384ae5fc89b9e5489 | Triage™

Analysis

max time kernel
113s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
07/03/2022, 14:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
forma400.hta
Size 10KB
Sample220307-rt5nzafdb8
SHA256 b087a40977e3257562b3dec10efc5043b0dee439e077655ebfd084840c8e9a21
MD5 c88f3cb7da08dada42624f2b3ff77219
SHA1 bbb5edab8b6a403eddeb3df37a9cb129c630fad6
SHA512 618240c6de782f2678fb5cac0ef7f2ef7134f1de1e6be067ae2ebfc03b2f4af904eae8701c7b65d62a24b94ea1f9cbfd4d161e016ca84011741cd24339160051
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2096	2956	WerFault.exe	53

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\forma400.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
PID:2956
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2956 -s 1472
  2⤵
  - Program crash
  PID:2096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2956 -ip 2956
1⤵
PID:632

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads