8ea25999fe93b84c817faa74af0ad94f0c0064d8e28fba5fea17665c38695430 | Triage

Resubmissions

02-06-2022 22:15

220602-16kn1abhf3 10

02-06-2022 21:45

220602-1mh13abha3 7

02-06-2022 21:44

220602-1ln6pabgh8 8

02-06-2022 21:40

220602-1jcpwabgh5 10

02-06-2022 21:27

220602-1ay7hsffap 10

Analysis

max time kernel
14s
max time network
19s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
02-06-2022 21:44

Sharing

Report Analysis Logs

General

Target

Invoice-06-1022.iso
Size

296KB
MD5

8e587660e5777ca12b72d46c88974db0
SHA1

a874bf87883d194ffee7629b5aff023dbfc53cc3
SHA256

867bdda02963b8226378c1d9c7fd01c951b6410a20a054e1fc470bfd2139b1a3
SHA512

65f30cee14049df3eb34af6654b2eee6984fb2a2e8a32a4441972934a797a16f5696fdc240e39d1a314ad0047abf9d7486301a5814692b5f15c90253944ed6f8

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

cmd.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\Local Settings cmd.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

cmd.exe

pid process

2704 cmd.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Invoice-06-1022.iso
1⤵
- Modifies registry class
- Suspicious behavior: LoadsDriver
PID:2704

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads