Analysis
-
max time kernel
37s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
02-06-2022 20:53
General
-
Target
Scan_314.jpg.lnk
-
Size
1KB
-
MD5
a43cd61911f636d590eb9a5edfc4777f
-
SHA1
419c382c0311691ee2ba00537d640500d1896366
-
SHA256
6ec963361dc22ff695854bbb3838856d78c1aef73ea07fc855b6d82b57ca51b1
-
SHA512
b8889b2f6cde2f85bdcdbe7f529bcdfb6637ec7b29c8f0d1198e954467fb404e1441195942abdb6029bdad5a224628fd05d8f6f8fe0431eb5d9bd13d2e2d7958
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Scan_314.jpg.lnk1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -w h -file 1204.ps12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
712KB
-
Filesize
3.2MB
-
Filesize
6.6MB
-
Filesize
420KB
-
Filesize
200KB
-
Filesize
14.9MB
-
Filesize
10.1MB
-
Filesize
14.9MB
-
Filesize
12KB
-
Filesize
11.4MB
-
Filesize
10.1MB
-
-
Filesize
11.4MB
-
Filesize
680KB
-
Filesize
916KB
-
Filesize
248KB
-
Filesize
2.1MB
-
Filesize
1.1MB
-
Filesize
1.4MB
-
Filesize
1.6MB
-
Filesize
8KB