8ea25999fe93b84c817faa74af0ad94f0c0064d8e28fba5fea17665c38695430 | Triage

Analysis

max time kernel
99s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
03-06-2022 04:28

Sharing

Report Analysis Logs

General

Target

Invoice-06-1022.iso
Size

296KB
MD5

8e587660e5777ca12b72d46c88974db0
SHA1

a874bf87883d194ffee7629b5aff023dbfc53cc3
SHA256

867bdda02963b8226378c1d9c7fd01c951b6410a20a054e1fc470bfd2139b1a3
SHA512

65f30cee14049df3eb34af6654b2eee6984fb2a2e8a32a4441972934a797a16f5696fdc240e39d1a314ad0047abf9d7486301a5814692b5f15c90253944ed6f8

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

cmd.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\Local Settings cmd.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

cmd.exe

pid process

3404 cmd.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Invoice-06-1022.iso
1⤵
- Modifies registry class
- Suspicious behavior: LoadsDriver
PID:3404

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...