c942a533bd1c751d840bcad0fcb2a0a8ef986ce1baf95bd10ca6937fcb18ed5e | Triage

Analysis

max time kernel
1629s
max time network
1794s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
05-07-2022 16:10

Sharing

Report Analysis Logs

General

Target

daa40acf17585b2246dc1e9e6610964368f6fb854fdc16a1972c7908c23ab5cf.iso
Size

496KB
MD5

7890c93fc13ca9e643c738a11054ec86
SHA1

0e0f581e3b2b69d4cc139c84e2367ae5af53b5ae
SHA256

daa40acf17585b2246dc1e9e6610964368f6fb854fdc16a1972c7908c23ab5cf
SHA512

7eb809eee53b1dc473b3b1ac21d1c08a6d9e86515d2cc43d970b70d9ba44aa8eb29e9e95e5a0521d5c28334ff5730c80a3f2bbfd4839c3de59ad5be9c2bd09d6

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

cmd.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\Local Settings cmd.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

cmd.exe

pid process

5036 cmd.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\daa40acf17585b2246dc1e9e6610964368f6fb854fdc16a1972c7908c23ab5cf.iso
1⤵
- Modifies registry class
- Suspicious behavior: LoadsDriver
PID:5036

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads