b96220c1055bd0baa99252aa1778abb90dacdfa16ce0cd5d45f3f0a51ecedf9a | Triage™

Analysis

max time kernel
60s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20220722-en
resource tags

arch:x64arch:x86image:win10v2004-20220722-enlocale:en-usos:windows10-2004-x64system
submitted
25/07/2022, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LoanStatus_07_25_22pdf.lnk
Size 1KB
Sample220725-tkmsxadde6
SHA256 9a5566c191c6d076ff9ff3312420f4f5361a5ff9c38dc66b88897c0de7736e6e
MD5 4471d73d51ce27cd2429e0bf56bcd67f
SHA1 91745738eef46ae5e564873cac61e4c81336a98c
SHA512 bb81d28d6b5c91c23f6ee64354496c70286486b22a5911cc21f32638e489a0f7401be51ae6ae75c144ced9e58d035957889d7b6353d73cb3cee4da8be11c03ba
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4528	cmd.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\LoanStatus_07_25_22pdf.lnk
1⤵
- Suspicious use of FindShellTrayWindow
PID:4528

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads