d75d7b0534ff648f16f5751be79a2c23158b6412a780180aec78c77c7e95071d | Triage

Analysis

max time kernel
154s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20220722-en
resource tags

arch:x64arch:x86image:win10v2004-20220722-enlocale:en-usos:windows10-2004-x64system
submitted
31-07-2022 05:29

Sharing

Report Analysis Logs

General

Target

zxcvb.exe
Size

586KB
MD5

131a32033cf88976a8df48361b90207d
SHA1

ce260393460fa5d4cbfa17d3329fd33594810add
SHA256

d75d7b0534ff648f16f5751be79a2c23158b6412a780180aec78c77c7e95071d
SHA512

120a4ef120c7b2d4c07af7e6418eaf83d7f3d41ba13f41ce2e494f76182c4b07fd16ec2ceaf1937ba3e76ecb9149cc42edba315e818dad09882cf77a62f6c708

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\zxcvb.exe
"C:\Users\Admin\AppData\Local\Temp\zxcvb.exe"
1⤵
PID:2780

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2780-132-0x0000000000A50000-0x0000000000AE8000-memory.dmp

Filesize
608KB

Download
memory/2780-133-0x0000000005970000-0x0000000005F14000-memory.dmp

Filesize
5.6MB

Download
memory/2780-134-0x00000000054A0000-0x0000000005532000-memory.dmp

Filesize
584KB

Download
memory/2780-135-0x0000000005490000-0x000000000549A000-memory.dmp

Filesize
40KB

Download