ed55687fda25549d0d8a47a2f7300db61e35a0be23d8a692ac949cbdcfe968fb | Triage

Analysis

max time kernel
90s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06-09-2022 13:35

Sharing

Report Analysis Logs

General

Target

documents.lnk
Size

1KB
MD5

ad962f186df7da5e5efca61555fc47ed
SHA1

9045ba63201225996bcd680cc762c56eb0a7a761
SHA256

3ca66f8b12394d093fd6095c072922bf8ad718a7d0bca490eaba752766fd3b23
SHA512

2144040581eeeac31788793db91a6d2d1cd145c08a7f84208c6e15d7add9d098999ac6879a56cbf4c57fcc92f128d8bb3d703b513c3898daa7b01b545f65ffb4

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

cmd.exe

pid process

1664 cmd.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\documents.lnk
1⤵
- Suspicious use of FindShellTrayWindow
PID:1664

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...