b47bf41986964ec1f181f023eacc2c10eed2ad556f64d402bec61b39e60aae69 | Triage

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
14-09-2022 14:46

Sharing

Report Analysis Logs

General

Target

Claim_Letter.lnk
Size

1KB
MD5

dbd85a01084c83ed79c8a6f9b597d946
SHA1

4b3942fe61f8138c7b7921f9f9c164eda42e0b0d
SHA256

f0e17e8f3be3618a8cf4cb6587401c777682ee81b0da220dc3867235f150e691
SHA512

bfb9415b5da616ea7af26544c4134e903db2c0ab8d92ee811fe8bf52da6d8169afd82957fa991aaafe124ef7ac42413d710efc5b79d11a28d872cf8d7b017f38

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Claim_Letter.lnk
1⤵
PID:1912

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1912-54-0x000007FEFC1F1000-0x000007FEFC1F3000-memory.dmp

Filesize
8KB

Download