76e2469c7a3140a0766ea651b88495c5ae4cfbdedcc0ec908f24471d0e36584f | Triage

Analysis

max time kernel
43s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
14-09-2022 16:43

Sharing

Report Analysis Logs

General

Target

Claim_Letter.lnk
Size

1KB
MD5

9eafb6b85708e156a32aff880054f1e4
SHA1

762d6dc702c5294d0f22b232c93d7c5ce283496b
SHA256

a76d39a93955d11b4eaca9c24a698e980677335282f9415d1d68cd4cff56a08e
SHA512

115200e27b4c3d477e47b2e06924ead024b5e0cf671365de8161c4d9e8728093d0b8f1915f371545618ed3e78cb7b751b654673f1830ad8f7071f5ce761548a7

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Claim_Letter.lnk
1⤵
PID:1272

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1272-54-0x000007FEFB621000-0x000007FEFB623000-memory.dmp

Filesize
8KB

Download