338dc690bc5a6e3f17334c52b27abbb7de9332f1977d7f70bdf9a92c82f8de04 | Triage

Resubmissions

15-09-2022 09:32

220915-lhzqpagcdq 10

14-09-2022 17:42

220914-v93q4aahg3 10

Analysis

max time kernel
1420s
max time network
1566s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
15-09-2022 09:32

Sharing

Report Analysis Logs

General

Target

Claim_Letter.lnk
Size

1KB
MD5

577f33f068c93c4727316b72564ef42e
SHA1

ca4f47d5550c990c09eaab46d8eb3f2b1e36fb47
SHA256

5097f1580643d87094f58a4078c455e3bf17bdcb3548087b21a81e1a0bed358b
SHA512

fecd1c985ed3fe9019525763eccbc72c01cf461e11352d6e06708ad12aa94832a80e871df9eceee9c285f662cf0a48a37a8a684eabe6acffaf94c83678cf9fcf

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Claim_Letter.lnk
1⤵
PID:2328

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads