420a9b53025c922bd4be1d93c2812c1d6b121575eba5d1215500c2d90aa9282d | Triage

Analysis

max time kernel
37s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
15/09/2022, 17:05

Sharing

Report Analysis Logs

General

Target

invoice.lnk
Size

1KB
MD5

d02df40b1b33f15d91c263d509ef075b
SHA1

1610557050fce3cfb4bb5fec061c16026a386671
SHA256

5e86ea9acb71fffba950f7d81f931f08a57d17eaa476807bd0997d0a47fda5d6
SHA512

0351b65be9445a18330ed3369ecab38a6847ad73ecf9cf4b4e6fd11b6e4c8cc44a68e0cb430c495c1713f4972c4bec1d92586caf1dc73c251ca7a23519b82825

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\invoice.lnk
1⤵
PID:1612

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1612-54-0x000007FEFBD91000-0x000007FEFBD93000-memory.dmp

Filesize
8KB

Download