5f48cc6c72b98dcf70d4fd73ec5a4494a0e9278f31f28780032940f78ebe2acb | Triage

Resubmissions

16-09-2022 14:04

220916-rdladsfhg9 3

16-09-2022 14:01

220916-rb18tsbffl 10

Analysis

max time kernel
91s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
16-09-2022 14:01

Sharing

Report Analysis Logs

General

Target

AnalyticsDO.lnk
Size

1KB
MD5

ed9ea26e8b76d9a5c448e46e759f8ee9
SHA1

8f9c069f973c5ac50dd8122c3e32ef30b7c7ab3d
SHA256

c0d26647274da09d6818a4d302dac242f560796533eb0d6c37a2817a795c89fa
SHA512

95e700dde7a186c1a71838ce83647213340b9e38b4cd5146a51d526b24ce67efbde67ed93c2f9d64f2ba1a51508a88b08693f8fe02f03abfabce4b6a985fcd03

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\AnalyticsDO.lnk
1⤵
PID:2412

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads