3952873719ebe020a1a4207f8c20adc4e025c8a9eeb787edfd45bd0b771b3d1c | Triage

Analysis

max time kernel
91s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
18/09/2022, 13:32

Sharing

Report Analysis Logs

General

Target

Discord-QR-Token-Logger-main/resources/template.png
Size

123KB
MD5

9ed2a8d45e1340e4f4cb3182b0fb564b
SHA1

6895927c549a87bdae75f152d92f6f124566b4f8
SHA256

b39f91ca11e5cba565d510459ce2baabfd6fa8f5faead47fef7e2f4e1073be4c
SHA512

ebbb25a2000f8244b1d8077595916aa06f471fbf20e760a4c4b17d96b5294b437b1abbd280c220a24e743cc74e605fdf96ec87223157542ef0acadadb8b3260a
SSDEEP

3072:w7QfdR89SmO8DRh6FCTNMcOCwU2p/DLDNGQ9z:MovnshWINnOCH2pDNv

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Discord-QR-Token-Logger-main\resources\template.png
1⤵
PID:1480

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads