9ade7d41fe1eb846c653498e8b2bc5bc222c99576fc01c73ccbe50e7b5837bdf | Triage

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20-09-2022 00:57

Sharing

Report Analysis Logs

General

Target

document.lnk
Size

1KB
MD5

77d8b2f19dd5bfb4e7c29739194a8b9e
SHA1

7f4f8f11d6321be41d3f474ee6fdec6d999a3951
SHA256

e7212925f7650b9caf83357e5fef5a923695794eb486303cbe2d1fa61e045815
SHA512

4999b299841d27f3a5b234619be4a4f08c03b2a0fc79950bdcb86f193b016bb68a14b3c8edb968afebfbe3af8a3436cc0b2cae940dfe7ee869507e3924924560

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2292	cmd.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\document.lnk
1⤵
- Suspicious use of FindShellTrayWindow
PID:2292

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads