e2b57121e017b1fea3a3cea65d0d72752ff3993a0981af18a1b765e2cef1c94b | Triage

Analysis

max time kernel
91s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21-09-2022 10:23

Sharing

Report Analysis Logs

General

Target

Calculation.lnk
Size

1KB
MD5

c5fcb4868f3731290d1f459a88f51818
SHA1

ef26c48a1c1e47c243f4721eae81596e41c5cffa
SHA256

16f3dc6ae384410ccb680ef22d1afd78c9620f20e1b5b563c5c01eb18aede36b
SHA512

26d5251102cda61b25684a236b5900523321f9a20ac9d336a90c85163af54d27f0f4e46a9f32a22dfc145e6d7a53ace038b90e42abee7015971dccbf0d3a6a4a

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1080	cmd.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Calculation.lnk
1⤵
- Suspicious use of FindShellTrayWindow
PID:1080

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads