Resubmissions

02-10-2022 15:25

221002-stk51adhdn 10

30-09-2022 13:52

220930-q6sdqsdga9 10

Analysis

  • max time kernel
    137s
  • max time network
    176s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-10-2022 15:25

General

  • Target

    cadets/located.png

  • Size

    26KB

  • MD5

    d7562d488b392aa85e0c90d924d5f3e0

  • SHA1

    490fb61ad54a9486e04b230bafc03ec3d2b5f06a

  • SHA256

    95a8db1d63b2212d59602c0c908de9bb67f21ea567e97a10d7e9c53e64f88670

  • SHA512

    cbb24b0721f91dd64d9c54404fa568f5774d65ef0602b5bcdb7eff0bdd99834d52b61d8bf2c162c5e85d3da4b1d29bd8e745ff1c83a635d030308189b1a3770e

  • SSDEEP

    768:I+tMbKHhuBqmDhu4VftFJA5DFKasjhw02oT:5mRhB3gDkTjh1TT

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices ⋅ 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\cadets\located.png
    PID:1696

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

          Execution

            Exfiltration

              Impact

                Initial Access

                  Lateral Movement

                    Persistence

                      Privilege Escalation

                        Replay Monitor

                        00:00 00:00

                        Downloads