5578fbc2b70fb9c4a49bfb8b7b6fbe945febee193699fcc9c2aa46675d86f778 | Triage

Analysis

max time kernel
33s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-10-2022 15:16

Sharing

Report Analysis Logs

General

Target

Contract.lnk
Size

1KB
MD5

c86d26c6773f581a96cc5198ee12830e
SHA1

d85174dda21f5ef8f92efdd35d2a13c426e1768e
SHA256

6ec0ba7e0db0e097c729bf9cf80b270f0d8f7e7314cec7bf30b8c644f866e584
SHA512

e27d1f610673888d881b422695356678775d3673f937e2e897525319f6ff2751382d75a3c89e58ab71ebc45e586c357b8e2e832e9d4cd288638e4e83d4ebcc74

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Contract.lnk
1⤵
PID:1388

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1388-54-0x000007FEFC141000-0x000007FEFC143000-memory.dmp

Filesize
8KB

Download