e72494d58a80a06fdf0ded1abee6bf23091aec41b6ab9ca4e2c37d10a6d0be70 | Triage

Resubmissions

03/10/2022, 18:20

221003-wy3sdsaehq 10

30/09/2022, 16:25

220930-twx31seah6 10

Analysis

max time kernel
38s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 18:20

Sharing

Report Analysis Logs

General

Target

CardS.lnk
Size

1KB
MD5

ae8ecc7287439157dac02a6a7d23816c
SHA1

4782bd0e164db8a1d9ecafac9228a263f04091d5
SHA256

af521257a74f32d890f81cbb8e057f335db17f91ee2e1f0306e1a17c005621ef
SHA512

d7cfe1beabe23135fa242ee9c44d7457981d177e251fd2c8461a0ee6b82aea8b36346b2d538aed68876c1aa753f2bca2c5a5d5aa04f26e95290d9a4c0ef7dcb1

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\CardS.lnk
1⤵
PID:784

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/784-54-0x000007FEFB871000-0x000007FEFB873000-memory.dmp

Filesize
8KB

Download