9dd98d9003151d92d8b5d39b135a51a0e4ca8e2ad43e6cffc666c2c6dc8570e9 | Triage

Analysis

max time kernel
91s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
18/10/2022, 19:54

Sharing

Report Analysis Logs

General

Target

Invoice-trappings_adv-82894_ISO/Document.lnk
Size

1KB
MD5

5fb8ac4155c738d146afc2fca775a0b3
SHA1

768f44029c7a77d534cdd44fc18f85c834c61316
SHA256

bb9f93e0450d2e57ea55a6cc8042d5f47478c9bc80636824edb0d813043da758
SHA512

838fd2b5f5cd3ddecd34fe60e57216dd54366e0f76d65006e568c7e298fab128bdc35973ecddacf32303533db3d771949f971cb5bcbf8b91b0977965a1826dfa

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Invoice-trappings_adv-82894_ISO\Document.lnk
1⤵
PID:5080

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads