601eabe782aff7a264fb37953d0ff488118936bb1a3e2a23e822d4919783c86c | Triage

Analysis

max time kernel
36s
max time network
97s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 00:38

Sharing

Report Analysis Logs

General

Target

a/I.class
Size

623B
MD5

ff7331fe41086589e501b2d8a3c729f9
SHA1

c4544d33c731f83f99bc07ce2ade2a78081eea56
SHA256

26e32f857989fffefcf602eb403673eb8e372c675bd6949ec3043a4b50a902ca
SHA512

3bd8960f9efc45d3732d8ce367535106f07555043622cf7d95bc2f3505274dbbe205b9f555c8ad28f7c1a934c96df04c5de97ed7c0c48dc5f387cd4ea34e890b

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\a\I.class
1⤵
PID:1676
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\a\I.class
  2⤵
  PID:912

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1676-54-0x000007FEFBD01000-0x000007FEFBD03000-memory.dmp

Filesize
8KB

Download