601eabe782aff7a264fb37953d0ff488118936bb1a3e2a23e822d4919783c86c | Triage

Analysis

max time kernel
82s
max time network
125s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 00:38

Sharing

Report Analysis Logs

General

Target

a/O.class
Size

3KB
MD5

1882ea5b1cb86acaa8a0508028cd0391
SHA1

72bab4529aaabeb385555d1305a991fc1c064cec
SHA256

0c7aaf33032e550ca5b28354672fe7d286bfb1f0e6f4335c3801f0246b7b0863
SHA512

3133b75a0eb56eae6cf3b25e1ef038ef5ceb257b65f5663a29a913f6a1a684e99f383df7420a6bd410a0bc527641006df8d7b193c61e75b729a9e5e5d6464cc5

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\a\O.class
1⤵
PID:952
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\a\O.class
  2⤵
  PID:1884
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\a\O.class"
    3⤵
    PID:804

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/804-82-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download
memory/952-54-0x000007FEFBF41000-0x000007FEFBF43000-memory.dmp

Filesize
8KB

Download