601eabe782aff7a264fb37953d0ff488118936bb1a3e2a23e822d4919783c86c | Triage

Analysis

max time kernel
42s
max time network
109s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 00:38

Sharing

Report Analysis Logs

General

Target

a/B.class
Size

2KB
MD5

ff3d7b022d9a8c6cb557b8ff7cb5e7bf
SHA1

da29bda243cf1bf76e75b107415ab997b2fc8690
SHA256

bacdaa856875ab1225bbf95377bddef5e0bd9771914c6546d48fb538b3959d9f
SHA512

d9edec14468b66813d46db1f5e495da1c2d9257e5e46790f9bb2da062e237e72b939f5a202575f5d2ecc1d205a16ab3685255012f9cdcac27d3db2b77f129988

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\a\B.class
1⤵
PID:1624
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\a\B.class
  2⤵
  PID:524

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1624-54-0x000007FEFBD21000-0x000007FEFBD23000-memory.dmp

Filesize
8KB

Download