601eabe782aff7a264fb37953d0ff488118936bb1a3e2a23e822d4919783c86c | Triage

Analysis

max time kernel
41s
max time network
107s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 00:38

Sharing

Report Analysis Logs

General

Target

a/E.class
Size

8KB
MD5

f21f97ce719932fa220a94347b7606ae
SHA1

6d21d62e5b2a03d4c43df1952807fd0d6f235f65
SHA256

abbd083a033bdcbe7107f53165840ebcabb75a1e2f2b6d099aa0105c3043aec6
SHA512

13d05dc1967b5711d1a6fb85f23efa6075482d96569cfacd847f97cb996a3627684b5b5d1abb672bc2eb4d605344550f660e20fc4a4b37ce1660743a5e672787
SSDEEP

192:2jqb6XDanqp1GyBlHbZl54XGqCzaoZJeolZOiX:AXDanqp1RB1ZlIYuCJeO7X

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\a\E.class
1⤵
PID:2024
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\a\E.class
  2⤵
  PID:1784

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2024-54-0x000007FEFB821000-0x000007FEFB823000-memory.dmp

Filesize
8KB

Download