faf28fe3156457ed5d637722f1bf7d7b976d870cf87d30d48745267004f9cfee | Triage

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/11/2022, 18:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Document.lnk
Size

1KB
MD5

e29a6f808e95e1ac31a6e038f7c0bcf3
SHA1

f3945df2aff8858a44a75764444dc20ff71ff8bf
SHA256

9e4f5aa0a959f1d17b346b959b3de15f4eab7ba159545b5d3bb14c8c7f6c3a1d
SHA512

6bffd6d28af354264203817178db83a02e79530d20c2304ba1ed01949b6ba90f21b9c26ffae07a87e74eedbc6c1916751bff7b413237b45e039c1fcaa163db67

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Document.lnk
1⤵
PID:1480

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1480-54-0x000007FEFB991000-0x000007FEFB993000-memory.dmp

Filesize
8KB

Download