1a267e33397c68390154cd33e9e2b43d72664ac5a17f726cdaa1104d07e0872f | Triage

Analysis

max time kernel
141s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 23:58

Sharing

Report Analysis Logs

General

Target

sxw/admin/Editor/Editor.asp
Size

2KB
MD5

f6d158ef2ff891390c80bbeb52d03e9e
SHA1

ac08b43cbfdf0048ccc9883faf065aee0668db70
SHA256

8a0c99e440e86d68375e1e1ca1bc9bce27fa88e82bfb06ef1a74b53cf05b3a55
SHA512

ca7f39d5fbb1e41dc9bf22753df0a96406ed7e2654a9822bc74dc26b0b2023a8d36f2ecf7f771ac097ac6083b655031f7e572d0bc57fe75a8ca1f2740c66c8da

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\sxw\admin\Editor\Editor.asp
1⤵
PID:3036

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads