3041536c2a8e1a90ee11ba958e9ee764404a801fda04af11d256475064f752a6 | Triage

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
14-12-2022 23:03

Sharing

Report Analysis Logs

General

Target

RRFB17.vhd
Size

2.0MB
MD5

9550997039bcbbbfb97efcb802b53a93
SHA1

9db73320291c262c35c944011dd6c9b1ee9a4c0b
SHA256

3041536c2a8e1a90ee11ba958e9ee764404a801fda04af11d256475064f752a6
SHA512

277fc3df93591324dd6796d586f6d9a74376f68ae9369982b6777e2efe7dad5b7e066600b9243dae9ef89ac2f0a31ccf21e8d0d7f9a854e99f0d3dbc43fcc3fe
SSDEEP

24576:ldBrbfL6VHOe+lhMjcxy9tnYu8UQw8Md:ldBXT6FOe+l+j4Yx8UQw8M

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

cmd.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings cmd.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\RRFB17.vhd
1⤵
- Modifies registry class
PID:4924

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads