e198a1cf6988b3e8bffa5dec0b28c891c5ef4116c71fbc94d9a68ed9e9b444eb | Triage

Resubmissions

23-01-2023 13:41

230123-qzjg9add79 10

27-12-2022 17:22

221227-vxl8ksfd97 10

27-12-2022 17:10

221227-vprhbsae8t 10

Analysis

max time kernel
226s
max time network
344s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27-12-2022 17:22

Sharing

Report Analysis Logs

General

Target

zsys-master/yaru_widgets.dart-main/.github/images/screenshot.png
Size

126KB
MD5

d401807b8c5e83a5258df0365d8326b8
SHA1

189caf74e445acab2a04d4cace4fb90028403fe7
SHA256

ebf2c8cd125f08ed46abbf525654bae55f9dd64a5c8f3b7d21004e3a188f01c6
SHA512

a29df3df4f11d183ac2fdafd41a40c2180897ed34ff5b2dbd9dcd2ef2ea3f6f18801928e6a75bad2d451f5959391cabb819f2b4c3eba7a284bfe3458038be9a7
SSDEEP

3072:01Yp/kBnbisjEV74COA+omgz+Bx+erFokDv7aDrrslyT:aYpsBFEVvOAUBxXiS7aDP9T

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\zsys-master\yaru_widgets.dart-main\.github\images\screenshot.png
1⤵
PID:3348

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads