501347d460f9442678ba5a3e0679124eec8add1fdeda84a79ce9300deb957bfc | Triage

Analysis

max time kernel
34s
max time network
38s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
05/02/2023, 14:59

Sharing

Report Analysis Logs

General

Target

Anymouse.png
Size

9KB
MD5

ac892129cf96cf0882c93799823275fb
SHA1

67228df28499d7ee0617d558e16d7984b267a93e
SHA256

501347d460f9442678ba5a3e0679124eec8add1fdeda84a79ce9300deb957bfc
SHA512

495b5644ba13cb0f25316b79b20cce08c98820eeb46f119889d1dce963d8f8e0a18336c49a10be4900cf0389f3cfe0a3335e923176898cb2261b6ec26c93d74b
SSDEEP

192:At7OcyIstT2W1ULzbjREuuJUn6LSqMJhHc6sN:AVyF2Wu3fuJW6Ln0hHNsN

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4732	816	WerFault.exe	44

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Anymouse.png
1⤵
PID:3124

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 472 -p 816 -ip 816
1⤵
PID:216

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 816 -s 768
1⤵
- Program crash
PID:4732

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads