24b57e77a5882d5fed62413c233cdd01533b29e0eaa4c27f91d99bd13543c65a | Triage

Analysis

max time kernel
165s
max time network
178s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
09/03/2023, 15:29

Sharing

Report Analysis Logs

General

Target

OutlookEmoji-16781466416548d39a82e-ae43-4325-8814-f82a1b26c799.png
Size

18KB
MD5

a0a71866020e73f936baaf4b5b06b254
SHA1

d2c2ee54ff44b85faf0cbcf7d9c02cddfdf239e3
SHA256

053c899b97373a201dc63145f4201bde504fa62796de3e95a84ae248e35d2585
SHA512

36683a8ac2f8c0f371f7eaa3c36ea0736380d557270ac8911646bb8957129121e430def3f43b7b15ccdc1acb8f1c66705714a8aeb0c0637cb9283fa649179ddd
SSDEEP

384:p63b1tRbFoEOwnh7EHRnCn4qpE/v2M5TpcY2p1LtK:ExtNFoxwh7EdUshj41L4

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\OutlookEmoji-16781466416548d39a82e-ae43-4325-8814-f82a1b26c799.png
1⤵
PID:2076

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads