de800ec458c404e412158787a7bc6660fe54a2bc3b6903b31d07a661325056f0 | Triage

Analysis

max time kernel
876s
max time network
878s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
21-03-2023 06:09

Sharing

Report Analysis Logs

General

Target

cversions.2.db
Size

16KB
MD5

f50b8221390febea673be698a6839744
SHA1

cca7be0b590583a72276069d0d8f6f9a858bb092
SHA256

de800ec458c404e412158787a7bc6660fe54a2bc3b6903b31d07a661325056f0
SHA512

1b69137cbffc12f70e036ed7ce5577ba2c024386bb97139f19cbe5cb9f3920fd00f62e62971ea12116b9edfbf842c1c8e3205271ba3e4fb160265850c13ccbea
SSDEEP

24:Rv0q54sc//0E6igTsi5QkU//M8yKIDka5I8M//:Rd54sc6igTs//M8a5I8M

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\cversions.2.db
1⤵
PID:1948

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1948-79-0x0000000001F00000-0x0000000001F01000-memory.dmp

Filesize
4KB

Download