a858b2b8b4be7cb23e0a7d37a0c08489a6820cb1be5523a7a466014eb994391f | Triage

Analysis

max time kernel
133s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
31-03-2023 16:01

Sharing

Report Analysis Logs

General

Target

$RECYCLE.BIN/$RC3SQXJ.exe
Size

787KB
MD5

6a31cd7386f96213190e07b4e5691821
SHA1

1dc0686217192136ade3ea4c97751692f2719086
SHA256

dff6fb4233937c2f69694da9fc0e85182ae3fb9a4d36aadfd2e6220e557ef5ca
SHA512

5527eb4b429808deb2f3032ee008f9d71a044bb2ad108d999bfc287e1b50f35c29f4f080fa43decfe62a2786a383b421f8d44c2476a1159fe4d40fc056c07396
SSDEEP

24576:Y6T8Ujl6vO01C1GCTsYoQZtlsZdc40QDrUYuGG1ihTGTTi0Cx:+TUwTGTTo

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

$RC3SQXJ.exe

pid process

1372 $RC3SQXJ.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

$RC3SQXJ.exe

pid process

1372 $RC3SQXJ.exe

C:\Users\Admin\AppData\Local\Temp\$RECYCLE.BIN\$RC3SQXJ.exe
"C:\Users\Admin\AppData\Local\Temp\$RECYCLE.BIN\$RC3SQXJ.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:1372

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...