dca9c0d5b10ab8b01e4e60cfb4fb11f858d8c4c3d92ca2f20d80ae78b138f915 | Triage

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
11-04-2023 15:35

Sharing

Report Analysis Logs

General

Target

dca9c0d5b10ab8b01e4e60cfb4fb11f858d8c4c3d92ca2f20d80ae78b138f915.lnk
Size

528KB
MD5

bf42189c53d02d4618030d75659296f3
SHA1

bbff2942b885222d450c1579ca807faf6ffdbc42
SHA256

dca9c0d5b10ab8b01e4e60cfb4fb11f858d8c4c3d92ca2f20d80ae78b138f915
SHA512

f73042e3e0840c64952b0ccd7c32d6b3037fce0a3d2488032af799e48de5c4568865cc3a6fd2db00db83693661f70eca8e1548aa69acceca02ffc2b7af5b351d
SSDEEP

12:8MMlHm/3BVSXvk4RnK9hRNSWhW+UcZRNS/De9DGvAl7DiNL4t2YqlsXSkgK:8lo/ByKn8+/lMAyvAl7a5/Mhg

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\dca9c0d5b10ab8b01e4e60cfb4fb11f858d8c4c3d92ca2f20d80ae78b138f915.lnk
1⤵
PID:1168

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads