3797d33045461d3f38719dc5a2c226a8163dc06ac0b75c2a93c54ab91f0efb5b | Triage

Analysis

max time kernel
376s
max time network
439s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
15-04-2023 12:36

Sharing

Report Analysis Logs

General

Target

res/GeoIP/Flags/AF.ico
Size

33KB
MD5

e18c650283441dfbdc3aa46a414f326c
SHA1

eda65607858d6b93db9ca4a9f20cac382cb685db
SHA256

ecf99e08bf15aca4325c4790ee20ccc674b6f4fc6dbbef0885f36bf8e6e8aa68
SHA512

f10cd2a31390bbb06546052214a817153f35ed9b5c5403995267e1e9b4987630c08ddf7db414146211b8cfb4769949cd660060bd2a5c8a51bf5bc381372a6673
SSDEEP

384:lHxUzM7kMzrJ129WuaU+3i7fgeJ3gDW/L5JEJ3jM9Go92n+J4w2zO0X8pm2zCrku:7ULgeI4WGxl2

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\res\GeoIP\Flags\AF.ico
1⤵
PID:3724

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...