3797d33045461d3f38719dc5a2c226a8163dc06ac0b75c2a93c54ab91f0efb5b | Triage

Analysis

max time kernel
400s
max time network
442s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
15-04-2023 12:36

Sharing

Report Analysis Logs

General

Target

res/GeoIP/Flags/AO.ico
Size

33KB
MD5

a5c78266329a1eb0f3e52bc0343783b5
SHA1

e0b254e2176f0eab8d2b76213a64c24ba1788675
SHA256

550a1b6e2b97febd865cd130b0c0d484cf2fd02b8066ddf6d7290b9cffb35059
SHA512

61a7bf67f9019e5f4c653246e1844703619d6421c3625c963862ee9b0b3975b26ce2f785c9b3cc79e77181c098f0e3d60c9f0e21203928117c6cd45f104af36f
SSDEEP

384:lbHZz/pFszYzGhcFz8La8h0fgY302UvB9yJVXSciVW6YF2eHNIC:PZPVXS62XC

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\res\GeoIP\Flags\AO.ico
1⤵
PID:3588

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...