c7a6d9c03343f882bf58d13a6a79db731c6eedabe67cb4a78d08e66b4971498a | Triage

Resubmissions

16-04-2023 17:34

230416-v5hkcsce3x 10

16-04-2023 17:26

230416-vzvbzaag27 10

Analysis

max time kernel
51s
max time network
71s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
16-04-2023 17:34

Sharing

Report Analysis Logs

General

Target

大航科技全球实体卡-虚拟卡接码PC端口/X64/DIFXAPI.db
Size

10.0MB
MD5

216d9df008dd6f1d3df83fce613524f6
SHA1

3b5f566334d588add84a0c7983187bccfbbf5aa7
SHA256

86be4940c2fc18eda11fa860c815eddcf98689aea446814127622bd47abec547
SHA512

bab7288b6a3740fe14cfd8e325fa78528f2288e87b08e60bf88f0753f99b6ffa4663933718e176b2549f371dfd85735424146d4b751d065324d1ff6dc8e9061c
SSDEEP

98304:27mUa6pMlGs+XMdFtDkHYOToHYOTFHYKHY6HYpwaLsyJ95xJm1hEVT4eNTigdGWO:EmVfcMv1iwaQQxJlTENIJranuf2jZ

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\大航科技全球实体卡-虚拟卡接码PC端口\X64\DIFXAPI.db
1⤵
PID:1008

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads