c7a6d9c03343f882bf58d13a6a79db731c6eedabe67cb4a78d08e66b4971498a | Triage

Resubmissions

16-04-2023 17:34

230416-v5hkcsce3x 10

16-04-2023 17:26

230416-vzvbzaag27 10

Analysis

max time kernel
29s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
16-04-2023 17:34

Sharing

Report Analysis Logs

General

Target

大航科技全球实体卡-虚拟卡接码PC端口/X64/DIFXAPI.db
Size

10.0MB
MD5

216d9df008dd6f1d3df83fce613524f6
SHA1

3b5f566334d588add84a0c7983187bccfbbf5aa7
SHA256

86be4940c2fc18eda11fa860c815eddcf98689aea446814127622bd47abec547
SHA512

bab7288b6a3740fe14cfd8e325fa78528f2288e87b08e60bf88f0753f99b6ffa4663933718e176b2549f371dfd85735424146d4b751d065324d1ff6dc8e9061c
SSDEEP

98304:27mUa6pMlGs+XMdFtDkHYOToHYOTFHYKHY6HYpwaLsyJ95xJm1hEVT4eNTigdGWO:EmVfcMv1iwaQQxJlTENIJranuf2jZ

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\大航科技全球实体卡-虚拟卡接码PC端口\X64\DIFXAPI.db
1⤵
PID:1240

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1240-75-0x0000000002090000-0x0000000002091000-memory.dmp

Filesize
4KB

Download