a85d22ccaf9cd7d27836ebaebe0bee61e5acd02356a83cf19d03d47e560fef5e | Triage

Analysis

max time kernel
28s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
20/05/2023, 14:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

dark/cursor/busy.ani
Size

151KB
MD5

74dcd9a571a8df8d4843f2be30922ccf
SHA1

7443e5cddb4396b6f367996e8da2fda45758bf66
SHA256

bf446faf0bef9a1e48223640dd6fad90fbdeaec0f5ef0dc7b7d98e91eeec3c53
SHA512

2a0751ad04c0aae576a73e2d4bf473003ccfcfe4f78f64783c20f00c0f8bd4bd88673496528b091e037485f0d1a0fd06443850ae45ad424d205fcdd4abfb0fae
SSDEEP

192:SgWr347F3yA7mfBCZRI1jIy1Y725drvmGWqrvmGRljm5GswaOr4WRo0T/PAkLSA+:SgCoz7+CsqnGWqKGRlOGLbr4Dy/PAk1S

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\dark\cursor\busy.ani
1⤵
PID:1388

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1388-79-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download