b3c5e464e43d7db2432f3e28de75bd0eee8fa7a2b7b6fef7134e7115d6681be3 | Triage

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25-03-2024 14:35

Sharing

Report Analysis Logs

General

Target

$RECYCLE.BIN/$ITQTF65.vhd
Size

52B
MD5

5c4658d0c26e73e822805cd541661a77
SHA1

45d2b460c1b8395401fd60b26b8f398f5cfbcbf5
SHA256

8f3b7422617b49f01037d7f18aeeec7892d95a804cc220228ded61e3fbb7bb30
SHA512

d8e455d594bf16b279f082aefccb939440619a0da8339534873dfbbddd3cc2880e2f7c6b2fdf9999ee48455b4c139750403ed9b8c2e6c82da0bdeb522b196002

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

cmd.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings cmd.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\$RECYCLE.BIN\$ITQTF65.vhd
1⤵
- Modifies registry class
PID:4936

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...