6663ff536e707a57681d585f35903f6164baa543667411e89050add532240bb1 | Triage

Analysis

max time kernel
30s
max time network
32s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/09/2024, 19:36

Sharing

Copy URL Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

鼠标指针/busy.ani
Size

17KB
MD5

bef88be0219a8ebac33fb3e102bc1b15
SHA1

ddefcf819bcfe5e1b566b61ed2db287d578e81b4
SHA256

12112f5dcae1efc7bf014643d5d3ff4850179097c052ee917c7983552be60b08
SHA512

7e7f7f6f32020b44cfc3b1fd7d7b0364d21b41de428c2201d2f5f268234009d486e5d5b4a3708b1d8624cb49ed167e90f5c5d24f859977a28ac7bf33a3d0e275
SSDEEP

48:koEr4nXl8+r4nXdZr4eX44zr4eX6YLr4eXjRZr4eXhRVr4nXRr4nXSgh:xUR4QDjZhWYSgh

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\鼠标指针\busy.ani
1⤵
PID:1824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads