683a2c5a072ff18213a03d08456cd84cad5a3bb1312d162f09c3fa4f0b62b3b4 | Triage™

Analysis

max time kernel
118s
max time network
120s
platform
windows10_x64
resource
win10-en-20210920
submitted
01/10/2021, 00:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
683A2C5A072FF18213A03D08456CD84CAD5A3BB1312D1.exe
Size 1.2MB
Sample211001-anyj2aaef4
SHA256 683a2c5a072ff18213a03d08456cd84cad5a3bb1312d162f09c3fa4f0b62b3b4
MD5 97626ae89c7f1285961d498763c67bb0
SHA1 7e4cb52a0dc2837df9770da71025a68d0131d284
SHA512 555bcb9a1cebda77c255f771323c7cb6caf054d10624dbb64506e3f898cbb7cb81417f5c533d08f2dd5a3815f587e8a404f924ded4666db54c783bc94dccdb4b
MD5 SHA1 SHA512

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3592	683A2C5A072FF18213A03D08456CD84CAD5A3BB1312D1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\683A2C5A072FF18213A03D08456CD84CAD5A3BB1312D1.exe
"C:\Users\Admin\AppData\Local\Temp\683A2C5A072FF18213A03D08456CD84CAD5A3BB1312D1.exe"
1⤵
- Loads dropped DLL
PID:3592

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads