77b03002cab8c788a323846f25ff38a86c8a050e805f38533593feffb5b41fe1 | Triage™

Analysis

max time kernel
2s
max time network
14s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
03/02/2022, 06:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Order_673N78333.exe
Size 261KB
Sample220203-he8mmsdfe5
SHA256 77b03002cab8c788a323846f25ff38a86c8a050e805f38533593feffb5b41fe1
MD5 ee91f6b50d9db02d7f50d34bc8648de7
SHA1 567b55f2aeace4c23362b971a436bb19e2035f1c
SHA512 76543db1cdd593bd43ca939663170b7a4a4dbf817e19f5b58f519a0b80840d97401b7b3f7910f089a963f56980cc8179e0c089bbd7b2b0fa02b904adf5558806
MD5 SHA1 SHA512

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2136	Order_673N78333.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\Order_673N78333.exe
"C:\Users\Admin\AppData\Local\Temp\Order_673N78333.exe"
1⤵
- Loads dropped DLL
PID:2136

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads