025be4078b35093f4d9c0429df53472bd4f6c9bf09120541170462dba6fc4e93 | Triage

Analysis

max time kernel
12s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 02:17 UTC

Sharing

Report Analysis Logs

General

Target

025be4078b35093f4d9c0429df53472bd4f6c9bf09120541170462dba6fc4e93.exe
Size

74KB
MD5

b467e902cc5dadafca95a463eb2f6cbe
SHA1

602971581ab006dfaaf3e52979a5daf300293214
SHA256

025be4078b35093f4d9c0429df53472bd4f6c9bf09120541170462dba6fc4e93
SHA512

c1308b4260737aa0628e284a8f55003674b546c20aa51abea3875fb2fbe31b3bc795e6d11683842664521011d7d2a219d4b9ac183ddceba9f12972a25ab56e56
SSDEEP

1536:pPx/CJAmx2/W5Ebnto4tmJtkIzOS5bjov4nJEgSu3kV:1x6UW6tpmJyih5bjov4JKu3q

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\025be4078b35093f4d9c0429df53472bd4f6c9bf09120541170462dba6fc4e93.exe
"C:\Users\Admin\AppData\Local\Temp\025be4078b35093f4d9c0429df53472bd4f6c9bf09120541170462dba6fc4e93.exe"
1⤵
PID:1628

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1628-54-0x0000000074AD1000-0x0000000074AD3000-memory.dmp

Filesize
8KB

Download