ef527e55157b9a89c6fb72f0bb6e0b2f34406968c8f87d0930179ce465343b9d | Triage

Analysis

max time kernel
37s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 04:49

Sharing

Report Analysis Logs

General

Target

ef527e55157b9a89c6fb72f0bb6e0b2f34406968c8f87d0930179ce465343b9d.exe
Size

70KB
MD5

6538decee35564358ac626c017e1bdf1
SHA1

7327083ab7a2f61b2358544abea42ff35faf4c49
SHA256

ef527e55157b9a89c6fb72f0bb6e0b2f34406968c8f87d0930179ce465343b9d
SHA512

af032c870d48ca51d42bdbad0aafadcf4675b485690dd770ab7fc9eb79bc378be28dea085a3f38f5cc1475e4fb19823446a4642d67b8c7f4b00a1d241b99e465
SSDEEP

1536:NUiudwBp3CyM8HsWmJCa9xP8jtletENhxGLga4U7LP2iPoa:NRnLy8MWmJF9xPqtYaxG8qj2soa

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\ef527e55157b9a89c6fb72f0bb6e0b2f34406968c8f87d0930179ce465343b9d.exe
"C:\Users\Admin\AppData\Local\Temp\ef527e55157b9a89c6fb72f0bb6e0b2f34406968c8f87d0930179ce465343b9d.exe"
1⤵
PID:880

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/880-54-0x0000000076871000-0x0000000076873000-memory.dmp

Filesize
8KB

Download