09ddfe8ae0e74edc3846b2f93e8cd07ea744b462d8848224a84fad7cf160997a | Triage

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 05:50

Sharing

Report Analysis Logs

General

Target

09ddfe8ae0e74edc3846b2f93e8cd07ea744b462d8848224a84fad7cf160997a.exe
Size

829KB
MD5

d94be274fd2b142142c29cc0ebc352dd
SHA1

8e046204ff01a74c7f797278062d0a87dce71e11
SHA256

09ddfe8ae0e74edc3846b2f93e8cd07ea744b462d8848224a84fad7cf160997a
SHA512

3692d28054687698453fdaa8170d367b74d42e7f905e85170d253f78e4f2a56736efeb6c07a8805a645be145f4a0fd75d59dc98665757dab6ba2f3613151d22a
SSDEEP

24576:8BT4UlNorpaqLezpE+aMTwc/RQ6ADmXCOnwQbx:8JNorUqg8UrwsCOnwQbx

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\09ddfe8ae0e74edc3846b2f93e8cd07ea744b462d8848224a84fad7cf160997a.exe
"C:\Users\Admin\AppData\Local\Temp\09ddfe8ae0e74edc3846b2f93e8cd07ea744b462d8848224a84fad7cf160997a.exe"
1⤵
PID:1980

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1980-54-0x0000000076031000-0x0000000076033000-memory.dmp

Filesize
8KB

Download