12f9cba765eb56a029a33f6d604d44df20cadb817fabcb18353c5c40d6439a07 | Triage

Analysis

max time kernel
36s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19-09-2022 06:01

Sharing

Report Analysis Logs

General

Target

12f9cba765eb56a029a33f6d604d44df20cadb817fabcb18353c5c40d6439a07.exe
Size

1.5MB
MD5

cb91fb48dcbfadb1db98d45103670fa3
SHA1

57d514e5b312c364587deefd46700299fed10732
SHA256

12f9cba765eb56a029a33f6d604d44df20cadb817fabcb18353c5c40d6439a07
SHA512

b998df87da8cdd6846955171550d95efd144fb545179e5ca833503aad431211a5e262b3aa462a9b66d48548a1a7ae2f37312cf4cf4e4c0637b69861f12956e84
SSDEEP

24576:7T4UlFT0BIeIYle8mB3ezyXZDCpAf5afqOaL/dPXhNGCV2Dam1xIg1wMQtM8wD:7x0BPIfTrDoCQqOE/dtEDa5g1lY/wD

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\12f9cba765eb56a029a33f6d604d44df20cadb817fabcb18353c5c40d6439a07.exe
"C:\Users\Admin\AppData\Local\Temp\12f9cba765eb56a029a33f6d604d44df20cadb817fabcb18353c5c40d6439a07.exe"
1⤵
PID:1996

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1996-54-0x0000000076031000-0x0000000076033000-memory.dmp

Filesize
8KB

Download