ef5d2c4c356dc2bef68cde6f24c0ff8515aaa873724c42d1cb8395f23795d277 | Triage

Analysis

max time kernel
47s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 12:36

Sharing

Report Analysis Logs

General

Target

ef5d2c4c356dc2bef68cde6f24c0ff8515aaa873724c42d1cb8395f23795d277.exe
Size

237KB
MD5

d93b7930ec1ded261caf7395d4afe6b0
SHA1

2acc5df9e503b41e5a93311b6242d4e9a1da3f4e
SHA256

ef5d2c4c356dc2bef68cde6f24c0ff8515aaa873724c42d1cb8395f23795d277
SHA512

272b44694208e04e07986cb0f1970935d6b6f3cc60cf03151ea38aefc460d1f621bed038855959748807af101389de46d3ce2063d6563dddad3b185c4aabd943
SSDEEP

6144:9OPjv24LWXTwAlj2blMMgiymcy86T9irKanJsu0EU:21LWXTFlzMgiym784orK6JsuG

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\ef5d2c4c356dc2bef68cde6f24c0ff8515aaa873724c42d1cb8395f23795d277.exe
"C:\Users\Admin\AppData\Local\Temp\ef5d2c4c356dc2bef68cde6f24c0ff8515aaa873724c42d1cb8395f23795d277.exe"
1⤵
PID:1768

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1768-54-0x0000000076961000-0x0000000076963000-memory.dmp

Filesize
8KB

Download