1de62bf1236cf4dc77f7afba88f4f72493e0e8a4642dce88dc8d301ed18d1e0d | Triage

Analysis

max time kernel
36s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/10/2022, 19:10 UTC

Sharing

Report Analysis Logs

General

Target

1de62bf1236cf4dc77f7afba88f4f72493e0e8a4642dce88dc8d301ed18d1e0d.exe
Size

15.7MB
MD5

ec54e4db4971171ac9f03bb63e931bf7
SHA1

b3e8ac1bcb9e27f9d4c6d246f274c24ad0513224
SHA256

1de62bf1236cf4dc77f7afba88f4f72493e0e8a4642dce88dc8d301ed18d1e0d
SHA512

49a2a3b32771f3b9c31c905fb9f0c9e47c00ddb3e81bda9659d73d961c41e7d2fdb356edc30fb76c145e3dc6fc6e51b60de1845e2384292123638910cc47a464
SSDEEP

393216:wmYrJQ2+fZE7S3JdKTQ/E6FIJnjPhwfirwKK6:wp5KdZdKTkpAjPhEbH6

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\1de62bf1236cf4dc77f7afba88f4f72493e0e8a4642dce88dc8d301ed18d1e0d.exe
"C:\Users\Admin\AppData\Local\Temp\1de62bf1236cf4dc77f7afba88f4f72493e0e8a4642dce88dc8d301ed18d1e0d.exe"
1⤵
PID:1720

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1720-54-0x0000000075BD1000-0x0000000075BD3000-memory.dmp

Filesize
8KB

Download