91909526fd8614c1a2837e2928e1847d1570cf61decef5eb09bef1dd5c31715b | Triage

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 09:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

91909526fd8614c1a2837e2928e1847d1570cf61decef5eb09bef1dd5c31715b.exe
Size

257KB
MD5

443b438edd8e2d61950797b6459556e0
SHA1

3aacf8b39642adc3386475025c29e3670f3eff54
SHA256

91909526fd8614c1a2837e2928e1847d1570cf61decef5eb09bef1dd5c31715b
SHA512

47a9364c3f3b3a43bed29beb2b7fba26154ff348e94abe40aeda46c7d36e4750e5f2d3a3d37caa80ceeeafe466ee2cd908e32c7192751b6829e920c12bb9ed05
SSDEEP

6144:3eTeM/nwFduF5gh8HafVR6A272Yx6lTYfknoERSZX:7M/wFIFW86fAKgQTnQ

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\91909526fd8614c1a2837e2928e1847d1570cf61decef5eb09bef1dd5c31715b.exe
"C:\Users\Admin\AppData\Local\Temp\91909526fd8614c1a2837e2928e1847d1570cf61decef5eb09bef1dd5c31715b.exe"
1⤵
PID:1644

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1644-54-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download