edaeef3f37b61953e5e8b322670842301635d23c5c2ad3bf04196ae76c10242f | Triage

Analysis

max time kernel
47s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03-10-2022 05:43

Sharing

Report Analysis Logs

General

Target

edaeef3f37b61953e5e8b322670842301635d23c5c2ad3bf04196ae76c10242f.exe
Size

108KB
MD5

00d802f5d491a03900b1a35d8a97c3d7
SHA1

27b974793bb9c20698b0013acfa42afc9bc2700a
SHA256

edaeef3f37b61953e5e8b322670842301635d23c5c2ad3bf04196ae76c10242f
SHA512

7dcde0fde26d5a3b6d1a761a36e132472f40818df7def23774149e750a3c4886cac360163d3b8010e3e457e6519daba7523d0b275e347535d70f10476faf56fd
SSDEEP

1536:zoBJvNmH6rNvxi0Qc3dIGAT01mMGlwtqCIEnP:zozVZvJm01mB+qTEnP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\edaeef3f37b61953e5e8b322670842301635d23c5c2ad3bf04196ae76c10242f.exe
"C:\Users\Admin\AppData\Local\Temp\edaeef3f37b61953e5e8b322670842301635d23c5c2ad3bf04196ae76c10242f.exe"
1⤵
PID:1416

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1416-54-0x0000000074DC1000-0x0000000074DC3000-memory.dmp

Filesize
8KB

Download