99bf4fe4a20e63996eb4cdf14a1f7e3a99a8014bc8b9f3d6ba902819bd0df407 | Triage

Analysis

max time kernel
42s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/10/2022, 01:39

Sharing

Report Analysis Logs

General

Target

99bf4fe4a20e63996eb4cdf14a1f7e3a99a8014bc8b9f3d6ba902819bd0df407.exe
Size

156KB
MD5

06d299ac4e7361e21c37adf185bf9670
SHA1

e7048e7419533a221de51cdd10cc8c81d3cafc49
SHA256

99bf4fe4a20e63996eb4cdf14a1f7e3a99a8014bc8b9f3d6ba902819bd0df407
SHA512

fe9aa8c4aca0cf986d71d74f14f8c7d8d83a41c63735b91fe9ff1ebb5d39b7a45b4c683ce56629dc1ecd5136c17c59f4be1a1ec9c472426988aa3d20289a6ffd
SSDEEP

3072:8rfYStS11rNiWzy9E10CZW9AxXFR6gLxeYlm05A7QoE08:Gf3tmxiWzy9E10CZW9ANF0g0YwgAcG

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\99bf4fe4a20e63996eb4cdf14a1f7e3a99a8014bc8b9f3d6ba902819bd0df407.exe
"C:\Users\Admin\AppData\Local\Temp\99bf4fe4a20e63996eb4cdf14a1f7e3a99a8014bc8b9f3d6ba902819bd0df407.exe"
1⤵
PID:900

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/900-54-0x00000000009C0000-0x00000000009EC000-memory.dmp

Filesize
176KB

Download
memory/900-55-0x00000000004E0000-0x0000000000528000-memory.dmp

Filesize
288KB

Download
memory/900-56-0x00000000762D1000-0x00000000762D3000-memory.dmp

Filesize
8KB

Download
memory/900-57-0x0000000004836000-0x0000000004847000-memory.dmp

Filesize
68KB

Download