38f28c5b959e69ad7a68e41250357264b760292b9de3b1a1f8cbb7ee4a0f4ee4 | Triage

Analysis

max time kernel
39s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/10/2022, 02:16

Sharing

Report Analysis Logs

General

Target

38f28c5b959e69ad7a68e41250357264b760292b9de3b1a1f8cbb7ee4a0f4ee4.exe
Size

310KB
MD5

059cc68bd6a9b2f98e7e6f854278bc90
SHA1

1f0e9c276972d3293b042287657d1faba9c3e7f3
SHA256

38f28c5b959e69ad7a68e41250357264b760292b9de3b1a1f8cbb7ee4a0f4ee4
SHA512

80bf19d158f7266f247883f003c3d095e43639d57f18c378750b0038dae78d1564112f2775a898986932aa5817d0d40558a2439aece18f2ab2fb209d13a37522
SSDEEP

6144:2e34Di4Uogw/TH+47ER0Ee16kTccQgCmay0RPTmbq7OVd1teoqkm9Zr16r+Y:8coVTZasvT6may4Pxu71mD0rl

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\38f28c5b959e69ad7a68e41250357264b760292b9de3b1a1f8cbb7ee4a0f4ee4.exe
"C:\Users\Admin\AppData\Local\Temp\38f28c5b959e69ad7a68e41250357264b760292b9de3b1a1f8cbb7ee4a0f4ee4.exe"
1⤵
PID:1428

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1428-54-0x0000000075071000-0x0000000075073000-memory.dmp

Filesize
8KB

Download