c07ae13e573161d3c07d9507685a6c287217c49c33834e0441d82a4f968ea271 | Triage

Analysis

max time kernel
47s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
04/10/2022, 21:00

Sharing

Report Analysis Logs

General

Target

c07ae13e573161d3c07d9507685a6c287217c49c33834e0441d82a4f968ea271.exe
Size

499KB
MD5

7854a5e525d2aa178b84502092aeda48
SHA1

a913179abde7cb19d99e7681668c6223b8958a9d
SHA256

c07ae13e573161d3c07d9507685a6c287217c49c33834e0441d82a4f968ea271
SHA512

0bbb643ea775d26229004aa2cbc5c092bd27808c61bfb9e5f9728ff4a15b48801f39020563846e8b92e47eecdd86caeecf3847534d17d673e2c67382a65f4d55
SSDEEP

12288:CuQTqRlzaAUlirZzw1JP6sDpuIc3w2iEXsax2eLiBOl:vaqTUlAz2x2lwFKdBNl

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\c07ae13e573161d3c07d9507685a6c287217c49c33834e0441d82a4f968ea271.exe
"C:\Users\Admin\AppData\Local\Temp\c07ae13e573161d3c07d9507685a6c287217c49c33834e0441d82a4f968ea271.exe"
1⤵
PID:1128

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1128-54-0x0000000076961000-0x0000000076963000-memory.dmp

Filesize
8KB

Download
memory/1128-55-0x0000000000400000-0x00000000004AB000-memory.dmp

Filesize
684KB

Download
memory/1128-56-0x0000000000230000-0x00000000002DB000-memory.dmp

Filesize
684KB

Download