e239dd28114ee8bdb6e49156e30e7a7e13993c0118444645b1710db4b15d9e53 | Triage

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
09/10/2022, 19:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e239dd28114ee8bdb6e49156e30e7a7e13993c0118444645b1710db4b15d9e53.exe
Size

5.1MB
MD5

7bae406b95d6d87b0f2ad570b500f3ba
SHA1

521109bed830c9095c18e073992972a6d47312af
SHA256

e239dd28114ee8bdb6e49156e30e7a7e13993c0118444645b1710db4b15d9e53
SHA512

85330097dfc17106313dc7669d51bc3a0ed7086aca35cfcec786d6dbcf77a8a34bd0135ccf4277a56775f4f29ba8893793f4b6ed2b9bf0988b7f057dcdc317c6
SSDEEP

98304:nSNrCQ+G08EZCXGERYg/YysPn/Lxp/IB1HRTM5AOp8dkDZeaNbhIjHLHP2:1J8EZtE//sPTxRu1HRw5AQ8FYbQHLHe

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\e239dd28114ee8bdb6e49156e30e7a7e13993c0118444645b1710db4b15d9e53.exe
"C:\Users\Admin\AppData\Local\Temp\e239dd28114ee8bdb6e49156e30e7a7e13993c0118444645b1710db4b15d9e53.exe"
1⤵
PID:1064

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1064-54-0x0000000075BB1000-0x0000000075BB3000-memory.dmp

Filesize
8KB

Download