3f8a47ca4251fb61f5a6b40ff6b98414226fca08d104b63e1436edb8b9077994 | Triage

Analysis

max time kernel
40s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
10/10/2022, 04:22

Sharing

Report Analysis Logs

General

Target

Installer_迅捷OCR文字识别_r1.7.4.exe
Size

3.7MB
MD5

0f66fcf0f98d120262dcc61684e9317d
SHA1

5d7c212866919ec82d82c1749ce266affb0ad974
SHA256

4c1454d5f7090c6fab06df485a87214add594889e803242ff573745fa8a6b3db
SHA512

91570e36a6d0124b871a1365eb41ffc7f8ca63ed7abdb829aa63568bbe77e5fcaaa030cbb13255bc2c1df15f46b3cd3679e8b3a031f9f761b89723638d90a2cc
SSDEEP

49152:fz35sKs5ErWcfoBzAT6VqIx5hAsHSJkzSyarz7FWorGhT5V+rSnOukY:b53lfoBNq0hAsevfsNVxO+

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\Installer_迅捷OCR文字识别_r1.7.4.exe
"C:\Users\Admin\AppData\Local\Temp\Installer_迅捷OCR文字识别_r1.7.4.exe"
1⤵
PID:1504

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1504-54-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download