81172df45d4363b4bd3d6e100030416dda340c5d685f329d0277490975565ba9 | Triage

Analysis

max time kernel
47s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 22:44

Sharing

Report Analysis Logs

General

Target

81172df45d4363b4bd3d6e100030416dda340c5d685f329d0277490975565ba9.exe
Size

12.7MB
MD5

c51b471ada86c2ef5b39e9516ea5e912
SHA1

30cac2a7d3c229728a9a499f834c7df8d8931578
SHA256

81172df45d4363b4bd3d6e100030416dda340c5d685f329d0277490975565ba9
SHA512

3f9bc86c54fd98dd8d141f8daa85debd3f61ac7e18d4397165550202f20eb2c20327ae6c089b981f8f130f75f35c060398e50d40a16fa66eec2ddfee23ed9022
SSDEEP

196608:7arQ/hHZA7nArrHL89ywz9gRK/+hBpH6/Bjsnahlnp8YvWrZy+KlF+30QBr:2WZAArrHuVx+7hX6/xnp8Y4yJlFGBr

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\81172df45d4363b4bd3d6e100030416dda340c5d685f329d0277490975565ba9.exe
"C:\Users\Admin\AppData\Local\Temp\81172df45d4363b4bd3d6e100030416dda340c5d685f329d0277490975565ba9.exe"
1⤵
PID:1304

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1304-54-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download