a9dddf276aaec78048c4c79de69a76856f84d83232a30eaf59091e4a3a4301a2 | Triage

Analysis

max time kernel
29s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11-10-2022 13:36

Sharing

Report Analysis Logs

General

Target

a9dddf276aaec78048c4c79de69a76856f84d83232a30eaf59091e4a3a4301a2.exe
Size

220KB
MD5

61cf113f04ccd30e67d4a8a986c9d3e0
SHA1

b0bb8f2ee1c0892e229a76941f1765e2b5e6b232
SHA256

a9dddf276aaec78048c4c79de69a76856f84d83232a30eaf59091e4a3a4301a2
SHA512

f832ff5a4bcf358ca2781e0390f632049503524e3da122324ed1e214c29ee0adf504396d5a7b5b4f0102656ba39e8b89a72aa6a9280bff3f353daf61c5629791
SSDEEP

3072:t1W3koFABS7dU82cvuKlyMeL4LMmY/lpCbMZvf2Q4XleNRiyrB6Op4v0osLeUYHy:tI2Gd12cWuNeLRblp9fllRrw8jW1cz

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\a9dddf276aaec78048c4c79de69a76856f84d83232a30eaf59091e4a3a4301a2.exe
"C:\Users\Admin\AppData\Local\Temp\a9dddf276aaec78048c4c79de69a76856f84d83232a30eaf59091e4a3a4301a2.exe"
1⤵
PID:2036

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2036-54-0x0000000076151000-0x0000000076153000-memory.dmp

Filesize
8KB

Download