c47608516ec7a3399a3de614d7f400cd186d040865b80882866a09da9dcf8cff | Triage

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11-10-2022 17:44

Sharing

Report Analysis Logs

General

Target

c47608516ec7a3399a3de614d7f400cd186d040865b80882866a09da9dcf8cff.exe
Size

26KB
MD5

7c96b99d436dfc0dce82a22448305f40
SHA1

c17a438c842d8fca35c046ff0b77004e31f2303d
SHA256

c47608516ec7a3399a3de614d7f400cd186d040865b80882866a09da9dcf8cff
SHA512

6bae6f08c381c1c590188a9a56debc1eca48be5a82106ad1dc687b11852072795a4766e33d8a4567269ec7033d2a1ab86b2b31c4a3496d3354c9fcd884014a20
SSDEEP

384:b3JjmrXrSNbEO6oDPlDCQ3ghVSSUrURRHzdWZ+dshe9tehDMI4Wk:bQIDkSSUrURxYZ+teY

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\c47608516ec7a3399a3de614d7f400cd186d040865b80882866a09da9dcf8cff.exe
"C:\Users\Admin\AppData\Local\Temp\c47608516ec7a3399a3de614d7f400cd186d040865b80882866a09da9dcf8cff.exe"
1⤵
PID:1504

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1504-54-0x000007FEF42B0000-0x000007FEF4CD3000-memory.dmp

Filesize
10.1MB

Download
memory/1504-55-0x000007FEF2DC0000-0x000007FEF3E56000-memory.dmp

Filesize
16.6MB

Download
memory/1504-56-0x0000000000AD6000-0x0000000000AF5000-memory.dmp

Filesize
124KB

Download
memory/1504-57-0x0000000000AD6000-0x0000000000AF5000-memory.dmp

Filesize
124KB

Download