920f0b2d159a39f480d848786547b1372aefac5693cab9b3d378edbdb730d5aa | Triage

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
12/10/2022, 16:29

Sharing

Report Analysis Logs

General

Target

920f0b2d159a39f480d848786547b1372aefac5693cab9b3d378edbdb730d5aa.exe
Size

160KB
MD5

631c575bc27ce59dbb4538bb91107ee3
SHA1

015c08d6ec52fb1b8cf15ba5ca8eaeadffc75455
SHA256

920f0b2d159a39f480d848786547b1372aefac5693cab9b3d378edbdb730d5aa
SHA512

d3996dd535c0b0f43052e0432bb383fe00709df73d1adbc321de3b915aaa38f3128cc4de7910155fc3b4e73ca428f8321926d7edd9cf8b631d746bc1766eed74
SSDEEP

3072:8sDV6Az1wWgFvYGnJd6KpZV3uTN9WU/G9h3Gw590KqkbmzALbvl6:tQAbgFvYGJd6KpZV3uTN9WU/G9h2w59X

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\920f0b2d159a39f480d848786547b1372aefac5693cab9b3d378edbdb730d5aa.exe
"C:\Users\Admin\AppData\Local\Temp\920f0b2d159a39f480d848786547b1372aefac5693cab9b3d378edbdb730d5aa.exe"
1⤵
PID:1104

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1104-54-0x000007FEF4360000-0x000007FEF4D83000-memory.dmp

Filesize
10.1MB

Download
memory/1104-55-0x000007FEF3080000-0x000007FEF4116000-memory.dmp

Filesize
16.6MB

Download
memory/1104-56-0x0000000001DB6000-0x0000000001DD5000-memory.dmp

Filesize
124KB

Download