678f8094ae5391fba69f253517d68070066476302f9514214f6dc9e4205b7ff8 | Triage

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
15/10/2022, 20:16

Sharing

Report Analysis Logs

General

Target

678f8094ae5391fba69f253517d68070066476302f9514214f6dc9e4205b7ff8.exe
Size

12.8MB
MD5

5a340e33b4bb6824e59228406800ed21
SHA1

7023e6dc846b255c9c5efa0bf5a90aaa32ab8b57
SHA256

678f8094ae5391fba69f253517d68070066476302f9514214f6dc9e4205b7ff8
SHA512

c7f375f779fe264dfc0ab48d1149a1f7b2d8642524fec069b0e90d2f2ab825bc5fcdfc9c9f78739872e72796d003252fd609aa691e3b24f8859f383610b281b0
SSDEEP

393216:loaK982MahBkDppEYjJ+dVH+y6oPjCpdJn:loaK982T3kHZjlRorWdB

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\678f8094ae5391fba69f253517d68070066476302f9514214f6dc9e4205b7ff8.exe
"C:\Users\Admin\AppData\Local\Temp\678f8094ae5391fba69f253517d68070066476302f9514214f6dc9e4205b7ff8.exe"
1⤵
PID:1884

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1884-54-0x0000000076171000-0x0000000076173000-memory.dmp

Filesize
8KB

Download