1ef616146057b3a51d0d6dd647537cba5a9e8ba3f0c1ef87e3116459e44683c6 | Triage

Analysis

max time kernel
35s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20-10-2022 04:26

Sharing

Report Analysis Logs

General

Target

1ef616146057b3a51d0d6dd647537cba5a9e8ba3f0c1ef87e3116459e44683c6.exe
Size

992KB
MD5

47fb9b1c8afad5645047094a988b3b20
SHA1

6fe95486c02d4649f928b5060a17adbf2980b7be
SHA256

1ef616146057b3a51d0d6dd647537cba5a9e8ba3f0c1ef87e3116459e44683c6
SHA512

ade55bf2d95410a967d15803465e468982655a8e5c02c0f522e14a5fb3d53a80996a42e112fd695a63df21713ab1298b699790b7159157896fe8c1f158145c66
SSDEEP

24576:AJwO1OhOahnBxScFvXORh7gO1SblpEyUL:AWwOh/IcxXmSlpQL

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\1ef616146057b3a51d0d6dd647537cba5a9e8ba3f0c1ef87e3116459e44683c6.exe
"C:\Users\Admin\AppData\Local\Temp\1ef616146057b3a51d0d6dd647537cba5a9e8ba3f0c1ef87e3116459e44683c6.exe"
1⤵
PID:1388

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1388-54-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download