2a787db4281119fee80cbf9a9cc372a153d860a879df7069f462d1f1bd4d1525 | Triage

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28/10/2022, 22:27

Sharing

Report Analysis Logs

General

Target

2a787db4281119fee80cbf9a9cc372a153d860a879df7069f462d1f1bd4d1525.exe
Size

496KB
MD5

a8b5283164205e52e5b46e4a454b1fb9
SHA1

aefb7573ed3c5b8849c4d74e52df3961cfa55d0e
SHA256

2a787db4281119fee80cbf9a9cc372a153d860a879df7069f462d1f1bd4d1525
SHA512

37e3cbb4710e77bcb321a315211ad9cb136d253d07dcccf262f20a5774345b73c207e9ca6aa94a859d4e7a4fc16dca13ea94e9843de82b2ebedc7f855326060b
SSDEEP

12288:TJ9dCge9MC8nJn1mikcLSjEHiwTgE103mVTg+m:l9dCgeyCEYrO9Hig19TgN

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\2a787db4281119fee80cbf9a9cc372a153d860a879df7069f462d1f1bd4d1525.exe
"C:\Users\Admin\AppData\Local\Temp\2a787db4281119fee80cbf9a9cc372a153d860a879df7069f462d1f1bd4d1525.exe"
1⤵
PID:1412

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1412-54-0x0000000075771000-0x0000000075773000-memory.dmp

Filesize
8KB

Download