ba6d728244f4b145d2085065130c73a6f1b9864832e0ab507acf6f57ba3d4d25 | Triage

Analysis

max time kernel
26s
max time network
50s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 23:18

Sharing

Report Analysis Logs

General

Target

ba6d728244f4b145d2085065130c73a6f1b9864832e0ab507acf6f57ba3d4d25.exe
Size

637KB
MD5

84d17a5c57b3cdfd232b42e1bca39640
SHA1

81fb7041281dd4ea49de6d2d4c2a5deb9e0408af
SHA256

ba6d728244f4b145d2085065130c73a6f1b9864832e0ab507acf6f57ba3d4d25
SHA512

27515f00bbdbba266f8d529a8188c10246f10b9cea343ef5b96ad1cb42d2fddf17d7f8d5978bb87658c5f87abcafa3fa48485ed730aadeea9864833f449d3566
SSDEEP

12288:guDk0KkcBTP8SxHEC9EC9wDXzLDte7dNF9Ze+tBQKSsxOcfOhj9lJumzfIcS7:gubW4ck819MLsZZe+tBQKgPRtIcS7

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\ba6d728244f4b145d2085065130c73a6f1b9864832e0ab507acf6f57ba3d4d25.exe
"C:\Users\Admin\AppData\Local\Temp\ba6d728244f4b145d2085065130c73a6f1b9864832e0ab507acf6f57ba3d4d25.exe"
1⤵
PID:1988

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1988-54-0x0000000075281000-0x0000000075283000-memory.dmp

Filesize
8KB

Download