efe66795a9fa88c11998e6454432c3def310b70f476f4da5dc09c0d3eb1e81f9 | Triage

Analysis

max time kernel
35s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 12:19

Sharing

Report Analysis Logs

General

Target

efe66795a9fa88c11998e6454432c3def310b70f476f4da5dc09c0d3eb1e81f9.exe
Size

84KB
MD5

b9308da0401de76931dc39742c23b75b
SHA1

06ef0ab8c43da008ab1ac36faccd7e10c55fc7c7
SHA256

efe66795a9fa88c11998e6454432c3def310b70f476f4da5dc09c0d3eb1e81f9
SHA512

189192e5d7dc7fd1d031bbae7008802771893bf8eac85f95050317c3d75f13ca14c53697ad89896409494d3d510729b8d335fbeba580f197d499b90bef47e84f
SSDEEP

1536:8qdBPkbwScJ2V+5n697ypBS7dU8NLqAqIY7bisSqdBPkbwSc4:R1W3koFABS7dU8+71W3X

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\efe66795a9fa88c11998e6454432c3def310b70f476f4da5dc09c0d3eb1e81f9.exe
"C:\Users\Admin\AppData\Local\Temp\efe66795a9fa88c11998e6454432c3def310b70f476f4da5dc09c0d3eb1e81f9.exe"
1⤵
PID:1368

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1368-54-0x0000000076071000-0x0000000076073000-memory.dmp

Filesize
8KB

Download