e14f844b7ac2afa72a103e50d64ac937d9f48ff0a471aaa60a6b597b7b5f4c32 | Triage

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-10-2022 14:43

Sharing

Report Analysis Logs

General

Target

e14f844b7ac2afa72a103e50d64ac937d9f48ff0a471aaa60a6b597b7b5f4c32.exe
Size

2.1MB
MD5

4f4e26510033c5e7128869e72701b5e2
SHA1

c71362742a9dd9b7412a9dbab60d6cf3abf3e3d5
SHA256

e14f844b7ac2afa72a103e50d64ac937d9f48ff0a471aaa60a6b597b7b5f4c32
SHA512

183b3f01aefa16a24488f2afa08b2450167cfbf2d66cad92af995e4540a7928c2ddb9b5b5dcdbd3cf91708ce3bb6c8b4df1fdefdb987582f7408ce5c1cd034a8
SSDEEP

49152:mdJWCE98vUdgGOk/uLPuzSEkuYwrnx6ZBNeozL:mdJEqvUdgGPmLGzS+V6xeeL

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\e14f844b7ac2afa72a103e50d64ac937d9f48ff0a471aaa60a6b597b7b5f4c32.exe
"C:\Users\Admin\AppData\Local\Temp\e14f844b7ac2afa72a103e50d64ac937d9f48ff0a471aaa60a6b597b7b5f4c32.exe"
1⤵
PID:240

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/240-54-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

Filesize
8KB

Download