0187dfcefbe23456f5c591e96c8c4fc6179420c58db3369f80560079e18a7a4c | Triage

Analysis

max time kernel
24s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 14:34

Sharing

Report Analysis Logs

General

Target

0187dfcefbe23456f5c591e96c8c4fc6179420c58db3369f80560079e18a7a4c.exe
Size

5.1MB
MD5

e077076f2dc403dad774df8d26b9ec0f
SHA1

760819555ecb1f1adeb3736761869e45bedfb9ac
SHA256

0187dfcefbe23456f5c591e96c8c4fc6179420c58db3369f80560079e18a7a4c
SHA512

9be59777289a3b65aba950972fc97e01f8d61fdde2706c43289d5f8669a7768330f7e0656040b17a4c6bbfb30a97aa73ff904ac19ece14b232cf434d80059e50
SSDEEP

98304:ndVEzssO86+ERSST3U96O5TwbPCRfTlCP6/cEQaPBpfXSthrwnA0XuQ9:ElQR5/O5TICRfT7+spXSPrwnAsX

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\0187dfcefbe23456f5c591e96c8c4fc6179420c58db3369f80560079e18a7a4c.exe
"C:\Users\Admin\AppData\Local\Temp\0187dfcefbe23456f5c591e96c8c4fc6179420c58db3369f80560079e18a7a4c.exe"
1⤵
PID:1872

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1872-54-0x0000000075571000-0x0000000075573000-memory.dmp

Filesize
8KB

Download