eea3ab69e1a2f09b10bb861b9bb42d79a4dba33194f8401dc11e8d7ac43fd784 | Triage

Analysis

max time kernel
23s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 15:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

eea3ab69e1a2f09b10bb861b9bb42d79a4dba33194f8401dc11e8d7ac43fd784.exe
Size

108KB
MD5

827a031db7151c2dacaf4b825b644b80
SHA1

e7cdffe9c97a94315ed3794097720e3ffe67c472
SHA256

eea3ab69e1a2f09b10bb861b9bb42d79a4dba33194f8401dc11e8d7ac43fd784
SHA512

5cccf28bda473ca85ca1c8e89ba55b0ed83fd278d8d03f3c89d8c5834fdd80695b2e865888c09969b57019ed14165839e96b87d99f7a45bf7d57a3f3eb92c98c
SSDEEP

768:kRtoeHx/7lQaM4/G826xKUVwh92nNSG/AuYXAKXCYmvYtFc5cbP8TfefhPqCQRuo:QeeRl6jMO92NFIueXBmMqG4elqCIyn2

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\eea3ab69e1a2f09b10bb861b9bb42d79a4dba33194f8401dc11e8d7ac43fd784.exe
"C:\Users\Admin\AppData\Local\Temp\eea3ab69e1a2f09b10bb861b9bb42d79a4dba33194f8401dc11e8d7ac43fd784.exe"
1⤵
PID:1952

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1952-54-0x00000000762F1000-0x00000000762F3000-memory.dmp

Filesize
8KB

Download