b4f18d13fdb9bda5f91f38d4338eb0eaed767bda04408ecd9563a655b896ff0b | Triage

Analysis

max time kernel
38s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
31-10-2022 01:13

Sharing

Report Analysis Logs

General

Target

b4f18d13fdb9bda5f91f38d4338eb0eaed767bda04408ecd9563a655b896ff0b.exe
Size

1.4MB
MD5

a09eb2e00e5784cf94c272453a9509e0
SHA1

49667ceb01c23f710e4e0d92b2b7f4edc2c437e3
SHA256

b4f18d13fdb9bda5f91f38d4338eb0eaed767bda04408ecd9563a655b896ff0b
SHA512

7f4a3238f1bb08e4d6c693481b74cd79225a78d39874df1325b8fd31ff9d4eef016a1cbd737e2c2be2349df70e7023cebb8997a61cf0aee23684b88320e58f94
SSDEEP

24576:WTwqUW/q7D/3JLYfzXsCwM0dRdaX2+qtNlEPaj8XjEV2hU+KC4Oe:IwBW/q71YfTg3aX2H8PBjECUOe

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\b4f18d13fdb9bda5f91f38d4338eb0eaed767bda04408ecd9563a655b896ff0b.exe
"C:\Users\Admin\AppData\Local\Temp\b4f18d13fdb9bda5f91f38d4338eb0eaed767bda04408ecd9563a655b896ff0b.exe"
1⤵
PID:1648

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1648-54-0x0000000075811000-0x0000000075813000-memory.dmp

Filesize
8KB

Download