662078a6505a8d583de64ecdaaee78f3199fcd3bc8ba8281223a0738032293f5 | Triage

Analysis

max time kernel
48s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
04-11-2022 19:08

Sharing

Report Analysis Logs

General

Target

662078a6505a8d583de64ecdaaee78f3199fcd3bc8ba8281223a0738032293f5.exe
Size

1.6MB
MD5

01338fa38617980a262c632bc04b35f3
SHA1

c96cdfd880289faa88f9cc1aa97b684d307d36de
SHA256

662078a6505a8d583de64ecdaaee78f3199fcd3bc8ba8281223a0738032293f5
SHA512

1eab0a5421c51b8a0215915612610b6514f7bd2e0450feb33e306a2b1acfddb39fd0d4c2935b01cd36eed56c2d678fd050ac4a98004a1faad68c59e6c71be410
SSDEEP

6144:DZuuObR8sVImcyYC5JQQCFgfptlGsuZaEkAcWtVrX4a39cG5:IV+mzYOZFEZtVfn5

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\662078a6505a8d583de64ecdaaee78f3199fcd3bc8ba8281223a0738032293f5.exe
"C:\Users\Admin\AppData\Local\Temp\662078a6505a8d583de64ecdaaee78f3199fcd3bc8ba8281223a0738032293f5.exe"
1⤵
PID:1288

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1288-54-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

Filesize
8KB

Download