2982b46812d29e3b2252b0c1abac73eb0d8b561a3d3f0a21a1352ae97b7c5209 | Triage

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-11-2022 22:08

Sharing

Report Analysis Logs

General

Target

2982b46812d29e3b2252b0c1abac73eb0d8b561a3d3f0a21a1352ae97b7c5209.exe
Size

364KB
MD5

2e359b8d0be1c980404fd5a580f477a5
SHA1

6d98d10b814883b178bc6846c1abcdea81007290
SHA256

2982b46812d29e3b2252b0c1abac73eb0d8b561a3d3f0a21a1352ae97b7c5209
SHA512

3e0459a07feb3caf989dcf638a8c9c51a1822e7faadad1537014bfd2496cbacb193411e6c1bb09bbe57a7fb48bd64ef0f4113eba6f0cb1170db7050f194e6522
SSDEEP

6144:Gj+OyK+eBP0jgIuArFi56CYREvWYL7vy3fe2bixowcyk1q52al:2+OIeBcTIY1REl7vHxoax2w

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\2982b46812d29e3b2252b0c1abac73eb0d8b561a3d3f0a21a1352ae97b7c5209.exe
"C:\Users\Admin\AppData\Local\Temp\2982b46812d29e3b2252b0c1abac73eb0d8b561a3d3f0a21a1352ae97b7c5209.exe"
1⤵
PID:864

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/864-54-0x0000000076321000-0x0000000076323000-memory.dmp

Filesize
8KB

Download