747bba0127057b80f77bec905024625cadc452c8020da8ee48bb6bbadd7ab8cb | Triage

Analysis

max time kernel
39s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/11/2022, 21:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

747bba0127057b80f77bec905024625cadc452c8020da8ee48bb6bbadd7ab8cb.exe
Size

473KB
MD5

0ef9e075eeb1e34d0dc76662c98cd740
SHA1

83017a2a9db9ef119b11f6f0e70f42c9c0806b7a
SHA256

747bba0127057b80f77bec905024625cadc452c8020da8ee48bb6bbadd7ab8cb
SHA512

3add9cabd03edd6af6a1a8a26a068b4ffc554219eebab43359e6a0543958b0d6cea794ad1ab1748e674d5ea6691e456304eb04fca9aa61291eb46150e306db2f
SSDEEP

6144:0cv0XjJgmx9jfumGiKW+s+9H/WdLb9lJ9uE7qBdVb4Q2uOpgKFQKPY:0cQGHJDfuX939u/Bn3OBHw

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\747bba0127057b80f77bec905024625cadc452c8020da8ee48bb6bbadd7ab8cb.exe
"C:\Users\Admin\AppData\Local\Temp\747bba0127057b80f77bec905024625cadc452c8020da8ee48bb6bbadd7ab8cb.exe"
1⤵
PID:1220

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1220-54-0x0000000074D81000-0x0000000074D83000-memory.dmp

Filesize
8KB

Download
memory/1220-55-0x0000000001000000-0x0000000001190000-memory.dmp

Filesize
1.6MB

Download
memory/1220-56-0x0000000001000000-0x0000000001190000-memory.dmp

Filesize
1.6MB

Download