a5103eaddf52f11dba295239d7a02abf694c990093b666f1a417fa95b27c04b9 | Triage

Analysis

max time kernel
140s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 17:09

Sharing

Report Analysis Logs

General

Target

a5103eaddf52f11dba295239d7a02abf694c990093b666f1a417fa95b27c04b9.exe
Size

321KB
MD5

0c96d8bb53807a7a4dc6defada1c2ec0
SHA1

19da7ffef5f3b385f7ea0f640c450febc3a6121f
SHA256

a5103eaddf52f11dba295239d7a02abf694c990093b666f1a417fa95b27c04b9
SHA512

b04ed85509ad2a17ae34c7eb91c6ec413e8f7b0236b7506aa0c5831930a4367af26b13ba48f6cc4161bdf7f1312dedab9f0873f6951eb37da98328c197dadf34
SSDEEP

6144:AmJI2a+h5a28fFvJ8E35x/4YqUMQ0jGesb+cOW4IplP3JqggJzGT:AmJFa+h5p8fFvaE35+YGc1tlIgEo

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\a5103eaddf52f11dba295239d7a02abf694c990093b666f1a417fa95b27c04b9.exe
"C:\Users\Admin\AppData\Local\Temp\a5103eaddf52f11dba295239d7a02abf694c990093b666f1a417fa95b27c04b9.exe"
1⤵
PID:4344

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4344-132-0x0000000000400000-0x00000000005EF000-memory.dmp

Filesize
1.9MB

Download