266a0dab6af369ff77efa8d7c16d471a22c9724300e07daa5b38e4ff68e89a6e | Triage

Analysis

max time kernel
35s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 06:27

Sharing

Report Analysis Logs

General

Target

266a0dab6af369ff77efa8d7c16d471a22c9724300e07daa5b38e4ff68e89a6e.exe
Size

399KB
MD5

26b5738a185189727b9a40e67c7a035f
SHA1

19f4782a0cace32c686b7d8ee2090ea655d4ebe3
SHA256

266a0dab6af369ff77efa8d7c16d471a22c9724300e07daa5b38e4ff68e89a6e
SHA512

3da8bf266f5924e8098c8780a6f5689985cafebdf93a9b5b08e51d16889aab6db2affc50752322bec79e0ede2ea6241085dd7a0ac2620adabaeb19559163367f
SSDEEP

12288:9M9jA7ovyRbJaHD4SYhISNbDjGhbxDljg8GtKjK:9My7fbT9ISNbDjyHjyK2

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\266a0dab6af369ff77efa8d7c16d471a22c9724300e07daa5b38e4ff68e89a6e.exe
"C:\Users\Admin\AppData\Local\Temp\266a0dab6af369ff77efa8d7c16d471a22c9724300e07daa5b38e4ff68e89a6e.exe"
1⤵
PID:1088

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1088-54-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download