e7b2c8625eb0a025817f46fe2bf624da575dc9661395514880ca45f2bca4393a | Triage

Analysis

max time kernel
34s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 06:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e7b2c8625eb0a025817f46fe2bf624da575dc9661395514880ca45f2bca4393a.exe
Size

577KB
MD5

0cc9c98c033fa8d669beac39e3e261b0
SHA1

a9428baaab23ce3b879e1d5880a2253504d17189
SHA256

e7b2c8625eb0a025817f46fe2bf624da575dc9661395514880ca45f2bca4393a
SHA512

7e385bb7198143640e24aa6e76b2bb55fc83f475072f8f88000c70fdc31c77db2478148c1d78186aef7df491f9135c9589ad161c6dbb41417895d57975f3fabd
SSDEEP

12288:20LzLF+ZPPfnEUnsEWfXsu0jsDZ5A/UGETYD4vpaNBVs:20L8lvANcIveEEDRNBG

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\e7b2c8625eb0a025817f46fe2bf624da575dc9661395514880ca45f2bca4393a.exe
"C:\Users\Admin\AppData\Local\Temp\e7b2c8625eb0a025817f46fe2bf624da575dc9661395514880ca45f2bca4393a.exe"
1⤵
PID:1488

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1488-54-0x0000000074AB1000-0x0000000074AB3000-memory.dmp

Filesize
8KB

Download