5899a58b3670d82dd72aa75e3b2fe61d691ffde553321fcf00ff95b4abd181e1 | Triage

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07-11-2022 14:58

Sharing

Report Analysis Logs

General

Target

5899a58b3670d82dd72aa75e3b2fe61d691ffde553321fcf00ff95b4abd181e1.exe
Size

108KB
MD5

0fc06960f957ecbc5b1733ce27fcf270
SHA1

3e4e533c6b62cb250a64ed5367be28329e7cf046
SHA256

5899a58b3670d82dd72aa75e3b2fe61d691ffde553321fcf00ff95b4abd181e1
SHA512

fda534d78d2daba0073106d3a8993df143aaa92e2d81c518ac4d358d7e1e3d881ce8a9c1f460bcc5e59a2149e8d6da8692c37555821aa9c8658554074549d66f
SSDEEP

3072:hY3dFNJPmDamJL4310t4BzpaRU8tWVu3pa2:h+npc4F0t4BkUsWVU42

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\5899a58b3670d82dd72aa75e3b2fe61d691ffde553321fcf00ff95b4abd181e1.exe
"C:\Users\Admin\AppData\Local\Temp\5899a58b3670d82dd72aa75e3b2fe61d691ffde553321fcf00ff95b4abd181e1.exe"
1⤵
PID:1996

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1996-54-0x0000000075281000-0x0000000075283000-memory.dmp

Filesize
8KB

Download