b4e65312c856b38deb1d6085f8787c1e8a7cdb8db90822407b84244cad88984e | Triage

Analysis

max time kernel
46s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
21/11/2022, 13:18

Sharing

Report Analysis Logs

General

Target

b4e65312c856b38deb1d6085f8787c1e8a7cdb8db90822407b84244cad88984e.exe
Size

716KB
MD5

0966406bbeb3afad02fef821996ff1d0
SHA1

a7ff07d5f839ae042ba5f973a320c2822c4efc8b
SHA256

b4e65312c856b38deb1d6085f8787c1e8a7cdb8db90822407b84244cad88984e
SHA512

7e10764f6081a3d4dd9fc86b0fa2535e5f1defccac8b67d5f931928fa8a33e481b301b4f6e1bc4f1b5f3566db8c605572d350fd781dac2446b31f8d9bc2713d1
SSDEEP

12288:AJxQdnOx/TqFLOJUh737BxoZvHEFKAXO0OTd4QccgSvPu:AJwO1OhOahnBxScFvXORh7gOm

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\b4e65312c856b38deb1d6085f8787c1e8a7cdb8db90822407b84244cad88984e.exe
"C:\Users\Admin\AppData\Local\Temp\b4e65312c856b38deb1d6085f8787c1e8a7cdb8db90822407b84244cad88984e.exe"
1⤵
PID:1200

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1200-54-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

Filesize
8KB

Download