17ad6fab46d2dd310d35431212a076fe86a7a41df5b0200f12ef9a64295c530b | Triage

Analysis

max time kernel
29s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 09:41

Sharing

Report Analysis Logs

General

Target

17ad6fab46d2dd310d35431212a076fe86a7a41df5b0200f12ef9a64295c530b.exe
Size

160KB
MD5

9faf3034ec3ee4dba75812f5afc41022
SHA1

71dc5de9d14242b660a62e6ca5178493f3c7d2de
SHA256

17ad6fab46d2dd310d35431212a076fe86a7a41df5b0200f12ef9a64295c530b
SHA512

b351698b67b03b2fa56f202dc5eed06f326b9ead2997d335b9a7022901d9538e6f131f28e0307fe98527c621265e22c7307ebad0387a849c42903e48bcf7245e
SSDEEP

3072:8sDV6Az1lWgFvYGnJd9KpZV3uTN9WU/G9h3Gw590KqWbmzALbvl6:tQAKgFvYGJd9KpZV3uTN9WU/G9h2w591

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\17ad6fab46d2dd310d35431212a076fe86a7a41df5b0200f12ef9a64295c530b.exe
"C:\Users\Admin\AppData\Local\Temp\17ad6fab46d2dd310d35431212a076fe86a7a41df5b0200f12ef9a64295c530b.exe"
1⤵
PID:1348

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1348-54-0x000007FEF35E0000-0x000007FEF4003000-memory.dmp

Filesize
10.1MB

Download
memory/1348-55-0x000007FEEE6C0000-0x000007FEEF756000-memory.dmp

Filesize
16.6MB

Download
memory/1348-56-0x0000000001FA6000-0x0000000001FC5000-memory.dmp

Filesize
124KB

Download
memory/1348-57-0x0000000001FA6000-0x0000000001FC5000-memory.dmp

Filesize
124KB

Download