ce050cd3fa969a2214b217ddcc27d26458b9a879e6d1370c9c818c82a34da344 | Triage

Analysis

max time kernel
21s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 11:02

Sharing

Report Analysis Logs

General

Target

ce050cd3fa969a2214b217ddcc27d26458b9a879e6d1370c9c818c82a34da344.exe
Size

290KB
MD5

c0bb1b813ab66d2f3c53aea0bdc2fadc
SHA1

8becedf9bc80707fe6c1ec0635fc4836200196c6
SHA256

ce050cd3fa969a2214b217ddcc27d26458b9a879e6d1370c9c818c82a34da344
SHA512

fb7b5ba2751352bcb3876ffe8788ca08b04bb2cdb25a8babddb1a374b249c6df1e395d0d2366360318cab234dd4b71f657195367eac4285e4256a33a68906ac5
SSDEEP

6144:FOPjkDaJnk1LEKEjUmr/cZw3VG71sRgob6iek0yr56x7xP:e4Oi16UI/iwYK7gkVK7R

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\ce050cd3fa969a2214b217ddcc27d26458b9a879e6d1370c9c818c82a34da344.exe
"C:\Users\Admin\AppData\Local\Temp\ce050cd3fa969a2214b217ddcc27d26458b9a879e6d1370c9c818c82a34da344.exe"
1⤵
PID:1896

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1896-54-0x0000000075EC1000-0x0000000075EC3000-memory.dmp

Filesize
8KB

Download