f670aaf32e166fb9800b284811e1cf601974f61a03e983c00bc070b6870a9c42 | Triage

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 11:04

Sharing

Report Analysis Logs

General

Target

f670aaf32e166fb9800b284811e1cf601974f61a03e983c00bc070b6870a9c42.exe
Size

127KB
MD5

4c8191f588db951617c83c7f3379c8b6
SHA1

28318299acd663fff0ab3d48386f36e6c48d3869
SHA256

f670aaf32e166fb9800b284811e1cf601974f61a03e983c00bc070b6870a9c42
SHA512

df20c04921eb086e315b1cb5621b037d586c96c08aad95dca66026c9adf8389a49e1d11f2ccb4aaa8573b26027a27bc3bc8033d3c82326e114682cd069842861
SSDEEP

3072:xLk395hYXJCtILa77j2NZkMEpoRk2ZnWMuDa6p:xQqgtILI8ZNRZnWMuDJ

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\f670aaf32e166fb9800b284811e1cf601974f61a03e983c00bc070b6870a9c42.exe
"C:\Users\Admin\AppData\Local\Temp\f670aaf32e166fb9800b284811e1cf601974f61a03e983c00bc070b6870a9c42.exe"
1⤵
PID:1788

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1788-54-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download