d4a8a88a20b7e53ce9c25c08294edf15fe57d2075c401c1bfae9b990fa892029 | Triage

Analysis

max time kernel
42s
max time network
66s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:35

Sharing

Report Analysis Logs

General

Target

d4a8a88a20b7e53ce9c25c08294edf15fe57d2075c401c1bfae9b990fa892029.exe
Size

270KB
MD5

bde29e1f39701b7eba1f9e6e8cac0714
SHA1

ab195b31de2d9ad3966fccb3146d8cadb3a24d89
SHA256

d4a8a88a20b7e53ce9c25c08294edf15fe57d2075c401c1bfae9b990fa892029
SHA512

f5a7d2a0d94969188360af573325d055c6db7ad8a67d174c4cce0d54fe0ccaf005f63afdf1128471c9f9b7355777b7941aec7a9c988f5ac39290f0067296c11f
SSDEEP

6144:k8Z7gxX629lW+OgRUPxjcASihGLt9TgWc7geiJTt:jFoMxdxjfSihGLt9Tg5QJTt

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\d4a8a88a20b7e53ce9c25c08294edf15fe57d2075c401c1bfae9b990fa892029.exe
"C:\Users\Admin\AppData\Local\Temp\d4a8a88a20b7e53ce9c25c08294edf15fe57d2075c401c1bfae9b990fa892029.exe"
1⤵
PID:1540

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1540-54-0x0000000075C31000-0x0000000075C33000-memory.dmp

Filesize
8KB

Download