72966c53fc103f074f8d59f4d8b88fa6d759c87506eb1f776629375042f24f90 | Triage

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 11:15

Sharing

Report Analysis Logs

General

Target

72966c53fc103f074f8d59f4d8b88fa6d759c87506eb1f776629375042f24f90.exe
Size

5.1MB
MD5

870abca2369345a5f0249d4deed936d6
SHA1

dd9d37638be056806acb22e78a304138de328923
SHA256

72966c53fc103f074f8d59f4d8b88fa6d759c87506eb1f776629375042f24f90
SHA512

f8da8f932d4f836698799c351965835396eca7308e4d706d2ae7c00c33816fb23f9b968a8389b0773280ceae2f89a93e5ac4a5bc810889ce0980775e03c525e1
SSDEEP

98304:I4cVHrH3nQzTjBvH4td+HC+wJ4JTcxF6jKynz0ZMi6cNRhzb/2PGKRZ2wtwTb+:I4cVHrH05AToC+weJTcVw0ZM+7tePrZt

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\72966c53fc103f074f8d59f4d8b88fa6d759c87506eb1f776629375042f24f90.exe
"C:\Users\Admin\AppData\Local\Temp\72966c53fc103f074f8d59f4d8b88fa6d759c87506eb1f776629375042f24f90.exe"
1⤵
PID:1696

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1696-54-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download
memory/1696-55-0x0000000000400000-0x0000000000615000-memory.dmp

Filesize
2.1MB

Download
memory/1696-56-0x0000000001F30000-0x0000000001F43000-memory.dmp

Filesize
76KB

Download
memory/1696-57-0x0000000001F30000-0x0000000001F32000-memory.dmp

Filesize
8KB

Download