5f02d11f87d53b8e02eb1a943c553c969dc80f57bad64fedd842b5607109a141 | Triage

Analysis

max time kernel
37s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 17:05

Sharing

Report Analysis Logs

General

Target

EXEPackager/EXEPackager.exe
Size

854KB
MD5

00bea0c049b0f25810b851058c472348
SHA1

5f18bb989a3eda8b46ea67ab54abe6eabc53ba6d
SHA256

c3521577fda7ec36c49d3c029d09fa48823a3cc7ccabbf75b5edfa7f20d8eb6c
SHA512

1a58b2eeaa13e8c6cfea68beeb6dde71879c32821bdfc9b58676876a850f29ad1921c88dda0f680b7f1df0abdea805d733ea482cd7461388eaab9fd90e54f1bc
SSDEEP

24576:Hp2ZKKY1Fz2dYF74iVsSfwwj1vpVYb9Z1vv72Yfn++lSZvPKX7:Ho2/SYF7dVsuj1vpavRj2SMZXKr

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\EXEPackager\EXEPackager.exe
"C:\Users\Admin\AppData\Local\Temp\EXEPackager\EXEPackager.exe"
1⤵
PID:1672

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1672-54-0x0000000075841000-0x0000000075843000-memory.dmp

Filesize
8KB

Download
memory/1672-55-0x0000000000400000-0x000000000067C000-memory.dmp

Filesize
2.5MB

Download
memory/1672-56-0x0000000000400000-0x000000000067C000-memory.dmp

Filesize
2.5MB

Download