6a7383ac98f977501d6a651ade833d0b18baf9eac121b8e04e28e086881c3479 | Triage

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 00:10

Sharing

Report Analysis Logs

General

Target

6a7383ac98f977501d6a651ade833d0b18baf9eac121b8e04e28e086881c3479.exe
Size

3.6MB
MD5

b7f0123f3dd101027ce5b6214ad13182
SHA1

4bd2998269270a83910784b37482a8723b2949f8
SHA256

6a7383ac98f977501d6a651ade833d0b18baf9eac121b8e04e28e086881c3479
SHA512

ea16a05c8706b676da79ce5524be43d10d87643b13cf370cc6185a5e3a6a25520b95b6cadba06d5840f5b8151ca0d4c678e1d9f343636af58d8a61750033ef13
SSDEEP

98304:bD0mA20c/x7TSL0Wt9KvW8lAm4rK2yb9RS6xVa9b64Eb1MLF:bD3z0mBTutcOSAm4rcb9da9bTY14

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\6a7383ac98f977501d6a651ade833d0b18baf9eac121b8e04e28e086881c3479.exe
"C:\Users\Admin\AppData\Local\Temp\6a7383ac98f977501d6a651ade833d0b18baf9eac121b8e04e28e086881c3479.exe"
1⤵
PID:2012

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2012-54-0x0000000074B51000-0x0000000074B53000-memory.dmp

Filesize
8KB

Download