638d71316c26169755e566b06cbecb4acefd5983854b9ea76bf1c580c5e72a20 | Triage

Analysis

max time kernel
109s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24/11/2022, 00:10

Sharing

Report Analysis Logs

General

Target

638d71316c26169755e566b06cbecb4acefd5983854b9ea76bf1c580c5e72a20.exe
Size

4.4MB
MD5

6176969377e154938299bd306b6d3431
SHA1

23a13f1822d8e51e9ae300b4c5cc840d9950890c
SHA256

638d71316c26169755e566b06cbecb4acefd5983854b9ea76bf1c580c5e72a20
SHA512

42d3d6ee8f3d3b19e342f16ccd9f1e3dcb3ed2ee6d05b68a0b1f4244e6ebb300d28d039ffa52b1582b721b78e12cff51a8e45758f2bad6119b53cd07066c11f6
SSDEEP

98304:td8ufnrqo53h1953J9vg1xX5fgf5P3mReE/Z1hrTdc8/SL6um6jUxfvGYIZlTgVE:LfnrDvtoaP2RNrTdRKLRm6oxfeXZyVtG

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\638d71316c26169755e566b06cbecb4acefd5983854b9ea76bf1c580c5e72a20.exe
"C:\Users\Admin\AppData\Local\Temp\638d71316c26169755e566b06cbecb4acefd5983854b9ea76bf1c580c5e72a20.exe"
1⤵
PID:1472

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1472-54-0x0000000075491000-0x0000000075493000-memory.dmp

Filesize
8KB

Download