d2dcc8e23d4adb3db16b19550fba8466850c1a04f1a44dcc2bfe6032c493031c | Triage

Analysis

max time kernel
94s
max time network
102s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24/11/2022, 05:15

Sharing

Report Analysis Logs

General

Target

d2dcc8e23d4adb3db16b19550fba8466850c1a04f1a44dcc2bfe6032c493031c.exe
Size

79KB
MD5

50656f12d52e27fdf8d0669635b9db8b
SHA1

5b4b3e3f0cc471b36de969f942d8dfb5305ade1d
SHA256

d2dcc8e23d4adb3db16b19550fba8466850c1a04f1a44dcc2bfe6032c493031c
SHA512

510c19203652956bcd4132b3a6fb3bf095c8f584ddad298929b9852fbd0808f075571847bd62b10a8f9da6879bdb942ef3ac9d6466655d2d44f00e2a934582e6
SSDEEP

768:tOKkRrbAeAvnLPu5BEAUMkCf9xszmJSwO8I3eUZjwyDOJJb+QhyU9o:yRrbAeAvn7uyMd6wO8wPw+JL

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\d2dcc8e23d4adb3db16b19550fba8466850c1a04f1a44dcc2bfe6032c493031c.exe
"C:\Users\Admin\AppData\Local\Temp\d2dcc8e23d4adb3db16b19550fba8466850c1a04f1a44dcc2bfe6032c493031c.exe"
1⤵
PID:1420

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1420-54-0x00000000767B1000-0x00000000767B3000-memory.dmp

Filesize
8KB

Download
memory/1420-55-0x0000000000B00000-0x0000000000B17000-memory.dmp

Filesize
92KB

Download
memory/1420-56-0x0000000000B00000-0x0000000000B17000-memory.dmp

Filesize
92KB

Download