11d63c8ba185387a82b9d78c6d37218bff8f578641e4589f0fedff93db61d314 | Triage

Analysis

max time kernel
32s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 13:39

Sharing

Report Analysis Logs

General

Target

11d63c8ba185387a82b9d78c6d37218bff8f578641e4589f0fedff93db61d314.exe
Size

18KB
MD5

ccb2f899010de04126e2e0d45fa77c3e
SHA1

a1d118cfd8ae4665c34587df45c2220b176cb7e6
SHA256

11d63c8ba185387a82b9d78c6d37218bff8f578641e4589f0fedff93db61d314
SHA512

589bcc349be86969fdd466b7e5a3d3aae5010f06c591ecd024f980cf139d4dcf3c7606aefc8ae7ff79e06048ceb3db9e1073324fcf75570fcbcfe68011f85e7e
SSDEEP

384:ARdCy1MqlWM4mQ2eJlSFuKZNExpmXBaOD+:kCyCqlP4mQ/Dsu88OS

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\11d63c8ba185387a82b9d78c6d37218bff8f578641e4589f0fedff93db61d314.exe
"C:\Users\Admin\AppData\Local\Temp\11d63c8ba185387a82b9d78c6d37218bff8f578641e4589f0fedff93db61d314.exe"
1⤵
PID:2032

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2032-54-0x0000000076B51000-0x0000000076B53000-memory.dmp

Filesize
8KB

Download