6c1ee695cdbb50df90a47420f34f3fadf417cf6686a9eb19536a4573fdbe7d47 | Triage

Analysis

max time kernel
231s
max time network
336s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
26/11/2022, 22:22

Sharing

Report Analysis Logs

General

Target

6c1ee695cdbb50df90a47420f34f3fadf417cf6686a9eb19536a4573fdbe7d47.exe
Size

578KB
MD5

e349e8aa8f1daf9421285a6d0669e664
SHA1

e7aaa0452bc751c9ea2afd25d1b4179cd40c0475
SHA256

6c1ee695cdbb50df90a47420f34f3fadf417cf6686a9eb19536a4573fdbe7d47
SHA512

fb694f2bcda717f4043cc7040b6f11fbc1a8114b7b47376c3f6ab478a63a00787b4a8ab9724ba7dfec5c01fffeb69425bedf6b23e5ce3664ffc59494dc0386d2
SSDEEP

12288:lY20AljdZgBPfKfu7AYl54pe6oMJ3RNzeuvfS2ZGVmh5+P9ecgVkeGqpBUH:a20gPgFKG7pl54pe6oMJBNzeHf8i91Eu

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\6c1ee695cdbb50df90a47420f34f3fadf417cf6686a9eb19536a4573fdbe7d47.exe
"C:\Users\Admin\AppData\Local\Temp\6c1ee695cdbb50df90a47420f34f3fadf417cf6686a9eb19536a4573fdbe7d47.exe"
1⤵
PID:544

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/544-54-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download