d1fca2db0130281c8e1d59652fc165430f40e3921be7cf2aa4548fe1110c0830 | Triage

Analysis

max time kernel
14s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26/11/2022, 21:41

Sharing

Report Analysis Logs

General

Target

d1fca2db0130281c8e1d59652fc165430f40e3921be7cf2aa4548fe1110c0830.exe
Size

81KB
MD5

5cbe8a9046c5eaa2b3eaaa5d2ce8b393
SHA1

e29ba54f8537083784c25e6d910bae7147e82cae
SHA256

d1fca2db0130281c8e1d59652fc165430f40e3921be7cf2aa4548fe1110c0830
SHA512

d6f5abc2d2e89ca2bbcd23c00fa2c228f59df893fa078e8d64fc0fe202a2e8d78f64e75eee54664aae027bce335e7013bc46f72cba1a5d7fd4e91c130843f6c3
SSDEEP

1536:eqdBPkbwScJ2V+5n697ypBSLdUQbQkPCKNg9kN:D1W3koFABSLdUQbQiNgiN

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\d1fca2db0130281c8e1d59652fc165430f40e3921be7cf2aa4548fe1110c0830.exe
"C:\Users\Admin\AppData\Local\Temp\d1fca2db0130281c8e1d59652fc165430f40e3921be7cf2aa4548fe1110c0830.exe"
1⤵
PID:1772

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1772-54-0x0000000075981000-0x0000000075983000-memory.dmp

Filesize
8KB

Download