ef00eb2a39b16b9c306fa4e6f2ce30b2bd1c7fe0b7600c12e4e4669f4b76d9e6 | Triage

Analysis

max time kernel
26s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 04:20

Sharing

Report Analysis Logs

General

Target

ef00eb2a39b16b9c306fa4e6f2ce30b2bd1c7fe0b7600c12e4e4669f4b76d9e6.exe
Size

63KB
MD5

ee74c87eae3c9438faf306834c9db056
SHA1

3466eef93ecf501780a9384dc76c7d1bb58d486a
SHA256

ef00eb2a39b16b9c306fa4e6f2ce30b2bd1c7fe0b7600c12e4e4669f4b76d9e6
SHA512

1397fae76ea97ce02e79c1f7d4f53123aa442471aa92d62065637f2e5e424714b81392a8e610fc63c4cf183094325a1164bcfff1b05bbd0d17424eee030db3b7
SSDEEP

1536:/ZHeDe88lx2AppTFr675Qz0HJc6rVY3t1teXs+j:/ZHXlx9TR676z0HJjsM

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\ef00eb2a39b16b9c306fa4e6f2ce30b2bd1c7fe0b7600c12e4e4669f4b76d9e6.exe
"C:\Users\Admin\AppData\Local\Temp\ef00eb2a39b16b9c306fa4e6f2ce30b2bd1c7fe0b7600c12e4e4669f4b76d9e6.exe"
1⤵
PID:1732

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1732-54-0x0000000075E81000-0x0000000075E83000-memory.dmp

Filesize
8KB

Download