9db7d61f765bd5bebac7ba1952af0cdea49e8fc21a5b8957832c57d245599c7c | Triage

Analysis

max time kernel
17s
max time network
50s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 07:40

Sharing

Report Analysis Logs

General

Target

9db7d61f765bd5bebac7ba1952af0cdea49e8fc21a5b8957832c57d245599c7c.exe
Size

2.2MB
MD5

0a639b93349de6595d614d6d7dea1000
SHA1

82aaf53d9bfe6faa1986d6463982adaaa9590d8d
SHA256

9db7d61f765bd5bebac7ba1952af0cdea49e8fc21a5b8957832c57d245599c7c
SHA512

10517bff12d46f0f7df0003148ac0f8840bb05fa2b5a86ffb31b6810cd3262b32f026c5bd9620301d119124e30429e14af3407a9eb977f7afd68a5393e256cc1
SSDEEP

49152:uQERN4LwvzMRVfbNZso69JMPGGRy/2yBj/RTwOIWZ8ruDJEt60C:uQEf4LwLM7YN2m2UtsO4wd

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\9db7d61f765bd5bebac7ba1952af0cdea49e8fc21a5b8957832c57d245599c7c.exe
"C:\Users\Admin\AppData\Local\Temp\9db7d61f765bd5bebac7ba1952af0cdea49e8fc21a5b8957832c57d245599c7c.exe"
1⤵
PID:2036

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2036-54-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

Filesize
8KB

Download