29916e387a2c73819eae773f7bfe640be03195f1c15b9b241fefa381d35ccd4b | Triage

Analysis

max time kernel
29s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 10:25

Sharing

Report Analysis Logs

General

Target

29916e387a2c73819eae773f7bfe640be03195f1c15b9b241fefa381d35ccd4b.exe
Size

4.4MB
MD5

4ec441c15b5b30198aefa43df2b47411
SHA1

e4f04b00be1e64d2ed9b6b4545319861ebf6407e
SHA256

29916e387a2c73819eae773f7bfe640be03195f1c15b9b241fefa381d35ccd4b
SHA512

50cf7ee3239693b87255e8b3d6e320c971886ce20fedf4f10eaaf8877a0e4b86ee3dd7e9130ea959b0f162d81acc0371cfc2d84cdf13d5d0a63ed6cb38e73b4c
SSDEEP

98304:xqplXaiJ+QCyfL750hN8nttZrMa2xOy8MdEZZAFvdpf3yx1:8rGSJ0snhAxOyMAFvdtyx1

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\29916e387a2c73819eae773f7bfe640be03195f1c15b9b241fefa381d35ccd4b.exe
"C:\Users\Admin\AppData\Local\Temp\29916e387a2c73819eae773f7bfe640be03195f1c15b9b241fefa381d35ccd4b.exe"
1⤵
PID:1508

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1508-54-0x0000000074C91000-0x0000000074C93000-memory.dmp

Filesize
8KB

Download