123048255c396db73c52d9a3df292ce1dcfd936630b1764100a45965908c1607 | Triage

Analysis

max time kernel
90s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 17:03

Sharing

Report Analysis Logs

General

Target

123048255c396db73c52d9a3df292ce1dcfd936630b1764100a45965908c1607.exe
Size

427KB
MD5

7bd64304966d9ada55db781e89af1984
SHA1

d2ce51dec279b37df3572c271dc7e86d89349723
SHA256

123048255c396db73c52d9a3df292ce1dcfd936630b1764100a45965908c1607
SHA512

eb20273126f84429b0fd34e67f33874669a817dfcf80dc2e5ebc098f2ebd4d71f89863b6e35cba227a66c4d98ea5d512d3c0997cea3c08dfe1e75b0001e824a0
SSDEEP

6144:jKrxiyLvmWVXGl3Kxk8Oq1KAZsVpJmC9JBizal0c+biQktM1KWDv+KjN8R:utLXhkKxkM158pQCaDcXM0WDv8

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\123048255c396db73c52d9a3df292ce1dcfd936630b1764100a45965908c1607.exe
"C:\Users\Admin\AppData\Local\Temp\123048255c396db73c52d9a3df292ce1dcfd936630b1764100a45965908c1607.exe"
1⤵
PID:1848

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads