ad851753970f61f6221f6f9bd33d125f0dc5e5ddad8ffbca270191116e39991e | Triage

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
28/11/2022, 01:33

Sharing

Report Analysis Logs

General

Target

ad851753970f61f6221f6f9bd33d125f0dc5e5ddad8ffbca270191116e39991e.exe
Size

191KB
MD5

7d3080389975577d64827c039a952fb5
SHA1

b628dfd64704dee3136a0bdcd92b0f5748b772a6
SHA256

ad851753970f61f6221f6f9bd33d125f0dc5e5ddad8ffbca270191116e39991e
SHA512

3cce3074261002927f4256bb7136222f0b67507c9f9bbd69c15d02230238b7ec912c42fa04b9747688a3bb59401e941aeb84d83e5327db77a21a5fe411e7571c
SSDEEP

3072:HADWbKzKbQmSVdSme+xmJyD4BliqzsmmEpEmboQd+ccewkyeZyYPuvGCJ30EZ0da:HAVySV1eY4k437d+4wkTHdS2i

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\ad851753970f61f6221f6f9bd33d125f0dc5e5ddad8ffbca270191116e39991e.exe
"C:\Users\Admin\AppData\Local\Temp\ad851753970f61f6221f6f9bd33d125f0dc5e5ddad8ffbca270191116e39991e.exe"
1⤵
PID:620

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/620-54-0x0000000075711000-0x0000000075713000-memory.dmp

Filesize
8KB

Download