ad0ea483113556a7903155f82f29e6645b792c8c7befb2d1f7b05d4488a674f5 | Triage

Analysis

max time kernel
85s
max time network
90s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
28/11/2022, 06:07

Sharing

Report Analysis Logs

General

Target

ad0ea483113556a7903155f82f29e6645b792c8c7befb2d1f7b05d4488a674f5.exe
Size

191KB
MD5

0c56db34d13fc769e50c5491d162a87b
SHA1

4f8a9d9edfe6ea05ba8fe32d71add2b5cad3f6a0
SHA256

ad0ea483113556a7903155f82f29e6645b792c8c7befb2d1f7b05d4488a674f5
SHA512

7fde8de33ae50135a0735735abc900917a942cc0ca8a2164eabd1aed66620b5dd51f503c800bd4639c2538fdb3dce5e3f4d3a272d567770fd5e6cf08ad0ec7ff
SSDEEP

3072:HADWbKzKbQmSVdSme+xmJyD4BliqzsmmEpEmboQd+ccewkyeZyYPuvGCJ30EZ0dR:HAVySV1eY4k437d+4wkTHdS2Z

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\ad0ea483113556a7903155f82f29e6645b792c8c7befb2d1f7b05d4488a674f5.exe
"C:\Users\Admin\AppData\Local\Temp\ad0ea483113556a7903155f82f29e6645b792c8c7befb2d1f7b05d4488a674f5.exe"
1⤵
PID:1168

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1168-54-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

Filesize
8KB

Download