f883ee48c162b510fbaa1a2354f2ec25647e962835020492dead1b8cb8b62a67 | Triage

Analysis

max time kernel
17s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 10:37

Sharing

Report Analysis Logs

General

Target

f883ee48c162b510fbaa1a2354f2ec25647e962835020492dead1b8cb8b62a67.exe
Size

121KB
MD5

b501a573925f6408573209799057dc2a
SHA1

f88ebc731c65ee93aa20d1e55b085f579d32b0ad
SHA256

f883ee48c162b510fbaa1a2354f2ec25647e962835020492dead1b8cb8b62a67
SHA512

50b6832f675d782ca18e5cc3cdebdc09aece4e56b6cae74ffa32c71d91144423bbb63b679333e50d19f08893b2dcbb90d155e3d4b72920c20d258570131341cf
SSDEEP

3072:EmeDmBqskJytwpoM3cpUM/wS2yy3T3bpR14vt1vcMJHJ/J:E8FwpoYcpUOFWMt1zJP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\f883ee48c162b510fbaa1a2354f2ec25647e962835020492dead1b8cb8b62a67.exe
"C:\Users\Admin\AppData\Local\Temp\f883ee48c162b510fbaa1a2354f2ec25647e962835020492dead1b8cb8b62a67.exe"
1⤵
PID:1180

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1180-54-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download