b54728f8b00170316897de7f50f998239ba97cd3f30dc76a401edc04681ed6b8 | Triage

Analysis

max time kernel
13s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 11:29

Sharing

Report Analysis Logs

General

Target

b54728f8b00170316897de7f50f998239ba97cd3f30dc76a401edc04681ed6b8.exe
Size

1.5MB
MD5

265e6204fa7018033a4780c72e913596
SHA1

1182d7c1cff833881a6b63edaf43f401bc6be5de
SHA256

b54728f8b00170316897de7f50f998239ba97cd3f30dc76a401edc04681ed6b8
SHA512

c58757e6c0a06105950a000e8591a922cd8e7ea830635af57b072ec5253d526cac8ab00124afb723e55cec5b233ad63162c4fa0497d687e7a5fc3bb6ffd353b8
SSDEEP

24576:Itye3CAqaZR/FMGPpCZ22p3dacsV3rDDGajnF5BiAsuKScHz3703QlCfsIb628TC:yzRtMGPpYP3dacsVG2tiA2HcAMfaSyC

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\b54728f8b00170316897de7f50f998239ba97cd3f30dc76a401edc04681ed6b8.exe
"C:\Users\Admin\AppData\Local\Temp\b54728f8b00170316897de7f50f998239ba97cd3f30dc76a401edc04681ed6b8.exe"
1⤵
PID:1032

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1032-54-0x0000000075601000-0x0000000075603000-memory.dmp

Filesize
8KB

Download
memory/1032-55-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download