81faae8ce7f55b8a70e8a76dc9484ac3ad06c303affb3db359876cfd88e95574 | Triage

Analysis

max time kernel
40s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 02:17

Sharing

Report Analysis Logs

General

Target

81faae8ce7f55b8a70e8a76dc9484ac3ad06c303affb3db359876cfd88e95574.exe
Size

84KB
MD5

5f0a8e543f99543889eea33121f04c53
SHA1

6da79be4c314209ed98e9c4addac5e3be76f48b6
SHA256

81faae8ce7f55b8a70e8a76dc9484ac3ad06c303affb3db359876cfd88e95574
SHA512

dbac68b7249a6b885225b57454c2ba3d5925f3815a31bf7b4d2117eca87e20194e8bbec2eeefe5374b4b8e2991a03948f3fac3ba8ca2a4d1d4b9659b65e5f72f
SSDEEP

1536:NQpQ5EP0ijnRTXJzRRHwDxOa3cx5qjPj4lGF8PMYkIbms1cdc1b:NQIURTXJz3cxCrqfJ6M1+N

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\81faae8ce7f55b8a70e8a76dc9484ac3ad06c303affb3db359876cfd88e95574.exe
"C:\Users\Admin\AppData\Local\Temp\81faae8ce7f55b8a70e8a76dc9484ac3ad06c303affb3db359876cfd88e95574.exe"
1⤵
PID:1096

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1096-54-0x0000000075991000-0x0000000075993000-memory.dmp

Filesize
8KB

Download