668cb1a25988354fad1e8073eb0fe97d01693537844d970b70a759ab248e9cc3 | Triage

Analysis

max time kernel
26s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 08:39

Sharing

Report Analysis Logs

General

Target

668cb1a25988354fad1e8073eb0fe97d01693537844d970b70a759ab248e9cc3.exe
Size

800KB
MD5

8777f54a2b757a78c35399deae643f72
SHA1

d89dbcf374d59e3e05bd6aac799016ebb11b965a
SHA256

668cb1a25988354fad1e8073eb0fe97d01693537844d970b70a759ab248e9cc3
SHA512

01015818cad20171f8ec4bfe9327471bec50ad7b140383d0c6667283ec419ab9589093dabc6f1e095f8517d44bbc8a0f9ea50f514a896d9ef04ae8f651294706
SSDEEP

24576:gnzgBxjPoBrmpUCcTQsw3YZmH0s3TZowlho3BfNeoQeFMEk:baEUCcTQ7ZH0atXlhyFMn

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\668cb1a25988354fad1e8073eb0fe97d01693537844d970b70a759ab248e9cc3.exe
"C:\Users\Admin\AppData\Local\Temp\668cb1a25988354fad1e8073eb0fe97d01693537844d970b70a759ab248e9cc3.exe"
1⤵
PID:1448

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1448-54-0x0000000075921000-0x0000000075923000-memory.dmp

Filesize
8KB

Download