eff0b4476578578803b726bbcbcc973ee61905262846c1aa942195beadedba5f | Triage

Analysis

max time kernel
37s
max time network
68s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 15:19

Sharing

Report Analysis Logs

General

Target

eff0b4476578578803b726bbcbcc973ee61905262846c1aa942195beadedba5f.exe
Size

5.3MB
MD5

f36e44c93a10d8f8a5089e311aa1dea8
SHA1

f3eb83d0f11254874f51d1d690523a136a92c7fd
SHA256

eff0b4476578578803b726bbcbcc973ee61905262846c1aa942195beadedba5f
SHA512

f4f3092c92d0e18cf702ea28ebfb94d8081d51e938dd067f5870aebf7108b650f4a3fa1b92e7a8faf20a37acec3f8f28117fdab15ec920c799d14590ba3dc472
SSDEEP

98304:E7qtOJ+OfSe+D4kbDKvw/ngWq2Nv+RUnYI23ZE9NyZ7ibeNbLObQOdg:Iq4+Oqi0hkwVE4beNbLObQOq

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\eff0b4476578578803b726bbcbcc973ee61905262846c1aa942195beadedba5f.exe
"C:\Users\Admin\AppData\Local\Temp\eff0b4476578578803b726bbcbcc973ee61905262846c1aa942195beadedba5f.exe"
1⤵
PID:1808

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1808-54-0x0000000075511000-0x0000000075513000-memory.dmp

Filesize
8KB

Download