8decf87a663d311aa46bee80e940f83daaa28cc788410f79bfbd9b80aead116b | Triage

Analysis

max time kernel
319s
max time network
445s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 21:21

Sharing

Report Analysis Logs

General

Target

8decf87a663d311aa46bee80e940f83daaa28cc788410f79bfbd9b80aead116b.exe
Size

262KB
MD5

e135ee0d7cecb3fd6707fe9ab0cd2daa
SHA1

aaa5f0aa8fa6b90b2eea0899d338f0f7556a5012
SHA256

8decf87a663d311aa46bee80e940f83daaa28cc788410f79bfbd9b80aead116b
SHA512

986265efdc1d9c265d60a2d5eb63a31e3351ac2d22870247880da4eb94c500623d6189e7825c13f5b203929c9ed28fce86b88d3f0742f0eca127141c2306f528
SSDEEP

6144:n5mts+yZ2zxvsr6Jj8fjvA7sG8jaBkj2p0JwaNnRSChs8bEOsgX88xAlg:nE6Z2zx0wj8fjvWN8+30Jw2RMIJQg

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\8decf87a663d311aa46bee80e940f83daaa28cc788410f79bfbd9b80aead116b.exe
"C:\Users\Admin\AppData\Local\Temp\8decf87a663d311aa46bee80e940f83daaa28cc788410f79bfbd9b80aead116b.exe"
1⤵
PID:4016

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4016-132-0x00000000001F0000-0x00000000001F5000-memory.dmp

Filesize
20KB

Download
memory/4016-133-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download