890cc7b687610d77965cb95603a1c1dd10951334875fd018d6de8cf631c6f4e3 | Triage

Analysis

max time kernel
46s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02-12-2022 22:08

Sharing

Report Analysis Logs

General

Target

890cc7b687610d77965cb95603a1c1dd10951334875fd018d6de8cf631c6f4e3.exe
Size

1.6MB
MD5

4c3dffdc61364e11a737a5debd795577
SHA1

2a1485c5f47692d366acf4f7f530d7fa9e8c3afd
SHA256

890cc7b687610d77965cb95603a1c1dd10951334875fd018d6de8cf631c6f4e3
SHA512

453b9a32266a4b918be50b9bcfc619bfe49bec483e07b2e5148ca5ff30828ad44354b04ebdcb6a0780c43bac4cebffc2ee416d980d24472c445e2d328edde5e9
SSDEEP

49152:DAzM1vI8c6U0Y2ughvNCl3KZtvBFHxpBgTJM:DAwUaucAuXHxTP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\890cc7b687610d77965cb95603a1c1dd10951334875fd018d6de8cf631c6f4e3.exe
"C:\Users\Admin\AppData\Local\Temp\890cc7b687610d77965cb95603a1c1dd10951334875fd018d6de8cf631c6f4e3.exe"
1⤵
PID:1600

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1600-54-0x00000000752B1000-0x00000000752B3000-memory.dmp

Filesize
8KB

Download