c17ef41032954818ac4caef6ab29cf1e968fb726c945451b937bb2c95e722ade | Triage

Analysis

max time kernel
26s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 21:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c17ef41032954818ac4caef6ab29cf1e968fb726c945451b937bb2c95e722ade.exe
Size

87KB
MD5

71556534df1e764309fbc272e3c27190
SHA1

006e60ee42f5931eba81c2ab423fad0984a2d180
SHA256

c17ef41032954818ac4caef6ab29cf1e968fb726c945451b937bb2c95e722ade
SHA512

4d101ba81d679582c538f10ab3448f3ff738a73f0d0160f5ae1a70a92e7a4e6c682a0badbe5e84735c5659db6908a6dd52a5e544b91be513145cd1ccfe997741
SSDEEP

1536:5Px/CJAmx2/W5Ebnto4tmJjSoLkeyqcrNiCsjg4wAgaif66om8VCdM7ZK1HY9BYr:Fx6UW6tpmJOoIeyqsiM4h2y6oXsdM7Z+

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\c17ef41032954818ac4caef6ab29cf1e968fb726c945451b937bb2c95e722ade.exe
"C:\Users\Admin\AppData\Local\Temp\c17ef41032954818ac4caef6ab29cf1e968fb726c945451b937bb2c95e722ade.exe"
1⤵
PID:1216

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1216-54-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download