845d79ddb673cd945897649c0e4819b323e23b617a3d03a39887e5744ecc070e | Triage

Analysis

max time kernel
39s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-12-2022 21:42

Sharing

Report Analysis Logs

General

Target

845d79ddb673cd945897649c0e4819b323e23b617a3d03a39887e5744ecc070e.exe
Size

90KB
MD5

66d52db58f2e05d202c722143822b9aa
SHA1

f0f49ed1deac935d5fda37565f8ea617a8a35742
SHA256

845d79ddb673cd945897649c0e4819b323e23b617a3d03a39887e5744ecc070e
SHA512

f27d960e8a20be90e5cfddc2ee4a71afcd6b4658617fdc3e1093a8896adb358956db1becc44766e845bdc715b7fb344e26e20dc9025dc913df7a483b0727069b
SSDEEP

1536:PPx/CJAmx2/W5Ebnto4tmJk4Romu/xjgDV6awBrdbLkrude7mnflp4tmJx4Ro1:Hx6UW6tpmJk456jgDV6dAruRdWmJx4G

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\845d79ddb673cd945897649c0e4819b323e23b617a3d03a39887e5744ecc070e.exe
"C:\Users\Admin\AppData\Local\Temp\845d79ddb673cd945897649c0e4819b323e23b617a3d03a39887e5744ecc070e.exe"
1⤵
PID:1148

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1148-54-0x0000000074C11000-0x0000000074C13000-memory.dmp

Filesize
8KB

Download