5e9d7ffd9243500c3c46dc99af56f7d4c31694aefa6b9f8cc658bd1233672135 | Triage

Analysis

max time kernel
19s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 02:21

Sharing

Report Analysis Logs

General

Target

5e9d7ffd9243500c3c46dc99af56f7d4c31694aefa6b9f8cc658bd1233672135.exe
Size

2.2MB
MD5

ead889022961f3809e0de5fc547cfe53
SHA1

0dc7907264e84f8070d37172c70e2782614d3fda
SHA256

5e9d7ffd9243500c3c46dc99af56f7d4c31694aefa6b9f8cc658bd1233672135
SHA512

e672a6ca182551c562565375f5c01267e7a84c9e06be4d436dba4a893792692eee33c15ce00bdfd180b00178f108174ab6c82df3a32a6d21048655fdecb70c67
SSDEEP

49152:2QsNCbl0eZp5473dNAAbrgscUeoSgO/u27M0B9BNRZMs:9baeKjdbgsQY2MgRZMs

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\5e9d7ffd9243500c3c46dc99af56f7d4c31694aefa6b9f8cc658bd1233672135.exe
"C:\Users\Admin\AppData\Local\Temp\5e9d7ffd9243500c3c46dc99af56f7d4c31694aefa6b9f8cc658bd1233672135.exe"
1⤵
PID:2040

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2040-54-0x0000000075591000-0x0000000075593000-memory.dmp

Filesize
8KB

Download