2b7788f39efb60557842ca5c70713ab6e1ec9d6bcfee4a254943bbe2d2229a1a | Triage

Analysis

max time kernel
142s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02-12-2022 18:51

Sharing

Report Analysis Logs

General

Target

2b7788f39efb60557842ca5c70713ab6e1ec9d6bcfee4a254943bbe2d2229a1a.exe
Size

444KB
MD5

89e6bc4db4e8161e18145cb6e56c8f10
SHA1

a7c693effed41b084502ae7924b31ed2d0eb0ffc
SHA256

2b7788f39efb60557842ca5c70713ab6e1ec9d6bcfee4a254943bbe2d2229a1a
SHA512

92397bc4b3ed7f2583ee0fc6dad5e805379c9949d09c527ed68e820fcf6d4bae889769bd24607dfd612fab068524be34142723217616fe068a51dc3d5107f8e1
SSDEEP

6144:Wb6WbTTUUNigbK3v4X/aQHZhBGz5C7/LTGcPZcWNNZxPQAkYkInlR2Q7IKuAUxFb:mtT4UN3K3vwlhs5C7TTJZBZprkO9uAml

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\2b7788f39efb60557842ca5c70713ab6e1ec9d6bcfee4a254943bbe2d2229a1a.exe
"C:\Users\Admin\AppData\Local\Temp\2b7788f39efb60557842ca5c70713ab6e1ec9d6bcfee4a254943bbe2d2229a1a.exe"
1⤵
PID:1812

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads