aa9b3220725d44390a626d33a5f4b5a6cc651c80bcd91ce9e828a7ee8f77bfef | Triage

Analysis

max time kernel
9s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 00:09

Sharing

Report Analysis Logs

General

Target

aa9b3220725d44390a626d33a5f4b5a6cc651c80bcd91ce9e828a7ee8f77bfef.exe
Size

3.6MB
MD5

81658878f46b5647b35d4cc333b0b4ca
SHA1

1d9fc9ec25f628c1b15ffa2ba868d763b8a88f0a
SHA256

aa9b3220725d44390a626d33a5f4b5a6cc651c80bcd91ce9e828a7ee8f77bfef
SHA512

f68ac7037c264321eaa4b481beeb0dd7980adc3d5427af53248dca525a30087e9c12618e95cfac2a5d75b9a6b5a9a9afab491f011253707cdd8d546e63fe297e
SSDEEP

98304:xfku1079dqHFnz/KBXLVx/Cl+xmcqKPSbrNzAZOBcrq:xfku107MJoVxK0kcnKbrmZO8q

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\aa9b3220725d44390a626d33a5f4b5a6cc651c80bcd91ce9e828a7ee8f77bfef.exe
"C:\Users\Admin\AppData\Local\Temp\aa9b3220725d44390a626d33a5f4b5a6cc651c80bcd91ce9e828a7ee8f77bfef.exe"
1⤵
PID:1704

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1704-54-0x00000000752B1000-0x00000000752B3000-memory.dmp

Filesize
8KB

Download