a6ceaa7bb228805c0a3015a33a7a119e610c04036d4b5c890d02125df45aa8a3 | Triage

Analysis

max time kernel
56s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 01:48

Sharing

Report Analysis Logs

General

Target

a6ceaa7bb228805c0a3015a33a7a119e610c04036d4b5c890d02125df45aa8a3.exe
Size

160KB
MD5

08229b6d17b7869e80f070261ca0ef42
SHA1

3b636a4a5a61bab5ce6d6fe6f2092b7328f30a3e
SHA256

a6ceaa7bb228805c0a3015a33a7a119e610c04036d4b5c890d02125df45aa8a3
SHA512

7c5abd9bbcb842c56c974cc005ff03606baf82e8cb6d5c158b21d4b627cca25cd3885ee098b8d05ff9108c00dd0b2f73ab3453e19f0920b9b737e799832bed92
SSDEEP

3072:8sDV6Az1lWgFvYGnJd6KpZVOuTN9WU/G9h3Gw590KqWbmzALbvl6:tQAKgFvYGJd6KpZVOuTN9WU/G9h2w591

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\a6ceaa7bb228805c0a3015a33a7a119e610c04036d4b5c890d02125df45aa8a3.exe
"C:\Users\Admin\AppData\Local\Temp\a6ceaa7bb228805c0a3015a33a7a119e610c04036d4b5c890d02125df45aa8a3.exe"
1⤵
PID:1308

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1308-54-0x000007FEF4070000-0x000007FEF4A93000-memory.dmp

Filesize
10.1MB

Download
memory/1308-55-0x000007FEF2FD0000-0x000007FEF4066000-memory.dmp

Filesize
16.6MB

Download
memory/1308-56-0x0000000001EC6000-0x0000000001EE5000-memory.dmp

Filesize
124KB

Download