2689b377ac694b05ba3ea97737ab3f5909f6f639bc97f401f39de4cdbcb17cc9 | Triage

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 16:12

Sharing

Report Analysis Logs

General

Target

2689b377ac694b05ba3ea97737ab3f5909f6f639bc97f401f39de4cdbcb17cc9.exe
Size

1.7MB
MD5

8251e40556e5b3ed9a4f5f5290b21525
SHA1

ae4dbb68f40d2b54bacc03a36a2e37d94db92088
SHA256

2689b377ac694b05ba3ea97737ab3f5909f6f639bc97f401f39de4cdbcb17cc9
SHA512

541be1736c27e39a86b2977cca167c762e2ec964eaf7b0aae5919c2ecfb503bb2bcaba57a2da0002df498992528e51a7a40a124cb0f6c816f7845f0e6c6fd76a
SSDEEP

49152:r7wRwEkDfBlrJXvDLvpGW2w3XFzdsbrEGvEpN7k:r7wRwESflXh/kgkE7w

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\2689b377ac694b05ba3ea97737ab3f5909f6f639bc97f401f39de4cdbcb17cc9.exe
"C:\Users\Admin\AppData\Local\Temp\2689b377ac694b05ba3ea97737ab3f5909f6f639bc97f401f39de4cdbcb17cc9.exe"
1⤵
PID:1896

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1896-54-0x0000000075201000-0x0000000075203000-memory.dmp

Filesize
8KB

Download