cea3dc703f738f7568c479fe6c84b3b56083af1bf9b039551d76de0654ef6876 | Triage

Analysis

max time kernel
39s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 02:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cea3dc703f738f7568c479fe6c84b3b56083af1bf9b039551d76de0654ef6876.exe
Size

2.7MB
MD5

f75f4d64e675ed2a551e0d1a0abdc567
SHA1

9b0eeb574c044a47abcf78f479f8df80558fc211
SHA256

cea3dc703f738f7568c479fe6c84b3b56083af1bf9b039551d76de0654ef6876
SHA512

2e0b2e7d0ca66dbd33e8bf3cc3dd5a6972fea7d1cb39bc3fbe76c06accf5e253e17e6f55d89648d451a6eb9bc8a630a6afc1bc4eb70d01700e37656cdb20c39b
SSDEEP

49152:aYczZ997x9lAwLuIeH8X0ryO2ZFDJhFiaxY2ypET98:anzZTWpmh3M698

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\cea3dc703f738f7568c479fe6c84b3b56083af1bf9b039551d76de0654ef6876.exe
"C:\Users\Admin\AppData\Local\Temp\cea3dc703f738f7568c479fe6c84b3b56083af1bf9b039551d76de0654ef6876.exe"
1⤵
PID:1680

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1680-54-0x0000000074D81000-0x0000000074D83000-memory.dmp

Filesize
8KB

Download