afdffcd81a9f2f191d6a1de3c50d27dda6ecf4d925f2e72e73d5589abbc4e8c3 | Triage

Analysis

max time kernel
25s
max time network
53s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 06:37

Sharing

Report Analysis Logs

General

Target

afdffcd81a9f2f191d6a1de3c50d27dda6ecf4d925f2e72e73d5589abbc4e8c3.exe
Size

191KB
MD5

17af2f0d5e716333f1e9c92368aeff47
SHA1

ece00ce76f58b369709cead8cc7642942ddcedc5
SHA256

afdffcd81a9f2f191d6a1de3c50d27dda6ecf4d925f2e72e73d5589abbc4e8c3
SHA512

dd620870b42930150aada9c3d161a6b88eaae6a45fd0d2e6232e52dd22896d15454d196b1923c7e3ee845c512724fb9feca62db6dcf073806fa706f919f68b5b
SSDEEP

3072:HADWbKzKbQmSVdSme+xmJyD4BliqzsmmEpEmboQd+ccewkyeZyYPuvGCJ30EZ0dB:HAVySV1eY4k437d+4wkTHdS25

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\afdffcd81a9f2f191d6a1de3c50d27dda6ecf4d925f2e72e73d5589abbc4e8c3.exe
"C:\Users\Admin\AppData\Local\Temp\afdffcd81a9f2f191d6a1de3c50d27dda6ecf4d925f2e72e73d5589abbc4e8c3.exe"
1⤵
PID:1488

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1488-54-0x00000000760A1000-0x00000000760A3000-memory.dmp

Filesize
8KB

Download