a8023b5918e865486b74ba150e0eef870f8fa297610c883f48b1469be7c9d807 | Triage

Analysis

max time kernel
41s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 08:07

Sharing

Report Analysis Logs

General

Target

a8023b5918e865486b74ba150e0eef870f8fa297610c883f48b1469be7c9d807.exe
Size

2.6MB
MD5

04c6a852cdff3bf571534f91dac47d33
SHA1

4d0bb4dc04ffed25b124d217d621d7ee03a5087d
SHA256

a8023b5918e865486b74ba150e0eef870f8fa297610c883f48b1469be7c9d807
SHA512

90cbce588636a6746a99f1366069e3765ad3956be4700321e58f30d0e7151944965caf86c0d40619ccd4113397e6e5fbd16f8ed2291b23c4ab48b260081bbd14
SSDEEP

49152:o4pfiGAXrNSitW85Fq7TRUjDAEY0YSEcfRbArbDXaRDQ9yT3CVvPzcyGGiv5KJOd:o4pEXr0itWO07TEXPNyqFiyT2yG4cJOd

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\a8023b5918e865486b74ba150e0eef870f8fa297610c883f48b1469be7c9d807.exe
"C:\Users\Admin\AppData\Local\Temp\a8023b5918e865486b74ba150e0eef870f8fa297610c883f48b1469be7c9d807.exe"
1⤵
PID:1632

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1632-54-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download