afa09796eebc7d5bf3082e4334b847149173bed506f6942d668e99b50c39f1ac | Triage

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 09:04

Sharing

Report Analysis Logs

General

Target

afa09796eebc7d5bf3082e4334b847149173bed506f6942d668e99b50c39f1ac.exe
Size

191KB
MD5

4fa8a2f25796b1e2e0e538cb623e66cf
SHA1

f5b741d45f7a34d6b0310896eb0abb4871e665ab
SHA256

afa09796eebc7d5bf3082e4334b847149173bed506f6942d668e99b50c39f1ac
SHA512

75cf947fef2e848ab35e77112b1e34d4135e1690aff9c3349226b7dfa4e6858fd2737d60e59113ba509b1efe47764574d2a300a6cf1ece3d608be9d5943d8f33
SSDEEP

3072:HADWbKzKbQmSVdSme+xmJyD4BliqzsmmEpEmboQd+ccewkyeZyYPuvGCJ30EZ0dD:HAVySV1eY4k437d+4wkTHdS2L

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\afa09796eebc7d5bf3082e4334b847149173bed506f6942d668e99b50c39f1ac.exe
"C:\Users\Admin\AppData\Local\Temp\afa09796eebc7d5bf3082e4334b847149173bed506f6942d668e99b50c39f1ac.exe"
1⤵
PID:852

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/852-54-0x0000000074E41000-0x0000000074E43000-memory.dmp

Filesize
8KB

Download