af6f7a6162a778e6175d89574f5d97e41d129041d4dfd66fe40033d0f86533dc | Triage

Analysis

max time kernel
43s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 10:33

Sharing

Report Analysis Logs

General

Target

af6f7a6162a778e6175d89574f5d97e41d129041d4dfd66fe40033d0f86533dc.exe
Size

898KB
MD5

37614f865d8d089342668fc2460fc41e
SHA1

d0652ae974af4fb442828738f90494436363e43a
SHA256

af6f7a6162a778e6175d89574f5d97e41d129041d4dfd66fe40033d0f86533dc
SHA512

6dd9f23d07f14e5a476b951229e620804c0b2a1187749e4680e3d348c500e4edf357cbf3bf4093067257fb4050ec4871267d71873f0514a1b8e93c4c4a27b805
SSDEEP

12288:ZNxsqEmUJl9bfg2SjNpONFPe+/0i/x2v/RscUWFxQT1l9bfg2SjNpONFPe+G:ZTLUJnbYxNWey0eeZscHLQT1nbYxNWep

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\af6f7a6162a778e6175d89574f5d97e41d129041d4dfd66fe40033d0f86533dc.exe
"C:\Users\Admin\AppData\Local\Temp\af6f7a6162a778e6175d89574f5d97e41d129041d4dfd66fe40033d0f86533dc.exe"
1⤵
PID:1652

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1652-54-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download