e8938b18ac6cd27a2021e7b1235784465f56d308d28e0e56550b9592fed19876 | Triage

Analysis

max time kernel
43s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 12:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e8938b18ac6cd27a2021e7b1235784465f56d308d28e0e56550b9592fed19876.exe
Size

3.8MB
MD5

d7aee8e261fe1708fbecee693069fd5d
SHA1

fe9befd8fe1cb2a58c4428e6a144ef2b85a5d5d7
SHA256

e8938b18ac6cd27a2021e7b1235784465f56d308d28e0e56550b9592fed19876
SHA512

7a027e8c5a3ec47003842e1ced35dab16d99a1d221976a0fd53a684679827aacba66f83bba9c2851307bea6d95040be3ace3fa1911af8dfec99eb662f35b6085
SSDEEP

98304:ySRo55doIx8VfZ+1r7M2Fw+x3bsWV2OtXqdZZD+vsV+u:e5TdCf81r7N7xr5VrqdZ8s4u

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\e8938b18ac6cd27a2021e7b1235784465f56d308d28e0e56550b9592fed19876.exe
"C:\Users\Admin\AppData\Local\Temp\e8938b18ac6cd27a2021e7b1235784465f56d308d28e0e56550b9592fed19876.exe"
1⤵
PID:1348

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1348-54-0x0000000075601000-0x0000000075603000-memory.dmp

Filesize
8KB

Download