af1a0ca62b9b50e1cf078521cb06d4a22447dbcee2aa799bde37628bee8c8367 | Triage

Analysis

max time kernel
46s
max time network
70s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 13:27

Sharing

Report Analysis Logs

General

Target

af1a0ca62b9b50e1cf078521cb06d4a22447dbcee2aa799bde37628bee8c8367.exe
Size

191KB
MD5

406f23756503f15865ac2bd2bf53df1d
SHA1

0a2229ec5e2db75e7e5d996bf1f439bb02a84a1b
SHA256

af1a0ca62b9b50e1cf078521cb06d4a22447dbcee2aa799bde37628bee8c8367
SHA512

775de0e130e65c0b89a22aaa2a88346547704d8a4e8bd1490c0632c81ddd69ea42737df5a811ef92d6dbf850524130073095abeaf648f4f8283e4d0cfd0f2470
SSDEEP

3072:HADWbKzKbQmSVdSme+xmJyD4BliqzsmmEpEmboQd+ccewkyeZyYPuvGCJ30EZ0d6:HAVySV1eY4k437d+4wkTHdS2i

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\af1a0ca62b9b50e1cf078521cb06d4a22447dbcee2aa799bde37628bee8c8367.exe
"C:\Users\Admin\AppData\Local\Temp\af1a0ca62b9b50e1cf078521cb06d4a22447dbcee2aa799bde37628bee8c8367.exe"
1⤵
PID:876

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/876-54-0x0000000075B11000-0x0000000075B13000-memory.dmp

Filesize
8KB

Download