1d2dba6696ae5df9e82e04526ed955a6b8320b5911bc439e53a1e9df7b320132 | Triage

Analysis

max time kernel
17s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 18:28

Sharing

Report Analysis Logs

General

Target

1d2dba6696ae5df9e82e04526ed955a6b8320b5911bc439e53a1e9df7b320132.exe
Size

2.5MB
MD5

e5cdddf30dfd4c70bd844ed3ca586d5f
SHA1

7fbc2c4dfefd4df2c871739d01718f3a50a46bd1
SHA256

1d2dba6696ae5df9e82e04526ed955a6b8320b5911bc439e53a1e9df7b320132
SHA512

df4684d030b0eefdf5e6c5f4f0f5dab5ee52d69121c3529684060caf98719a4ad71b7469233d63569a5eac0bb376a20d5a263c74576b1edd53a6bf01d50e56f1
SSDEEP

49152:t/l25/4+ijJwUClHginlzau61hKt+S7C7MoMrqXYJatpchrxDVidJJ3:tdAw+i+TA+lzau61hQ+24FMrqYatahfg

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\1d2dba6696ae5df9e82e04526ed955a6b8320b5911bc439e53a1e9df7b320132.exe
"C:\Users\Admin\AppData\Local\Temp\1d2dba6696ae5df9e82e04526ed955a6b8320b5911bc439e53a1e9df7b320132.exe"
1⤵
PID:1252

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1252-54-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download