6ffa425ef7a433138e4d24073db262df62ed5e85efa9ee2d2452d465e0a4b087 | Triage

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 17:43

Sharing

Report Analysis Logs

General

Target

6ffa425ef7a433138e4d24073db262df62ed5e85efa9ee2d2452d465e0a4b087.exe
Size

2.6MB
MD5

676fe13fe4f63b42aeddef1fff194150
SHA1

bb4b13c361071147f779bd13257c393fa9f19fd4
SHA256

6ffa425ef7a433138e4d24073db262df62ed5e85efa9ee2d2452d465e0a4b087
SHA512

fdb5d0249969bbf9264efd27cc67298a1f5d3957bd184b3f86a992b87bcaf247cdeaf2c84ff67b02cce969f18f8b713472aedebd5932a69c9132ad2fcf031ed4
SSDEEP

49152:YBzOLK0AozY51U6bKzVpl8oXzfYNH+kOSMiD2OLMRiHL/x6x5FwDJRzwfkiSsEiK:YBzOu0C06bKzTl8oXzfYAkUiDhdLEx5q

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\6ffa425ef7a433138e4d24073db262df62ed5e85efa9ee2d2452d465e0a4b087.exe
"C:\Users\Admin\AppData\Local\Temp\6ffa425ef7a433138e4d24073db262df62ed5e85efa9ee2d2452d465e0a4b087.exe"
1⤵
PID:812

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/812-54-0x0000000075131000-0x0000000075133000-memory.dmp

Filesize
8KB

Download