951834f472259cb4090f518104d958e2aed027e197c2a55792127c2ad8007c13 | Triage

Analysis

max time kernel
153s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 23:05

Sharing

Report Analysis Logs

General

Target

951834f472259cb4090f518104d958e2aed027e197c2a55792127c2ad8007c13.exe
Size

207KB
MD5

05de535daf0e69905d34cfae37fba4b7
SHA1

f39d5784a4821e1452493793d49737610e036017
SHA256

951834f472259cb4090f518104d958e2aed027e197c2a55792127c2ad8007c13
SHA512

845256882bcc8ac60c330ed374bc8e41e099e20e3c3ff0d2b0e78b5c1431cb96b189b65d795ab96fcea0ec27690d053ee684123b2b436882cc077c96143b99c0
SSDEEP

6144:Ywrsev0/dWhPZvOIzQC+3HfJEjZxBUhDGLuX:NPkdQzy3/JEjjBUY8

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\951834f472259cb4090f518104d958e2aed027e197c2a55792127c2ad8007c13.exe
"C:\Users\Admin\AppData\Local\Temp\951834f472259cb4090f518104d958e2aed027e197c2a55792127c2ad8007c13.exe"
1⤵
PID:1876

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1876-54-0x00000000752B1000-0x00000000752B3000-memory.dmp

Filesize
8KB

Download