cf098cad20faff92a4a2ad9a27eb02d86d61f03ce0b2eaa530427e3c16b3435a | Triage

Analysis

max time kernel
238s
max time network
336s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 02:37

Sharing

Report Analysis Logs

General

Target

cf098cad20faff92a4a2ad9a27eb02d86d61f03ce0b2eaa530427e3c16b3435a.exe
Size

95KB
MD5

e374e9ac96922cf7659dd7cd7e3de062
SHA1

731d5b50f3ff08d742dc74391f5b75fc00ab79d1
SHA256

cf098cad20faff92a4a2ad9a27eb02d86d61f03ce0b2eaa530427e3c16b3435a
SHA512

4e096cf47e47cc02a004b6b1fba51cf9afb5ec25775031344bf80f48f308b66c3ca223e7e8d39ab726fe81a85f81b6a7731700343e8ebfcd567e8aca2dae9fd3
SSDEEP

1536:xPx/CJAmx2/W5Ebnto4tmJTFDgGXt4qnSNd0i9K266ITHXKXiA:tx6UW6tpmJhDXdZd41ITHXIF

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\cf098cad20faff92a4a2ad9a27eb02d86d61f03ce0b2eaa530427e3c16b3435a.exe
"C:\Users\Admin\AppData\Local\Temp\cf098cad20faff92a4a2ad9a27eb02d86d61f03ce0b2eaa530427e3c16b3435a.exe"
1⤵
PID:692

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/692-54-0x0000000074E61000-0x0000000074E63000-memory.dmp

Filesize
8KB

Download