f1b506a365f630be0d8d34d877a6f2bb83331cc4022f4e875547dd7af8ba94f7 | Triage

Analysis

max time kernel
12s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 17:03

Sharing

Report Analysis Logs

General

Target

f1b506a365f630be0d8d34d877a6f2bb83331cc4022f4e875547dd7af8ba94f7.exe
Size

777KB
MD5

036d8a0aceb9c7b38ea13fa8a204f470
SHA1

321f6e9e4c21841b5d6836f6840163523aebaae4
SHA256

f1b506a365f630be0d8d34d877a6f2bb83331cc4022f4e875547dd7af8ba94f7
SHA512

ab4d082deb1b9e7099a90da207033601306b242a44ba372cc79d81d113af6e4c6d4d7eeb54ff17e580ff28c39af3dbad0d4c38996d6ddf7b90c9c4a183f3e5d9
SSDEEP

12288:0Lkcoxg7v3qnC11ErwIhh0F4qwUgUny5QPC+qRHk:qfmMv6Ckr7Mny5QanHk

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\f1b506a365f630be0d8d34d877a6f2bb83331cc4022f4e875547dd7af8ba94f7.exe
"C:\Users\Admin\AppData\Local\Temp\f1b506a365f630be0d8d34d877a6f2bb83331cc4022f4e875547dd7af8ba94f7.exe"
1⤵
PID:1808

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1808-54-0x0000000075991000-0x0000000075993000-memory.dmp

Filesize
8KB

Download