5ca39e95cc0a2e37e09e761798594ab168cf60b97c4351e68d7c3e8ed739166a | Triage

Analysis

max time kernel
395s
max time network
397s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
21-12-2022 23:52

Sharing

Report Analysis Logs

General

Target

cdccb18c253e2a4a7a4fbe59d4d0ed43a26f1de5abf61f95aa3091f4d298a1fe.exe
Size

282KB
MD5

abae19910a144bbaa6da3f40ff3af52c
SHA1

b899b325e4c23d3d06dbbaae782dc68cfec5901e
SHA256

cdccb18c253e2a4a7a4fbe59d4d0ed43a26f1de5abf61f95aa3091f4d298a1fe
SHA512

96ab5a666b63fc7ad4a3b35301d1c42d2a34a084085aab360ad216f6db54b66207b1351f78036bae78188dfb2c6776101e91332402defae997a1e30aafc371c3
SSDEEP

6144:fTt0EBLlxZLDXVlgGDv8RnhKOLOlF/KlZE//n/W:JDRZLDrtjMnVOlF/QEH+

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\cdccb18c253e2a4a7a4fbe59d4d0ed43a26f1de5abf61f95aa3091f4d298a1fe.exe
"C:\Users\Admin\AppData\Local\Temp\cdccb18c253e2a4a7a4fbe59d4d0ed43a26f1de5abf61f95aa3091f4d298a1fe.exe"
1⤵
PID:828

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/828-54-0x0000000074ED1000-0x0000000074ED3000-memory.dmp

Filesize
8KB

Download