4d490108ad315f4b035dade040fcafbcdf7dfcd6f2ba613cf33cf26f97a3781c | Triage

Analysis

max time kernel
46s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
22/12/2022, 07:09

Sharing

Report Analysis Logs

General

Target

4d490108ad315f4b035dade040fcafbcdf7dfcd6f2ba613cf33cf26f97a3781c.exe
Size

3.2MB
MD5

0f09e9f052f733a57de30f9391aaf763
SHA1

bdf0abe8b45b84490f7696e6a190284eecb86678
SHA256

4d490108ad315f4b035dade040fcafbcdf7dfcd6f2ba613cf33cf26f97a3781c
SHA512

5b68a827cec44ba4d42483a5953d4cdbb7e1c2fea609bce749ff399d2e0f00ff137236f232dee4c0d2c04d1d6a882283365ef79a7fd175875ed14725064b809c
SSDEEP

98304:NdJuMKDz2vWvMpnjFGanXa45qdshrM1Ih4:4MKDz2vuJar0

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\4d490108ad315f4b035dade040fcafbcdf7dfcd6f2ba613cf33cf26f97a3781c.exe
"C:\Users\Admin\AppData\Local\Temp\4d490108ad315f4b035dade040fcafbcdf7dfcd6f2ba613cf33cf26f97a3781c.exe"
1⤵
PID:1880

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1880-54-0x0000000075D71000-0x0000000075D73000-memory.dmp

Filesize
8KB

Download