595bf86c3a2a669ac1ef49ddb10dba032eb90e8860803ddd6a842bd50458b41c | Triage

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28-12-2022 09:22

Sharing

Report Analysis Logs

General

Target

Trojan.MSIL.Starter.ak-595bf86c3a2a669ac1ef49ddb10dba032eb90e8860803ddd6a842bd50458b41c.exe
Size

7KB
MD5

293ae4fbc6b1b702ab86aa1c34833183
SHA1

3cbc034d2ab15ad82fd5b632b972dacf9ab8a76b
SHA256

595bf86c3a2a669ac1ef49ddb10dba032eb90e8860803ddd6a842bd50458b41c
SHA512

0fc82f571ab531e823edfcddd205ef8b270b90f2da514afe79d4b2bf3b6c2729e6ebab92af1c7fd074a1f09beb90b9b14ce3b75ff96ba800e8a7863ac5087d1f
SSDEEP

192:70+3iguNZSWSPECVyWnlYJLLLTTWnPsT+uD:70+SgISPECAjPLTVT+y

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\Trojan.MSIL.Starter.ak-595bf86c3a2a669ac1ef49ddb10dba032eb90e8860803ddd6a842bd50458b41c.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan.MSIL.Starter.ak-595bf86c3a2a669ac1ef49ddb10dba032eb90e8860803ddd6a842bd50458b41c.exe"
1⤵
PID:1644

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1644-55-0x000007FEEDDC0000-0x000007FEEEE56000-memory.dmp

Filesize
16.6MB

Download
memory/1644-56-0x000007FEFB881000-0x000007FEFB883000-memory.dmp

Filesize
8KB

Download