991230ea25273a6ba693baa5ebfeb8442ba6699a6a5da1150554716565de07df | Triage

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-01-2023 18:49

Sharing

Report Analysis Logs

General

Target

991230ea25273a6ba693baa5ebfeb8442ba6699a6a5da1150554716565de07df.exe
Size

15.3MB
MD5

7dfde84c1349b61caddc2d2559f21e56
SHA1

b509ef4e1e59aa4d27b2862417611b3dff7adfa1
SHA256

991230ea25273a6ba693baa5ebfeb8442ba6699a6a5da1150554716565de07df
SHA512

c10b30d8e39b40b8b8923c6f01b03f95ae8f35f468a97bed961df3f87e557d41f2916f9e4a3f292c4242eaf9370128483f8a9e1f000926138812971202e9bc98
SSDEEP

393216:IeOcs5jfLUKIUfgAOFuAXGNQ6aayrHQ18kJezoieZTbXaS:IzcoDRIa9Yr67mkJ9i0KS

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\991230ea25273a6ba693baa5ebfeb8442ba6699a6a5da1150554716565de07df.exe
"C:\Users\Admin\AppData\Local\Temp\991230ea25273a6ba693baa5ebfeb8442ba6699a6a5da1150554716565de07df.exe"
1⤵
PID:1780

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1780-54-0x00000000762F1000-0x00000000762F3000-memory.dmp

Filesize
8KB

Download