04f007d28db6b3c9c09d3fe9663854936276f6e83a1ae7b272a111a596a2bdf7 | Triage

Analysis

max time kernel
115s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
09/01/2023, 19:47

Sharing

Report Analysis Logs

General

Target

04f007d28db6b3c9c09d3fe9663854936276f6e83a1ae7b272a111a596a2bdf7.exe
Size

13.0MB
MD5

69b530e969b066abeb84993eafe79fbc
SHA1

c68aefa884f8cf76ba095a79db2d1df99b78c0c8
SHA256

04f007d28db6b3c9c09d3fe9663854936276f6e83a1ae7b272a111a596a2bdf7
SHA512

0daaaf8d2188297d8181e692a12cb7c3fc1e88ad9e5be0ae291123dce450503434aa27ab918aec4adde655a2bea45d9150bb5f653da7d4d9f3f2cb46fb94ac84
SSDEEP

393216:EvrQjlv9hLJepwch9ZwTtjT0EXRh+nmLlfvrjePYPA:EvrclkwZv0QOAfOAI

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\04f007d28db6b3c9c09d3fe9663854936276f6e83a1ae7b272a111a596a2bdf7.exe
"C:\Users\Admin\AppData\Local\Temp\04f007d28db6b3c9c09d3fe9663854936276f6e83a1ae7b272a111a596a2bdf7.exe"
1⤵
PID:1716

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads