169b591d42ac6dac4d0c5b803e6c4edcab60608f0983a8334339857e4a7588ee | Triage

Analysis

max time kernel
38s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
16-01-2023 22:38

Sharing

Report Analysis Logs

General

Target

169b591d42ac6dac4d0c5b803e6c4edcab60608f0983a8334339857e4a7588ee.exe
Size

216KB
MD5

509a790f29b511f6da99dab521f82b4f
SHA1

af60c982d11400133e1d6bde8face07ac7133949
SHA256

169b591d42ac6dac4d0c5b803e6c4edcab60608f0983a8334339857e4a7588ee
SHA512

8ddc94e9cf41e9fa693a0a72b6847e5b925ce9ac28be646cfb6824d8709c53ba3012dc19774e01888aeacf35f2b57331b417b4be02d3f3cc4f7dadbf0c761720
SSDEEP

6144:E3hqLCa8aAYFHHHHHHHHHHv8BVBb9aAxAYD7xTBegDHqnFD873K7UzB:E3zCFHHHHHHHHHHvCBb9ZJf/egDbFB

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\169b591d42ac6dac4d0c5b803e6c4edcab60608f0983a8334339857e4a7588ee.exe
"C:\Users\Admin\AppData\Local\Temp\169b591d42ac6dac4d0c5b803e6c4edcab60608f0983a8334339857e4a7588ee.exe"
1⤵
PID:1980

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1980-54-0x00000000754E1000-0x00000000754E3000-memory.dmp

Filesize
8KB

Download