4f7e27d350a6d074aa0edebef2b9fe29a8d75f641dad5eab8eb879ffdc6e6ef0 | Triage

Analysis

max time kernel
43s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
14/02/2023, 20:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4f7e27d350a6d074aa0edebef2b9fe29a8d75f641dad5eab8eb879ffdc6e6ef0.exe
Size

16.4MB
MD5

ca576ed78d4d14ce10abae46a620d527
SHA1

a12ae38c48cbf58e2f1e0d36b98e29ce4bc33a9b
SHA256

4f7e27d350a6d074aa0edebef2b9fe29a8d75f641dad5eab8eb879ffdc6e6ef0
SHA512

fe5c60b15cda484f7a74ea6678883116a5de81584b7add75475b4407118a81258e86f5e79a21f551557c9d04062638b0501b87918a90073c10635bbe7c985b18
SSDEEP

393216:pmZ7y4Dqoaqn07MVk8lV21PlI+fgL2BbaHGnY3MqvXmSvp770uU:pmZ7J3lV21PffDxaHGY750d

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\4f7e27d350a6d074aa0edebef2b9fe29a8d75f641dad5eab8eb879ffdc6e6ef0.exe
"C:\Users\Admin\AppData\Local\Temp\4f7e27d350a6d074aa0edebef2b9fe29a8d75f641dad5eab8eb879ffdc6e6ef0.exe"
1⤵
PID:1768

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1768-54-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download