437ed32057191c8f46d933230b1dc625508ea108850f6c7c77a949c9b2509ac7 | Triage

Analysis

max time kernel
43s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
15/02/2023, 19:38

Sharing

Report Analysis Logs

General

Target

437ed32057191c8f46d933230b1dc625508ea108850f6c7c77a949c9b2509ac7.exe
Size

1.3MB
MD5

19afc1f196eb5c944155ec5575438113
SHA1

f9d9a27e93c8a0f53475a16e218949ce670bc703
SHA256

437ed32057191c8f46d933230b1dc625508ea108850f6c7c77a949c9b2509ac7
SHA512

84da954f567fa2f5d824842c233a270bddbacac18fc13746ba1c312680895adb43daab27238e360e183b052f0ccd747227b83b68baba5efc9f9dacd38fcf62ab
SSDEEP

24576:m8AZQEh0fXF8FitYL/+Zf694Y2U9u5bW4hsPpGZ7UDo+H:qQ9fZtYbQu2ZaMsPYZWo+H

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\437ed32057191c8f46d933230b1dc625508ea108850f6c7c77a949c9b2509ac7.exe
"C:\Users\Admin\AppData\Local\Temp\437ed32057191c8f46d933230b1dc625508ea108850f6c7c77a949c9b2509ac7.exe"
1⤵
PID:1968

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1968-54-0x0000000075141000-0x0000000075143000-memory.dmp

Filesize
8KB

Download
memory/1968-55-0x0000000000400000-0x0000000000820000-memory.dmp

Filesize
4.1MB

Download
memory/1968-57-0x0000000000400000-0x0000000000820000-memory.dmp

Filesize
4.1MB

Download
memory/1968-56-0x0000000000400000-0x0000000000820000-memory.dmp

Filesize
4.1MB

Download
memory/1968-58-0x0000000000400000-0x0000000000820000-memory.dmp

Filesize
4.1MB

Download
memory/1968-59-0x0000000000400000-0x0000000000820000-memory.dmp

Filesize
4.1MB

Download
memory/1968-60-0x0000000000400000-0x0000000000820000-memory.dmp

Filesize
4.1MB

Download