437ed32057191c8f46d933230b1dc625508ea108850f6c7c77a949c9b2509ac7 | Triage

Analysis

max time kernel
88s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
15-02-2023 19:38

Sharing

Report Analysis Logs

General

Target

437ed32057191c8f46d933230b1dc625508ea108850f6c7c77a949c9b2509ac7.exe
Size

1.3MB
MD5

19afc1f196eb5c944155ec5575438113
SHA1

f9d9a27e93c8a0f53475a16e218949ce670bc703
SHA256

437ed32057191c8f46d933230b1dc625508ea108850f6c7c77a949c9b2509ac7
SHA512

84da954f567fa2f5d824842c233a270bddbacac18fc13746ba1c312680895adb43daab27238e360e183b052f0ccd747227b83b68baba5efc9f9dacd38fcf62ab
SSDEEP

24576:m8AZQEh0fXF8FitYL/+Zf694Y2U9u5bW4hsPpGZ7UDo+H:qQ9fZtYbQu2ZaMsPYZWo+H

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\437ed32057191c8f46d933230b1dc625508ea108850f6c7c77a949c9b2509ac7.exe
"C:\Users\Admin\AppData\Local\Temp\437ed32057191c8f46d933230b1dc625508ea108850f6c7c77a949c9b2509ac7.exe"
1⤵
PID:4712

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4712-132-0x0000000000400000-0x0000000000820000-memory.dmp

Filesize
4.1MB

Download
memory/4712-133-0x0000000000400000-0x0000000000820000-memory.dmp

Filesize
4.1MB

Download
memory/4712-134-0x0000000000400000-0x0000000000820000-memory.dmp

Filesize
4.1MB

Download
memory/4712-135-0x0000000000400000-0x0000000000820000-memory.dmp

Filesize
4.1MB

Download
memory/4712-136-0x0000000000400000-0x0000000000820000-memory.dmp

Filesize
4.1MB

Download