49f41b35d66eb65322e9cab25ad1f43ffd8d0be408d8231089beb644319d7e8a | Triage

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
01-03-2023 04:44

Sharing

Report Analysis Logs

General

Target

49f41b35d66eb65322e9cab25ad1f43ffd8d0be408d8231089beb644319d7e8a.exe
Size

3.6MB
MD5

79a4a8ceab1770890b4e191b895cac35
SHA1

ce5be7e4e41e3996061a85a35936d2dc8cb49765
SHA256

49f41b35d66eb65322e9cab25ad1f43ffd8d0be408d8231089beb644319d7e8a
SHA512

dcc48639d15065d4282899901a7016b6f68ae32c094a4bab73e110bff6c25269c48210f5d357c35da343dd981f8262268455b53ae3c4d84df20678c54f07268d
SSDEEP

98304:5CGuAjlAZpDH1gHjEPsvCX3aUNyISIkbBKOCu97r:wGRWlVgJaX3aRIS5oOJr

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\49f41b35d66eb65322e9cab25ad1f43ffd8d0be408d8231089beb644319d7e8a.exe
"C:\Users\Admin\AppData\Local\Temp\49f41b35d66eb65322e9cab25ad1f43ffd8d0be408d8231089beb644319d7e8a.exe"
1⤵
PID:2036

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads