544a6b77b4800f460e60fc88530fd1fc7daeb90bfa4f22ccf3b3ed4cab35e6e5 | Triage

Analysis

max time kernel
30s
max time network
18s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
03/04/2023, 17:53

Sharing

Report Analysis Logs

General

Target

simsetup.exe
Size

1.5MB
MD5

91b5973ce77948260b44bc8a5afcae2a
SHA1

f79ee83009330c2e1d33564c5b2681553f35520d
SHA256

544a6b77b4800f460e60fc88530fd1fc7daeb90bfa4f22ccf3b3ed4cab35e6e5
SHA512

eefb77220e3b6a22d93257a34d6125fecf75f4a98df8e2ad3c50c12e82bb5675b1342ef2de377f330688ecbfd46ea2144bb5e34c52ec79360f202351b0ce3d71
SSDEEP

24576:pAT8QE+kz+2B0R57j/hMFgQCs4jW+5n8nxy4Y7HHxUSj5YaSU6Aqw7rAMxPf4iiR:pAI+H/7FbPW+OneUqUwkMxPf+Zojs

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\simsetup.exe
"C:\Users\Admin\AppData\Local\Temp\simsetup.exe"
1⤵
PID:2156

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2156-144-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download