249a372ea680944104fed1127a91ef50413df0b9a9496f7040125440c44817d0 | Triage

Analysis

max time kernel
28s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
15/04/2023, 18:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

249a372ea680944104fed1127a91ef50413df0b9a9496f7040125440c44817d0.exe
Size

3.2MB
MD5

cef2ee5fe3def59d3d206dec103a4dd9
SHA1

7ef7580ab782b364d12e3900acd9b4ab99dcb4f3
SHA256

249a372ea680944104fed1127a91ef50413df0b9a9496f7040125440c44817d0
SHA512

f0a7d30078ee51bc0ebc2970c1c30a395830d27e614bb791dc903bc8b08f0ad6e39730d2a4577052a8f07a15e2586b65495af8ef9a0fb80acc10f2c6b65e9ea4
SSDEEP

98304:UEXBhBUUUUUUUUEtDR1h5qXVIcdw5GR3VO9mKa6rNIsz3zWXOh0TDVy7pfNs:GP0FZR3VOM56rysz3zW+WDVy9fa

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\249a372ea680944104fed1127a91ef50413df0b9a9496f7040125440c44817d0.exe
"C:\Users\Admin\AppData\Local\Temp\249a372ea680944104fed1127a91ef50413df0b9a9496f7040125440c44817d0.exe"
1⤵
PID:1596

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads