b23cb04afe59fee16c95ef5d24a67cb493d4ea88b62f6996e54493548acad6c2 | Triage

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01-01-2024 15:27

Sharing

Report Analysis Logs

General

Target

7e41197b74e2dcc6c0563d4b71a4ad16293909889ce4f1c5ab214bdd59088667.exe
Size

153KB
MD5

91e890f3e0f1f456486445816797a221
SHA1

244741c1514206d953d5d4767fd0c3dd48cfc6d7
SHA256

7e41197b74e2dcc6c0563d4b71a4ad16293909889ce4f1c5ab214bdd59088667
SHA512

c91287ea947bc43a7c1d54028e487e8df88b4cbce07e0c607fa35d6849189b4f2efb472b1cc80bc2668ff7e9553d28e852a021c8cccd551ecb3d6b1db0e36f5d
SSDEEP

768:oS+1pDY5Kp+ByAAAAAAAAAAAAAAAAAAAAzAAAAAAAAAAAAAAAHtAAAAAAAAAAAA3:b+1pc0sB5QV0TGE

Score

9^/10

ransomware spyware stealer

Malware Config

Signatures

Renames multiple (66) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

C:\Users\Admin\AppData\Local\Temp\7e41197b74e2dcc6c0563d4b71a4ad16293909889ce4f1c5ab214bdd59088667.exe
"C:\Users\Admin\AppData\Local\Temp\7e41197b74e2dcc6c0563d4b71a4ad16293909889ce4f1c5ab214bdd59088667.exe"
1⤵
PID:3012

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3012-0-0x0000000000A50000-0x0000000000A7C000-memory.dmp

Filesize
176KB

Download
memory/3012-1-0x000007FEF51D0000-0x000007FEF5BBC000-memory.dmp

Filesize
9.9MB

Download
memory/3012-2-0x000000001ACC0000-0x000000001AD40000-memory.dmp

Filesize
512KB

Download
memory/3012-135-0x000007FEF51D0000-0x000007FEF5BBC000-memory.dmp

Filesize
9.9MB

Download
memory/3012-136-0x000000001ACC0000-0x000000001AD40000-memory.dmp

Filesize
512KB

Download
memory/3012-137-0x000000001ACC0000-0x000000001AD40000-memory.dmp

Filesize
512KB

Download
memory/3012-138-0x000000001ACC0000-0x000000001AD40000-memory.dmp

Filesize
512KB

Download