7e0aea360d1ce3a8c743ad6225421dd97a95d2192c67156b8b03a89ae3de10af | Triage™

Login
Reports

Overview

overview

9

Static

static

3

7e0aea360d...af.exe

windows10-2004-x64

9

7e0aea360d...af.exe

windows11-ltsc_2024-x64

8

Sharing

Copy URL Twitter E-mail

General

Target
7e0aea360d1ce3a8c743ad6225421dd97a95d2192c67156b8b03a89ae3de10af
Size 3.9MB
Sample260728-kz6pwsshqb
SHA256 7e0aea360d1ce3a8c743ad6225421dd97a95d2192c67156b8b03a89ae3de10af
MD5 19bfa1ff7d9426ea2d8042d19739f9d2
SHA1 91831e1b7d1053919e278c99ddebbcbe1540ba04
SHA512 a325bc1634382bbae1efe24585172d2a172bd18fb4860cc31f7a8f1956f33f059ce0f9c6a83c677a30c5d74d604137a1dbedb23431d95e47a239a9a7f5b0c123
SSDEEP 98304:HSbhsC0JipTUBCrl9ebNqXRRmICj2UgpfOL36aEfEoaBYs:HSbhsC0JipTUBCrl9ebNCmIC6UgAP
TLSH
T1B716E94365DB0CE9CDD6E7B4A1C76236A734BD66CA391F3A9704CA312D537C1A92EB00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence privilege_escalation ransomware

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

7e0aea360d1ce3a8c743ad6225421dd97a95d2192c67156b8b03a89ae3de10af.exe

Resource

win10v2004-20260513-en

windows10-2004-x64

14 signatures

150 seconds

defense_evasion discovery execution persistence privilege_escalation ransomware

Behavioral task

behavioral2

Sample

7e0aea360d1ce3a8c743ad6225421dd97a95d2192c67156b8b03a89ae3de10af.exe

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

13 signatures

150 seconds

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Targets

- Target
  7e0aea360d1ce3a8c743ad6225421dd97a95d2192c67156b8b03a89ae3de10af
- Size 3.9MB
- SHA256 7e0aea360d1ce3a8c743ad6225421dd97a95d2192c67156b8b03a89ae3de10af
- MD5 19bfa1ff7d9426ea2d8042d19739f9d2
- SHA1 91831e1b7d1053919e278c99ddebbcbe1540ba04
- SHA512 a325bc1634382bbae1efe24585172d2a172bd18fb4860cc31f7a8f1956f33f059ce0f9c6a83c677a30c5d74d604137a1dbedb23431d95e47a239a9a7f5b0c123
- SSDEEP 98304:HSbhsC0JipTUBCrl9ebNqXRRmICj2UgpfOL36aEfEoaBYs:HSbhsC0JipTUBCrl9ebNCmIC6UgAP
- TLSH
  T1B716E94365DB0CE9CDD6E7B4A1C76236A734BD66CA391F3A9704CA312D537C1A92EB00
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution persistence privilege_escalation ransomware
- Renames multiple (58) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Modifies Windows Firewall
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Network Service Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Network Connections Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomware

behavioral2

defense_evasiondiscoveryexecutionpersistenceprivilege_escalation

© 2018-2026

Terms | Privacy