Extracted

• • Target

    emotet_e2_b77758a7936af2b7c6b3df9fc45475ca411a9cfaae447bd97a2ab3b8d60aa160_2021-01-21__053335189093._fpx

  • Size

    165KB

  • MD5

    e6ab02ec9b6cd4e06af335fa8731596a

  • SHA1

    8f73e04c1ad3e5227a9a758ffe863c527a1d6874

  • SHA256

    b77758a7936af2b7c6b3df9fc45475ca411a9cfaae447bd97a2ab3b8d60aa160

  • SHA512

    00eb4fe50cc0e12fc6b5aad99f0a60975a8bb9282361e7b3027be43dd59c789c39a838e0ff79edcc5041c3d1b80214235c4e315791f2880afe2a2c27aab1ac4b

  Score

  10^/10

  ransomware

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Enumerates physical storage devices

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    ransomware
  behavioral1