Extracted

• • Target

    emotet_e2_98d8a069e31ddf52bebf1318faf2efcd49c1664d4735b9076ca64e8f62f94e71_2021-01-22__162121484010._doc

  • Size

    174KB

  • MD5

    3419a2357bfe1a1df94afb932341545e

  • SHA1

    f1ec5e5dc56472ab7f62155bf91cccba35851e8a

  • SHA256

    98d8a069e31ddf52bebf1318faf2efcd49c1664d4735b9076ca64e8f62f94e71

  • SHA512

    1e9b2284455448620383b69fca5dfed8902aa28b4e9b7a67adbd78083a98e5defd7d09fe84965d045eb97257de5b717b5a3a4fc58801b9617bab4266146e926a

  Score

  10^/10

  ransomware

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Enumerates physical storage devices

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    ransomware
  behavioral1