Extracted

• • Target

    emotet_e2_4de1c4143ae99fd06eec658e5c44de43c165410d78622490b2ffa406a9f66496_2021-01-22__173322307678._doc

  • Size

    173KB

  • MD5

    b8bddc646fa12858d523a03271f5f820

  • SHA1

    a1a567c6b4a5a5e6cd4bfca67a2575c468a256a4

  • SHA256

    4de1c4143ae99fd06eec658e5c44de43c165410d78622490b2ffa406a9f66496

  • SHA512

    209ea8151970b70ede48578c5110e40291cebbac41f4093786417f4e0071cd967250f0a104dd7ca3a921f1f4935b0d6bf8ca447928533dff6d2f00b4dc516400

  Score

  10^/10

  ransomware

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Enumerates physical storage devices

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    ransomware
  behavioral1