Analysis
-
max time kernel
25s -
max time network
47s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
15-05-2021 14:41
General
-
Target
62ee56badb9240aeb1e5b6e6256e0e1bfc5314f2a0c9d8b816d022c6955fab2b.exe
-
Size
768KB
-
MD5
87eb0ff2fac6f376f08047aedc54691e
-
SHA1
4e2bfe1433bdd0d1b52de35d631560479bb52746
-
SHA256
62ee56badb9240aeb1e5b6e6256e0e1bfc5314f2a0c9d8b816d022c6955fab2b
-
SHA512
aca36e77d5045a834898879a2a969a09503211914e8f9916bd2daa5a72ca4097591329b3ed68b1509ce37771d4945a0afa74b12dea84b32f4d29b8730720f6a8
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\62ee56badb9240aeb1e5b6e6256e0e1bfc5314f2a0c9d8b816d022c6955fab2b.exe"C:\Users\Admin\AppData\Local\Temp\62ee56badb9240aeb1e5b6e6256e0e1bfc5314f2a0c9d8b816d022c6955fab2b.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\~87eb0ff2.exe"C:\Users\Admin\AppData\Local\Temp\~87eb0ff2.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB