e64dc8b80b5d447b520f557781acb0b3d539c92e6919de4b376ef1cca9af953a

Analysis

max time kernel
148s
max time network
152s
platform
windows10_x64
resource
win10-en-20210920
submitted
30-09-2021 12:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e64dc8b80b5d447b520f557781acb0b3d539c92e6919de4b376ef1cca9af953a.exe
Size

385KB
MD5

22efb002ff6995db833e92bc0e151613
SHA1

fe78c82bf566f4c54b32474917b13b66ef1c11ff
SHA256

e64dc8b80b5d447b520f557781acb0b3d539c92e6919de4b376ef1cca9af953a
SHA512

7218abb399f75d81bf0eb5bd41f62eb5ba648632ea49818598791ccdff002fb4770214c0efd08517faa3d622ac8ababbeb1e50e5768787f2988c2eeb9a5c3202

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

e64dc8b80b5d447b520f557781acb0b3d539c92e6919de4b376ef1cca9af953a.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings	e64dc8b80b5d447b520f557781acb0b3d539c92e6919de4b376ef1cca9af953a.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

3572 OpenWith.exe

pid	process
3572	OpenWith.exe

C:\Users\Admin\AppData\Local\Temp\e64dc8b80b5d447b520f557781acb0b3d539c92e6919de4b376ef1cca9af953a.exe
"C:\Users\Admin\AppData\Local\Temp\e64dc8b80b5d447b520f557781acb0b3d539c92e6919de4b376ef1cca9af953a.exe"
1⤵
- Modifies registry class
PID:300

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3572

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/300-115-0x0000000000950000-0x00000000009FE000-memory.dmp

Filesize
696KB

Download