e4e1d121e95ab52e36678103bf37808d1c7758b81db12ea1c6129c3ca57610da

Analysis

max time kernel
43s
max time network
47s
platform
windows7_x64
resource
win7-20220414-en
submitted
08/05/2022, 15:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e4e1d121e95ab52e36678103bf37808d1c7758b81db12ea1c6129c3ca57610da.exe
Size

1.3MB
MD5

7631dedd207e6f7d0e0ca5e451651eb6
SHA1

335924463afcdf55958a4f5e20d50143261f0306
SHA256

e4e1d121e95ab52e36678103bf37808d1c7758b81db12ea1c6129c3ca57610da
SHA512

9ae5b1969f5a5fd4fb1592e99ad7530e5c962f4926c190b4122317f4beb92a1511e0c2e55db0dc7ce5261518a1fa88a9b23cbbdbca4db63d92690c3627b6158e

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1652	e4e1d121e95ab52e36678103bf37808d1c7758b81db12ea1c6129c3ca57610da.exe
1652	e4e1d121e95ab52e36678103bf37808d1c7758b81db12ea1c6129c3ca57610da.exe
1652	e4e1d121e95ab52e36678103bf37808d1c7758b81db12ea1c6129c3ca57610da.exe
1652	e4e1d121e95ab52e36678103bf37808d1c7758b81db12ea1c6129c3ca57610da.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 2044	1652	e4e1d121e95ab52e36678103bf37808d1c7758b81db12ea1c6129c3ca57610da.exe	29
PID 1652 wrote to memory of 2044	1652	e4e1d121e95ab52e36678103bf37808d1c7758b81db12ea1c6129c3ca57610da.exe	29
PID 1652 wrote to memory of 2044	1652	e4e1d121e95ab52e36678103bf37808d1c7758b81db12ea1c6129c3ca57610da.exe	29
PID 1652 wrote to memory of 2044	1652	e4e1d121e95ab52e36678103bf37808d1c7758b81db12ea1c6129c3ca57610da.exe	29

C:\Users\Admin\AppData\Local\Temp\e4e1d121e95ab52e36678103bf37808d1c7758b81db12ea1c6129c3ca57610da.exe
"C:\Users\Admin\AppData\Local\Temp\e4e1d121e95ab52e36678103bf37808d1c7758b81db12ea1c6129c3ca57610da.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  PID:2044

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1652-57-0x00000000752B1000-0x00000000752B3000-memory.dmp

Filesize
8KB

Download