56dd24957c30f559a8ff2daac9d648242e8189495d354bc93d7cbe6625596383

Resubmissions

14-07-2022 15:43

13-06-2022 10:06

Target

E-Invioce_23894.exe
Size

1.5MB
MD5

350a4846873dece26848e64154d19a6d
SHA1

fce16311dc6c14665ea167a28166d6bb19a8fa2d
SHA256

56dd24957c30f559a8ff2daac9d648242e8189495d354bc93d7cbe6625596383
SHA512

dcc6d69b6a503f0241b37a42c928fb3a6d5f4e34aeaf5997fd103e90021a23a40a4d5a9d6ca4646713dbc786668a0e32969590ea9eb2ec8f993b7d7848bed29d

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

E-Invioce_23894.exe

pid process

2896 E-Invioce_23894.exe
2896 E-Invioce_23894.exe
2896 E-Invioce_23894.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

E-Invioce_23894.exe

description	pid	process	target process
PID 2896 wrote to memory of 1324	2896	E-Invioce_23894.exe	cmd.exe
PID 2896 wrote to memory of 1324	2896	E-Invioce_23894.exe	cmd.exe
PID 2896 wrote to memory of 1324	2896	E-Invioce_23894.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\E-Invioce_23894.exe
"C:\Users\Admin\AppData\Local\Temp\E-Invioce_23894.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  PID:1324

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact