Overview

overview

10

Static

static

10

E-Invioce_23894.exe

windows7_x64

3

E-Invioce_23894.exe

windows10-2004_x64

3

Resubmissions

14-07-2022 15:43

220714-s5y61acbd2 10

13-06-2022 10:06

220613-l43dpsfedl 10

Analysis

  • max time kernel
    137s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    14-07-2022 15:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    E-Invioce_23894.exe

  • Size

    1.5MB

  • MD5

    350a4846873dece26848e64154d19a6d

  • SHA1

    fce16311dc6c14665ea167a28166d6bb19a8fa2d

  • SHA256

    56dd24957c30f559a8ff2daac9d648242e8189495d354bc93d7cbe6625596383

  • SHA512

    dcc6d69b6a503f0241b37a42c928fb3a6d5f4e34aeaf5997fd103e90021a23a40a4d5a9d6ca4646713dbc786668a0e32969590ea9eb2ec8f993b7d7848bed29d

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\E-Invioce_23894.exe
    "C:\Users\Admin\AppData\Local\Temp\E-Invioce_23894.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3404
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
      2⤵
        PID:3168

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Discovery

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3168-132-0x0000000000000000-mapping.dmp
      Download