Overview

overview

8

Static

static

1

e1d6b8def3...8e.exe

windows7-x64

8

e1d6b8def3...8e.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    3s
  • max time network
    77s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    29/10/2022, 06:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e1d6b8def3e348b1a43f5a384c73613d1b059ea06226371baa7d7ccdd1e9738e.exe

  • Size

    1.2MB

  • MD5

    d1f37749bc4c75fe8eca6c8f93d1bd29

  • SHA1

    9ff30d97a575ed1559502693b1b95df67f114519

  • SHA256

    e1d6b8def3e348b1a43f5a384c73613d1b059ea06226371baa7d7ccdd1e9738e

  • SHA512

    077bbfbf80cd882274234d0e6628669e97821dcb097e9f2a12b4b301b2f574dc8c5b8e4986b6b2d96b99d220776cfcab1158c44aade5f975ecb64de85fe8343d

  • SSDEEP

    24576:DOfTv4IgjnkvYmOtM4HaASz8S8TsR5IdGTupGypUE0dwiO:KTQIgTmF4HaD8gRGYTcGyFzr

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

Processes

  • C:\Users\Admin\AppData\Local\Temp\e1d6b8def3e348b1a43f5a384c73613d1b059ea06226371baa7d7ccdd1e9738e.exe
    "C:\Users\Admin\AppData\Local\Temp\e1d6b8def3e348b1a43f5a384c73613d1b059ea06226371baa7d7ccdd1e9738e.exe"
    1⤵
      PID:1912

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \Users\Admin\AppData\Local\Temp\nse916A.tmp\D1989.dll
      Filesize

      14KB

      MD5

      904beebec2790ee2ca0c90fc448ac7e0

      SHA1

      40fabf1eb0a3b7168351c4514c5288216cb1566d

      SHA256

      f730d9385bf72eac5d579bcf1f7e4330f1d239ca1054d4ead48e9e363d9f4222

      SHA512

      8bdbbaaf73e396cf9fd9866b3e824b7e70c59a2bdefdb3236387e60d0e645d011265fe79fb193f6c0d6abe2e9c01260720c71cd8f068fcc4624760511c54efaa

      Download Submit

    • \Users\Admin\AppData\Local\Temp\nse916A.tmp\System.dll
      Filesize

      11KB

      MD5

      a436db0c473a087eb61ff5c53c34ba27

      SHA1

      65ea67e424e75f5065132b539c8b2eda88aa0506

      SHA256

      75ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49

      SHA512

      908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d

      Download Submit

    • memory/1912-54-0x0000000076031000-0x0000000076033000-memory.dmp

      Filesize

      8KB

      Download