e2b976d66322346913addd07ad3166734d7dd11997d1974781484acfebaa2036

Analysis

max time kernel
151s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 13:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e2b976d66322346913addd07ad3166734d7dd11997d1974781484acfebaa2036.exe
Size

48KB
MD5

d7a2bd9ac894338d660926fdbdbde702
SHA1

f3377bf05a6b7a0f4e29a826839de5910e903877
SHA256

e2b976d66322346913addd07ad3166734d7dd11997d1974781484acfebaa2036
SHA512

60998b8bca18d9160b59c8bfa8c5359888f9b776af58a8101c3e63c5dfbba33671e4e7378fce7e4dbe9f548f49abd8194da6a9c5d56d5542c5d0e69f803f23f3
SSDEEP

768:hXHQB+04j2V5y/zDvnVoQoiFhXXeFKZGodFz9dfALEvRW9Hxb/D2CX9S+izEG:hzLXvnVoQLxXegZu1Jr0r

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database	e2b976d66322346913addd07ad3166734d7dd11997d1974781484acfebaa2036.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Charset	e2b976d66322346913addd07ad3166734d7dd11997d1974781484acfebaa2036.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Codepage	e2b976d66322346913addd07ad3166734d7dd11997d1974781484acfebaa2036.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
900	e2b976d66322346913addd07ad3166734d7dd11997d1974781484acfebaa2036.exe

C:\Users\Admin\AppData\Local\Temp\e2b976d66322346913addd07ad3166734d7dd11997d1974781484acfebaa2036.exe
"C:\Users\Admin\AppData\Local\Temp\e2b976d66322346913addd07ad3166734d7dd11997d1974781484acfebaa2036.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:900

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/900-56-0x0000000076121000-0x0000000076123000-memory.dmp

Filesize
8KB

Download