ea3bb0089bb6ea9eacdcb91daa7dd59a9e8dc07c721c0767c41e90d0a9395457

Analysis

max time kernel
143s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 04:08

Target
ea3bb0089bb6ea9eacdcb91daa7dd59a9e8dc07c721c0767c41e90d0a9395457.exe
Size 491KB
Sample221020-eqel6addd2
SHA256 ea3bb0089bb6ea9eacdcb91daa7dd59a9e8dc07c721c0767c41e90d0a9395457
MD5 7b1952ac002bff3c09d1ab4d74cc17fc
SHA1 d2e5c352fac31b72cd3f26ce5c9aca0190492b9f
SHA512 60fcba3fcd61a76c8830c8495fccc68ee5c5d5c881f1b4cb93f097f72e28da38547065af3b925dc9a626258a573f9f8c2d881aa7adce450b5d8851132ab802fb
SSDEEP 12288:TK2mhAMJ/cPlXEuZILxfs1Exj0oHpEN0Ea9Cp5bkO4bBg+:W2O/GllCxfsi0cAHbkOsO+
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\love	ea3bb0089bb6ea9eacdcb91daa7dd59a9e8dc07c721c0767c41e90d0a9395457.exe
File created	C:\Windows\SysWOW64\love\__tmp_rar_sfx_access_check_240554750	ea3bb0089bb6ea9eacdcb91daa7dd59a9e8dc07c721c0767c41e90d0a9395457.exe
File created	C:\Windows\SysWOW64\love\image.jpg	ea3bb0089bb6ea9eacdcb91daa7dd59a9e8dc07c721c0767c41e90d0a9395457.exe
File opened for modification	C:\Windows\SysWOW64\love\image.jpg	ea3bb0089bb6ea9eacdcb91daa7dd59a9e8dc07c721c0767c41e90d0a9395457.exe
File created	C:\Windows\SysWOW64\love\k.exe	ea3bb0089bb6ea9eacdcb91daa7dd59a9e8dc07c721c0767c41e90d0a9395457.exe
File opened for modification	C:\Windows\SysWOW64\love\k.exe	ea3bb0089bb6ea9eacdcb91daa7dd59a9e8dc07c721c0767c41e90d0a9395457.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\ea3bb0089bb6ea9eacdcb91daa7dd59a9e8dc07c721c0767c41e90d0a9395457.exe
"C:\Users\Admin\AppData\Local\Temp\ea3bb0089bb6ea9eacdcb91daa7dd59a9e8dc07c721c0767c41e90d0a9395457.exe"
1⤵
- Drops file in System32 directory
PID:4408

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact