e73a0ac584136fd4930b4433306f03a8eed4acc444faa15ccde110d47d3e6d1a

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
30-10-2022 16:29

Target

e73a0ac584136fd4930b4433306f03a8eed4acc444faa15ccde110d47d3e6d1a.exe
Size

900KB
MD5

8299d580007407a50cbce9665bb7c5cd
SHA1

c40340b9dad89423dcc9fa113ea3ec68ab60d124
SHA256

e73a0ac584136fd4930b4433306f03a8eed4acc444faa15ccde110d47d3e6d1a
SHA512

e7c5d21490586c5729eb2ad10d12dcb95546e1eb476d2e80348beaa8e58786f60a40e2efc3b440c33dbd351b9e4a0e25ea841d30c5c8a9f298c9542da9a34c92
SSDEEP

12288:IszqX+Teo7IiQ7heyy7e2dIiWQYu6vApvS1I2FMubxu9Pm:IlX+TZ7IV7D2dchu6vAhdW

Score

4^/10

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\wmsetup.log	e73a0ac584136fd4930b4433306f03a8eed4acc444faa15ccde110d47d3e6d1a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\e73a0ac584136fd4930b4433306f03a8eed4acc444faa15ccde110d47d3e6d1a.exe
"C:\Users\Admin\AppData\Local\Temp\e73a0ac584136fd4930b4433306f03a8eed4acc444faa15ccde110d47d3e6d1a.exe"
1⤵
- Drops file in Windows directory
PID:1368

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1368-54-0x0000000074E41000-0x0000000074E43000-memory.dmp

Filesize
8KB

Download
memory/1368-55-0x0000000001000000-0x000000000111E000-memory.dmp

Filesize
1.1MB

Download
memory/1368-56-0x0000000000940000-0x0000000000A5E000-memory.dmp

Filesize
1.1MB

Download
memory/1368-57-0x0000000001000000-0x000000000111E000-memory.dmp

Filesize
1.1MB

Download