31fd81055f80b334d771a5a1e0a12a878591b3df49a1a67d2e9629543caea546

Analysis

max time kernel
127s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
14-06-2023 10:04

Target

eCloud-Admin-v2.8.9.exe
Size

6.9MB
MD5

dffbe13eb39aa32f9467762e76ce636a
SHA1

12a044615ffe8decaf4509aaba0de7dbbbee6dfb
SHA256

31fd81055f80b334d771a5a1e0a12a878591b3df49a1a67d2e9629543caea546
SHA512

2649ea8ed0081c1c29be8837445df8f64bb3f7a1e19ffe652629946290e7974b4471b6d560663f2bbb3faced4d572ae44077d080070ceab72a0e8e8bb716dfc6
SSDEEP

196608:bQHqeZjRMEz8sZlh+SNWDMxHPfdnVZLRhTrM3a4OV7iFM5U7f4dm:bojRMEzNbJIDsfdVRRh3cTsU7Qo

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1152	eCloud-Admin-v2.8.9.exe

C:\Users\Admin\AppData\Local\Temp\eCloud-Admin-v2.8.9.exe
"C:\Users\Admin\AppData\Local\Temp\eCloud-Admin-v2.8.9.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1152

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact