Overview

overview

6

Static

static

1

EPA_4000.exe

windows10-2004-x64

6

EPA_4000.exe

windows11-ltsc_2024-x64

4

Analysis

  • max time kernel
    300s
  • max time network
    136s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    18/08/2026, 00:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    EPA_4000.exe
  • Size 118.9MB
  • Sample260818-aarvbssxcy
  • SHA256 bd6b5fe71956c68950b02d518182365a4dd21dc4608092c18563b148949d7124
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
discoveryransomware

Malware Config

Signatures

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\EPA_4000.exe
    "C:\Users\Admin\AppData\Local\Temp\EPA_4000.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:812
    • C:\Users\Admin\AppData\Local\Temp\e592b9a\EPA_4000.exe
      run=1 shortcut="C:\Users\Admin\AppData\Local\Temp\EPA_4000.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1560
      • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\Data\Setup.exe
        Data\Setup.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4576
        • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\Data\MSI\VC_redist.x64.exe
          "C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\Data\MSI\VC_redist.x64.exe" /passive /norestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1136
          • C:\Windows\Temp\{D15975C3-F76C-46C9-89DB-B5DA03B29EC9}\.cr\VC_redist.x64.exe
            "C:\Windows\Temp\{D15975C3-F76C-46C9-89DB-B5DA03B29EC9}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\Data\MSI\VC_redist.x64.exe" -burn.filehandle.attached=600 -burn.filehandle.self=700 /passive /norestart
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:5440
            • C:\Windows\Temp\{EC2790A0-DF6B-4EC8-90DC-AE0979CDF4CC}\.be\VC_redist.x64.exe
              "C:\Windows\Temp\{EC2790A0-DF6B-4EC8-90DC-AE0979CDF4CC}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{1387AFF3-8394-48E2-80E9-56A3EC2BEAF2} {91FD612F-D26F-44E8-8188-A15AFA01BC99} 5440
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:1452
        • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\Data\MSI\Setup_Automate.exe
          "C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\Data\MSI\Setup_Automate.exe" /install
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4556
          • C:\Windows\Temp\{6103AE19-3DA3-4E27-82DE-9EE93BC9F4C7}\.cr\Setup_Automate.exe
            "C:\Windows\Temp\{6103AE19-3DA3-4E27-82DE-9EE93BC9F4C7}\.cr\Setup_Automate.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\Data\MSI\Setup_Automate.exe" -burn.filehandle.attached=732 -burn.filehandle.self=560 /install
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:1264
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:4532
  • C:\Windows\system32\srtasks.exe
    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2016

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VC_redist.x64.exe
        • Path C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\Data\MSI\VC_redist.x64.exe
        • Size 24.2MB
        • SHA256 917c37d816488545b70affd77d6e486e4dd27e2ece63f6bbaaf486b178b2b888
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Setup.exe
        • Path C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\Data\Setup.exe
        • Size 287KB
        • SHA256 c54c9050af396399fc4607ad952a37c3e9c304566f097afb0112dcbde9cf9572
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Setup_Automate.exe
        • Path C:\Windows\Temp\{6103AE19-3DA3-4E27-82DE-9EE93BC9F4C7}\.cr\Setup_Automate.exe
        • Size 1.0MB
        • SHA256 0549d6d46ac8dd1133ef0c09e82f35925db7ccf0f68e54da3de4d11c1006b89a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        logo.png
        • Path C:\Windows\Temp\{7B53C878-4A6A-4A05-93E0-66B3093C104E}\.ba\logo.png
        • Size 3KB
        • SHA256 a9051d3b36f41e515a9ffa0bd461d1c36e3f1f3162e30ee1dcefa4080c10aaec
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        wixstdba.dll
        • Path C:\Windows\Temp\{7B53C878-4A6A-4A05-93E0-66B3093C104E}\.ba\wixstdba.dll
        • Size 184KB
        • SHA256 2bea14d70943a42d344e09b7c9de5562fa7e109946e1c615dd584da30d06cc80
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VC_redist.x64.exe
        • Path C:\Windows\Temp\{D15975C3-F76C-46C9-89DB-B5DA03B29EC9}\.cr\VC_redist.x64.exe
        • Size 635KB
        • SHA256 9a6c005e1a71e11617f87ede695af32baac8a2056f11031941df18b23c4eeba6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        logo.png
        • Path C:\Windows\Temp\{EC2790A0-DF6B-4EC8-90DC-AE0979CDF4CC}\.ba\logo.png
        • Size 1KB
        • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        wixstdba.dll
        • Path C:\Windows\Temp\{EC2790A0-DF6B-4EC8-90DC-AE0979CDF4CC}\.ba\wixstdba.dll
        • Size 191KB
        • SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download